diff --git a/compliance/controls/error_messages.log b/compliance/controls/error_messages.log new file mode 100644 index 000000000..e69de29bb diff --git a/compliance/controls/rename_integration_type_name.sh b/compliance/controls/rename_integration_type_name.sh new file mode 100755 index 000000000..32e80de79 --- /dev/null +++ b/compliance/controls/rename_integration_type_name.sh @@ -0,0 +1,39 @@ +#!/bin/bash + +# Description: +# This script traverses all subdirectories to find YAML files containing the 'Integration_Type_Name' key +# and renames the key to 'IntegrationTypeName' while preserving its values. + +# Define the root directory (current directory) +ROOT_DIR="." + +# Create or clear the log files +> renamed_files.log +> error_files.log +> error_messages.log + +# Find all .yaml and .yml files +find "$ROOT_DIR" -type f \( -iname "*.yaml" -o -iname "*.yml" \) -print0 | while IFS= read -r -d '' file; do + # Check if the file contains the 'Integration_Type_Name:' key + if grep -q '^Integration_Type_Name:' "$file"; then + echo "Processing: $file" + + # Apply the yq transformation to rename the key + if yq eval -i ' + .IntegrationTypeName = .Integration_Type_Name | + del(.Integration_Type_Name) + ' "$file"; then + echo "$file renamed successfully." >> renamed_files.log + else + echo "Error renaming $file" >> error_files.log + # Capture detailed error messages + yq eval -i ' + .IntegrationTypeName = .Integration_Type_Name | + del(.Integration_Type_Name) + ' "$file" 2>> error_messages.log + fi + fi +done + +echo "Bulk renaming completed. Check 'renamed_files.log' for details." +echo "Any errors are logged in 'error_files.log' and 'error_messages.log'." diff --git a/compliance/controls/renamed_files.log b/compliance/controls/renamed_files.log new file mode 100644 index 000000000..01a2cf2f6 --- /dev/null +++ b/compliance/controls/renamed_files.log @@ -0,0 +1,2846 @@ +./azure/azure_cis_v130_1_4.yaml renamed successfully. +./azure/azure_cis_v130_1_15.yaml renamed successfully. +./azure/azure_cis_v210_3_13.yaml renamed successfully. +./azure/azure_monitor_log_profile_retention_365_days.yaml renamed successfully. +./azure/azure_cis_v210_7_5.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_4333.yaml renamed successfully. +./azure/azure_cis_v140_1_3.yaml renamed successfully. +./azure/azure_log_analytics_workspace_block_log_ingestion_and_querying_from_public.yaml renamed successfully. +./azure/azure_synapse_workspace_encryption_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_cis_v150_2_1_5.yaml renamed successfully. +./azure/azure_cis_v150_5_2_7.yaml renamed successfully. +./azure/azure_cis_v200_4_4_2.yaml renamed successfully. +./azure/azure_cis_v130_5_3.yaml renamed successfully. +./azure/azure_iam_subscription_owner_max_3.yaml renamed successfully. +./azure/azure_monitor_logs_storage_container_not_public_accessible.yaml renamed successfully. +./azure/azure_keyvault_with_rbac_secret_expiration_set.yaml renamed successfully. +./azure/azure_data_factory_uses_git_repository.yaml renamed successfully. +./azure/azure_cis_v200_2_1_12.yaml renamed successfully. +./azure/azure_cis_v210_3_2.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_public_ip_address.yaml renamed successfully. +./azure/azure_cis_v130_9_3.yaml renamed successfully. +./azure/azure_cis_v150_1_9.yaml renamed successfully. +./azure/azure_cis_v200_5_1_1.yaml renamed successfully. +./azure/azure_network_interface_ip_forwarding_disabled.yaml renamed successfully. +./azure/azure_securitycenter_security_alerts_to_owner_enabled.yaml renamed successfully. +./azure/azure_cis_v140_9_4.yaml renamed successfully. +./azure/azure_cis_v210_6_1.yaml renamed successfully. +./azure/azure_postgres_sql_ssl_enabled.yaml renamed successfully. +./azure/azure_keyvault_with_non_rbac_key_expiration_set.yaml renamed successfully. +./azure/azure_cis_v200_3_8.yaml renamed successfully. +./azure/azure_appservice_api_app_cors_no_star.yaml renamed successfully. +./azure/azure_cis_v130_2_13.yaml renamed successfully. +./azure/azure_container_registry_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_log_profile_enabled_for_all_subscription.yaml renamed successfully. +./azure/azure_cis_v210_5_4.yaml renamed successfully. +./azure/azure_cis_v140_3_2.yaml renamed successfully. +./azure/azure_storage_sync_private_link_used.yaml renamed successfully. +./azure/azure_cis_v150_4_4_1.yaml renamed successfully. +./azure/azure_sql_server_transparent_data_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v200_2_1_6.yaml renamed successfully. +./azure/azure_cis_v200_5_2_4.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_25.yaml renamed successfully. +./azure/azure_kubernetes_cluster_node_restrict_public_access.yaml renamed successfully. +./azure/azure_storage_account_tables_logging_enabled.yaml renamed successfully. +./azure/azure_iot_hub_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v210_1_14.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_app_service_web_app_mandatory.yaml renamed successfully. +./azure/azure_cis_v140_7_5.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_system_updates_installed.yaml renamed successfully. +./azure/azure_cognitive_service_local_auth_disabled.yaml renamed successfully. +./azure/azure_mysql_server_audit_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v130_7_2.yaml renamed successfully. +./azure/azure_compute_vm_disaster_recovery_enabled.yaml renamed successfully. +./azure/azure_cis_v140_2_6.yaml renamed successfully. +./azure/azure_kubernetes_cluster_http_application_routing_disabled.yaml renamed successfully. +./azure/azure_appservice_api_app_use_https.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_update_public_ip_address.yaml renamed successfully. +./azure/azure_cis_v150_1_21.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_postgresql_server_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_2_1.yaml renamed successfully. +./azure/azure_cis_v150_3_8.yaml renamed successfully. +./azure/azure_cosmosdb_account_uses_aad_and_rbac.yaml renamed successfully. +./azure/azure_appservice_plan_minimum_sku.yaml renamed successfully. +./azure/azure_cis_v210_1_2_3.yaml renamed successfully. +./azure/azure_cis_v210_9_4.yaml renamed successfully. +./azure/azure_cis_v140_6_1.yaml renamed successfully. +./azure/azure_databox_edge_device_double_encryption_enabled.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_use_allowed_images.yaml renamed successfully. +./azure/azure_cis_v150_4_1_2.yaml renamed successfully. +./azure/azure_cis_v130_6_6.yaml renamed successfully. +./azure/azure_cis_v200_1_9.yaml renamed successfully. +./azure/azure_cis_v150_5_1_2.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_use_allowed_capabilities.yaml renamed successfully. +./azure/azure_kubernetes_cluster_key_vault_secret_rotation_enabled.yaml renamed successfully. +./azure/azure_cis_v210_7_9.yaml renamed successfully. +./azure/azure_compute_vm_remote_access_restricted_all_ports.yaml renamed successfully. +./azure/azure_keyvault_vault_private_link_used.yaml renamed successfully. +./azure/azure_cis_v150_9_2.yaml renamed successfully. +./azure/azure_cis_v200_6_7.yaml renamed successfully. +./azure/azure_cis_v130_1_19.yaml renamed successfully. +./azure/azure_cis_v130_1_8.yaml renamed successfully. +./azure/azure_cis_v210_1_22.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_log_alert_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_max_password_age_70_days_windows.yaml renamed successfully. +./azure/azure_cis_v140_1_12.yaml renamed successfully. +./azure/azure_appservice_authentication_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_3.yaml renamed successfully. +./azure/azure_cis_v210_5_2_1.yaml renamed successfully. +./azure/azure_container_registry_trust_policy_enabled.yaml renamed successfully. +./azure/azure_cis_v150_2_1_9.yaml renamed successfully. +./azure/azure_search_service_uses_private_link.yaml renamed successfully. +./azure/azure_mysql_server_encrypted_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_appservice_function_app_cors_no_star.yaml renamed successfully. +./azure/azure_cis_v140_9_8.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_app_service_environment_mandatory.yaml renamed successfully. +./azure/azure_cis_v200_1_2_6.yaml renamed successfully. +./azure/azure_cis_v140_2_14.yaml renamed successfully. +./azure/azure_cis_v150_1_5.yaml renamed successfully. +./azure/azure_cis_v200_7_3.yaml renamed successfully. +./azure/azure_cis_v150_8_6.yaml renamed successfully. +./azure/azure_signalr_service_private_link_used.yaml renamed successfully. +./azure/azure_network_security_group_not_configured_gateway_subnets.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_data_factory_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_1_17.yaml renamed successfully. +./azure/azure_batch_account_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_apimanagement_service_with_virtual_network.yaml renamed successfully. +./azure/azure_cis_v210_2_1_13.yaml renamed successfully. +./azure/azure_search_service_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v200_3_4.yaml renamed successfully. +./azure/azure_sql_server_auditing_storage_account_destination_retention_90_days.yaml renamed successfully. +./azure/azure_cis_v200_1_1_3.yaml renamed successfully. +./azure/azure_cis_v200_5_2_8.yaml renamed successfully. +./azure/azure_cis_v130_5_2_1.yaml renamed successfully. +./azure/azure_cis_v130_3_9.yaml renamed successfully. +./azure/azure_cis_v140_5_2_2.yaml renamed successfully. +./azure/azure_cis_v150_2_1_10.yaml renamed successfully. +./azure/azure_cis_v200_9_2.yaml renamed successfully. +./azure/azure_synapse_workspace_vulnerability_assessment_enabled.yaml renamed successfully. +./azure/azure_cis_v210_1_18.yaml renamed successfully. +./azure/azure_cis_v150_10_1.yaml renamed successfully. +./azure/azure_cis_v130_1_23.yaml renamed successfully. +./azure/azure_sql_server_va_setting_scan_reports_configured.yaml renamed successfully. +./azure/azure_cis_v150_3_4.yaml renamed successfully. +./azure/azure_cis_v130_4_3_5.yaml renamed successfully. +./azure/azure_cis_v150_3_10.yaml renamed successfully. +./azure/azure_container_registry_admin_user_disabled.yaml renamed successfully. +./azure/azure_cis_v210_4_5_3.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v200_1_5.yaml renamed successfully. +./azure/azure_cosmosdb_account_key_based_metadata_write_access_disabled.yaml renamed successfully. +./azure/azure_cis_v150_7_3.yaml renamed successfully. +./azure/azure_appservice_web_app_ftps_enabled.yaml renamed successfully. +./azure/azure_cis_v200_8_6.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_endpoint_protection_solution_installed.yaml renamed successfully. +./azure/azure_cis_v150_1_2_5.yaml renamed successfully. +./azure/azure_cis_v210_9_8.yaml renamed successfully. +./azure/azure_compute_unattached_disk_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v210_5_1_4.yaml renamed successfully. +./azure/azure_cis_v210_4_1_4.yaml renamed successfully. +./azure/azure_postgresql_server_infrastructure_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v210_5_1_5.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_mssql_elasticpool_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_4_1_5.yaml renamed successfully. +./azure/azure_cis_v200_1_4.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_cpu_and_memory_resource_limit.yaml renamed successfully. +./azure/azure_cis_v150_7_2.yaml renamed successfully. +./azure/azure_appservice_web_app_register_with_active_directory_enabled.yaml renamed successfully. +./azure/azure_cis_v150_1_2_4.yaml renamed successfully. +./azure/azure_kubernetes_cluster_max_pod_50.yaml renamed successfully. +./azure/azure_cis_v210_4_5_2.yaml renamed successfully. +./azure/azure_cis_v140_4_3_7.yaml renamed successfully. +./azure/azure_cis_v150_3_5.yaml renamed successfully. +./azure/azure_cis_v150_3_11.yaml renamed successfully. +./azure/azure_cis_v150_5_2_10.yaml renamed successfully. +./azure/azure_monitor_log_cluster_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v210_1_19.yaml renamed successfully. +./azure/azure_appservice_function_app_uses_managed_identity.yaml renamed successfully. +./azure/azure_network_security_group_subnet_associated.yaml renamed successfully. +./azure/azure_cis_v130_1_22.yaml renamed successfully. +./azure/azure_cis_v150_2_1_11.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_host_process_id_not_shared.yaml renamed successfully. +./azure/azure_appservice_web_app_cors_no_star.yaml renamed successfully. +./azure/azure_cis_v200_9_3.yaml renamed successfully. +./azure/azure_apimanagement_service_client_certificate_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_data_lake_store_mandatory.yaml renamed successfully. +./azure/azure_cis_v140_5_2_3.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_udp_port_1434.yaml renamed successfully. +./azure/azure_cis_v200_1_1_2.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_automatic_upgrade_enabled.yaml renamed successfully. +./azure/azure_cis_v200_5_2_9.yaml renamed successfully. +./azure/azure_cis_v130_3_8.yaml renamed successfully. +./azure/azure_cis_v200_9_11.yaml renamed successfully. +./azure/azure_cis_v210_2_1_12.yaml renamed successfully. +./azure/azure_cis_v200_3_5.yaml renamed successfully. +./azure/azure_cis_v150_5_3.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_53.yaml renamed successfully. +./azure/azure_cis_v150_1_16.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_resource_manager.yaml renamed successfully. +./azure/azure_cis_v140_2_15.yaml renamed successfully. +./azure/azure_cis_v130_5_1_5.yaml renamed successfully. +./azure/azure_cis_v150_1_4.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_udp_port_53.yaml renamed successfully. +./azure/azure_cis_v200_7_2.yaml renamed successfully. +./azure/azure_compute_vm_non_internet_facing_protected_with_nsg.yaml renamed successfully. +./azure/azure_cognitive_account_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v140_9_9.yaml renamed successfully. +./azure/azure_monitor_logs_storage_container_encryptes_with_byok.yaml renamed successfully. +./azure/azure_securitycenter_mcas_integration.yaml renamed successfully. +./azure/azure_cis_v150_2_1_8.yaml renamed successfully. +./azure/azure_cis_v150_1_1_1.yaml renamed successfully. +./azure/azure_network_sg_flowlog_retention_period_greater_than_90.yaml renamed successfully. +./azure/azure_cis_v140_1_13.yaml renamed successfully. +./azure/azure_eventhub_namespace_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_kubernetes_cluster_pod_host_path_volume_use_allowed_host_path.yaml renamed successfully. +./azure/azure_cis_v210_2_1_2.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_virtual_network_gateway_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_1_18.yaml renamed successfully. +./azure/azure_cis_v130_1_9.yaml renamed successfully. +./azure/azure_cis_v210_1_23.yaml renamed successfully. +./azure/azure_log_analytics_workspace_block_non_azure_ingestion.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_privilege_escalation_restricted.yaml renamed successfully. +./azure/azure_cis_v210_7_8.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_cosmosdb_mongo_database_mandatory.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_data_lake_analytics_account_mandatory.yaml renamed successfully. +./azure/azure_appservice_api_app_latest_tls_version.yaml renamed successfully. +./azure/azure_appservice_api_app_client_certificates_on.yaml renamed successfully. +./azure/azure_appservice_function_app_ftps_enabled.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_java_version.yaml renamed successfully. +./azure/azure_storage_account_infrastructure_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v150_5_1_3.yaml renamed successfully. +./azure/azure_cis_v200_1_8.yaml renamed successfully. +./azure/azure_cis_v150_2_2_1.yaml renamed successfully. +./azure/azure_cis_v210_1_2_2.yaml renamed successfully. +./azure/azure_cis_v210_9_5.yaml renamed successfully. +./azure/azure_cis_v200_1_10.yaml renamed successfully. +./azure/azure_cis_v150_1_20.yaml renamed successfully. +./azure/azure_cis_v130_4_3_8.yaml renamed successfully. +./azure/azure_cis_v200_4_3_1.yaml renamed successfully. +./azure/azure_cis_v150_3_9.yaml renamed successfully. +./azure/azure_cis_v200_5_3_1.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_application_security_group_mandatory.yaml renamed successfully. +./azure/azure_logic_app_integration_service_environment_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_135.yaml renamed successfully. +./azure/azure_cis_v140_2_7.yaml renamed successfully. +./azure/azure_kubernetes_cluster_authorized_ip_range_defined.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_appservice.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_boot_diagnostics_enabled.yaml renamed successfully. +./azure/azure_logic_app_workflow_logging_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_storage_account_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_7_3.yaml renamed successfully. +./azure/azure_container_registry_quarantine_policy_enabled.yaml renamed successfully. +./azure/azure_cis_v210_1_15.yaml renamed successfully. +./azure/azure_storage_account_queue_services_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v210_8_1.yaml renamed successfully. +./azure/azure_cis_v140_7_4.yaml renamed successfully. +./azure/azure_cis_v130_3_4.yaml renamed successfully. +./azure/azure_cosmosdb_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_cis_v200_2_1_7.yaml renamed successfully. +./azure/azure_cis_v200_5_2_5.yaml renamed successfully. +./azure/azure_cis_v140_3_3.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_policy_assignment.yaml renamed successfully. +./azure/azure_cis_v210_4_3_8.yaml renamed successfully. +./azure/azure_cis_v130_2_12.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_1433.yaml renamed successfully. +./azure/azure_compute_vm_administrators_group_with_extra_accounts_windows.yaml renamed successfully. +./azure/azure_cis_v200_3_9.yaml renamed successfully. +./azure/azure_securitycenter_notify_alerts_configured.yaml renamed successfully. +./azure/azure_cis_v140_9_5.yaml renamed successfully. +./azure/azure_keyvault_certificate_validity_12_months.yaml renamed successfully. +./azure/azure_cis_v130_9_2.yaml renamed successfully. +./azure/azure_cis_v150_1_8.yaml renamed successfully. +./azure/azure_cis_v200_2_1_13.yaml renamed successfully. +./azure/azure_cis_v210_3_3.yaml renamed successfully. +./azure/azure_appservice_api_app_ftps_enabled.yaml renamed successfully. +./azure/azure_storage_account_blob_containers_public_access_private.yaml renamed successfully. +./azure/azure_iam_deprecated_account.yaml renamed successfully. +./azure/azure_appservice_web_app_remote_debugging_disabled.yaml renamed successfully. +./azure/azure_cis_v150_2_1_4.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_log_profile_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_5_2_6.yaml renamed successfully. +./azure/azure_cognitive_account_private_link_used.yaml renamed successfully. +./azure/azure_cis_v140_8_1.yaml renamed successfully. +./azure/azure_cis_v210_7_4.yaml renamed successfully. +./azure/azure_keyvault_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v140_1_2.yaml renamed successfully. +./azure/azure_container_instance_container_group_identity_provider_enabled.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_storage.yaml renamed successfully. +./azure/azure_cis_v130_1_5.yaml renamed successfully. +./azure/azure_cis_v130_1_14.yaml renamed successfully. +./azure/azure_sql_server_tde_protector_cmk_encrypted.yaml renamed successfully. +./azure/azure_keyvault_rbac_enabled.yaml renamed successfully. +./azure/azure_cis_v210_3_12.yaml renamed successfully. +./azure/azure_sql_database_vulnerability_findings_resolved.yaml renamed successfully. +./azure/azure_cis_v140_1_9.yaml renamed successfully. +./azure/azure_network_security_group_remote_access_restricted.yaml renamed successfully. +./azure/azure_kubernetes_cluster_sku_standard.yaml renamed successfully. +./azure/azure_storage_account_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_keyvault_with_non_rbac_secret_expiration_set.yaml renamed successfully. +./azure/azure_mariadb_server_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v150_9_4.yaml renamed successfully. +./azure/azure_cis_v200_6_1.yaml renamed successfully. +./azure/azure_hdinsight_cluster_encryption_in_transit_enabled.yaml renamed successfully. +./azure/azure_cis_v210_1_24.yaml renamed successfully. +./azure/azure_search_service_uses_sku_supporting_private_link.yaml renamed successfully. +./azure/azure_cis_v200_2_1_18.yaml renamed successfully. +./azure/azure_keyvault_managed_hms_purge_protection_enabled.yaml renamed successfully. +./azure/azure_cis_v210_3_8.yaml renamed successfully. +./azure/azure_cis_v140_1_14.yaml renamed successfully. +./azure/azure_cis_v140_4_4_2.yaml renamed successfully. +./azure/azure_cis_v210_5_2_7.yaml renamed successfully. +./azure/azure_cis_v210_2_1_5.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_use_allowed_apparmor_profile.yaml renamed successfully. +./azure/azure_postgres_db_server_log_checkpoints_on.yaml renamed successfully. +./azure/azure_authorize_access_to_security_functions_and_information.yaml renamed successfully. +./azure/azure_healthcare_fhir_azure_api_encrypted_at_rest_with_cmk.yaml renamed successfully. +./azure/azure_network_watcher_flow_log_traffic_analytics_enabled.yaml renamed successfully. +./azure/azure_cis_v140_5_1_1.yaml renamed successfully. +./azure/azure_compute_vm_malware_agent_automatic_upgrade_enabled.yaml renamed successfully. +./azure/azure_cis_v140_2_12.yaml renamed successfully. +./azure/azure_appservice_function_app_client_certificates_on.yaml renamed successfully. +./azure/azure_cis_v200_1_21.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_option_audit_requirement_windows.yaml renamed successfully. +./azure/azure_cis_v130_4_1_2.yaml renamed successfully. +./azure/azure_cis_v130_9_9.yaml renamed successfully. +./azure/azure_cis_v200_7_5.yaml renamed successfully. +./azure/azure_audit_diagnostic_setting.yaml renamed successfully. +./azure/azure_cis_v130_5_1_2.yaml renamed successfully. +./azure/azure_cis_v150_1_3.yaml renamed successfully. +./azure/azure_cosmosdb_account_encryption_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_cis_v150_1_11.yaml renamed successfully. +./azure/azure_compute_vm_administrators_group_with_specified_members_windows.yaml renamed successfully. +./azure/azure_kusto_cluster_disk_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_15.yaml renamed successfully. +./azure/azure_keyvault_key_expiration_set.yaml renamed successfully. +./azure/azure_sql_db_active_directory_admin_configured.yaml renamed successfully. +./azure/azure_cis_v200_3_2.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_mssql_managed_instance_mandatory.yaml renamed successfully. +./azure/azure_cis_v200_2_1_22.yaml renamed successfully. +./azure/azure_cis_v130_5_2_7.yaml renamed successfully. +./azure/azure_cis_v150_2_6.yaml renamed successfully. +./azure/azure_network_lb_no_basic_sku.yaml renamed successfully. +./azure/azure_cis_v140_5_2_4.yaml renamed successfully. +./azure/azure_cis_v210_4_4_1.yaml renamed successfully. +./azure/azure_cis_v140_3_8.yaml renamed successfully. +./azure/azuread_spn_with_more_than_one_active_client_secret_created_x_days_ago.yaml renamed successfully. +./azure/azure_application_gateway_waf_enabled.yaml renamed successfully. +./azure/azure_compute_vm_log_analytics_agent_installed_windows.yaml renamed successfully. +./azure/azure_cis_v200_9_4.yaml renamed successfully. +./azure/azure_cis_v150_6_1.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_uses_managed_disks.yaml renamed successfully. +./azure/azure_container_registry_geo_replication_enabled.yaml renamed successfully. +./azure/azure_cis_v210_1_9.yaml renamed successfully. +./azure/azure_eventhub_namespace_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v200_5_4.yaml renamed successfully. +./azure/azure_compute_disk_access_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v150_3_2.yaml renamed successfully. +./azure/azure_cosmosdb_account_with_firewall_rules.yaml renamed successfully. +./azure/azure_machine_learning_workspace_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_compute_vm_windows_defender_exploit_guard_enabled.yaml renamed successfully. +./azure/azure_postgres_db_server_log_retention_days_3.yaml renamed successfully. +./azure/azure_cis_v150_7_5.yaml renamed successfully. +./azure/azure_redis_cache_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v200_1_3.yaml renamed successfully. +./azure/azure_databox_job_double_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v150_1_2_3.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_app_service_function_app_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_restrict_previous_24_passwords_resuse_windows.yaml renamed successfully. +./azure/azure_eventgrid_domain_private_link_used.yaml renamed successfully. +./azure/azure_cis_v210_4_1_2.yaml renamed successfully. +./azure/azure_compute_vm_vulnerability_assessment_solution_enabled.yaml renamed successfully. +./azure/azure_securitycenter_additional_email_configured.yaml renamed successfully. +./azure/azure_cis_v210_5_1_2.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_mysql_server_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_8_1.yaml renamed successfully. +./azure/azure_cis_v150_9_8.yaml renamed successfully. +./azure/azure_cis_v130_1_2.yaml renamed successfully. +./azure/azure_cis_v130_1_13.yaml renamed successfully. +./azure/azure_cis_v210_3_15.yaml renamed successfully. +./azure/azure_storage_account_encryption_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_availability_set_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_password_complexity_setting_enabled_windows.yaml renamed successfully. +./azure/azure_cis_v140_1_5.yaml renamed successfully. +./azure/azure_cis_v210_7_3.yaml renamed successfully. +./azure/azure_cis_v140_8_6.yaml renamed successfully. +./azure/azure_monitor_application_insights_configured.yaml renamed successfully. +./azure/azure_frontdoor_waf_enabled.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_dotnet_framework_version.yaml renamed successfully. +./azure/azure_cis_v150_5_2_1.yaml renamed successfully. +./azure/azure_cis_v150_2_1_3.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_http_version.yaml renamed successfully. +./azure/azure_cis_v140_1_18.yaml renamed successfully. +./azure/azure_cis_v210_3_4.yaml renamed successfully. +./azure/azure_cis_v200_10_1.yaml renamed successfully. +./azure/azure_cis_v200_2_1_14.yaml renamed successfully. +./azure/azure_cis_v200_3_10.yaml renamed successfully. +./azure/azure_cis_v200_5_1_7.yaml renamed successfully. +./azure/azure_cis_v130_9_5.yaml renamed successfully. +./azure/azure_appservice_web_app_http_logs_enabled.yaml renamed successfully. +./azure/azure_cis_v140_9_2.yaml renamed successfully. +./azure/azure_cis_v210_6_7.yaml renamed successfully. +./azure/azure_mariadb_server_geo_redundant_backup_enabled.yaml renamed successfully. +./azure/azure_kubernetes_cluster_network_policy_enabled.yaml renamed successfully. +./azure/azure_postgres_db_server_log_connections_on.yaml renamed successfully. +./azure/azure_compute_vm_secure_communication_protocols_configured.yaml renamed successfully. +./azure/azure_compute_vm_min_password_age_1_day_windows.yaml renamed successfully. +./azure/azure_cis_v210_2_1_19.yaml renamed successfully. +./azure/azure_cis_v130_2_15.yaml renamed successfully. +./azure/azure_sql_database_allow_internet_access.yaml renamed successfully. +./azure/azure_cis_v140_5_2_8.yaml renamed successfully. +./azure/azure_cis_v140_3_4.yaml renamed successfully. +./azure/azure_cis_v140_1_22.yaml renamed successfully. +./azure/azure_cis_v130_3_3.yaml renamed successfully. +./azure/azure_cis_v200_5_2_2.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_23.yaml renamed successfully. +./azure/azure_appservice_web_app_uses_managed_identity.yaml renamed successfully. +./azure/azure_cis_v210_1_12.yaml renamed successfully. +./azure/azure_iam_user_no_built_in_contributor_role.yaml renamed successfully. +./azure/azure_monitor_log_profile_enabled_for_all_categories.yaml renamed successfully. +./azure/azure_cis_v210_1_5.yaml renamed successfully. +./azure/azure_cis_v140_7_3.yaml renamed successfully. +./azure/azure_cis_v210_8_6.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_option_requirement_windows.yaml renamed successfully. +./azure/azure_cis_v200_9_8.yaml renamed successfully. +./azure/azure_cis_v130_7_4.yaml renamed successfully. +./azure/azure_cis_v150_2_3_2.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_mariadb_server_mandatory.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_keyvault.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_options_network_access_requirement_windows.yaml renamed successfully. +./azure/azure_monitor_logs_storage_container_insights_operational_logs_not_public_accessible.yaml renamed successfully. +./azure/azure_automation_account_variable_encryption_enabled.yaml renamed successfully. +./azure/azure_sql_server_va_setting_reports_notify_admins.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_containerregistry.yaml renamed successfully. +./azure/azure_compute_vm_with_no_specified_certificates_in_trusted_root_windows.yaml renamed successfully. +./azure/azure_app_service_environment_internal_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v130_2_7.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_servicebus_namespace_mandatory.yaml renamed successfully. +./azure/azure_network_security_group_https_access_restricted.yaml renamed successfully. +./azure/azure_cis_v210_9_2.yaml renamed successfully. +./azure/azure_cis_v210_1_2_5.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_sqldb.yaml renamed successfully. +./azure/azure_cis_v200_1_17.yaml renamed successfully. +./azure/azure_cis_v150_4_1_4.yaml renamed successfully. +./azure/azure_compute_vm_utilizing_managed_disk.yaml renamed successfully. +./azure/azure_cis_v150_5_1_5.yaml renamed successfully. +./azure/azure_compute_vm_network_traffic_data_collection_linux_agent_installed.yaml renamed successfully. +./azure/azure_cis_v150_9_11.yaml renamed successfully. +./azure/azure_cis_v130_6_1.yaml renamed successfully. +./azure/azure_cis_v150_4_1_5.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_policy_assignment.yaml renamed successfully. +./azure/azure_cis_v140_6_6.yaml renamed successfully. +./azure/azure_cis_v210_9_3.yaml renamed successfully. +./azure/azure_eventhub_namespace_private_link_used.yaml renamed successfully. +./azure/azure_cis_v210_1_2_4.yaml renamed successfully. +./azure/azure_cis_v200_1_16.yaml renamed successfully. +./azure/azure_cis_v150_4_5_2.yaml renamed successfully. +./azure/azure_cis_v130_2_6.yaml renamed successfully. +./azure/azure_sql_db_public_network_access_disabled.yaml renamed successfully. +./azure/azure_network_public_ip_no_basic_sku.yaml renamed successfully. +./azure/azure_cis_v200_4_3_7.yaml renamed successfully. +./azure/azure_data_factory_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v140_2_1.yaml renamed successfully. +./azure/azure_cognitive_account_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_firewall_mandatory.yaml renamed successfully. +./azure/azure_eventgrid_topic_identity_provider_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_22.yaml renamed successfully. +./azure/azure_storage_account_blob_service_logging_enabled.yaml renamed successfully. +./azure/azure_signalr_service_no_free_tier_sku.yaml renamed successfully. +./azure/azure_cis_v200_9_9.yaml renamed successfully. +./azure/azure_cis_v130_7_5.yaml renamed successfully. +./azure/azure_batch_account_identity_provider_enabled.yaml renamed successfully. +./azure/azure_cis_v150_2_3_3.yaml renamed successfully. +./azure/azure_cis_v210_1_13.yaml renamed successfully. +./azure/azure_kubernetes_cluster_addon_azure_policy_enabled.yaml renamed successfully. +./azure/azure_network_bastion_host_min_1.yaml renamed successfully. +./azure/azure_cis_v210_1_4.yaml renamed successfully. +./azure/azure_cis_v140_7_2.yaml renamed successfully. +./azure/azure_compute_vm_passwords_stored_using_reversible_encryption_windows.yaml renamed successfully. +./azure/azure_servicebus_namespace_no_overly_permissive_network_access.yaml renamed successfully. +./azure/azure_cis_v130_3_2.yaml renamed successfully. +./azure/azure_cis_v200_5_2_3.yaml renamed successfully. +./azure/azure_cis_v200_2_1_1.yaml renamed successfully. +./azure/azure_storage_account_min_tls_1_2.yaml renamed successfully. +./azure/azure_cis_v140_5_2_9.yaml renamed successfully. +./azure/azure_recovery_service_vault_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v130_2_14.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_cosmosdb_account_mandatory.yaml renamed successfully. +./azure/azure_network_ddos_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_18.yaml renamed successfully. +./azure/azure_appservice_web_app_failed_request_tracing_enabled.yaml renamed successfully. +./azure/azure_cis_v200_4_5_1.yaml renamed successfully. +./azure/azure_sql_server_uses_private_link.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_udp_port_138.yaml renamed successfully. +./azure/azure_cis_v210_6_6.yaml renamed successfully. +./azure/azure_cis_v140_9_3.yaml renamed successfully. +./azure/azure_appservice_web_app_client_certificates_on.yaml renamed successfully. +./azure/azure_cis_v200_3_11.yaml renamed successfully. +./azure/azure_kubernetes_cluster_privilege_containers_restricted.yaml renamed successfully. +./azure/azure_cis_v200_5_1_6.yaml renamed successfully. +./azure/azure_cis_v150_2_4_1.yaml renamed successfully. +./azure/azure_cis_v130_9_4.yaml renamed successfully. +./azure/azure_iam_user_not_allowed_to_create_security_group.yaml renamed successfully. +./azure/azure_compute_vm_container_security_configurations_vulnerabilities_remediated.yaml renamed successfully. +./azure/azure_cis_v210_1_1_1.yaml renamed successfully. +./azure/azure_cis_v140_1_19.yaml renamed successfully. +./azure/azure_cis_v210_3_5.yaml renamed successfully. +./azure/azure_cis_v140_5_3.yaml renamed successfully. +./azure/azure_cis_v200_2_1_15.yaml renamed successfully. +./azure/azure_cis_v210_2_1_8.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_network_interface_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_2_1_2.yaml renamed successfully. +./azure/azure_monitor_diagnostic_settings_captures_proper_categories.yaml renamed successfully. +./azure/azure_cis_v140_1_4.yaml renamed successfully. +./azure/azure_cis_v140_8_7.yaml renamed successfully. +./azure/azure_cis_v210_7_2.yaml renamed successfully. +./azure/azure_compute_vm_and_sacle_set_encryption_at_host_enabled.yaml renamed successfully. +./azure/azure_cis_v150_9_9.yaml renamed successfully. +./azure/azure_appservice_function_app_remote_debugging_disabled.yaml renamed successfully. +./azure/azure_cis_v130_1_3.yaml renamed successfully. +./azure/azure_cis_v130_1_12.yaml renamed successfully. +./azure/azure_mysql_ssl_enabled.yaml renamed successfully. +./azure/azure_cis_v210_3_14.yaml renamed successfully. +./azure/azure_network_security_group_outbound_access_restricted.yaml renamed successfully. +./azure/azure_compute_vm_temp_disks_cache_and_data_flows_encrypted.yaml renamed successfully. +./azure/azure_mysql_server_infrastructure_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_2_1.yaml renamed successfully. +./azure/azure_cis_v210_5_1_3.yaml renamed successfully. +./azure/azure_mysql_server_min_tls_1_2.yaml renamed successfully. +./azure/azure_cis_v200_8_1.yaml renamed successfully. +./azure/azure_cis_v150_7_4.yaml renamed successfully. +./azure/azure_eventgrid_domain_restrict_public_access.yaml renamed successfully. +./azure/azure_compute_vm_log_analytics_agent_installed.yaml renamed successfully. +./azure/azure_cis_v150_1_2_2.yaml renamed successfully. +./azure/azure_securitycenter_automatic_provisioning_monitoring_agent_on.yaml renamed successfully. +./azure/azure_servicebus_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_postgres_db_server_log_disconnections_on.yaml renamed successfully. +./azure/azure_cis_v140_4_3_1.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_update_security_solution.yaml renamed successfully. +./azure/azure_cis_v130_4_3_2.yaml renamed successfully. +./azure/azure_cis_v150_3_3.yaml renamed successfully. +./azure/azure_container_registry_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cosmosdb_account_uses_private_link.yaml renamed successfully. +./azure/azure_kusto_cluster_sku_with_sla.yaml renamed successfully. +./azure/azure_cis_v210_1_8.yaml renamed successfully. +./azure/azure_network_security_group_udp_service_restricted.yaml renamed successfully. +./azure/azure_application_insights_block_log_ingestion_and_querying_from_public.yaml renamed successfully. +./azure/azure_data_factory_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v200_9_5.yaml renamed successfully. +./azure/azure_cis_v140_5_2_5.yaml renamed successfully. +./azure/azure_kubernetes_cluster_upgraded_with_non_vulnerable_version.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_3306.yaml renamed successfully. +./azure/azure_cis_v140_3_9.yaml renamed successfully. +./azure/azure_sql_database_long_term_geo_redundant_backup_enabled.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_installed.yaml renamed successfully. +./azure/azure_cis_v200_1_1_4.yaml renamed successfully. +./azure/azure_cis_v130_5_2_6.yaml renamed successfully. +./azure/azure_cis_v140_3_12.yaml renamed successfully. +./azure/azure_cis_v210_2_1_14.yaml renamed successfully. +./azure/azure_storage_account_uses_private_link.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_tls_version.yaml renamed successfully. +./azure/azure_iam_no_custom_subscription_owner_roles_created.yaml renamed successfully. +./azure/azure_compute_vm_security_configuration_vulnerabilities_remediated.yaml renamed successfully. +./azure/azure_mariadb_server_ssl_enabled.yaml renamed successfully. +./azure/azure_cis_v150_4_3_8.yaml renamed successfully. +./azure/azure_cis_v200_3_3.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_with_no_managed_identity.yaml renamed successfully. +./azure/azure_iam_user_not_allowed_to_register_application.yaml renamed successfully. +./azure/azure_cis_v150_1_10.yaml renamed successfully. +./azure/azure_recovery_service_vault_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v140_2_13.yaml renamed successfully. +./azure/azure_cis_v200_1_2_1.yaml renamed successfully. +./azure/azure_cis_v200_1_20.yaml renamed successfully. +./azure/azure_cis_v130_9_8.yaml renamed successfully. +./azure/azure_datalake_analytics_account_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v150_8_1.yaml renamed successfully. +./azure/azure_cis_v200_7_4.yaml renamed successfully. +./azure/azure_cis_v130_5_1_3.yaml renamed successfully. +./azure/azure_batch_account_logging_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_batch_account_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_ssh_key_authentication_linux.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_security_solution.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_baseline_requirements_windows.yaml renamed successfully. +./azure/azure_cis_v200_2_1_19.yaml renamed successfully. +./azure/azure_cis_v210_3_9.yaml renamed successfully. +./azure/azure_cis_v140_1_15.yaml renamed successfully. +./azure/azure_cis_v210_5_2_6.yaml renamed successfully. +./azure/azure_cis_v210_2_1_4.yaml renamed successfully. +./azure/azure_cis_v150_9_5.yaml renamed successfully. +./azure/azure_compute_disk_unattached_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_key_vault_mandatory.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_logic_app_workflow_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_1_25.yaml renamed successfully. +./azure/azure_compute_vm_password_file_permissions_0644_linux.yaml renamed successfully. +./azure/azure_storage_account_block_public_access.yaml renamed successfully. +./azure/azure_arc_compute_machine_windows_log_analytics_agent_installed.yaml renamed successfully. +./azure/azure_cis_v200_1_19.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_containers.yaml renamed successfully. +./azure/azure_redis_cache_ssl_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_container_registry_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_1_2_1.yaml renamed successfully. +./azure/azure_cis_v200_8_2.yaml renamed successfully. +./azure/azure_securitycenter_container_image_scan_enabled.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_with_user_and_system_assigned_managed_identity.yaml renamed successfully. +./azure/azure_machine_learning_workspace_private_link_used.yaml renamed successfully. +./azure/azure_cis_v130_2_9.yaml renamed successfully. +./azure/azure_cis_v150_3_14.yaml renamed successfully. +./azure/azure_cis_v130_4_3_1.yaml renamed successfully. +./azure/azure_cis_v200_4_3_8.yaml renamed successfully. +./azure/azure_cis_v210_8_8.yaml renamed successfully. +./azure/azure_compute_vm_malware_agent_installed.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_key_vault_key_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_6_3.yaml renamed successfully. +./azure/azure_cis_v200_9_6.yaml renamed successfully. +./azure/azure_container_instance_container_group_in_virtual_network.yaml renamed successfully. +./azure/azure_cis_v140_5_2_6.yaml renamed successfully. +./azure/azure_iot_hub_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v140_3_11.yaml renamed successfully. +./azure/azure_cis_v200_2_1_20.yaml renamed successfully. +./azure/azure_cis_v130_5_2_5.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_route_table_mandatory.yaml renamed successfully. +./azure/azure_automation_account_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_network_security_group_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_2_1_17.yaml renamed successfully. +./azure/azure_eventhub_namespace_cmk_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v210_5_3_1.yaml renamed successfully. +./azure/azure_cis_v210_4_3_1.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_k8s.yaml renamed successfully. +./azure/azure_container_registry_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v150_8_2.yaml renamed successfully. +./azure/azure_cis_v200_7_7.yaml renamed successfully. +./azure/azure_cis_v140_2_10.yaml renamed successfully. +./azure/azure_cis_v200_1_2_2.yaml renamed successfully. +./azure/azure_cis_v200_1_23.yaml renamed successfully. +./azure/azure_web_pub_sub_private_link_used.yaml renamed successfully. +./azure/azure_securitycenter_wdatp_integration.yaml renamed successfully. +./azure/azure_sql_server_azure_defender_enabled.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_udp_port_137.yaml renamed successfully. +./azure/azure_cis_v140_5_1_3.yaml renamed successfully. +./azure/azure_kusto_cluster_double_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v150_1_1_4.yaml renamed successfully. +./azure/azure_keyvault_with_rbac_key_expiration_set.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_installed_linux.yaml renamed successfully. +./azure/azure_compute_vm_allowlist_rules_in_adaptive_application_control_policy_updated.yaml renamed successfully. +./azure/azure_cis_v210_5_2_5.yaml renamed successfully. +./azure/azure_cis_v210_2_1_7.yaml renamed successfully. +./azure/azure_cis_v140_1_16.yaml renamed successfully. +./azure/azure_postgres_sql_server_encrypted_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_cis_v200_6_3.yaml renamed successfully. +./azure/azure_cis_v150_9_6.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_api_management_mandatory.yaml renamed successfully. +./azure/azure_appservice_function_app_latest_http_version.yaml renamed successfully. +./azure/azure_spring_cloud_service_network_injection_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_network_watcher_flow_log_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_vulnerability_findings_resolved_for_sql_server.yaml renamed successfully. +./azure/azure_cis_v130_6_2.yaml renamed successfully. +./azure/azure_cis_v150_5_1_6.yaml renamed successfully. +./azure/azure_cis_v200_1_15.yaml renamed successfully. +./azure/azure_monitor_log_alert_for_administrative_operations.yaml renamed successfully. +./azure/azure_search_service_uses_managed_identity.yaml renamed successfully. +./azure/azure_iam_deprecated_account_with_owner_roles.yaml renamed successfully. +./azure/azure_cis_v210_1_2_7.yaml renamed successfully. +./azure/azure_compute_vm_data_and_os_disk_uses_managed_disk.yaml renamed successfully. +./azure/azure_sql_server_auditing_retention_period_90.yaml renamed successfully. +./azure/azure_cis_v150_1_25.yaml renamed successfully. +./azure/azure_cis_v150_4_5_1.yaml renamed successfully. +./azure/azure_cis_v130_2_5.yaml renamed successfully. +./azure/azure_cis_v210_2_1_21.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_server.yaml renamed successfully. +./azure/azure_cis_v140_2_2.yaml renamed successfully. +./azure/azure_eventgrid_domain_identity_provider_enabled.yaml renamed successfully. +./azure/azure_cis_v130_7_6.yaml renamed successfully. +./azure/azure_container_registry_retention_policy_enabled.yaml renamed successfully. +./azure/azure_cis_v210_8_4.yaml renamed successfully. +./azure/azure_arc_compute_machine_linux_log_analytics_agent_installed.yaml renamed successfully. +./azure/azure_cis_v140_7_1.yaml renamed successfully. +./azure/azure_cis_v210_1_7.yaml renamed successfully. +./azure/azure_bot_service_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_nsg_rule.yaml renamed successfully. +./azure/azure_storage_account_blobs_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v210_1_10.yaml renamed successfully. +./azure/azure_securitycenter_pricing_standard.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_disk_encryption_set_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_3_1.yaml renamed successfully. +./azure/azure_storage_account_secure_transfer_required_enabled.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_21.yaml renamed successfully. +./azure/azure_cis_v130_5_2_9.yaml renamed successfully. +./azure/azure_cis_v200_2_1_2.yaml renamed successfully. +./azure/azure_cis_v140_1_20.yaml renamed successfully. +./azure/azure_postgres_db_server_allow_access_to_azure_services_disabled.yaml renamed successfully. +./azure/azure_monitor_log_cluster_infrastructure_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v140_3_6.yaml renamed successfully. +./azure/azure_keyvault_vault_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_securitycenter_asc_default_setting_not_disabled.yaml renamed successfully. +./azure/azure_app_configuration_private_link_used.yaml renamed successfully. +./azure/azure_cis_v150_4_3_7.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_opensource_relational_db.yaml renamed successfully. +./azure/azure_cis_v200_4_5_2.yaml renamed successfully. +./azure/azure_network_security_group_ssh_access_restricted.yaml renamed successfully. +./azure/azure_sql_server_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_options_user_account_control_requirement_windows.yaml renamed successfully. +./azure/azure_monitor_logs_storage_container_insights_activity_logs_not_public_accessible.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_log_analytics_agent_installed.yaml renamed successfully. +./azure/azure_cis_v130_9_7.yaml renamed successfully. +./azure/azure_cis_v150_2_4_2.yaml renamed successfully. +./azure/azure_eventgrid_topic_private_link_used.yaml renamed successfully. +./azure/azure_cis_v200_5_1_5.yaml renamed successfully. +./azure/azure_cis_v200_3_12.yaml renamed successfully. +./azure/azure_compute_vm_azure_backup_enabled.yaml renamed successfully. +./azure/azure_cis_v210_5_2_9.yaml renamed successfully. +./azure/azure_cis_v200_2_1_16.yaml renamed successfully. +./azure/azure_cis_v210_1_1_2.yaml renamed successfully. +./azure/azure_cis_v210_3_6.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_python_version.yaml renamed successfully. +./azure/azure_cis_v150_5_2_3.yaml renamed successfully. +./azure/azure_cis_v150_2_1_1.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_sqlservervm.yaml renamed successfully. +./azure/azure_cis_v140_8_4.yaml renamed successfully. +./azure/azure_cis_v210_7_1.yaml renamed successfully. +./azure/azure_cis_v140_1_7.yaml renamed successfully. +./azure/azure_cis_v130_1_11.yaml renamed successfully. +./azure/azure_cis_v130_8_3.yaml renamed successfully. +./azure/azure_compute_os_and_data_disk_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v210_3_16.yaml renamed successfully. +./azure/azure_cis_v130_1_1.yaml renamed successfully. +./azure/azure_storage_account_table_service_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v130_1_10.yaml renamed successfully. +./azure/azure_cis_v130_8_2.yaml renamed successfully. +./azure/azure_cis_v140_8_5.yaml renamed successfully. +./azure/azure_appservice_web_app_always_on.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_sql_database_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_baseline_requirements_linux.yaml renamed successfully. +./azure/azure_cosmosdb_account_virtual_network_filter_enabled.yaml renamed successfully. +./azure/azure_cis_v150_5_2_2.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_public_ip_mandatory.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_key_vault_managed_hardware_security_module_mandatory.yaml renamed successfully. +./azure/azure_keyvault_soft_delete_enabled.yaml renamed successfully. +./azure/azure_cis_v210_5_2_8.yaml renamed successfully. +./azure/azure_container_instance_container_group_secured_environment_variable.yaml renamed successfully. +./azure/azure_network_network_peering_connected.yaml renamed successfully. +./azure/azure_postgres_db_server_geo_redundant_backup_enabled.yaml renamed successfully. +./azure/azure_cis_v200_2_1_17.yaml renamed successfully. +./azure/azure_cis_v210_1_1_3.yaml renamed successfully. +./azure/azure_monitor_log_alert_sql_firewall_rule.yaml renamed successfully. +./azure/azure_cis_v210_3_7.yaml renamed successfully. +./azure/azure_cis_v130_9_6.yaml renamed successfully. +./azure/azure_cis_v200_4_1_4.yaml renamed successfully. +./azure/azure_postgres_db_server_latest_tls_version.yaml renamed successfully. +./azure/azure_cis_v140_9_1.yaml renamed successfully. +./azure/azure_cis_v210_6_4.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_virtual_machine_scale_set_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_uses_azure_resource_manager.yaml renamed successfully. +./azure/azure_compute_vm_adaptive_application_controls_enabled.yaml renamed successfully. +./azure/azure_cis_v200_4_5_3.yaml renamed successfully. +./azure/azure_container_instance_container_group_encrypted_using_cmk.yaml renamed successfully. +./azure/azure_storage_account_restrict_network_access.yaml renamed successfully. +./azure/azure_cis_v140_4_5.yaml renamed successfully. +./azure/azure_storage_account_uses_azure_resource_manager.yaml renamed successfully. +./azure/azure_appservice_function_app_latest_tls_version.yaml renamed successfully. +./azure/azure_cis_v140_3_7.yaml renamed successfully. +./azure/azure_cis_v200_5_2_1.yaml renamed successfully. +./azure/azure_cis_v130_5_2_8.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_20.yaml renamed successfully. +./azure/azure_cis_v200_2_1_3.yaml renamed successfully. +./azure/azure_cis_v140_1_21.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_virtual_machine_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_8_5.yaml renamed successfully. +./azure/azure_cis_v210_1_6.yaml renamed successfully. +./azure/azure_compute_vm_adaptive_network_hardening_recommendation_applied.yaml renamed successfully. +./azure/azure_cis_v210_1_11.yaml renamed successfully. +./azure/azure_cis_v150_2_3_1.yaml renamed successfully. +./azure/azure_hdinsight_cluster_encrypted_at_rest_with_cmk.yaml renamed successfully. +./azure/azure_cis_v130_7_7.yaml renamed successfully. +./azure/azure_network_watcher_enabled.yaml renamed successfully. +./azure/azure_postgres_server_private_link_used.yaml renamed successfully. +./azure/azure_cis_v210_2_1_20.yaml renamed successfully. +./azure/azure_cis_v140_2_3.yaml renamed successfully. +./azure/azure_app_configuration_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v200_4_3_5.yaml renamed successfully. +./azure/azure_cis_v150_1_24.yaml renamed successfully. +./azure/azure_cis_v130_2_4.yaml renamed successfully. +./azure/azure_cis_v200_1_14.yaml renamed successfully. +./azure/azure_cis_v210_1_2_6.yaml renamed successfully. +./azure/azure_keyvault_vault_recoverable.yaml renamed successfully. +./azure/azure_cis_v210_9_1.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_stream_analytics_job_mandatory.yaml renamed successfully. +./azure/azure_network_sg_flowlog_enabled.yaml renamed successfully. +./azure/azure_cis_v130_6_3.yaml renamed successfully. +./azure/azure_cis_v150_5_1_7.yaml renamed successfully. +./azure/azure_monitor_log_profile_enabled_for_all_regions.yaml renamed successfully. +./azure/azure_cis_v150_9_7.yaml renamed successfully. +./azure/azure_cis_v200_6_2.yaml renamed successfully. +./azure/azure_healthcare_fhir_uses_private_link.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_update_sql_servers_firewall_rule.yaml renamed successfully. +./azure/azure_kubernetes_cluster_pods_and_containers_uses_approved_user_and_group_id.yaml renamed successfully. +./azure/azure_cis_v140_4_4_1.yaml renamed successfully. +./azure/azure_cis_v210_5_2_4.yaml renamed successfully. +./azure/azure_cis_v210_2_1_6.yaml renamed successfully. +./azure/azure_network_watcher_in_regions_with_virtual_network.yaml renamed successfully. +./azure/azure_cis_v140_1_17.yaml renamed successfully. +./azure/azure_cis_v210_9_10.yaml renamed successfully. +./azure/azure_compute_vm_ssh_key_authentication_linux.yaml renamed successfully. +./azure/azure_hdinsight_cluster_encryption_at_host_enabled.yaml renamed successfully. +./azure/azure_cis_v140_5_1_2.yaml renamed successfully. +./azure/azure_ad_guest_user_reviewed_monthly.yaml renamed successfully. +./azure/azure_cis_v140_4_1_2.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_update_nsg.yaml renamed successfully. +./azure/azure_cis_v130_5_1_1.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_dns.yaml renamed successfully. +./azure/azure_cis_v200_7_6.yaml renamed successfully. +./azure/azure_cis_v150_8_3.yaml renamed successfully. +./azure/azure_securitycenter_email_configured.yaml renamed successfully. +./azure/azure_cis_v140_2_11.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_445.yaml renamed successfully. +./azure/azure_cis_v200_1_2_3.yaml renamed successfully. +./azure/azure_cis_v200_1_22.yaml renamed successfully. +./azure/azure_compute_vm_account_with_password_linux.yaml renamed successfully. +./azure/azure_cis_v150_1_12.yaml renamed successfully. +./azure/azure_compute_vm_endpoint_protection_agent_installed.yaml renamed successfully. +./azure/azure_servicebus_premium_namespace_cmk_encrypted.yaml renamed successfully. +./azure/azure_cis_v200_3_1.yaml renamed successfully. +./azure/azure_compute_vm_network_traffic_data_collection_windows_agent_installed.yaml renamed successfully. +./azure/azure_cis_v210_2_1_16.yaml renamed successfully. +./azure/azure_cis_v140_3_10.yaml renamed successfully. +./azure/azure_cis_v200_2_1_21.yaml renamed successfully. +./azure/azure_cis_v130_5_2_4.yaml renamed successfully. +./azure/azure_eventgrid_topic_local_auth_enabled.yaml renamed successfully. +./azure/azure_cis_v150_2_5.yaml renamed successfully. +./azure/azure_synapse_workspace_private_link_used.yaml renamed successfully. +./azure/azure_mysql_server_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v130_9_11.yaml renamed successfully. +./azure/azure_cis_v140_5_2_7.yaml renamed successfully. +./azure/azure_cis_v210_4_4_2.yaml renamed successfully. +./azure/azure_cis_v200_9_7.yaml renamed successfully. +./azure/azure_cis_v150_6_2.yaml renamed successfully. +./azure/azure_network_security_group_diagnostic_setting_deployed.yaml renamed successfully. +./azure/azure_iam_subscription_owner_more_than_1.yaml renamed successfully. +./azure/azure_kubernetes_cluster_https_enabled.yaml renamed successfully. +./azure/azure_mssql_managed_instance_encryption_at_rest_using_cmk.yaml renamed successfully. +./azure/azure_cis_v130_2_8.yaml renamed successfully. +./azure/azure_cis_v150_3_1.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_search_service_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_3_15.yaml renamed successfully. +./azure/azure_cis_v150_7_6.yaml renamed successfully. +./azure/azure_cis_v200_8_3.yaml renamed successfully. +./azure/azure_cis_v210_5_1_1.yaml renamed successfully. +./azure/azure_cis_v200_1_18.yaml renamed successfully. +./azure/azure_application_gateway_waf_uses_specified_mode.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_with_system_assigned_managed_identity.yaml renamed successfully. +./azure/azure_cis_v150_2_2_2.yaml renamed successfully. +./azure/azure_cis_v200_8_8.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_lb_mandatory.yaml renamed successfully. +./azure/azure_cis_v200_1_13.yaml renamed successfully. +./azure/azure_cis_v140_6_3.yaml renamed successfully. +./azure/azure_cis_v210_9_6.yaml renamed successfully. +./azure/azure_cis_v210_1_2_1.yaml renamed successfully. +./azure/azure_keyvault_purge_protection_enabled.yaml renamed successfully. +./azure/azure_cis_v130_2_3.yaml renamed successfully. +./azure/azure_kubernetes_cluster_add_on_azure_policy_enabled.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_udp_port_445.yaml renamed successfully. +./azure/azure_cis_v150_1_23.yaml renamed successfully. +./azure/azure_storage_account_soft_delete_enabled.yaml renamed successfully. +./azure/azure_cis_v140_4_3_8.yaml renamed successfully. +./azure/azure_mssql_managed_instance_vulnerability_assessment_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_app_service_plan_mandatory.yaml renamed successfully. +./azure/azure_cis_v140_2_4.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_nsg.yaml renamed successfully. +./azure/azure_search_service_replica_count_3.yaml renamed successfully. +./azure/azure_cis_v140_9_11.yaml renamed successfully. +./azure/azure_cis_v130_3_10.yaml renamed successfully. +./azure/azure_cis_v210_8_2.yaml renamed successfully. +./azure/azure_cis_v140_7_7.yaml renamed successfully. +./azure/azure_sql_server_auditing_on.yaml renamed successfully. +./azure/azure_cis_v210_1_16.yaml renamed successfully. +./azure/azure_cis_v150_4_4_3.yaml renamed successfully. +./azure/azure_cis_v130_3_7.yaml renamed successfully. +./azure/azure_cis_v200_2_1_4.yaml renamed successfully. +./azure/azure_cis_v200_5_2_6.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_network_watcher_mandatory.yaml renamed successfully. +./azure/azure_appservice_function_app_restrict_public_acces.yaml renamed successfully. +./azure/azure_cis_v150_1_19.yaml renamed successfully. +./azure/azure_cis_v130_2_11.yaml renamed successfully. +./azure/azure_recovery_service_vault_uses_managed_identity.yaml renamed successfully. +./azure/azure_cis_v150_4_3_1.yaml renamed successfully. +./azure/azure_network_watcher_flow_log_enabled.yaml renamed successfully. +./azure/azure_iam_user_with_owner_permission_on_subscription_mfa_enabled.yaml renamed successfully. +./azure/azure_cis_v210_6_3.yaml renamed successfully. +./azure/azure_cis_v140_9_6.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_snapshot_mandatory.yaml renamed successfully. +./azure/azure_appservice_web_app_incoming_client_cert_on.yaml renamed successfully. +./azure/azure_postgresql_server_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v200_5_1_3.yaml renamed successfully. +./azure/azure_cis_v200_2_2_1.yaml renamed successfully. +./azure/azure_cis_v130_9_1.yaml renamed successfully. +./azure/azure_cis_v150_8_8.yaml renamed successfully. +./azure/azure_appservice_ftp_deployment_disabled.yaml renamed successfully. +./azure/azure_compute_vm_guest_configuration_installed_windows.yaml renamed successfully. +./azure/azure_cis_v200_3_14.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_5432.yaml renamed successfully. +./azure/azure_databox_job_unlock_password_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_sql_server_and_databases_va_enabled.yaml renamed successfully. +./azure/azure_monitor_log_alert_create_update_nsg_rule.yaml renamed successfully. +./azure/azure_cis_v210_1_1_4.yaml renamed successfully. +./azure/azure_sql_database_transparent_data_encryption_enabled.yaml renamed successfully. +./azure/azure_kubernetes_cluster_restrict_public_access.yaml renamed successfully. +./azure/azure_cis_v150_2_1_7.yaml renamed successfully. +./azure/azure_cis_v150_5_2_5.yaml renamed successfully. +./azure/azure_cis_v140_1_1.yaml renamed successfully. +./azure/azure_cis_v140_8_2.yaml renamed successfully. +./azure/azure_cis_v210_7_7.yaml renamed successfully. +./azure/azure_sql_server_va_setting_periodic_scan_enabled.yaml renamed successfully. +./azure/azure_container_registry_vulnerabilities_remediated.yaml renamed successfully. +./azure/azure_compute_os_and_data_disk_encrypted_with_cmk_and_platform_managed.yaml renamed successfully. +./azure/azure_cis_v210_3_11.yaml renamed successfully. +./azure/azure_iam_external_user_with_read_permission.yaml renamed successfully. +./azure/azure_cis_v130_8_5.yaml renamed successfully. +./azure/azure_cis_v130_1_6.yaml renamed successfully. +./azure/azure_cis_v130_1_17.yaml renamed successfully. +./azure/azure_search_service_logging_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_image_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_5_1_6.yaml renamed successfully. +./azure/azure_cis_v200_8_4.yaml renamed successfully. +./azure/azure_compute_vm_tcp_udp_access_restricted_internet.yaml renamed successfully. +./azure/azure_cis_v150_7_1.yaml renamed successfully. +./azure/azure_cis_v200_1_7.yaml renamed successfully. +./azure/azure_cis_v210_4_5_1.yaml renamed successfully. +./azure/azure_cis_v140_2_8.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_5500.yaml renamed successfully. +./azure/azure_synapse_workspace_data_exfiltration_protection_enabled.yaml renamed successfully. +./azure/azure_appservice_web_app_diagnostic_logs_enabled.yaml renamed successfully. +./azure/azure_cis_v150_3_12.yaml renamed successfully. +./azure/azure_network_virtual_network_gateway_no_basic_sku.yaml renamed successfully. +./azure/azure_appservice_web_app_slot_use_https.yaml renamed successfully. +./azure/azure_keyvault_firewall_enabled.yaml renamed successfully. +./azure/azure_cis_v150_3_6.yaml renamed successfully. +./azure/azure_cis_v130_1_21.yaml renamed successfully. +./azure/azure_datalake_store_account_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v150_2_1_12.yaml renamed successfully. +./azure/azure_storage_account_geo_redundant_enabled.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_tcp_port_5900.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_eventhub_namespace_mandatory.yaml renamed successfully. +./azure/azure_sql_server_azure_ad_authentication_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_sql_server_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_5_2_3.yaml renamed successfully. +./azure/azure_cis_v200_2_1_8.yaml renamed successfully. +./azure/azure_stream_analytics_job_logging_enabled.yaml renamed successfully. +./azure/azure_network_security_group_rdp_access_restricted.yaml renamed successfully. +./azure/azure_cis_v200_1_1_1.yaml renamed successfully. +./azure/azure_network_subnet_protected_by_firewall.yaml renamed successfully. +./azure/azure_cis_v200_3_6.yaml renamed successfully. +./azure/azure_cis_v210_2_1_11.yaml renamed successfully. +./azure/azure_cis_v150_1_15.yaml renamed successfully. +./azure/azure_compute_vm_attached_with_network.yaml renamed successfully. +./azure/azure_cis_v210_4_3_7.yaml renamed successfully. +./azure/azure_cis_v150_8_4.yaml renamed successfully. +./azure/azure_cis_v200_7_1.yaml renamed successfully. +./azure/azure_cis_v150_1_7.yaml renamed successfully. +./azure/azure_cis_v200_1_2_4.yaml renamed successfully. +./azure/azure_iam_external_user_with_write_permission.yaml renamed successfully. +./azure/azure_appservice_web_app_use_https.yaml renamed successfully. +./azure/azure_cis_v200_1_25.yaml renamed successfully. +./azure/azure_compute_vm_system_updates_installed.yaml renamed successfully. +./azure/azure_cis_v140_5_1_5.yaml renamed successfully. +./azure/azure_servicebus_name_space_private_link_used.yaml renamed successfully. +./azure/azure_cis_v150_1_1_2.yaml renamed successfully. +./azure/azure_cis_v150_5_2_9.yaml renamed successfully. +./azure/azure_iam_external_user_with_owner_role.yaml renamed successfully. +./azure/azure_kubernetes_cluster_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_1.yaml renamed successfully. +./azure/azure_cis_v210_5_2_3.yaml renamed successfully. +./azure/azure_mandatory_sql_subscription_resource_group_mandatory.yaml renamed successfully. +./azure/azure_cis_v140_1_10.yaml renamed successfully. +./azure/azure_monitor_log_analytics_workspace_integrated_with_encrypted_storage_account.yaml renamed successfully. +./azure/azure_cis_v210_1_20.yaml renamed successfully. +./azure/azure_cis_v210_5_2_10.yaml renamed successfully. +./azure/azure_app_configuration_sku_standard.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_redis_cache_mandatory.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_virtual_network_mandatory.yaml renamed successfully. +./azure/azure_iam_user_not_allowed_to_create_tenants.yaml renamed successfully. +./azure/azure_appservice_web_app_latest_php_version.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_express_route_circuit_mandatory.yaml renamed successfully. +./azure/azure_cis_v210_1_21.yaml renamed successfully. +./azure/azure_network_security_group_restrict_inbound_icmp_port.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_key_vault_deleted_vault_mandatory.yaml renamed successfully. +./azure/azure_cis_v150_9_1.yaml renamed successfully. +./azure/azure_cis_v200_6_4.yaml renamed successfully. +./azure/azure_keyvault_vault_public_network_access_disabled.yaml renamed successfully. +./azure/azure_cis_v210_5_2_2.yaml renamed successfully. +./azure/azure_kubernetes_cluster_network_plugin_azure.yaml renamed successfully. +./azure/azure_cis_v140_1_11.yaml renamed successfully. +./azure/azure_appservice_function_app_latest_python_version.yaml renamed successfully. +./azure/azure_cis_v150_1_1_3.yaml renamed successfully. +./azure/azure_cis_v150_5_2_8.yaml renamed successfully. +./azure/azure_servicebus_namespace_azure_ad_authentication_enabled.yaml renamed successfully. +./azure/azure_kubernetes_cluster_pod_use_approved_host_network_and_port_range.yaml renamed successfully. +./azure/azure_compute_vm_jit_access_protected.yaml renamed successfully. +./azure/azure_cis_v150_8_5.yaml renamed successfully. +./azure/azure_compute_vm_monitor_missing_endpoint_protection_in_asc.yaml renamed successfully. +./azure/azure_keyvault_managed_hms_logging_enabled.yaml renamed successfully. +./azure/azure_compute_vm_restrict_remote_connection_from_accounts_without_password_linux.yaml renamed successfully. +./azure/azure_cis_v150_1_6.yaml renamed successfully. +./azure/azure_cis_v200_1_2_5.yaml renamed successfully. +./azure/azure_cis_v200_1_24.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_cosmosdb.yaml renamed successfully. +./azure/azure_iam_subscriptions_with_custom_roles_no_overly_permissive.yaml renamed successfully. +./azure/azure_cis_v150_1_14.yaml renamed successfully. +./azure/azure_monitor_log_alert_delete_sql_servers_firewall_rule.yaml renamed successfully. +./azure/azure_servicebus_namespace_logging_enabled.yaml renamed successfully. +./azure/azure_cis_v210_2_1_10.yaml renamed successfully. +./azure/azure_cis_v130_5_2_2.yaml renamed successfully. +./azure/azure_servicefabric_cluster_active_directory_authentication_enabled.yaml renamed successfully. +./azure/azure_cis_v200_2_1_9.yaml renamed successfully. +./azure/azure_sql_server_threat_detection_all_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_iothub_mandatory.yaml renamed successfully. +./azure/azure_compute_vm_meet_security_options_requirement_windows.yaml renamed successfully. +./azure/azure_storage_account_default_network_access_rule_denied.yaml renamed successfully. +./azure/azure_kubernetes_cluster_temp_disks_and_agent_node_pool_cache_encrypted_at_host.yaml renamed successfully. +./azure/azure_cis_v140_5_2_1.yaml renamed successfully. +./azure/azure_securitycenter_azure_defender_on_for_database.yaml renamed successfully. +./azure/azure_compute_vm_meet_system_audit_policies_requirement_windows.yaml renamed successfully. +./azure/azure_cis_v200_9_1.yaml renamed successfully. +./azure/azure_cis_v150_6_4.yaml renamed successfully. +./azure/azure_cis_v150_2_1_13.yaml renamed successfully. +./azure/azure_iam_no_custom_role.yaml renamed successfully. +./azure/azure_cis_v130_1_20.yaml renamed successfully. +./azure/azure_redis_cache_no_basic_sku.yaml renamed successfully. +./azure/azure_kubernetes_cluster_os_and_data_disks_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_data_factory_public_network_access_disabled.yaml renamed successfully. +./azure/azure_keyvault_secret_expiration_set.yaml renamed successfully. +./azure/azure_compute_vm_image_builder_uses_private_link.yaml renamed successfully. +./azure/azure_cis_v150_3_7.yaml renamed successfully. +./azure/azure_stream_analytics_job_encrypted_with_cmk.yaml renamed successfully. +./azure/azuread_user_should_have_mfa_enabled_with_azure_subscription_role_assignment.yaml renamed successfully. +./azure/azure_cis_v140_2_9.yaml renamed successfully. +./azure/azure_appservice_api_app_uses_managed_identity.yaml renamed successfully. +./azure/azure_cis_v150_1_2_6.yaml renamed successfully. +./azure/azure_cis_v200_8_5.yaml renamed successfully. +./azure/azure_container_registry_public_network_access_disabled.yaml renamed successfully. +./azure/azure_iam_user_with_write_permission_on_subscription_mfa_enabled.yaml renamed successfully. +./azure/azure_compute_vm_meet_firewall_properties_windows.yaml renamed successfully. +./azure/azure_compute_vm_scale_set_security_configuration_vulnerabilities_remediated.yaml renamed successfully. +./azure/azure_cis_v200_1_6.yaml renamed successfully. +./azure/azure_mysql_server_audit_logging_events_connection_set.yaml renamed successfully. +./azure/azure_mysql_server_private_link_used.yaml renamed successfully. +./azure/azure_appservice_web_app_use_virtual_service_endpoint.yaml renamed successfully. +./azure/azure_cis_v210_3_10.yaml renamed successfully. +./azure/azure_cis_v130_8_4.yaml renamed successfully. +./azure/azure_cis_v130_1_7.yaml renamed successfully. +./azure/azure_cis_v130_1_16.yaml renamed successfully. +./azure/azure_redis_cache_min_tls_1_2.yaml renamed successfully. +./azure/azure_recovery_service_vault_uses_private_link_for_backup.yaml renamed successfully. +./azure/azure_cognitive_account_restrict_public_access.yaml renamed successfully. +./azure/azure_compute_vm_min_password_length_14_windows.yaml renamed successfully. +./azure/azure_cis_v210_7_6.yaml renamed successfully. +./azure/azure_cis_v140_8_3.yaml renamed successfully. +./azure/azure_iam_user_with_read_permission_on_subscription_mfa_enabled.yaml renamed successfully. +./azure/azure_cis_v150_2_1_6.yaml renamed successfully. +./azure/azure_appservice_function_app_latest_java_version.yaml renamed successfully. +./azure/azure_cis_v150_5_2_4.yaml renamed successfully. +./azure/azure_cis_v200_4_4_1.yaml renamed successfully. +./azure/azure_kubernetes_instance_rbac_enabled.yaml renamed successfully. +./azure/azure_cis_v210_3_1.yaml renamed successfully. +./azure/azure_cis_v200_2_1_11.yaml renamed successfully. +./azure/azure_cis_v200_5_1_2.yaml renamed successfully. +./azure/azure_arc_kubernetes_cluster_azure_defender_extension_installed.yaml renamed successfully. +./azure/azure_storage_account_encryption_scopes_encrypted_at_rest_with_cmk.yaml renamed successfully. +./azure/azure_cis_v200_4_1_2.yaml renamed successfully. +./azure/azure_kubernetes_cluster_upgrade_channel.yaml renamed successfully. +./azure/azure_cis_v200_3_15.yaml renamed successfully. +./azure/azure_datalake_store_account_encryption_enabled.yaml renamed successfully. +./azure/azure_cis_v140_9_7.yaml renamed successfully. +./azure/azure_cis_v210_6_2.yaml renamed successfully. +./azure/azure_cis_v200_5_2_10.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_key_vault_secret_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_4_4.yaml renamed successfully. +./azure/azure_cis_v210_10_1.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_kubernetes_cluster_mandatory.yaml renamed successfully. +./azure/azure_cis_v130_2_10.yaml renamed successfully. +./azure/azure_iam_conditional_access_mfa_enabled.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_recovery_services_vault_mandatory.yaml renamed successfully. +./azure/azure_cis_v140_3_1.yaml renamed successfully. +./azure/azure_appservice_function_app_authentication_on.yaml renamed successfully. +./azure/azure_appservice_function_app_only_https_accessible.yaml renamed successfully. +./azure/azure_appservice_web_app_health_check_enabled.yaml renamed successfully. +./azure/azure_servicefabric_cluster_protection_level_as_encrypt_and_sign.yaml renamed successfully. +./azure/azure_cis_v130_3_6.yaml renamed successfully. +./azure/azure_cis_v150_4_4_2.yaml renamed successfully. +./azure/azure_cis_v200_2_1_5.yaml renamed successfully. +./azure/azure_cis_v200_5_2_7.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_compute_disk_mandatory.yaml renamed successfully. +./azure/azure_appservice_api_app_remote_debugging_disabled.yaml renamed successfully. +./azure/azure_hpc_cache_encrypted_with_cmk.yaml renamed successfully. +./azure/azure_cis_v130_3_11.yaml renamed successfully. +./azure/azure_cis_v140_7_6.yaml renamed successfully. +./azure/azure_cis_v210_8_3.yaml renamed successfully. +./azure/azure_cis_v210_1_17.yaml renamed successfully. +./azure/azure_cis_v130_7_1.yaml renamed successfully. +./azure/azure_sql_server_atp_enabled.yaml renamed successfully. +./azure/azure_postgres_db_server_connection_throttling_on.yaml renamed successfully. +./azure/azure_cis_v140_2_5.yaml renamed successfully. +./azure/azure_compute_vm_administrators_group_with_no_specified_members_windows.yaml renamed successfully. +./azure/azure_cis_v130_2_2.yaml renamed successfully. +./azure/azure_redis_cache_in_virtual_network.yaml renamed successfully. +./azure/azure_kusto_cluster_encrypted_at_rest_with_cmk.yaml renamed successfully. +./azure/azure_cis_v150_1_22.yaml renamed successfully. +./azure/azure_mandatory_sql_resource_group_cosmosdb_sql_database_mandatory.yaml renamed successfully. +./azure/azure_cis_v200_1_12.yaml renamed successfully. +./azure/azure_mysql_db_server_geo_redundant_backup_enabled.yaml renamed successfully. +./azure/azure_cis_v210_9_7.yaml renamed successfully. +./azure/azure_cis_v140_6_2.yaml renamed successfully. +./azure/azure_container_registry_restrict_public_access.yaml renamed successfully. +./azure/azure_kubernetes_cluster_service_listen_to_allowed_ports.yaml renamed successfully. +./azure/azure_cis_v150_5_1_1.yaml renamed successfully. +./azure/azure_cis_v150_2_2_3.yaml renamed successfully. +./azure/azure_storage_account_trusted_microsoft_services_enabled.yaml renamed successfully. +./azure/azure_kubernetes_cluster_container_with_read_only_root_file_system.yaml renamed successfully. +./baseline/azure/storage_account/azure_disable_public_access_to_storage_accounts_with_blob_containers.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_trusted_microsoft_services_for_storage_account_access.yaml renamed successfully. +./baseline/azure/storage_account/azure_private_endpoint_in_use.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_blob_storage_lifecycle_management.yaml renamed successfully. +./baseline/azure/storage_account/azure_disable_anonymous_access_to_blob_containers.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_logging_for_azure_storage_table_service.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_immutable_blob_storage.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_infrastructure_encryption.yaml renamed successfully. +./baseline/azure/storage_account/azure_storage_account_encryption_using_customer_managed_keys.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_soft_delete_for_azure_blob_storage.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_logging_for_azure_storage_queue_service.yaml renamed successfully. +./baseline/azure/storage_account/azure_check_for_sufficient_soft_deleted_data_retention_period.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_secure_transfer_in_azure_storage.yaml renamed successfully. +./baseline/azure/storage_account/azure_configure_minimum_tls_version.yaml renamed successfully. +./baseline/azure/storage_account/azure_use_byok_for_storage_account_encryption.yaml renamed successfully. +./baseline/azure/storage_account/azure_check_for_publicly_accessible_web_containers.yaml renamed successfully. +./baseline/azure/storage_account/azure_enable_logging_for_azure_storage_blob_service.yaml renamed successfully. +./baseline/azure/storage_account/azure_limit_storage_account_access_by_ip_address.yaml renamed successfully. +./baseline/azure/storage_account/azure_restrict_default_network_access_for_storage_accounts.yaml renamed successfully. +./baseline/azure/monitor/azure_monitor_log_all_activities.yaml renamed successfully. +./baseline/azure/recovery_service/azure_recovery_service_vault_not_publicly_accessible_and_not_encrypted.yaml renamed successfully. +./baseline/azure/recovery_service/azure_recovery_service_vault_alert_for_job_failures_enabled.yaml renamed successfully. +./baseline/azure/KeyVault/azure_set_azure_secret_key_expiration.yaml renamed successfully. +./baseline/azure/KeyVault/azure_app_tier_customer_managed_key_in_use.yaml renamed successfully. +./baseline/azure/KeyVault/azure_enable_auditevent_logging_for_azure_key_vaults.yaml renamed successfully. +./baseline/azure/KeyVault/azure_web_tier_customer_managed_key_in_use.yaml renamed successfully. +./baseline/azure/KeyVault/azure_set_encryption_key_expiration.yaml renamed successfully. +./baseline/azure/KeyVault/azure_enable_trusted_microsoft_services_for_key_vault_access.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_allowed_certificate_key_types.yaml renamed successfully. +./baseline/azure/KeyVault/azure_database_tier_customer_managed_key_in_use.yaml renamed successfully. +./baseline/azure/KeyVault/azure_enable_ssl_certificate_auto_renewal.yaml renamed successfully. +./baseline/azure/KeyVault/azure_enable_certificate_transparency.yaml renamed successfully. +./baseline/azure/KeyVault/azure_restrict_default_network_access_for_azure_key_vaults.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_azure_key_vault_secrets_expiration_date.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_sufficient_certificate_auto_renewal_period.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_azure_key_vault_keys_expiration_date.yaml renamed successfully. +./baseline/azure/KeyVault/azure_enable_key_vault_recoverability.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_key_vault_full_administrator_permissions.yaml renamed successfully. +./baseline/azure/KeyVault/azure_check_for_certificate_minimum_key_size.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_accelerated_networking_for_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_disk_encryption_for_boot_disk_volumes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_backups_for_azure_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_server_side_encryption_for_unattached_disk_using_cmk.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_usage_of_customer_managed_keys_for_virtual_hard_disk_encryption.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_encryption_for_web_tier_disk_volumes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_approved_azure_machine_image_in_use.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_old_virtual_machine_disk_snapshots.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_guest_level_diagnostics_for_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_usage_of_managed_disk_volumes_for_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_sufficient_instant_restore_retention_period.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_usage_of_approved_extensions_only.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_installataion_for_latest_os_patches.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_autoscale_notifications.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_sufficient_daily_backup_retention_period.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_performance_diagnostics_for_azure_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_ssh_authentication_type.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_disk_encryption_for_non_boot_disk_volumes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_unattached_virtual_machine_disk_volumes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_disks_should_use_standard_snapshots.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_virtual_machine_boot_diagnostics.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_unused_load_balancers.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_automatic_os_upgrades.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_zone_redundant_virtual_machine_scale_sets.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_associated_load_balancers.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_virtual_machine_access_using_microsoft_entra_id_authentication.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_instance_termination_notifications_for_virtual_machine_scale_sets.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_system_assigned_managed_identities.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_usage_of_byok_for_disk_volumes_encryption.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_usage_of_endpoint_protection.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_server_side_encryption_for_boot_disk_using_cmk.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_disk_encryption_for_unattached_disk_volumes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_just_in_time_access_for_virtual_machines.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_desired_vm_sku_sizes.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_configure_health_monitoring.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_server_side_encryption_for_non_boot_disk_using_cmk.yaml renamed successfully. +./baseline/azure/virtual_machine/azure_check_for_automatic_instance_repairs.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_ssh_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_telnet_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_postgresql_database_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_smtp_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_oracle_database_access.yaml renamed successfully. +./baseline/azure/network/azure_review_network_interfaces_with_ip_forwarding_enabled.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_mysql_database_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_netbios_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_rdp_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_mongodb_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_udp_access.yaml renamed successfully. +./baseline/azure/network/azure_enable_azure_network_watcher.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_mssql_access.yaml renamed successfully. +./baseline/azure/network/azure_check_for_unrestricted_rpc_access.yaml renamed successfully. +./baseline/azure/network/azure_enable_ddos_standard_protection_for_virtual_networks.yaml renamed successfully. +./baseline/azure/aks/azure_secure_access_to_kubernetes_api_server_using_authorized_ip_address_ranges.yaml renamed successfully. +./baseline/azure/aks/azure_enable_defender_for_cloud_for_aks_clusters.yaml renamed successfully. +./baseline/azure/aks/azure_check_for_kubernetes_version.yaml renamed successfully. +./baseline/azure/aks/azure_use_azure_cni_add_on_for_managing_network_resources.yaml renamed successfully. +./baseline/azure/aks/azure_use_user_assigned_managed_identities_for_aks_clusters.yaml renamed successfully. +./baseline/azure/aks/azure_enable_kubernetes_role_based_access_control.yaml renamed successfully. +./baseline/azure/aks/azure_use_microsoft_entra_id_integration_for_aks_clusters.yaml renamed successfully. +./baseline/azure/aks/azure_kubernetes_api_version.yaml renamed successfully. +./baseline/azure/aks/azure_use_network_contributor_role_for_managing_azure_network_resources.yaml renamed successfully. +./baseline/azure/aks/azure_use_system_assigned_managed_identities_for_aks_clusters.yaml renamed successfully. +./baseline/azure/cosmosdb/azure_enable_automatic_failover.yaml renamed successfully. +./baseline/azure/app_services/azure_disable_plain_ftp_deployment.yaml renamed successfully. +./baseline/azure/sql/azure_enable_auditing_for_sql_servers.yaml renamed successfully. +./baseline/azure/sql/azure_check_for_unrestricted_sql_database_access.yaml renamed successfully. +./baseline/azure/sql/azure_enable_vulnerability_assessment_email_notifications_for_admins_and_subscription_owners.yaml renamed successfully. +./baseline/azure/sql/azure_check_for_sufficient_point_in_time_restore_pitr_backup_retention_period.yaml renamed successfully. +./baseline/azure/sql/azure_enable_in_transit_encryption_for_mysql_servers.yaml renamed successfully. +./baseline/azure/sql/azure_enable_auto_failover_groups.yaml renamed successfully. +./baseline/azure/sql/azure_enable_transparent_data_encryption_for_sql_managed_instance_using_customer_managed_keys.yaml renamed successfully. +./baseline/azure/sql/azure_enable_all_types_of_threat_detection_on_sql_servers.yaml renamed successfully. +./baseline/azure/sql/azure_sql_auditing_retention.yaml renamed successfully. +./baseline/azure/sql/azure_enable_vulnerability_assessment_periodic_recurring_scans.yaml renamed successfully. +./baseline/azure/sql/azure_enable_automatic_tuning_for_sql_database_servers.yaml renamed successfully. +./baseline/azure/sql/azure_configure_emails_for_vulnerability_assessment_scan_reports_and_alerts.yaml renamed successfully. +./baseline/azure/sql/azure_check_for_publicly_accessible_sql_servers.yaml renamed successfully. +./baseline/azure/sql/azure_use_microsoft_entra_admin_for_sql_authentication.yaml renamed successfully. +./baseline/azure/sql/azure_use_byok_for_transparent_data_encryption.yaml renamed successfully. +./baseline/azure/sql/azure_enable_vulnerability_assessment_for_microsoft_sql_servers.yaml renamed successfully. +./baseline/azure/sql/azure_restrict_default_network_access_for_azure_cosmos_db_accounts.yaml renamed successfully. +./baseline/azure/sql/azure_configure_audit_action_group_for_sql_server_auditing.yaml renamed successfully. +./baseline/azure/sql/azure_advanced_data_security_for_sql_servers.yaml renamed successfully. +./baseline/shared/cost/kaytu_mom_cost_growth_15.yaml renamed successfully. +./baseline/shared/cost/kaytu_connection_mom_cost_growth.yaml renamed successfully. +./baseline/aws/acm_certificate/aws_acm_certificates_with_wildcard_domain_names.yaml renamed successfully. +./baseline/aws/acm_certificate/aws_acm_certificates_renewal_7_days_before_expiration.yaml renamed successfully. +./baseline/aws/acm_certificate/aws_acm_certificates_validity.yaml renamed successfully. +./baseline/aws/acm_certificate/aws_acm_certificate_expired.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_glb_minimum_number_of_ec2_target_instances.yaml renamed successfully. +./baseline/aws/load_balancer/aws_unused_elastic_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_internet_facing_elbs.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_alb_security_group.yaml renamed successfully. +./baseline/aws/load_balancer/aws_enable_amazon_waf_integration_for_application_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_enable_support_for_grpc_protocol.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_access_log.yaml renamed successfully. +./baseline/aws/load_balancer/aws_configure_multiple_availability_zones_for_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_alb_security_policy.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elb_access_log.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elb_cross_zone_load_balancing_enabled.yaml renamed successfully. +./baseline/aws/load_balancer/aws_enable_cross_zone_load_balancing.yaml renamed successfully. +./baseline/aws/load_balancer/aws_internet_facing_elbv2s.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_alb_listener_security.yaml renamed successfully. +./baseline/aws/load_balancer/aws_unused_application_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_elastic_load_balancing_deletion_protection.yaml renamed successfully. +./baseline/aws/load_balancer/aws_enable_http_to_https_redirect_for_application_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_unused_gateway_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_configure_http_desync_mitigation_mode_for_application_load_balancers.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elb_connection_draining_enabled.yaml renamed successfully. +./baseline/aws/load_balancer/aws_enable_deletion_protection.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_nlb_listener_security.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elbv2_alb_minimum_number_of_ec2_target_instances.yaml renamed successfully. +./baseline/aws/load_balancer/aws_elb_insecure_ssl_protocols.yaml renamed successfully. +./baseline/aws/opensearch/aws_encryption_at_rest.yaml renamed successfully. +./baseline/aws/opensearch/aws_enable_audit_logs.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_version.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_domain_in_vpc.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_domain_encrypted_with_kms_cmks.yaml renamed successfully. +./baseline/aws/opensearch/aws_enable_in_transit_encryption.yaml renamed successfully. +./baseline/aws/opensearch/aws_tls_security_policy_version.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_slow_logs.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_node_to_node_encryption.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_zone_awareness_enabled.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_dedicated_master_enabled.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_domain_exposed.yaml renamed successfully. +./baseline/aws/opensearch/aws_opensearch_accessible_only_from_safelisted_ip_addresses.yaml renamed successfully. +./baseline/aws/ecr/aws_ecr_repository_exposed.yaml renamed successfully. +./baseline/aws/ecr/aws_lifecycle_policy_in_use.yaml renamed successfully. +./baseline/aws/ecr/aws_enable_scan_on_push_for_ecr_container_images.yaml renamed successfully. +./baseline/aws/ecr/aws_enable_cross_region_replication.yaml renamed successfully. +./baseline/aws/dynamoDb/aws_unused_dynamodb_table.yaml renamed successfully. +./baseline/aws/ecs/aws_ecs_task_log_driver_in_use.yaml renamed successfully. +./baseline/aws/ecs/aws_enable_cloudwatch_container_insights.yaml renamed successfully. +./baseline/aws/ecs/aws_check_for_amazon_ecs_service_placement_strategy.yaml renamed successfully. +./baseline/aws/ecs/aws_check_for_ecs_container_instance_agent_version.yaml renamed successfully. +./baseline/aws/ecs/aws_check_for_fargate_platform_version.yaml renamed successfully. +./baseline/aws/fsx/aws_use_kms_customer_master_keys_for_fsx_windows_file_server_file_systems.yaml renamed successfully. +./baseline/aws/ebs/aws_use_io2_not_io1.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_encrypted.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_snapshot_encrypted.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_volume_unused.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_public_snapshots.yaml renamed successfully. +./baseline/aws/ebs/aws_use_gp3_not_gp2.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_volumes_too_old_snapshots.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_volumes_attached_to_stopped_ec2_instances.yaml renamed successfully. +./baseline/aws/ebs/aws_ebs_encrypted_with_kms_customer_master_keys.yaml renamed successfully. +./baseline/aws/IAM/aws_ssh_public_keys_rotated_45_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_policies.yaml renamed successfully. +./baseline/aws/IAM/aws_root_mfa_enabled.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_policies_with_effect_set_to_allow_and_notaction.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_users_with_administrative_privileges.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_group_with_inline_policies.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_access_analyzer_in_use.yaml renamed successfully. +./baseline/aws/IAM/aws_mfa_device_deactivated.yaml renamed successfully. +./baseline/aws/IAM/aws_inactive_iam_console_user.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_users_unauthorized_to_edit_access_policies.yaml renamed successfully. +./baseline/aws/IAM/aws_root_account_access_keys_present.yaml renamed successfully. +./baseline/aws/IAM/aws_check_for_overly_permissive_iam_group_policies.yaml renamed successfully. +./baseline/aws/IAM/aws_enforce_infrastructure_as_code_using_iam_policies.yaml renamed successfully. +./baseline/aws/IAM/aws_credentials_last_used.yaml renamed successfully. +./baseline/aws/IAM/aws_allow_iam_users_to_change_their_own_password.yaml renamed successfully. +./baseline/aws/IAM/aws_check_for_individual_iam_users.yaml renamed successfully. +./baseline/aws/IAM/aws_unnecessary_ssh_public_keys.yaml renamed successfully. +./baseline/aws/IAM/aws_unnecessary_access_keys.yaml renamed successfully. +./baseline/aws/IAM/aws_expired_ssl_tls_certificate.yaml renamed successfully. +./baseline/aws/IAM/aws_access_keys_during_initial_iam_user_setup.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_password_expiry_30_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_password_policy.yaml renamed successfully. +./baseline/aws/IAM/aws_approved_ecs_execute_command_access.yaml renamed successfully. +./baseline/aws/IAM/aws_ssl_tls_certificate_expiry_30_days.yaml renamed successfully. +./baseline/aws/IAM/aws_unapproved_iam_policy_in_use.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_support_role.yaml renamed successfully. +./baseline/aws/IAM/aws_enable_mfa_for_iam_users_with_console_password.yaml renamed successfully. +./baseline/aws/IAM/aws_ssl_tls_certificate_expiry_x_days.yaml renamed successfully. +./baseline/aws/IAM/aws_unused_iam_group.yaml renamed successfully. +./baseline/aws/IAM/aws_canary_access_token.yaml renamed successfully. +./baseline/aws/IAM/aws_check_for_untrusted_cross_account_iam_roles.yaml renamed successfully. +./baseline/aws/IAM/aws_multi_account_centralized_management.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_with_password_and_access_keys.yaml renamed successfully. +./baseline/aws/IAM/aws_root_account_credentials_usage.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_groups_with_administrative_privileges.yaml renamed successfully. +./baseline/aws/IAM/aws_ec2_purchase_restriction.yaml renamed successfully. +./baseline/aws/IAM/aws_pre_heartbleed_server_certificates.yaml renamed successfully. +./baseline/aws/IAM/aws_cross_account_access_lacks_external_id_and_mfa.yaml renamed successfully. +./baseline/aws/IAM/aws_access_keys_rotated_x_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_server_certificate_size.yaml renamed successfully. +./baseline/aws/IAM/aws_check_for_iam_user_group_membership.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_access_analyzer_findings.yaml renamed successfully. +./baseline/aws/IAM/aws_valid_iam_identity_providers.yaml renamed successfully. +./baseline/aws/IAM/aws_access_keys_rotated_45_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_password_expiry_x_days.yaml renamed successfully. +./baseline/aws/IAM/aws_root_account_active_signing_certificates.yaml renamed successfully. +./baseline/aws/IAM/aws_check_that_only_safelisted_iam_users_exist.yaml renamed successfully. +./baseline/aws/IAM/aws_account_alternate_contacts.yaml renamed successfully. +./baseline/aws/IAM/aws_hardware_mfa_for_aws_root_account.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_role_policy_too_permissive.yaml renamed successfully. +./baseline/aws/IAM/aws_ssh_public_keys_rotated_x_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_policies_with_full_administrative_privileges.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_password_expiry_7_days.yaml renamed successfully. +./baseline/aws/IAM/aws_attach_policy_to_iam_roles_associated_with_app_tier_ec2_instances.yaml renamed successfully. +./baseline/aws/IAM/aws_ssh_public_keys_rotated_90_days.yaml renamed successfully. +./baseline/aws/IAM/aws_iam_user_no_policies.yaml renamed successfully. +./baseline/aws/eks/aws_enable_envelope_encryption_for_eks_kubernetes_secrets.yaml renamed successfully. +./baseline/aws/eks/aws_eks_cluster_endpoint_public_access.yaml renamed successfully. +./baseline/aws/eks/aws_enable_cloudtrail_logging_for_kubernetes_api_calls.yaml renamed successfully. +./baseline/aws/eks/aws_kubernetes_cluster_version.yaml renamed successfully. +./baseline/aws/eks/aws_use_aws_managed_policy_to_manage_networking_resources.yaml renamed successfully. +./baseline/aws/eks/aws_kubernetes_cluster_logging.yaml renamed successfully. +./baseline/aws/eks/aws_disable_remote_access_to_eks_cluster_node_groups.yaml renamed successfully. +./baseline/aws/eks/aws_eks_security_groups.yaml renamed successfully. +./baseline/aws/eks/aws_eks_cluster_node_group_iam_role_policies.yaml renamed successfully. +./baseline/aws/eks/aws_use_aws_managed_policy_to_access_amazon_ecr_repositories.yaml renamed successfully. +./baseline/aws/eks/aws_use_oidc_provider_for_authenticating_kubernetes_api_calls.yaml renamed successfully. +./baseline/aws/eks/aws_use_aws_managed_policy_to_manage_aws_resources.yaml renamed successfully. +./baseline/aws/vpc/aws_managed_nat_gateway_in_use.yaml renamed successfully. +./baseline/aws/vpc/aws_unrestricted_network_acl_outbound_traffic.yaml renamed successfully. +./baseline/aws/vpc/aws_vpc_endpoint_cross_account_access.yaml renamed successfully. +./baseline/aws/vpc/aws_unrestricted_network_acl_inbound_traffic.yaml renamed successfully. +./baseline/aws/vpc/aws_vpc_flow_logs_enabled.yaml renamed successfully. +./baseline/aws/vpc/aws_vpc_peering_connections_to_accounts_outside_aws_organization.yaml renamed successfully. +./baseline/aws/vpc/aws_unrestricted_inbound_traffic_on_remote_server_administration_ports.yaml renamed successfully. +./baseline/aws/vpc/aws_vpc_endpoints_in_use.yaml renamed successfully. +./baseline/aws/vpc/aws_vpc_endpoint_exposed.yaml renamed successfully. +./baseline/aws/backup/aws_dynamodb_instances_have_backup_withing_48_hours.yaml renamed successfully. +./baseline/aws/backup/aws_ec2_instances_have_backup_with_lifecyclepolicy_above_35_days.yaml renamed successfully. +./baseline/aws/backup/aws_check_for_protected_amazon_backup_resource_types.yaml renamed successfully. +./baseline/aws/backup/aws_efs_files_have_backup_with_lifecyclepolicy_above_35_days.yaml renamed successfully. +./baseline/aws/backup/aws_efs_files_have_backup_withing_48_hours.yaml renamed successfully. +./baseline/aws/backup/aws_use_kms_customer_master_keys_for_aws_backup.yaml renamed successfully. +./baseline/aws/backup/aws_enable_alert_notifications_for_failed_backup_jobs.yaml renamed successfully. +./baseline/aws/backup/aws_backup_service_lifecycle_configuration.yaml renamed successfully. +./baseline/aws/backup/aws_rds_database_instances_must_have_a_minimum_acceptable_restore_time.yaml renamed successfully. +./baseline/aws/backup/aws_configure_aws_backup_vault_access_policy.yaml renamed successfully. +./baseline/aws/backup/aws_ebs_instances_have_backup_with_lifecyclepolicy_above_35_days.yaml renamed successfully. +./baseline/aws/backup/aws_ec2_instances_have_backup_withing_48_hours.yaml renamed successfully. +./baseline/aws/backup/aws_dynamodb_instances_have_backup_with_lifecyclepolicy_above_35_days.yaml renamed successfully. +./baseline/aws/backup/aws_rds_database_instances_have_a_minimum_acceptable_backup_policy.yaml renamed successfully. +./baseline/aws/backup/aws_ebs_instances_have_backup_withing_rpo_period.yaml renamed successfully. +./baseline/aws/rds/aws_rds_default_port.yaml renamed successfully. +./baseline/aws/rds/aws_rds_instance_counts.yaml renamed successfully. +./baseline/aws/rds/aws_rds_public_snapshots.yaml renamed successfully. +./baseline/aws/rds/aws_instance_deletion_protection.yaml renamed successfully. +./baseline/aws/rds/aws_rds_desired_instance_type.yaml renamed successfully. +./baseline/aws/rds/aws_rds_encrypted_with_kms_customer_master_keys.yaml renamed successfully. +./baseline/aws/rds/aws_rotate_ssltls_certificates_for_database_instances.yaml renamed successfully. +./baseline/aws/rds/aws_rds_encryption_enabled.yaml renamed successfully. +./baseline/aws/rds/aws_aurora_database_cluster_activity_streams.yaml renamed successfully. +./baseline/aws/rds/aws_enable_rds_snapshot_encryption.yaml renamed successfully. +./baseline/aws/rds/aws_enable_aurora_cluster_copy_tags_to_snapshots.yaml renamed successfully. +./baseline/aws/rds/aws_db_instance_generation.yaml renamed successfully. +./baseline/aws/rds/aws_aurora_database_instance_accessibility.yaml renamed successfully. +./baseline/aws/rds/aws_log_exports.yaml renamed successfully. +./baseline/aws/rds/aws_instance_level_events_subscriptions.yaml renamed successfully. +./baseline/aws/rds/aws_rds_db_instance_no_public_subnet.yaml renamed successfully. +./baseline/aws/rds/aws_rds_multi_az.yaml renamed successfully. +./baseline/aws/rds/aws_security_groups_events_subscriptions.yaml renamed successfully. +./baseline/aws/rds/aws_backtrack.yaml renamed successfully. +./baseline/aws/rds/aws_enable_instance_storage_auto_scaling.yaml renamed successfully. +./baseline/aws/rds/aws_enable_serverless_log_exports.yaml renamed successfully. +./baseline/aws/rds/aws_rds_publicly_accessible.yaml renamed successfully. +./baseline/aws/rds/aws_cluster_deletion_protection.yaml renamed successfully. +./baseline/aws/rds/aws_performance_insights.yaml renamed successfully. +./baseline/aws/rds/aws_rds_automated_backups_enabled.yaml renamed successfully. +./baseline/aws/rds/aws_use_aws_backup_service_in_use_for_amazon_rds.yaml renamed successfully. +./baseline/aws/rds/aws_enable_aws_rds_transport_encryption.yaml renamed successfully. +./baseline/aws/rds/aws_rds_event_notifications.yaml renamed successfully. +./baseline/aws/efs/aws_kms_customer_master_keys_for_efs_encryption.yaml renamed successfully. +./baseline/aws/efs/aws_efs_encryption_enabled.yaml renamed successfully. +./baseline/aws/ec2/aws_unused_aws_ec2_key_pairs.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instance_in_vpc.yaml renamed successfully. +./baseline/aws/ec2/aws_default_security_group_unrestricted.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_ami_too_old.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_ssh_access.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_oracle_access.yaml renamed successfully. +./baseline/aws/ec2/aws_require_imdsv2_for_ec2_instances.yaml renamed successfully. +./baseline/aws/ec2/aws_disable_public_ip_address_assignment_for_ec2_instances.yaml renamed successfully. +./baseline/aws/ec2/aws_unused_elastic_network_interfaces.yaml renamed successfully. +./baseline/aws/ec2/aws_ami_encryption.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_desired_instance_type.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_mongodb_access.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_cifs_access.yaml renamed successfully. +./baseline/aws/ec2/aws_security_group_name_prefixed_with_launch_wizard.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_icmp_access.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_opensearch_access.yaml renamed successfully. +./baseline/aws/ec2/aws_security_group_port_range.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_netbios_access.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instance_not_in_public_subnet.yaml renamed successfully. +./baseline/aws/ec2/aws_unused_ami.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_mysql_access.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instances_with_multiple_elastic_network_interfaces.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_mssql_access.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_security_group_ingress_on_uncommon_ports.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instance_naming_conventions.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_rpc_access.yaml renamed successfully. +./baseline/aws/ec2/aws_default_security_groups_in_use.yaml renamed successfully. +./baseline/aws/ec2/aws_unrestricted_smtp_access.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instance_termination_protection.yaml renamed successfully. +./baseline/aws/ec2/aws_ec2_instance_too_old.yaml renamed successfully. +./baseline/aws/ec2/aws_unassociated_elastic_ip_addresses.yaml renamed successfully. +./baseline/aws/ec2/aws_publicly_shared_ami.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_1.yaml renamed successfully. +./aws/aws_cis_v140_3_9.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_8.yaml renamed successfully. +./aws/aws_cis_v200_2_1_2.yaml renamed successfully. +./aws/aws_ec2_instance_in_vpc.yaml renamed successfully. +./aws/aws_foundational_security_dynamodb_1.yaml renamed successfully. +./aws/aws_autoscaling_use_multiple_instance_types_in_multiple_az.yaml renamed successfully. +./aws/aws_cis_v130_3_11.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_2_1.yaml renamed successfully. +./aws/aws_cis_v300_1_7.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_8.yaml renamed successfully. +./aws/aws_ec2_network_interface_unused.yaml renamed successfully. +./aws/aws_foundational_security_s3_19.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_write_permission_on_critical_s3_configuration.yaml renamed successfully. +./aws/aws_opensearch_domain_audit_logging_enabled.yaml renamed successfully. +./aws/aws_redshift_cluster_no_default_admin_name.yaml renamed successfully. +./aws/aws_iam_account_password_policy_min_length_14.yaml renamed successfully. +./aws/aws_secretsmanager_secret_encrypted_with_kms_cmk.yaml renamed successfully. +./aws/aws_mandatory_sql_ebs_volume_mandatory.yaml renamed successfully. +./aws/aws_iam_user_console_access_mfa_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_10.yaml renamed successfully. +./aws/aws_cis_v200_5_5.yaml renamed successfully. +./aws/aws_es_domain_dedicated_master_nodes_min_3.yaml renamed successfully. +./aws/aws_cis_v150_3_3.yaml renamed successfully. +./aws/aws_iam_access_analyzer_enabled.yaml renamed successfully. +./aws/aws_cis_v200_1_12.yaml renamed successfully. +./aws/aws_account_part_of_organizations.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_redis_port.yaml renamed successfully. +./aws/aws_cis_v120_3_14.yaml renamed successfully. +./aws/aws_cis_v300_1_21.yaml renamed successfully. +./aws/aws_cis_v200_2_4_1.yaml renamed successfully. +./aws/aws_lambda_function_dead_letter_queue_configured.yaml renamed successfully. +./aws/aws_backup_vault_region_configured.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_cloud_log_tampering_access.yaml renamed successfully. +./aws/aws_iam_user_unused_credentials_45.yaml renamed successfully. +./aws/aws_cis_v200_1_2.yaml renamed successfully. +./aws/aws_foundational_security_ecs_4.yaml renamed successfully. +./aws/aws_cis_v200_2_3_3.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_policy_default_stateless_action_check_full_packets.yaml renamed successfully. +./aws/aws_iam_account_password_policy_strong_min_reuse_24.yaml renamed successfully. +./aws/aws_elb_application_lb_waf_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_11.yaml renamed successfully. +./aws/aws_cis_v130_1_16.yaml renamed successfully. +./aws/aws_foundational_security_docdb_1.yaml renamed successfully. +./aws/aws_kinesis_stream_server_side_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_v150_2_1_1.yaml renamed successfully. +./aws/aws_cis_v300_3_6.yaml renamed successfully. +./aws/aws_s3_bucket_lifecycle_policy_enabled.yaml renamed successfully. +./aws/aws_foundational_security_s3_6.yaml renamed successfully. +./aws/aws_lambda_function_cloudtrail_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_iam_21.yaml renamed successfully. +./aws/aws_ebs_volume_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cis_v120_1_13.yaml renamed successfully. +./aws/aws_foundational_security_redshift_2.yaml renamed successfully. +./aws/aws_cis_v150_1_2.yaml renamed successfully. +./aws/aws_mandatory_sql_accessanalyzer_analyzer_mandatory.yaml renamed successfully. +./aws/aws_vpc_security_group_allows_ingress_authorized_ports.yaml renamed successfully. +./aws/aws_athena_workgroup_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_iam_user_group_role_cloudshell_fullaccess_restricted.yaml renamed successfully. +./aws/aws_config_enabled_all_regions.yaml renamed successfully. +./aws/aws_iam_user_unused_credentials_90.yaml renamed successfully. +./aws/aws_foundational_security_redshift_10.yaml renamed successfully. +./aws/aws_mandatory_sql_ssm_parameter_mandatory.yaml renamed successfully. +./aws/aws_s3_bucket_default_encryption_enabled_kms.yaml renamed successfully. +./aws/aws_cis_v150_5_5.yaml renamed successfully. +./aws/aws_s3_bucket_event_notifications_enabled.yaml renamed successfully. +./aws/aws_cis_v200_3_3.yaml renamed successfully. +./aws/aws_ec2_instance_publicly_accessible_iam_profile_attached.yaml renamed successfully. +./aws/aws_foundational_security_rds_10.yaml renamed successfully. +./aws/aws_cloudfront_distribution_use_secure_cipher.yaml renamed successfully. +./aws/aws_cis_v150_1_18.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_1_4.yaml renamed successfully. +./aws/aws_cis_v130_3_2.yaml renamed successfully. +./aws/aws_foundational_security_elb_2.yaml renamed successfully. +./aws/aws_autoscaling_ec2_launch_configuration_no_sensitive_data.yaml renamed successfully. +./aws/aws_foundational_security_iam_2.yaml renamed successfully. +./aws/aws_cis_v140_3_5.yaml renamed successfully. +./aws/aws_cloudformation_stack_output_no_secrets.yaml renamed successfully. +./aws/aws_cis_v140_2_1_4.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_4.yaml renamed successfully. +./aws/aws_mandatory_sql_codecommit_repository_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_es_6.yaml renamed successfully. +./aws/aws_ec2_instance_uses_imdsv2.yaml renamed successfully. +./aws/aws_mandatory_sql_eventbridge_rule_mandatory.yaml renamed successfully. +./aws/aws_mandatory_sql_cloudfront_distribution_mandatory.yaml renamed successfully. +./aws/aws_cis_v130_1_20.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_new_group_creation_with_attached_policy_access.yaml renamed successfully. +./aws/aws_foundational_security_neptune_3.yaml renamed successfully. +./aws/aws_cis_v300_4_14.yaml renamed successfully. +./aws/aws_opensearch_domain_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_8.yaml renamed successfully. +./aws/aws_cloudtrail_trail_logs_encrypted_with_kms_cmk.yaml renamed successfully. +./aws/aws_elb_application_lb_redirect_http_request_to_https.yaml renamed successfully. +./aws/aws_cis_v300_2_1_3.yaml renamed successfully. +./aws/aws_mandatory_sql_redshift_cluster_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_ecs_8.yaml renamed successfully. +./aws/aws_foundational_security_codebuild_1.yaml renamed successfully. +./aws/aws_foundational_security_sns_2.yaml renamed successfully. +./aws/aws_ec2_classic_lb_connection_draining_enabled.yaml renamed successfully. +./aws/aws_vpc_in_more_than_one_region.yaml renamed successfully. +./aws/aws_cloudtrail_trail_integrated_with_logs.yaml renamed successfully. +./aws/aws_sagemaker_endpoint_configuration_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cloudfront_distribution_custom_origins_encryption_in_transit_enabled.yaml renamed successfully. +./aws/aws_foundational_security_elasticbeanstalk_1.yaml renamed successfully. +./aws/aws_cis_v140_1_4.yaml renamed successfully. +./aws/aws_docdb_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_redshift_cluster_maintenance_settings_check.yaml renamed successfully. +./aws/aws_mandatory_sql_eks_cluster_mandatory.yaml renamed successfully. +./aws/aws_opensearch_domain_updated_with_latest_service_software_version.yaml renamed successfully. +./aws/aws_rds_db_instance_postgres_not_exposed_to_local_file_read_vulnerability.yaml renamed successfully. +./aws/aws_es_domain_error_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_3.yaml renamed successfully. +./aws/aws_mandatory_sql_kinesis_firehose_delivery_stream_mandatory.yaml renamed successfully. +./aws/aws_cis_v130_1_3.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_5_2.yaml renamed successfully. +./aws/aws_gatewayv2_stage_access_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v140_1_11.yaml renamed successfully. +./aws/aws_elasticache_cluster_auto_minor_version_upgrade_enabled.yaml renamed successfully. +./aws/aws_s3_bucket_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_6.yaml renamed successfully. +./aws/aws_cis_v130_5_4.yaml renamed successfully. +./aws/aws_iam_policy_no_full_access_to_cloudtrail.yaml renamed successfully. +./aws/aws_backup_plan_region_configured.yaml renamed successfully. +./aws/aws_cis_v140_2_2_1.yaml renamed successfully. +./aws/aws_cis_v300_2_3_2.yaml renamed successfully. +./aws/aws_rds_db_cluster_multiple_az_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_6.yaml renamed successfully. +./aws/aws_cis_v300_1_17.yaml renamed successfully. +./aws/aws_glue_job_bookmarks_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_v140_4_7.yaml renamed successfully. +./aws/aws_cis_v150_1_14.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_data_destruction_access.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_network_acl_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_waf_1.yaml renamed successfully. +./aws/aws_iam_policy_no_star_star.yaml renamed successfully. +./aws/aws_cloudfront_distribution_sni_enabled.yaml renamed successfully. +./aws/aws_vpc_subnet_auto_assign_public_ip_disabled.yaml renamed successfully. +./aws/aws_codebuild_project_environment_privileged_mode_disabled.yaml renamed successfully. +./aws/aws_lambda_function_restrict_public_access.yaml renamed successfully. +./aws/aws_foundational_security_ecs_12.yaml renamed successfully. +./aws/aws_cis_v150_1_15.yaml renamed successfully. +./aws/aws_cloudfront_distribution_logging_enabled.yaml renamed successfully. +./aws/aws_mandatory_sql_codebuild_project_mandatory.yaml renamed successfully. +./aws/aws_vpc_security_group_allows_ingress_to_cassandra_ports.yaml renamed successfully. +./aws/aws_efs_access_point_enforce_root_directory.yaml renamed successfully. +./aws/aws_cis_v300_1_16.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_7.yaml renamed successfully. +./aws/aws_log_metric_filter_iam_policy.yaml renamed successfully. +./aws/aws_ecr_repository_prohibit_public_access.yaml renamed successfully. +./aws/aws_foundational_security_acm_1.yaml renamed successfully. +./aws/aws_log_metric_filter_route_table.yaml renamed successfully. +./aws/aws_cis_v120_1_8.yaml renamed successfully. +./aws/aws_cis_v300_2_3_3.yaml renamed successfully. +./aws/aws_mandatory_sql_kms_key_mandatory.yaml renamed successfully. +./aws/aws_redshift_cluster_enhanced_vpc_routing_enabled.yaml renamed successfully. +./aws/aws_s3_bucket_restrict_public_read_access.yaml renamed successfully. +./aws/aws_ecs_cluster_no_registered_container_instance.yaml renamed successfully. +./aws/aws_foundational_security_kms_3.yaml renamed successfully. +./aws/aws_elb_application_classic_network_lb_prohibit_public_access.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_7.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_passrole_and_lambda_invoke_function_access.yaml renamed successfully. +./aws/aws_sns_topic_policy_prohibit_subscription_access.yaml renamed successfully. +./aws/aws_emr_cluster_kerberos_enabled.yaml renamed successfully. +./aws/aws_cis_v140_5_2.yaml renamed successfully. +./aws/aws_cis_v140_1_10.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_2.yaml renamed successfully. +./aws/aws_cloudformation_stack_termination_protection_enabled.yaml renamed successfully. +./aws/aws_dms_endpoint_ssl_configured.yaml renamed successfully. +./aws/aws_s3_bucket_restrict_public_write_access.yaml renamed successfully. +./aws/aws_elasticache_replication_group_encryption_in_transit_enabled.yaml renamed successfully. +./aws/aws_cis_v130_1_2.yaml renamed successfully. +./aws/aws_log_metric_filter_root_login.yaml renamed successfully. +./aws/aws_foundational_security_ec2_7.yaml renamed successfully. +./aws/aws_mandatory_sql_cloudwatch_alarm_mandatory.yaml renamed successfully. +./aws/aws_elasticache_cluster_no_default_subnet_group.yaml renamed successfully. +./aws/aws_rds_db_cluster_iam_authentication_enabled.yaml renamed successfully. +./aws/aws_elb_application_gateway_network_lb_multiple_az_configured.yaml renamed successfully. +./aws/aws_cis_v140_1_5.yaml renamed successfully. +./aws/aws_foundational_security_secretsmanager_4.yaml renamed successfully. +./aws/aws_ec2_instance_not_use_multiple_enis.yaml renamed successfully. +./aws/aws_cis_v150_4_16.yaml renamed successfully. +./aws/aws_ec2_instance_attached_ebs_volume_delete_on_termination_enabled.yaml renamed successfully. +./aws/aws_elb_network_lb_tls_listener_security_policy_configured.yaml renamed successfully. +./aws/aws_neptune_db_cluster_automated_backup_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ecs_9.yaml renamed successfully. +./aws/aws_foundational_security_rds_9.yaml renamed successfully. +./aws/aws_dynamodb_table_encrypted_with_kms.yaml renamed successfully. +./aws/aws_api_gateway_method_request_parameter_validated.yaml renamed successfully. +./aws/aws_ec2_instance_not_older_than_180_days.yaml renamed successfully. +./aws/aws_wafv2_web_acl_rule_attached.yaml renamed successfully. +./aws/aws_mandatory_sql_wafv2_ip_set_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_rds_27.yaml renamed successfully. +./aws/aws_foundational_security_elb_12.yaml renamed successfully. +./aws/aws_cis_v300_2_1_2.yaml renamed successfully. +./aws/aws_foundational_security_ec2_51.yaml renamed successfully. +./aws/aws_directory_service_certificate_expires_90_days.yaml renamed successfully. +./aws/aws_vpc_network_acl_unused.yaml renamed successfully. +./aws/aws_cis_v130_1_21.yaml renamed successfully. +./aws/aws_sagemaker_notebook_instance_in_vpc.yaml renamed successfully. +./aws/aws_cis_v300_2_4_1.yaml renamed successfully. +./aws/aws_foundational_security_neptune_2.yaml renamed successfully. +./aws/aws_foundational_security_fsx_1.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_5.yaml renamed successfully. +./aws/aws_elb_classic_lb_cross_zone_load_balancing_enabled.yaml renamed successfully. +./aws/aws_foundational_security_es_7.yaml renamed successfully. +./aws/aws_opensearch_domain_node_to_node_encryption_enabled.yaml renamed successfully. +./aws/aws_redshift_cluster_encryption_in_transit_enabled.yaml renamed successfully. +./aws/aws_apigateway_stage_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_iam_3.yaml renamed successfully. +./aws/aws_cis_v140_3_4.yaml renamed successfully. +./aws/aws_ecs_service_load_balancer_attached.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_5.yaml renamed successfully. +./aws/aws_cis_v130_3_3.yaml renamed successfully. +./aws/aws_neptune_db_cluster_snapshot_prohibit_public_access.yaml renamed successfully. +./aws/aws_foundational_security_dms_1.yaml renamed successfully. +./aws/aws_rds_db_instance_backup_retention_period_less_than_7.yaml renamed successfully. +./aws/aws_foundational_security_eks_8.yaml renamed successfully. +./aws/aws_sns_topic_policy_prohibit_public_access.yaml renamed successfully. +./aws/aws_iam_user_in_group.yaml renamed successfully. +./aws/aws_cis_v150_1_19.yaml renamed successfully. +./aws/aws_rds_db_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_rds_db_cluster_aurora_postgres_not_exposed_to_local_file_read_vulnerability.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_10_1.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_1_5.yaml renamed successfully. +./aws/aws_cloudfront_distribution_use_custom_ssl_certificate.yaml renamed successfully. +./aws/aws_cis_v150_5_4.yaml renamed successfully. +./aws/aws_cis_v200_3_2.yaml renamed successfully. +./aws/aws_iam_policy_unused.yaml renamed successfully. +./aws/aws_foundational_security_rds_11.yaml renamed successfully. +./aws/aws_vpc_gateway_endpoint_restrict_public_access.yaml renamed successfully. +./aws/aws_neptune_db_cluster_copy_tags_to_snapshot_enabled.yaml renamed successfully. +./aws/aws_acm_certificate_no_wildcard_domain_name.yaml renamed successfully. +./aws/aws_cis_v120_1_4.yaml renamed successfully. +./aws/aws_foundational_security_ssm_4.yaml renamed successfully. +./aws/aws_elb_application_classic_lb_logging_enabled.yaml renamed successfully. +./aws/aws_ecr_repository_image_scan_on_push_enabled.yaml renamed successfully. +./aws/aws_cis_v120_1_12.yaml renamed successfully. +./aws/aws_foundational_security_redshift_3.yaml renamed successfully. +./aws/aws_cis_v150_1_3.yaml renamed successfully. +./aws/aws_glacier_vault_restrict_public_access.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_classic_load_balancer_mandatory.yaml renamed successfully. +./aws/aws_ec2_instance_no_amazon_key_pair.yaml renamed successfully. +./aws/aws_efs_file_system_enforces_ssl.yaml renamed successfully. +./aws/aws_codebuild_project_source_repo_oauth_configured.yaml renamed successfully. +./aws/aws_ecs_task_definition_logging_enabled.yaml renamed successfully. +./aws/aws_eks_cluster_with_latest_kubernetes_version.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_6.yaml renamed successfully. +./aws/aws_ec2_stopped_instance_30_days.yaml renamed successfully. +./aws/aws_kms_cmk_rotation_enabled.yaml renamed successfully. +./aws/aws_ec2_ami_restrict_public_access.yaml renamed successfully. +./aws/aws_mandatory_sql_inspector_assessment_template_mandatory.yaml renamed successfully. +./aws/aws_fsx_file_system_copy_tags_to_backup_and_volume_enabled.yaml renamed successfully. +./aws/aws_cloudfront_distribution_default_root_object_configured.yaml renamed successfully. +./aws/aws_sns_topic_policy_prohibit_publishing_access.yaml renamed successfully. +./aws/aws_organizational_tag_policies_enabled.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_rdp_all.yaml renamed successfully. +./aws/aws_mandatory_sql_wafv2_web_acl_mandatory.yaml renamed successfully. +./aws/aws_cis_v200_2_3_2.yaml renamed successfully. +./aws/aws_cloudwatch_log_group_retention_period_365.yaml renamed successfully. +./aws/aws_es_domain_audit_logging_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_10.yaml renamed successfully. +./aws/aws_cis_v130_1_17.yaml renamed successfully. +./aws/aws_kms_key_not_pending_deletion.yaml renamed successfully. +./aws/aws_elb_classic_lb_with_inbound_rule.yaml renamed successfully. +./aws/aws_cis_v200_1_3.yaml renamed successfully. +./aws/aws_foundational_security_ecs_5.yaml renamed successfully. +./aws/aws_cis_v200_1_13.yaml renamed successfully. +./aws/aws_acm_certificate_no_failed_certificate.yaml renamed successfully. +./aws/aws_vpc_security_group_allows_ingress_to_memcached_port.yaml renamed successfully. +./aws/aws_cis_v300_1_20.yaml renamed successfully. +./aws/aws_foundational_security_account_1.yaml renamed successfully. +./aws/aws_elb_listener_use_secure_ssl_cipher.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_11.yaml renamed successfully. +./aws/aws_cis_v200_5_4.yaml renamed successfully. +./aws/aws_foundational_security_sfn_1.yaml renamed successfully. +./aws/aws_dms_replication_instance_not_publicly_accessible.yaml renamed successfully. +./aws/aws_s3_bucket_policy_restricts_cross_account_permission_changes.yaml renamed successfully. +./aws/aws_cis_v150_3_2.yaml renamed successfully. +./aws/aws_elb_application_network_lb_use_listeners.yaml renamed successfully. +./aws/aws_route53_domain_privacy_protection_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_5.yaml renamed successfully. +./aws/aws_log_metric_filter_disable_or_delete_cmk.yaml renamed successfully. +./aws/aws_cis_v120_3_5.yaml renamed successfully. +./aws/aws_foundational_security_ecr_1.yaml renamed successfully. +./aws/aws_cis_v300_1_6.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_9.yaml renamed successfully. +./aws/aws_secretsmanager_secret_unused_90_day.yaml renamed successfully. +./aws/aws_cis_v150_2_3_1.yaml renamed successfully. +./aws/aws_api_gatewayv2_route_authorization_type_configured.yaml renamed successfully. +./aws/aws_networkfirewall_stateless_rule_group_not_empty.yaml renamed successfully. +./aws/aws_cis_v130_3_10.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_parameter_group_mandatory.yaml renamed successfully. +./aws/aws_cis_v200_2_1_3.yaml renamed successfully. +./aws/aws_docdb_cluster_instance_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_kms_key_decryption_restricted_in_iam_inline_policy.yaml renamed successfully. +./aws/aws_foundational_security_waf_10.yaml renamed successfully. +./aws/aws_rds_db_instance_events_subscription.yaml renamed successfully. +./aws/aws_cis_v140_3_8.yaml renamed successfully. +./aws/aws_cis_v140_3_10.yaml renamed successfully. +./aws/aws_cis_v130_3_4.yaml renamed successfully. +./aws/aws_autoscaling_launch_config_hop_limit.yaml renamed successfully. +./aws/aws_cloudfront_distribution_waf_enabled.yaml renamed successfully. +./aws/aws_lambda_function_use_latest_runtime.yaml renamed successfully. +./aws/aws_foundational_security_dms_6.yaml renamed successfully. +./aws/aws_appstream_fleet_idle_disconnect_timeout_600_seconds.yaml renamed successfully. +./aws/aws_cis_v130_2_1_1.yaml renamed successfully. +./aws/aws_foundational_security_ec2_17.yaml renamed successfully. +./aws/aws_foundational_security_elb_4.yaml renamed successfully. +./aws/aws_sns_topic_encrypted_at_rest.yaml renamed successfully. +./aws/aws_cloudtrail_trail_enabled.yaml renamed successfully. +./aws/aws_cis_v140_2_1_2.yaml renamed successfully. +./aws/aws_cis_v140_3_3.yaml renamed successfully. +./aws/aws_foundational_security_iam_4.yaml renamed successfully. +./aws/aws_cloudformation_stack_notifications_enabled.yaml renamed successfully. +./aws/aws_foundational_security_s3_13.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_2.yaml renamed successfully. +./aws/aws_foundational_security_config_1.yaml renamed successfully. +./aws/aws_mandatory_sql_elastic_beanstalk_application_mandatory.yaml renamed successfully. +./aws/aws_s3_bucket_enforces_ssl.yaml renamed successfully. +./aws/aws_cis_v140_4_14.yaml renamed successfully. +./aws/aws_rds_db_instance_multiple_az_enabled.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_management_level_access.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_kibana_port.yaml renamed successfully. +./aws/aws_dax_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_foundational_security_sagemaker_3.yaml renamed successfully. +./aws/aws_rds_db_instance_in_vpc.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_privilege_escalation_risk_access.yaml renamed successfully. +./aws/aws_foundational_security_neptune_5.yaml renamed successfully. +./aws/aws_foundational_security_emr_2.yaml renamed successfully. +./aws/aws_cis_v300_4_12.yaml renamed successfully. +./aws/aws_cis_v150_3_9.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_6_1.yaml renamed successfully. +./aws/aws_foundational_security_rds_20.yaml renamed successfully. +./aws/aws_emr_account_public_access_blocked.yaml renamed successfully. +./aws/aws_s3_bucket_protected_by_macie.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_6.yaml renamed successfully. +./aws/aws_rds_db_security_group_events_subscription.yaml renamed successfully. +./aws/aws_cis_v200_1_8.yaml renamed successfully. +./aws/aws_cis_v200_1_18.yaml renamed successfully. +./aws/aws_foundational_security_secretsmanager_3.yaml renamed successfully. +./aws/aws_cis_v140_1_2.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_5.yaml renamed successfully. +./aws/aws_acm_certificate_transparency_logging_enabled.yaml renamed successfully. +./aws/aws_es_domain_internal_user_database_enabled.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_1.yaml renamed successfully. +./aws/aws_ecr_repository_lifecycle_policy_configured.yaml renamed successfully. +./aws/aws_cis_v130_1_5.yaml renamed successfully. +./aws/aws_foundational_security_cloudformation_1.yaml renamed successfully. +./aws/aws_efs_file_system_encrypted_with_cmk.yaml renamed successfully. +./aws/aws_eks_cluster_control_plane_audit_logging_enabled.yaml renamed successfully. +./aws/aws_route53_domain_expires_30_days.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_ssh_all.yaml renamed successfully. +./aws/aws_cis_v140_1_17.yaml renamed successfully. +./aws/aws_cis_v130_5_2.yaml renamed successfully. +./aws/aws_redshift_cluster_kms_enabled.yaml renamed successfully. +./aws/aws_iam_users_with_console_access_are_requried_to_have_MFA.yaml renamed successfully. +./aws/aws_cis_v120_1_19.yaml renamed successfully. +./aws/aws_foundational_security_redshift_8.yaml renamed successfully. +./aws/aws_cis_v150_1_8.yaml renamed successfully. +./aws/aws_cis_v300_1_11.yaml renamed successfully. +./aws/aws_rds_db_cluster_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_ssm_managed_instance_compliance_association_compliant.yaml renamed successfully. +./aws/aws_cloudtrail_security_trail_enabled.yaml renamed successfully. +./aws/aws_cis_v150_1_12.yaml renamed successfully. +./aws/aws_rds_db_instance_backup_enabled.yaml renamed successfully. +./aws/aws_foundational_security_waf_7.yaml renamed successfully. +./aws/aws_iam_user_with_administrator_access_mfa_enabled.yaml renamed successfully. +./aws/aws_iam_managed_policy_attached_to_role.yaml renamed successfully. +./aws/aws_securityhub_enabled.yaml renamed successfully. +./aws/aws_cloudtrail_s3_data_events_enabled.yaml renamed successfully. +./aws/aws_log_metric_filter_network_acl.yaml renamed successfully. +./aws/aws_cis_v200_3_9.yaml renamed successfully. +./aws/aws_kinesis_firehose_delivery_stream_server_side_encryption_enabled.yaml renamed successfully. +./aws/aws_ec2_transit_gateway_auto_cross_account_attachment_disabled.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_7.yaml renamed successfully. +./aws/aws_cloudtrail_multi_region_read_write_enabled.yaml renamed successfully. +./aws/aws_cis_v120_2_6.yaml renamed successfully. +./aws/aws_log_metric_filter_unauthorized_api.yaml renamed successfully. +./aws/aws_foundational_security_iam_8.yaml renamed successfully. +./aws/aws_mandatory_sql_route53_domain_mandatory.yaml renamed successfully. +./aws/aws_rds_db_instance_ca_certificate_expires_7_days.yaml renamed successfully. +./aws/aws_vpc_configured_to_use_vpc_endpoints.yaml renamed successfully. +./aws/aws_s3_bucket_mfa_delete_enabled.yaml renamed successfully. +./aws/aws_cis_v130_4_13.yaml renamed successfully. +./aws/aws_cis_v300_5_6.yaml renamed successfully. +./aws/aws_cis_v130_3_8.yaml renamed successfully. +./aws/aws_cis_v140_1_21.yaml renamed successfully. +./aws/aws_autoscaling_group_multiple_az_configured.yaml renamed successfully. +./aws/aws_cis_v200_2_1_4.yaml renamed successfully. +./aws/aws_rds_db_instance_cloudwatch_logs_enabled.yaml renamed successfully. +./aws/aws_rds_db_cluster_aurora_mysql_audit_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v300_1_1.yaml renamed successfully. +./aws/aws_foundational_security_rds_2.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_vpn_connection_mandatory.yaml renamed successfully. +./aws/aws_kinesis_stream_encrypted_with_kms_cmk.yaml renamed successfully. +./aws/aws_cloudfront_distribution_origin_access_identity_enabled.yaml renamed successfully. +./aws/aws_guardduty_enabled.yaml renamed successfully. +./aws/aws_cis_v150_3_5.yaml renamed successfully. +./aws/aws_eks_cluster_endpoint_restrict_public_access.yaml renamed successfully. +./aws/aws_cis_v200_5_3.yaml renamed successfully. +./aws/aws_vpc_security_group_restricted_common_ports.yaml renamed successfully. +./aws/aws_cis_v200_1_14.yaml renamed successfully. +./aws/aws_cis_v120_3_12.yaml renamed successfully. +./aws/aws_foundational_security_ecs_2.yaml renamed successfully. +./aws/aws_cis_v200_1_4.yaml renamed successfully. +./aws/aws_sagemaker_model_in_vpc.yaml renamed successfully. +./aws/aws_iam_support_role.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_9.yaml renamed successfully. +./aws/aws_cis_v130_1_10.yaml renamed successfully. +./aws/aws_foundational_security_route53_2.yaml renamed successfully. +./aws/aws_ebs_snapshot_encryption_enabled.yaml renamed successfully. +./aws/aws_iam_policy_no_full_access_to_kms.yaml renamed successfully. +./aws/aws_ec2_launch_template_not_publicly_accessible.yaml renamed successfully. +./aws/aws_foundational_security_cloudtrail_1.yaml renamed successfully. +./aws/aws_sagemaker_training_job_in_vpc.yaml renamed successfully. +./aws/aws_appstream_fleet_max_user_duration_36000_seconds.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_cis_v150_4_7.yaml renamed successfully. +./aws/aws_dms_replication_instance_automatic_minor_version_upgrade_enabled.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_common_ports_all.yaml renamed successfully. +./aws/aws_efs_file_system_restrict_public_access.yaml renamed successfully. +./aws/aws_emr_cluster_local_disk_encrypted_with_cmk.yaml renamed successfully. +./aws/aws_elastic_beanstalk_environment_logs_to_cloudwatch.yaml renamed successfully. +./aws/aws_cis_v150_1_4.yaml renamed successfully. +./aws/aws_dynamodb_table_point_in_time_recovery_enabled.yaml renamed successfully. +./aws/aws_cis_v120_1_15.yaml renamed successfully. +./aws/aws_foundational_security_redshift_4.yaml renamed successfully. +./aws/aws_cis_v200_2_2_1.yaml renamed successfully. +./aws/aws_s3_bucket_acls_should_prohibit_user_access.yaml renamed successfully. +./aws/aws_ebs_volume_unused.yaml renamed successfully. +./aws/aws_foundational_security_ssm_3.yaml renamed successfully. +./aws/aws_es_domain_node_to_node_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_v120_1_3.yaml renamed successfully. +./aws/aws_foundational_security_efs_1.yaml renamed successfully. +./aws/aws_cis_v200_3_5.yaml renamed successfully. +./aws/aws_cis_v150_5_3.yaml renamed successfully. +./aws/aws_ebs_attached_volume_encryption_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_16.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_1_2.yaml renamed successfully. +./aws/aws_ec2_stopped_instance_90_days.yaml renamed successfully. +./aws/aws_lambda_function_encryption_enabled.yaml renamed successfully. +./aws/aws_sqs_queue_encrypted_at_rest.yaml renamed successfully. +./aws/aws_iam_user_access_keys_and_password_at_setup.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_1_3.yaml renamed successfully. +./aws/aws_rds_db_cluster_events_subscription.yaml renamed successfully. +./aws/aws_cis_v200_3_4.yaml renamed successfully. +./aws/aws_cis_v150_5_2.yaml renamed successfully. +./aws/aws_foundational_security_rds_17.yaml renamed successfully. +./aws/aws_s3_bucket_versioning_and_lifecycle_policy_enabled.yaml renamed successfully. +./aws/aws_log_metric_filter_cloudtrail_configuration.yaml renamed successfully. +./aws/aws_foundational_security_ssm_2.yaml renamed successfully. +./aws/aws_cis_v120_1_2.yaml renamed successfully. +./aws/aws_ebs_volume_in_backup_plan.yaml renamed successfully. +./aws/aws_api_gateway_rest_api_public_endpoint_with_authorizer.yaml renamed successfully. +./aws/aws_cis_v150_1_5.yaml renamed successfully. +./aws/aws_fsx_file_system_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_directory_service_directory_sns_notifications_enabled.yaml renamed successfully. +./aws/aws_iam_root_last_used.yaml renamed successfully. +./aws/aws_codebuild_project_artifact_encryption_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ec2_20.yaml renamed successfully. +./aws/aws_foundational_security_s3_1.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_12.yaml renamed successfully. +./aws/aws_cis_v120_4_1.yaml renamed successfully. +./aws/aws_sfn_state_machine_logging_enabled.yaml renamed successfully. +./aws/aws_s3_bucket_policy_restrict_public_access.yaml renamed successfully. +./aws/aws_route53_domain_auto_renew_enabled.yaml renamed successfully. +./aws/aws_es_domain_in_vpc.yaml renamed successfully. +./aws/aws_cis_v130_1_11.yaml renamed successfully. +./aws/aws_cis_v130_1_8.yaml renamed successfully. +./aws/aws_rds_db_cluster_automatic_minor_version_upgrade_enabled.yaml renamed successfully. +./aws/aws_vpc_security_group_allows_ingress_to_oracle_ports.yaml renamed successfully. +./aws/aws_drs_job_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ecs_3.yaml renamed successfully. +./aws/aws_cis_v200_1_5.yaml renamed successfully. +./aws/aws_cis_v200_1_15.yaml renamed successfully. +./aws/aws_cloudtrail_s3_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v120_3_13.yaml renamed successfully. +./aws/aws_mandatory_sql_wafv2_rule_group_mandatory.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_policy_default_stateless_action_check_fragmented_packets.yaml renamed successfully. +./aws/aws_cis_v150_3_4.yaml renamed successfully. +./aws/aws_elasticache_redis_cluster_automatic_backup_retention_15_days.yaml renamed successfully. +./aws/aws_cis_v200_5_2.yaml renamed successfully. +./aws/aws_foundational_security_rds_3.yaml renamed successfully. +./aws/aws_es_domain_logs_to_cloudwatch.yaml renamed successfully. +./aws/aws_rds_db_instance_connections_encryption_enabled.yaml renamed successfully. +./aws/aws_apigateway_rest_api_stage_use_ssl_certificate.yaml renamed successfully. +./aws/aws_docdb_cluster_instance_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_neptune_8.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_12.yaml renamed successfully. +./aws/aws_cis_v200_4_6.yaml renamed successfully. +./aws/aws_cis_v140_1_20.yaml renamed successfully. +./aws/aws_foundational_security_elb_9.yaml renamed successfully. +./aws/aws_foundational_security_dynamodb_6.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_6.yaml renamed successfully. +./aws/aws_cis_v120_2_7.yaml renamed successfully. +./aws/aws_mandatory_sql_efs_file_system_mandatory.yaml renamed successfully. +./aws/aws_eks_cluster_no_multiple_security_groups.yaml renamed successfully. +./aws/aws_vpc_security_group_remote_administration.yaml renamed successfully. +./aws/aws_codebuild_project_plaintext_env_variables_no_sensitive_aws_values.yaml renamed successfully. +./aws/aws_cis_v200_3_8.yaml renamed successfully. +./aws/aws_ec2_client_vpn_endpoint_client_connection_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_eks_2.yaml renamed successfully. +./aws/aws_cis_v150_1_13.yaml renamed successfully. +./aws/aws_log_metric_filter_network_gateway.yaml renamed successfully. +./aws/aws_foundational_security_waf_6.yaml renamed successfully. +./aws/aws_dynamodb_table_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_cis_v120_1_18.yaml renamed successfully. +./aws/aws_foundational_security_redshift_9.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v150_1_9.yaml renamed successfully. +./aws/aws_cis_v300_1_10.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_1.yaml renamed successfully. +./aws/aws_iam_server_certificate_not_expired.yaml renamed successfully. +./aws/aws_iam_user_console_access_unused_45.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_destruction_kms_access.yaml renamed successfully. +./aws/aws_mandatory_sql_sagemaker_model_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_1.yaml renamed successfully. +./aws/aws_rds_db_cluster_aurora_backtracking_enabled.yaml renamed successfully. +./aws/aws_apigateway_rest_api_authorizers_configured.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_security_group_mandatory.yaml renamed successfully. +./aws/aws_mandatory_sql_lambda_function_mandatory.yaml renamed successfully. +./aws/aws_cis_v140_1_16.yaml renamed successfully. +./aws/aws_cis_v140_5_4.yaml renamed successfully. +./aws/aws_autoscaling_group_propagate_tags_to_ec2_instance_enabled.yaml renamed successfully. +./aws/aws_sagemaker_notebook_instance_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_appstream_fleet_default_internet_access_disabled.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_4.yaml renamed successfully. +./aws/aws_cis_v130_1_4.yaml renamed successfully. +./aws/aws_rds_db_instance_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_rds_db_instance_in_backup_plan.yaml renamed successfully. +./aws/aws_ebs_snapshot_not_publicly_restorable.yaml renamed successfully. +./aws/aws_elb_classic_lb_no_registered_instance.yaml renamed successfully. +./aws/aws_sagemaker_training_job_inter_container_traffic_encryption_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ec2_1.yaml renamed successfully. +./aws/aws_iam_user_no_inline_attached_policies.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_10.yaml renamed successfully. +./aws/aws_elb_application_lb_desync_mitigation_mode.yaml renamed successfully. +./aws/aws_cis_v140_1_3.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_destruction_rds_access.yaml renamed successfully. +./aws/aws_cis_v300_2_2_1.yaml renamed successfully. +./aws/aws_foundational_security_secretsmanager_2.yaml renamed successfully. +./aws/aws_cis_v200_1_19.yaml renamed successfully. +./aws/aws_cis_v120_1_22.yaml renamed successfully. +./aws/aws_opensearch_domain_in_vpc.yaml renamed successfully. +./aws/aws_cis_v150_4_10.yaml renamed successfully. +./aws/aws_s3_bucket_not_accessible_to_all_authenticated_user.yaml renamed successfully. +./aws/aws_mandatory_sql_cloudtrail_trail_mandatory.yaml renamed successfully. +./aws/aws_opensearch_domain_data_node_fault_tolerance.yaml renamed successfully. +./aws/aws_foundational_security_rds_21.yaml renamed successfully. +./aws/aws_eks_cluster_secrets_encrypted.yaml renamed successfully. +./aws/aws_foundational_security_elb_14.yaml renamed successfully. +./aws/aws_vpc_security_group_remote_administration_ipv4.yaml renamed successfully. +./aws/aws_msk_cluster_encryption_in_transit_with_tls_enabled.yaml renamed successfully. +./aws/aws_mandatory_sql_eks_addon_mandatory.yaml renamed successfully. +./aws/aws_mandatory_sql_elastic_beanstalk_environment_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_kinesis_1.yaml renamed successfully. +./aws/aws_s3_bucket_cross_region_replication_enabled.yaml renamed successfully. +./aws/aws_redshift_cluster_encryption_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_lambda_1.yaml renamed successfully. +./aws/aws_cis_v150_3_8.yaml renamed successfully. +./aws/aws_cloudformation_stack_drift_detection_check.yaml renamed successfully. +./aws/aws_appsync_graphql_api_field_level_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_sagemaker_2.yaml renamed successfully. +./aws/aws_mandatory_sql_iam_server_certificate_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_neptune_4.yaml renamed successfully. +./aws/aws_ecs_task_definition_no_host_pid_mode.yaml renamed successfully. +./aws/aws_dynamodb_table_encryption_enabled.yaml renamed successfully. +./aws/aws_vpc_flow_logs_enabled.yaml renamed successfully. +./aws/aws_eventbridge_custom_bus_resource_based_policy_attached.yaml renamed successfully. +./aws/aws_elasticache_cluster_no_public_subnet.yaml renamed successfully. +./aws/aws_iam_role_no_administrator_access_policy_attached.yaml renamed successfully. +./aws/aws_foundational_security_s3_12.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_3.yaml renamed successfully. +./aws/aws_rds_db_instance_prohibit_public_access.yaml renamed successfully. +./aws/aws_docdb_cluster_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_foundational_security_es_1.yaml renamed successfully. +./aws/aws_apigateway_stage_cache_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cis_v140_2_1_3.yaml renamed successfully. +./aws/aws_cis_v140_3_2.yaml renamed successfully. +./aws/aws_foundational_security_iam_5.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_3.yaml renamed successfully. +./aws/aws_cis_v140_3_11.yaml renamed successfully. +./aws/aws_cis_v130_3_5.yaml renamed successfully. +./aws/aws_rds_db_cluster_copy_tags_to_snapshot_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ec2_16.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_instance_mandatory.yaml renamed successfully. +./aws/aws_cloudfront_distribution_configured_with_origin_failover.yaml renamed successfully. +./aws/aws_foundational_security_rds_18.yaml renamed successfully. +./aws/aws_sagemaker_training_job_network_isolation_enabled.yaml renamed successfully. +./aws/aws_cis_v150_1_10.yaml renamed successfully. +./aws/aws_foundational_security_eks_1.yaml renamed successfully. +./aws/aws_cis_v200_1_20.yaml renamed successfully. +./aws/aws_ecr_repository_tag_immutability_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_2.yaml renamed successfully. +./aws/aws_rds_db_parameter_group_events_subscription.yaml renamed successfully. +./aws/aws_cloudtrail_bucket_not_public.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_2.yaml renamed successfully. +./aws/aws_iam_role_unused_60.yaml renamed successfully. +./aws/aws_cis_v140_1_15.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_security_group_write_access.yaml renamed successfully. +./aws/aws_rds_db_instance_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_3.yaml renamed successfully. +./aws/aws_sso_users_with_permission_assignments_are_required_to_have_MFA_on_AzureAD.yaml renamed successfully. +./aws/aws_cis_v130_1_7.yaml renamed successfully. +./aws/aws_lambda_function_tracing_enabled.yaml renamed successfully. +./aws/aws_ecs_cluster_container_instance_agent_connected.yaml renamed successfully. +./aws/aws_cloudtrail_trail_bucket_mfa_enabled.yaml renamed successfully. +./aws/aws_neptune_db_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cis_v140_2_3_1.yaml renamed successfully. +./aws/aws_s3_bucket_static_website_hosting_disabled.yaml renamed successfully. +./aws/aws_waf_regional_web_acl_rule_attached.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_cluster_parameter_group_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_ec2_2.yaml renamed successfully. +./aws/aws_cis_v120_1_21.yaml renamed successfully. +./aws/aws_mandatory_sql_dms_replication_instance_mandatory.yaml renamed successfully. +./aws/aws_vpc_endpoint_service_acceptance_required_enabled.yaml renamed successfully. +./aws/aws_foundational_security_secretsmanager_1.yaml renamed successfully. +./aws/aws_mandatory_sql_ecs_service_mandatory.yaml renamed successfully. +./aws/aws_cloudfront_distribution_no_non_existent_s3_origin.yaml renamed successfully. +./aws/aws_iam_root_user_no_access_keys.yaml renamed successfully. +./aws/aws_foundational_security_codebuild_5.yaml renamed successfully. +./aws/aws_iam_user_access_key_age_90.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_4.yaml renamed successfully. +./aws/aws_api_gatewayv2_route_authorizer_configured.yaml renamed successfully. +./aws/aws_rds_db_instance_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_vpc_route_table_restrict_public_access_to_igw.yaml renamed successfully. +./aws/aws_foundational_security_rds_22.yaml renamed successfully. +./aws/aws_foundational_security_lambda_2.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_6_3.yaml renamed successfully. +./aws/aws_vpc_network_acl_remote_administration.yaml renamed successfully. +./aws/aws_s3_public_access_block_account.yaml renamed successfully. +./aws/aws_redshift_cluster_no_default_database_name.yaml renamed successfully. +./aws/aws_foundational_security_sagemaker_1.yaml renamed successfully. +./aws/aws_foundational_security_neptune_7.yaml renamed successfully. +./aws/aws_ec2_instance_termination_protection_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_34.yaml renamed successfully. +./aws/aws_ec2_instance_user_data_no_secrets.yaml renamed successfully. +./aws/aws_foundational_security_es_2.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_cluster_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_s3_11.yaml renamed successfully. +./aws/aws_neptune_db_cluster_snapshot_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cloudfront_distribution_geo_restrictions_enabled.yaml renamed successfully. +./aws/aws_dynamodb_table_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_cis_v120_2_8.yaml renamed successfully. +./aws/aws_foundational_security_elb_6.yaml renamed successfully. +./aws/aws_rds_db_instance_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ec2_15.yaml renamed successfully. +./aws/aws_vpc_security_group_allows_ingress_to_mongodb_ports.yaml renamed successfully. +./aws/aws_s3_bucket_versioning_enabled.yaml renamed successfully. +./aws/aws_iam_policy_all_attached_no_star_star.yaml renamed successfully. +./aws/aws_cis_v130_3_6.yaml renamed successfully. +./aws/aws_autoscaling_group_with_lb_use_health_check.yaml renamed successfully. +./aws/aws_dynamodb_table_auto_scaling_enabled.yaml renamed successfully. +./aws/aws_codebuild_project_with_user_controlled_buildspec.yaml renamed successfully. +./aws/aws_neptune_db_cluster_iam_authentication_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_14.yaml renamed successfully. +./aws/aws_acm_certificate_not_expired.yaml renamed successfully. +./aws/aws_lightsail_instance_ipv6_networking_disabled.yaml renamed successfully. +./aws/aws_vpc_default_security_group_restricts_all_traffic.yaml renamed successfully. +./aws/aws_cis_v130_4_8.yaml renamed successfully. +./aws/aws_foundational_security_efs_3.yaml renamed successfully. +./aws/aws_cis_v200_3_7.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_subnet_group_mandatory.yaml renamed successfully. +./aws/aws_mandatory_sql_config_rule_mandatory.yaml renamed successfully. +./aws/aws_iam_root_user_mfa_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ssm_1.yaml renamed successfully. +./aws/aws_cis_v120_1_1.yaml renamed successfully. +./aws/aws_waf_rule_group_rule_attached.yaml renamed successfully. +./aws/aws_cis_v200_3_11.yaml renamed successfully. +./aws/aws_foundational_security_redshift_6.yaml renamed successfully. +./aws/aws_neptune_db_cluster_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_cis_v120_1_17.yaml renamed successfully. +./aws/aws_ecs_cluster_container_insights_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_11.yaml renamed successfully. +./aws/aws_cis_v140_1_19.yaml renamed successfully. +./aws/aws_cis_v120_4_2.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_3.yaml renamed successfully. +./aws/aws_log_group_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_ecs_task_definition_container_non_privileged.yaml renamed successfully. +./aws/aws_es_domain_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ec2_23.yaml renamed successfully. +./aws/aws_cis_v300_3_2.yaml renamed successfully. +./aws/aws_cis_v150_4_5.yaml renamed successfully. +./aws/aws_mandatory_sql_ecs_container_instance_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_appsync_2.yaml renamed successfully. +./aws/aws_iam_account_password_policy_one_symbol.yaml renamed successfully. +./aws/aws_mandatory_sql_directory_service_directory_mandatory.yaml renamed successfully. +./aws/aws_iam_account_password_policy_one_lowercase_letter.yaml renamed successfully. +./aws/aws_foundational_security_docdb_5.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_kafka_port.yaml renamed successfully. +./aws/aws_cis_v130_1_12.yaml renamed successfully. +./aws/aws_elb_tls_listener_protocol_version.yaml renamed successfully. +./aws/aws_cloudwatch_alarm_action_enabled_check.yaml renamed successfully. +./aws/aws_mandatory_sql_dax_cluster_mandatory.yaml renamed successfully. +./aws/aws_cloudtrail_multi_region_trail_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_8.yaml renamed successfully. +./aws/aws_iam_user_one_active_key.yaml renamed successfully. +./aws/aws_waf_regional_rule_group_rule_attached.yaml renamed successfully. +./aws/aws_rds_db_instance_iam_authentication_enabled.yaml renamed successfully. +./aws/aws_log_metric_filter_vpc.yaml renamed successfully. +./aws/aws_vpc_security_group_restrict_ingress_tcp_udp_all.yaml renamed successfully. +./aws/aws_mandatory_sql_sagemaker_notebook_instance_mandatory.yaml renamed successfully. +./aws/aws_mandatory_sql_dynamodb_table_mandatory.yaml renamed successfully. +./aws/aws_sagemaker_training_job_volume_and_data_encryption_enabled.yaml renamed successfully. +./aws/aws_iam_role_should_not_have_trust_to_cognito_full_access.yaml renamed successfully. +./aws/aws_wafv2_rule_group_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v200_1_16.yaml renamed successfully. +./aws/aws_mandatory_sql_iam_user_mandatory.yaml renamed successfully. +./aws/aws_cis_v150_3_7.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_14.yaml renamed successfully. +./aws/aws_es_domain_cognito_authentication_enabled.yaml renamed successfully. +./aws/aws_secretsmanager_secret_last_used_1_day.yaml renamed successfully. +./aws/aws_log_metric_filter_security_group.yaml renamed successfully. +./aws/aws_iam_group_not_empty.yaml renamed successfully. +./aws/aws_cis_v300_1_3.yaml renamed successfully. +./aws/aws_iam_users_with_api_keys_should_have_keys_rotated_every_x_days.yaml renamed successfully. +./aws/aws_backup_recovery_point_min_retention_35_days.yaml renamed successfully. +./aws/aws_foundational_security_dms_8.yaml renamed successfully. +./aws/aws_foundational_security_ec2_19.yaml renamed successfully. +./aws/aws_ec2_instance_ssm_managed.yaml renamed successfully. +./aws/aws_sagemaker_notebook_instance_direct_internet_access_disabled.yaml renamed successfully. +./aws/aws_es_domain_encrypted_using_tls_1_2.yaml renamed successfully. +./aws/aws_redshift_cluster_automatic_upgrade_major_versions_enabled.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_5.yaml renamed successfully. +./aws/aws_eks_cluster_endpoint_public_access_restricted.yaml renamed successfully. +./aws/aws_cis_v120_2_4.yaml renamed successfully. +./aws/aws_iam_custom_policy_unattached_no_star_star.yaml renamed successfully. +./aws/aws_route53_zone_query_logging_enabled.yaml renamed successfully. +./aws/aws_apigateway_rest_api_endpoint_restrict_public_access.yaml renamed successfully. +./aws/aws_ec2_instance_detailed_monitoring_enabled.yaml renamed successfully. +./aws/aws_s3_bucket_default_encryption_enabled.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_4.yaml renamed successfully. +./aws/aws_cis_v120_2_5.yaml renamed successfully. +./aws/aws_foundational_security_dms_9.yaml renamed successfully. +./aws/aws_foundational_security_ec2_18.yaml renamed successfully. +./aws/aws_foundational_security_sqs_1.yaml renamed successfully. +./aws/aws_elastic_beanstalk_enhanced_health_reporting_enabled.yaml renamed successfully. +./aws/aws_ssm_managed_instance_compliance_patch_compliant.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_10.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_network_load_balancer_mandatory.yaml renamed successfully. +./aws/aws_rds_db_snapshot_encrypted_at_rest.yaml renamed successfully. +./aws/aws_cis_v300_5_5.yaml renamed successfully. +./aws/aws_sagemaker_model_network_isolation_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_2_4.yaml renamed successfully. +./aws/aws_autoscaling_group_no_suspended_process.yaml renamed successfully. +./aws/aws_rds_db_instance_and_cluster_no_default_port.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_cluster_snapshot_mandatory.yaml renamed successfully. +./aws/aws_cis_v300_1_2.yaml renamed successfully. +./aws/aws_iam_inline_policy_no_administrative_privileges.yaml renamed successfully. +./aws/aws_ssm_document_prohibit_public_access.yaml renamed successfully. +./aws/aws_appstream_fleet_session_disconnect_timeout_300_seconds.yaml renamed successfully. +./aws/aws_opensearch_domain_cognito_authentication_enabled_for_kibana.yaml renamed successfully. +./aws/aws_cis_v150_3_6.yaml renamed successfully. +./aws/aws_mandatory_sql_secretsmanager_secret_mandatory.yaml renamed successfully. +./aws/aws_cis_v120_3_11.yaml renamed successfully. +./aws/aws_neptune_db_cluster_audit_logging_enabled.yaml renamed successfully. +./aws/aws_cis_v200_1_17.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_9.yaml renamed successfully. +./aws/aws_elb_application_lb_drop_http_headers.yaml renamed successfully. +./aws/aws_ssm_parameter_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_v200_1_7.yaml renamed successfully. +./aws/aws_foundational_security_ecs_1.yaml renamed successfully. +./aws/aws_cis_v150_2_2_1.yaml renamed successfully. +./aws/aws_ebs_volume_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_iam_user_access_key_unused_45.yaml renamed successfully. +./aws/aws_cis_v130_1_13.yaml renamed successfully. +./aws/aws_guardduty_finding_archived.yaml renamed successfully. +./aws/aws_cloudtrail_trail_insight_selectors_and_logging_enabled.yaml renamed successfully. +./aws/aws_ec2_instance_no_launch_wizard_security_group.yaml renamed successfully. +./aws/aws_foundational_security_docdb_4.yaml renamed successfully. +./aws/aws_cis_v300_3_3.yaml renamed successfully. +./aws/aws_cis_v150_2_1_4.yaml renamed successfully. +./aws/aws_elasticache_replication_group_auto_failover_enabled.yaml renamed successfully. +./aws/aws_foundational_security_cloudtrail_2.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_10.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_2.yaml renamed successfully. +./aws/aws_cis_v140_1_18.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_instance_mandatory.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_11_1.yaml renamed successfully. +./aws/aws_cis_v200_3_10.yaml renamed successfully. +./aws/aws_foundational_security_redshift_7.yaml renamed successfully. +./aws/aws_cis_v120_1_16.yaml renamed successfully. +./aws/aws_cis_v150_1_7.yaml renamed successfully. +./aws/aws_log_metric_filter_console_login_mfa.yaml renamed successfully. +./aws/aws_cloudwatch_alarm_action_enabled.yaml renamed successfully. +./aws/aws_ebs_volume_snapshot_exists.yaml renamed successfully. +./aws/aws_cloudtrail_multi_region_trail_integrated_with_logs.yaml renamed successfully. +./aws/aws_foundational_security_rds_15.yaml renamed successfully. +./aws/aws_log_metric_filter_organization.yaml renamed successfully. +./aws/aws_foundational_security_efs_2.yaml renamed successfully. +./aws/aws_cis_v200_3_6.yaml renamed successfully. +./aws/aws_foundational_security_waf_8.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_1_1.yaml renamed successfully. +./aws/aws_foundational_security_elb_7.yaml renamed successfully. +./aws/aws_root_accounts_needs_to_have_mfa.yaml renamed successfully. +./aws/aws_cis_v130_2_1_2.yaml renamed successfully. +./aws/aws_cis_v130_3_7.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_1.yaml renamed successfully. +./aws/aws_mandatory_sql_wafv2_regex_pattern_set_mandatory.yaml renamed successfully. +./aws/aws_cis_v120_2_9.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_8.yaml renamed successfully. +./aws/aws_iam_security_audit_role.yaml renamed successfully. +./aws/aws_iam_policy_custom_no_assume_role.yaml renamed successfully. +./aws/aws_cis_v140_2_1_1.yaml renamed successfully. +./aws/aws_acm_certificate_no_pending_validation_certificate.yaml renamed successfully. +./aws/aws_foundational_security_es_3.yaml renamed successfully. +./aws/aws_foundational_security_s3_10.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_1.yaml renamed successfully. +./aws/aws_foundational_security_neptune_6.yaml renamed successfully. +./aws/aws_foundational_security_rds_35.yaml renamed successfully. +./aws/aws_codebuild_project_logging_enabled.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_gateway_load_balancer_mandatory.yaml renamed successfully. +./aws/aws_cis_v300_4_11.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_6_2.yaml renamed successfully. +./aws/aws_elb_classic_lb_multiple_az_configured.yaml renamed successfully. +./aws/aws_foundational_security_emr_1.yaml renamed successfully. +./aws/aws_vpc_security_group_remote_administration_ipv6.yaml renamed successfully. +./aws/aws_foundational_security_codebuild_4.yaml renamed successfully. +./aws/aws_vpc_security_group_associated_to_eni.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_5.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_nat_gateway_mandatory.yaml renamed successfully. +./aws/aws_opensearch_domain_logs_to_cloudwatch.yaml renamed successfully. +./aws/aws_cloudfront_distribution_no_deprecated_ssl_protocol.yaml renamed successfully. +./aws/aws_cis_v120_1_20.yaml renamed successfully. +./aws/aws_cloudformation_stack_rollback_enabled.yaml renamed successfully. +./aws/aws_vpc_security_group_unused.yaml renamed successfully. +./aws/aws_iam_account_password_policy_one_number.yaml renamed successfully. +./aws/aws_cis_v140_1_1.yaml renamed successfully. +./aws/aws_foundational_security_ec2_3.yaml renamed successfully. +./aws/aws_backup_recovery_point_manual_deletion_disabled.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_2.yaml renamed successfully. +./aws/aws_vpc_peering_connection_no_cross_account_access.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_6.yaml renamed successfully. +./aws/aws_ec2_ebs_default_encryption_enabled.yaml renamed successfully. +./aws/aws_vpc_peering_connection_route_table_least_privilege.yaml renamed successfully. +./aws/aws_cis_v140_1_14.yaml renamed successfully. +./aws/aws_rds_db_instance_no_default_admin_name.yaml renamed successfully. +./aws/aws_ecs_task_definition_no_root_user.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_3.yaml renamed successfully. +./aws/aws_cis_v150_4_8.yaml renamed successfully. +./aws/aws_rds_db_snapshot_prohibit_public_access.yaml renamed successfully. +./aws/aws_apigateway_stage_use_waf_web_acl.yaml renamed successfully. +./aws/aws_autoscaling_group_uses_ec2_launch_template.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_in_vpc.yaml renamed successfully. +./aws/aws_cis_v200_1_21.yaml renamed successfully. +./aws/aws_guardduty_no_high_severity_findings.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_3.yaml renamed successfully. +./aws/aws_cis_v300_1_12.yaml renamed successfully. +./aws/aws_iam_account_password_policy_reuse_24.yaml renamed successfully. +./aws/aws_foundational_security_waf_4.yaml renamed successfully. +./aws/aws_cis_v150_1_11.yaml renamed successfully. +./aws/aws_vpc_not_in_use.yaml renamed successfully. +./aws/aws_ec2_instance_virtualization_type_no_paravirtual.yaml renamed successfully. +./aws/aws_foundational_security_rds_19.yaml renamed successfully. +./aws/aws_kms_cmk_policy_prohibit_public_access.yaml renamed successfully. +./aws/aws_directory_service_directory_snapshots_limit_2.yaml renamed successfully. +./aws/aws_waf_web_acl_logging_enabled.yaml renamed successfully. +./aws/aws_elb_classic_lb_with_outbound_rule.yaml renamed successfully. +./aws/aws_foundational_security_rds_12.yaml renamed successfully. +./aws/aws_s3_public_access_block_bucket_account.yaml renamed successfully. +./aws/aws_efs_file_system_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_cloudfront_distribution_latest_tls_version.yaml renamed successfully. +./aws/aws_apigateway_rest_api_stage_xray_tracing_enabled.yaml renamed successfully. +./aws/aws_elb_classic_lb_use_tls_https_listeners.yaml renamed successfully. +./aws/aws_acmpca_root_certificate_authority_disabled.yaml renamed successfully. +./aws/aws_elb_classic_lb_desync_mitigation_mode.yaml renamed successfully. +./aws/aws_elasticache_replication_group_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_8.yaml renamed successfully. +./aws/aws_cis_v300_1_19.yaml renamed successfully. +./aws/aws_cis_v120_1_11.yaml renamed successfully. +./aws/aws_kms_cmk_unused.yaml renamed successfully. +./aws/aws_vpc_vpn_tunnel_up.yaml renamed successfully. +./aws/aws_mandatory_sql_s3_bucket_mandatory.yaml renamed successfully. +./aws/aws_ecs_cluster_no_active_services_count.yaml renamed successfully. +./aws/aws_cis_v120_4_4.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_5.yaml renamed successfully. +./aws/aws_ec2_instance_ebs_optimized.yaml renamed successfully. +./aws/aws_ec2_instance_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_cis_v150_4_3.yaml renamed successfully. +./aws/aws_cis_v300_3_4.yaml renamed successfully. +./aws/aws_sns_topic_notification_delivery_status_enabled.yaml renamed successfully. +./aws/aws_foundational_security_cloudtrail_5.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_application_load_balancer_mandatory.yaml renamed successfully. +./aws/aws_cis_v150_2_1_3.yaml renamed successfully. +./aws/aws_backup_recovery_point_encryption_enabled.yaml renamed successfully. +./aws/aws_route53_domain_not_expired.yaml renamed successfully. +./aws/aws_mandatory_sql_elasticache_cluster_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_ec2_8.yaml renamed successfully. +./aws/aws_cis_v130_1_14.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_9.yaml renamed successfully. +./aws/aws_cis_v200_2_3_1.yaml renamed successfully. +./aws/aws_glue_connection_ssl_enabled.yaml renamed successfully. +./aws/aws_iam_policy_custom_attached_no_star_star.yaml renamed successfully. +./aws/aws_codebuild_project_build_greater_then_90_days.yaml renamed successfully. +./aws/aws_rds_db_cluster_aurora_protected_by_backup_plan.yaml renamed successfully. +./aws/aws_cis_v200_1_10.yaml renamed successfully. +./aws/aws_s3_public_access_block_bucket.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_12.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_elastic_ip_hijacking_access.yaml renamed successfully. +./aws/aws_backup_plan_min_retention_35_days.yaml renamed successfully. +./aws/aws_es_domain_data_nodes_min_3.yaml renamed successfully. +./aws/aws_mandatory_sql_ecr_repository_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_es_8.yaml renamed successfully. +./aws/aws_elb_application_lb_with_outbound_rule.yaml renamed successfully. +./aws/aws_cis_v150_2_3_2.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_attached_with_credentials_exposure_access.yaml renamed successfully. +./aws/aws_elb_application_network_lb_use_ssl_certificate.yaml renamed successfully. +./aws/aws_foundational_security_ecr_2.yaml renamed successfully. +./aws/aws_cis_v300_1_5.yaml renamed successfully. +./aws/aws_mandatory_sql_sagemaker_endpoint_configuration_mandatory.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_2_3.yaml renamed successfully. +./aws/aws_ebs_attached_volume_delete_on_termination_enabled.yaml renamed successfully. +./aws/aws_iam_account_password_policy_strong_min_length_8.yaml renamed successfully. +./aws/aws_efs_file_system_encrypt_data_at_rest.yaml renamed successfully. +./aws/aws_foundational_security_dynamodb_3.yaml renamed successfully. +./aws/aws_networkfirewall_firewall_policy_rule_group_not_empty.yaml renamed successfully. +./aws/aws_mandatory_sql_guardduty_detector_mandatory.yaml renamed successfully. +./aws/aws_cis_v200_4_3.yaml renamed successfully. +./aws/aws_cis_v300_5_2.yaml renamed successfully. +./aws/aws_lambda_function_concurrent_execution_limit_configured.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_3.yaml renamed successfully. +./aws/aws_waf_web_acl_rule_attached.yaml renamed successfully. +./aws/aws_cis_v120_2_2.yaml renamed successfully. +./aws/aws_foundational_security_backup_1.yaml renamed successfully. +./aws/aws_mandatory_sql_elasticsearch_domain_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_waf_3.yaml renamed successfully. +./aws/aws_mandatory_sql_codepipeline_pipeline_mandatory.yaml renamed successfully. +./aws/aws_cis_v140_4_5.yaml renamed successfully. +./aws/aws_cis_v150_1_16.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_snapshot_mandatory.yaml renamed successfully. +./aws/aws_sagemaker_notebook_instance_root_access_disabled.yaml renamed successfully. +./aws/aws_foundational_security_acm_2.yaml renamed successfully. +./aws/aws_cis_v300_1_15.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_4.yaml renamed successfully. +./aws/aws_rds_db_cluster_no_default_admin_name.yaml renamed successfully. +./aws/aws_efs_file_system_in_backup_plan.yaml renamed successfully. +./aws/aws_cis_v300_3_8.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_4.yaml renamed successfully. +./aws/aws_kms_key_decryption_restricted_in_iam_customer_managed_policy.yaml renamed successfully. +./aws/aws_emr_cluster_encryption_at_rest_with_sse_kms.yaml renamed successfully. +./aws/aws_s3_bucket_object_lock_enabled.yaml renamed successfully. +./aws/aws_cloudfront_distribution_field_level_encryption_enabled.yaml renamed successfully. +./aws/aws_rds_db_instance_copy_tags_to_snapshot_enabled.yaml renamed successfully. +./aws/aws_cis_v140_5_1.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_9.yaml renamed successfully. +./aws/aws_cis_v140_1_13.yaml renamed successfully. +./aws/aws_wafv2_web_acl_logging_enabled.yaml renamed successfully. +./aws/aws_waf_regional_rule_condition_attached.yaml renamed successfully. +./aws/aws_elastic_beanstalk_environment_managed_updates_enabled.yaml renamed successfully. +./aws/aws_foundational_security_s3_8.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_5.yaml renamed successfully. +./aws/aws_cis_v130_1_1.yaml renamed successfully. +./aws/aws_sagemaker_notebook_instance_encrypted_with_kms_cmk.yaml renamed successfully. +./aws/aws_cis_v130_1_18.yaml renamed successfully. +./aws/aws_foundational_security_autoscaling_1.yaml renamed successfully. +./aws/aws_dms_certificate_not_expired.yaml renamed successfully. +./aws/aws_foundational_security_elasticbeanstalk_3.yaml renamed successfully. +./aws/aws_foundational_security_ec2_4.yaml renamed successfully. +./aws/aws_iam_account_password_policy_one_uppercase_letter.yaml renamed successfully. +./aws/aws_cloudfront_distribution_encryption_in_transit_enabled.yaml renamed successfully. +./aws/aws_foundational_security_codebuild_3.yaml renamed successfully. +./aws/aws_mandatory_sql_cloudwatch_log_group_mandatory.yaml renamed successfully. +./aws/aws_route53_domain_transfer_lock_enabled.yaml renamed successfully. +./aws/aws_cloudwatch_cross_account_sharing.yaml renamed successfully. +./aws/aws_foundational_security_pca_1.yaml renamed successfully. +./aws/aws_redshift_cluster_automatic_snapshots_min_7_days.yaml renamed successfully. +./aws/aws_secretsmanager_secret_rotated_as_scheduled.yaml renamed successfully. +./aws/aws_cis_v300_2_1_1.yaml renamed successfully. +./aws/aws_foundational_security_rds_24.yaml renamed successfully. +./aws/aws_elb_application_lb_deletion_protection_enabled.yaml renamed successfully. +./aws/aws_log_metric_filter_console_authentication_failure.yaml renamed successfully. +./aws/aws_api_gateway_method_authorization_type_configured.yaml renamed successfully. +./aws/aws_iam_policy_inline_no_blocked_kms_actions.yaml renamed successfully. +./aws/aws_log_metric_filter_config_configuration.yaml renamed successfully. +./aws/aws_cis_v150_3_11.yaml renamed successfully. +./aws/aws_redshift_cluster_audit_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_neptune_1.yaml renamed successfully. +./aws/aws_workspaces_workspace_volume_encryption_enabled.yaml renamed successfully. +./aws/aws_mandatory_sql_rds_db_option_group_mandatory.yaml renamed successfully. +./aws/aws_emr_cluster_master_nodes_no_public_ip.yaml renamed successfully. +./aws/aws_autoscaling_launch_config_public_ip_disabled.yaml renamed successfully. +./aws/aws_cis_v130_1_22.yaml renamed successfully. +./aws/aws_foundational_security_es_4.yaml renamed successfully. +./aws/aws_lambda_function_cloudwatch_insights_enabled.yaml renamed successfully. +./aws/aws_dynamodb_table_in_backup_plan.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_6.yaml renamed successfully. +./aws/aws_dms_replication_task_source_database_logging_enabled.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_6.yaml renamed successfully. +./aws/aws_iam_user_mfa_enabled.yaml renamed successfully. +./aws/aws_cis_v140_3_7.yaml renamed successfully. +./aws/aws_lambda_function_in_vpc.yaml renamed successfully. +./aws/aws_foundational_security_elb_1.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_eip_mandatory.yaml renamed successfully. +./aws/aws_cloudtrail_s3_object_read_events_audit_enabled.yaml renamed successfully. +./aws/aws_iam_all_policy_no_service_wild_card.yaml renamed successfully. +./aws/aws_foundational_security_cloudfront_7.yaml renamed successfully. +./aws/aws_foundational_security_athena_1.yaml renamed successfully. +./aws/aws_cis_v140_3_6.yaml renamed successfully. +./aws/aws_foundational_security_iam_1.yaml renamed successfully. +./aws/aws_foundational_security_es_5.yaml renamed successfully. +./aws/aws_route53_domain_expires_7_days.yaml renamed successfully. +./aws/aws_cis_v300_1_8.yaml renamed successfully. +./aws/aws_sqs_queue_dead_letter_queue_configured.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_7.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_org_write_access.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_6_4.yaml renamed successfully. +./aws/aws_cis_v150_3_10.yaml renamed successfully. +./aws/aws_foundational_security_elb_10.yaml renamed successfully. +./aws/aws_codebuild_project_s3_logs_encryption_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_25.yaml renamed successfully. +./aws/aws_secretsmanager_secret_automatic_rotation_enabled.yaml renamed successfully. +./aws/aws_waf_web_acl_resource_associated.yaml renamed successfully. +./aws/aws_neptune_db_cluster_no_public_subnet.yaml renamed successfully. +./aws/aws_lambda_function_variables_no_sensitive_data.yaml renamed successfully. +./aws/aws_foundational_security_codebuild_2.yaml renamed successfully. +./aws/aws_ec2_instance_not_publicly_accessible.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_3.yaml renamed successfully. +./aws/aws_mandatory_sql_vpc_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_eventbridge_3.yaml renamed successfully. +./aws/aws_cis_v150_4_14.yaml renamed successfully. +./aws/aws_iam_policy_custom_no_permissive_role_assumption.yaml renamed successfully. +./aws/aws_foundational_security_sns_1.yaml renamed successfully. +./aws/aws_cis_v140_1_7.yaml renamed successfully. +./aws/aws_opensearch_domain_internal_user_database_disabled.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_4.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_5_1.yaml renamed successfully. +./aws/aws_ecs_service_not_publicly_accessible.yaml renamed successfully. +./aws/aws_cis_v130_1_19.yaml renamed successfully. +./aws/aws_ecs_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./aws/aws_sqs_queue_policy_prohibit_public_access.yaml renamed successfully. +./aws/aws_ecs_task_definition_container_readonly_root_filesystem.yaml renamed successfully. +./aws/aws_cis_v140_1_12.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_alter_critical_s3_permissions_configuration.yaml renamed successfully. +./aws/aws_iam_root_user_hardware_mfa_enabled.yaml renamed successfully. +./aws/aws_foundational_security_s3_9.yaml renamed successfully. +./aws/aws_cis_v300_3_9.yaml renamed successfully. +./aws/aws_foundational_security_elasticache_5.yaml renamed successfully. +./aws/aws_ec2_instance_iam_profile_attached.yaml renamed successfully. +./aws/aws_account_alternate_contact_security_registered.yaml renamed successfully. +./aws/aws_acm_certificate_expires_30_days.yaml renamed successfully. +./aws/aws_foundational_security_kms_1.yaml renamed successfully. +./aws/aws_cis_v300_2_3_1.yaml renamed successfully. +./aws/aws_mandatory_sql_ec2_reserved_instance_mandatory.yaml renamed successfully. +./aws/aws_elasticache_replication_group_redis_auth_enabled.yaml renamed successfully. +./aws/aws_autoscaling_launch_config_requires_imdsv2.yaml renamed successfully. +./aws/aws_cis_v130_2_2_1.yaml renamed successfully. +./aws/aws_glue_data_catalog_encryption_settings_metadata_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_5.yaml renamed successfully. +./aws/aws_glue_data_catalog_encryption_settings_password_encryption_enabled.yaml renamed successfully. +./aws/aws_cis_v300_1_14.yaml renamed successfully. +./aws/aws_foundational_security_waf_2.yaml renamed successfully. +./aws/aws_vpc_igw_attached_to_authorized_vpc.yaml renamed successfully. +./aws/aws_cis_v150_1_17.yaml renamed successfully. +./aws/aws_ec2_ami_ebs_encryption_enabled.yaml renamed successfully. +./aws/aws_athena_workgroup_enforce_configuration_enabled.yaml renamed successfully. +./aws/aws_foundational_security_ecs_10.yaml renamed successfully. +./aws/aws_lambda_function_cors_configuration.yaml renamed successfully. +./aws/aws_cis_v130_4_3.yaml renamed successfully. +./aws/aws_iam_group_user_role_no_inline_policies.yaml renamed successfully. +./aws/aws_dlm_ebs_snapshot_lifecycle_policy_enabled.yaml renamed successfully. +./aws/aws_sns_topic_policy_prohibit_cross_account_access.yaml renamed successfully. +./aws/aws_foundational_security_msk_1.yaml renamed successfully. +./aws/aws_rds_db_instance_automatic_minor_version_upgrade_enabled.yaml renamed successfully. +./aws/aws_opensearch_domain_https_required.yaml renamed successfully. +./aws/aws_foundational_security_opensearch_2.yaml renamed successfully. +./aws/aws_config_configuration_recorder_no_failed_deliver_logs.yaml renamed successfully. +./aws/aws_cis_v120_2_3.yaml renamed successfully. +./aws/aws_ecs_task_definition_container_environment_no_secret.yaml renamed successfully. +./aws/aws_foundational_security_waf_12.yaml renamed successfully. +./aws/aws_elb_classic_lb_use_ssl_certificate.yaml renamed successfully. +./aws/aws_foundational_security_dynamodb_2.yaml renamed successfully. +./aws/aws_cis_v200_2_1_1.yaml renamed successfully. +./aws/aws_cis_v300_5_3.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_with_write_level_access.yaml renamed successfully. +./aws/aws_secretsmanager_secret_last_changed_90_day.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_2_2.yaml renamed successfully. +./aws/aws_vpc_eip_associated.yaml renamed successfully. +./aws/aws_ecs_service_fargate_using_latest_platform_version.yaml renamed successfully. +./aws/aws_ec2_ami_not_older_than_90_days.yaml renamed successfully. +./aws/aws_cis_v150_2_3_3.yaml renamed successfully. +./aws/aws_eks_cluster_no_default_vpc.yaml renamed successfully. +./aws/aws_foundational_security_ecr_3.yaml renamed successfully. +./aws/aws_cis_v300_1_4.yaml renamed successfully. +./aws/aws_cloudtrail_s3_object_write_events_audit_enabled.yaml renamed successfully. +./aws/aws_foundational_security_rds_7.yaml renamed successfully. +./aws/aws_cis_v150_1_21.yaml renamed successfully. +./aws/aws_cis_v200_5_6.yaml renamed successfully. +./aws/aws_acm_certificate_rsa_key_length_2048_bits_or_greater.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_2_13.yaml renamed successfully. +./aws/aws_mandatory_sql_iam_role_mandatory.yaml renamed successfully. +./aws/aws_mq_broker_restrict_public_access.yaml renamed successfully. +./aws/aws_mandatory_sql_ebs_snapshot_mandatory.yaml renamed successfully. +./aws/aws_lambda_function_multiple_az_configured.yaml renamed successfully. +./aws/aws_cis_v200_1_11.yaml renamed successfully. +./aws/aws_emr_cluster_security_configuration_enabled.yaml renamed successfully. +./aws/aws_cloudtrail_trail_validation_enabled.yaml renamed successfully. +./aws/aws_cis_v200_1_1.yaml renamed successfully. +./aws/aws_waf_rule_condition_attached.yaml renamed successfully. +./aws/aws_mandatory_sql_route53_resolver_endpoint_mandatory.yaml renamed successfully. +./aws/aws_docdb_cluster_backup_retention_period_7_days.yaml renamed successfully. +./aws/aws_opensearch_domain_fine_grained_access_enabled.yaml renamed successfully. +./aws/aws_cis_v130_1_15.yaml renamed successfully. +./aws/aws_ec2_instance_no_iam_role_with_new_role_creation_with_attached_policy_access.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_3_12.yaml renamed successfully. +./aws/aws_sqs_queue_encrypted_with_kms_cmk.yaml renamed successfully. +./aws/aws_foundational_security_apigateway_8.yaml renamed successfully. +./aws/aws_secretsmanager_secret_automatic_rotation_lambda_enabled.yaml renamed successfully. +./aws/aws_ecs_task_definition_user_for_host_mode_check.yaml renamed successfully. +./aws/aws_foundational_security_ec2_9.yaml renamed successfully. +./aws/aws_foundational_security_docdb_2.yaml renamed successfully. +./aws/aws_iam_policy_custom_no_blocked_kms_actions.yaml renamed successfully. +./aws/aws_cis_v300_3_5.yaml renamed successfully. +./aws/aws_log_metric_filter_bucket_policy.yaml renamed successfully. +./aws/aws_foundational_security_cloudtrail_4.yaml renamed successfully. +./aws/aws_cis_v150_2_1_2.yaml renamed successfully. +./aws/aws_foundational_security_networkfirewall_4.yaml renamed successfully. +./aws/aws_foundational_security_s3_5.yaml renamed successfully. +./aws/aws_foundational_security_ec2_24.yaml renamed successfully. +./aws/aws_rds_db_instance_and_cluster_enhanced_monitoring_enabled.yaml renamed successfully. +./aws/aws_cis_v150_2_4_1.yaml renamed successfully. +./aws/aws_cis_v150_1_1.yaml renamed successfully. +./aws/aws_cis_v300_1_18.yaml renamed successfully. +./aws/aws_cis_compute_service_v100_4_9.yaml renamed successfully. +./aws/aws_s3_access_point_restrict_public_access.yaml renamed successfully. +./aws/aws_foundational_security_redshift_1.yaml renamed successfully. +./aws/aws_iam_user_no_policies.yaml renamed successfully. +./aws/aws_vpc_security_group_not_uses_launch_wizard_sg.yaml renamed successfully. +./aws/aws_efs_access_point_enforce_user_identity.yaml renamed successfully. +./aws/aws_mandatory_sql_api_gateway_stage_mandatory.yaml renamed successfully. +./aws/aws_foundational_security_rds_13.yaml renamed successfully. +./aws/aws_foundational_security_efs_4.yaml renamed successfully. +./aws/aws_redshift_cluster_prohibit_public_access.yaml renamed successfully. +./aws/aws_lambda_function_restrict_public_url.yaml renamed successfully. +./aws/aws_cis_v200_4_12.yaml renamed successfully. +./aws/aws_mandatory_sql_sagemaker_training_job_mandatory.yaml renamed successfully. +./aws/aws_cis_v140_4_8.yaml renamed successfully. +./aws/aws_elasticache_replication_group_encryption_at_rest_enabled_with_kms_cmk.yaml renamed successfully. +./aws/aws_cloudtrail_trail_enabled_account.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_1_1.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_3_3.yaml renamed successfully. +./pending/azure/azure_cis_v130_3_5.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_2_4.yaml renamed successfully. +./pending/azure/azure_cis_v210_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v200_1_11.yaml renamed successfully. +./pending/azure/azure_cis_v130_5_1_4.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_3_5.yaml renamed successfully. +./pending/azure/azure_cis_v200_9_10.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_2_1.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_2_2.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_3_6.yaml renamed successfully. +./pending/azure/azure_cis_v210_9_9.yaml renamed successfully. +./pending/azure/azure_cis_v200_8_7.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_3_4.yaml renamed successfully. +./pending/azure/azure_cis_v150_6_6.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_2_3.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_3_4.yaml renamed successfully. +./pending/azure/azure_cis_v150_8_7.yaml renamed successfully. +./pending/azure/azure_cis_v200_6_6.yaml renamed successfully. +./pending/azure/azure_cis_v150_9_3.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_2_5.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_3_2.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_4_3.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_1_1.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_3_3.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_2_4.yaml renamed successfully. +./pending/azure/azure_mariadb_server_private_link_used.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_3_3.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_2_1.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_4_4.yaml renamed successfully. +./pending/azure/azure_cis_v210_2_1_9.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_3_5.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_6.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_2_2.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_3_6.yaml renamed successfully. +./pending/azure/azure_cis_v150_5_1_4.yaml renamed successfully. +./pending/azure/azure_cis_v150_9_10.yaml renamed successfully. +./pending/azure/azure_cis_v210_8_7.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_2_3.yaml renamed successfully. +./pending/azure/azure_cis_v140_3_5.yaml renamed successfully. +./pending/azure/azure_iot_hub_private_link_used.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_3_4.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_1_6.yaml renamed successfully. +./pending/azure/azure_application_insights_linked_to_log_analytics_workspace.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_2_5.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_3_2.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v140_1_8.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_3_2.yaml renamed successfully. +./pending/azure/azure_cis_v130_9_10.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_4_3.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_2_5.yaml renamed successfully. +./pending/azure/azure_cis_v150_1_13.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_1_6.yaml renamed successfully. +./pending/azure/azure_cis_v140_6_5.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_3_4.yaml renamed successfully. +./pending/azure/azure_cis_v210_6_5.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_1_5.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_2_3.yaml renamed successfully. +./pending/azure/azure_cis_v210_3_17.yaml renamed successfully. +./pending/azure/azure_cis_v140_1_6.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_2_2.yaml renamed successfully. +./pending/azure/azure_cis_v200_5_1_4.yaml renamed successfully. +./pending/azure/azure_cis_v200_3_13.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_3_6.yaml renamed successfully. +./pending/azure/azure_monitor_logs_storage_container_insights_activity_logs_encrypted_with_byok.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_4_4.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_2_1.yaml renamed successfully. +./pending/azure/azure_storage_account_queues_logging_enabled.yaml renamed successfully. +./pending/azure/azure_cis_v140_6_4.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_1_1.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_2_4.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_3_3.yaml renamed successfully. +./pending/azure/azure_storage_account_containing_vhd_os_disk_cmk_encrypted.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_1_1.yaml renamed successfully. +./pending/azure/azure_cis_v130_6_4.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_3_2.yaml renamed successfully. +./pending/azure/azure_monitor_logs_storage_container_insights_operational_logs_encrypted_with_byok.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_5.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_1_3.yaml renamed successfully. +./pending/azure/azure_cis_v200_2_1_10.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_2_5.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_1_6.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_3_4.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_3_7.yaml renamed successfully. +./pending/azure/azure_cis_v150_6_5.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_2_3.yaml renamed successfully. +./pending/azure/azure_cis_v200_6_5.yaml renamed successfully. +./pending/azure/azure_cis_v140_5_1_4.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_3_6.yaml renamed successfully. +./pending/azure/azure_cis_v200_3_7.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_2_2.yaml renamed successfully. +./pending/azure/azure_cis_v210_4_4_4.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_2_1.yaml renamed successfully. +./pending/azure/azure_cis_v130_4_3_6.yaml renamed successfully. +./pending/azure/azure_cis_v150_3_13.yaml renamed successfully. +./pending/azure/azure_cis_v140_4_3_5.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_2_4.yaml renamed successfully. +./pending/azure/azure_cis_v150_1_18.yaml renamed successfully. +./pending/azure/azure_appservice_web_app_worker_more_than_one.yaml renamed successfully. +./pending/azure/azure_compute_windows_vm_secure_boot_enabled.yaml renamed successfully. +./pending/azure/azure_cis_v140_9_10.yaml renamed successfully. +./pending/azure/azure_cis_v200_4_3_3.yaml renamed successfully. +./pending/azure/azure_postgres_db_server_log_duration_on.yaml renamed successfully. +./pending/azure/azure_cis_v150_4_1_1.yaml renamed successfully. +./pending/azure/azure_cis_v130_6_5.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_1.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_15.yaml renamed successfully. +./pending/aws/aws_foundational_security_rds_4.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_4.yaml renamed successfully. +./pending/aws/aws_emr_cluster_encryption_at_rest_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_4.yaml renamed successfully. +./pending/aws/aws_ec2_instance_no_iam_role_with_defense_evasion_impact_of_aws_security_services_access.yaml renamed successfully. +./pending/aws/aws_redshift_cluster_encrypted_with_cmk.yaml renamed successfully. +./pending/aws/aws_cis_v140_1_8.yaml renamed successfully. +./pending/aws/aws_iam_password_policy_expire_90.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_1.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_5.yaml renamed successfully. +./pending/aws/aws_lightsail_instance_ssh_rdp_http_ports_disabled.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_11.yaml renamed successfully. +./pending/aws/aws_cis_compute_service_v100_3_4.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_12.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_8.yaml renamed successfully. +./pending/aws/aws_foundational_security_elb_13.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_8.yaml renamed successfully. +./pending/aws/aws_s3_bucket_object_logging_enabled.yaml renamed successfully. +./pending/aws/aws_foundational_security_ec2_6.yaml renamed successfully. +./pending/aws/aws_cis_v140_5_3.yaml renamed successfully. +./pending/aws/aws_foundational_security_kms_2.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_9.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_1.yaml renamed successfully. +./pending/aws/aws_codedeploy_deployment_group_lambda_allatonce_traffic_shift_disabled.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_6.yaml renamed successfully. +./pending/aws/aws_glue_dev_endpoint_cloudwatch_logs_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_9.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_15.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_9.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_13.yaml renamed successfully. +./pending/aws/aws_cis_v140_2_1_5.yaml renamed successfully. +./pending/aws/aws_foundational_security_elb_3.yaml renamed successfully. +./pending/aws/aws_foundational_security_ec2_10.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_10.yaml renamed successfully. +./pending/aws/aws_cis_v300_3_7.yaml renamed successfully. +./pending/aws/aws_cis_v140_1_9.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_5.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_14.yaml renamed successfully. +./pending/aws/aws_cis_v300_5_1.yaml renamed successfully. +./pending/aws/aws_cis_v120_2_1.yaml renamed successfully. +./pending/aws/aws_foundational_security_cloudfront_9.yaml renamed successfully. +./pending/aws/aws_emr_cluster_local_disk_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_11.yaml renamed successfully. +./pending/aws/aws_docdb_cluster_snapshot_restrict_public_access.yaml renamed successfully. +./pending/aws/aws_cis_v200_1_22.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_1.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_6.yaml renamed successfully. +./pending/aws/aws_iam_role_cross_account_read_only_access_policy.yaml renamed successfully. +./pending/aws/aws_ec2_instance_no_high_level_finding_in_inspector_scan.yaml renamed successfully. +./pending/aws/aws_foundational_security_cloudfront_13.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_7.yaml renamed successfully. +./pending/aws/aws_foundational_security_guardduty_1.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_2.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_2.yaml renamed successfully. +./pending/aws/aws_rds_db_cluster_encrypted_with_cmk.yaml renamed successfully. +./pending/aws/aws_cis_v130_1_9.yaml renamed successfully. +./pending/aws/aws_foundational_security_ec2_21.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_16.yaml renamed successfully. +./pending/aws/aws_dms_replication_task_target_database_logging_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_14.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_6.yaml renamed successfully. +./pending/aws/aws_glue_dev_endpoint_s3_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v300_3_1.yaml renamed successfully. +./pending/aws/aws_lightsail_instance_rdp_restricted_ip.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_3.yaml renamed successfully. +./pending/aws/aws_iam_access_analyzer_enabled_without_findings.yaml renamed successfully. +./pending/aws/aws_emr_cluster_encryption_at_rest_with_cse_cmk.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_3.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_12.yaml renamed successfully. +./pending/aws/aws_cis_v130_3_9.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_7.yaml renamed successfully. +./pending/aws/aws_cis_v130_5_3.yaml renamed successfully. +./pending/aws/aws_rds_db_instance_no_public_subnet.yaml renamed successfully. +./pending/aws/aws_vpc_subnet_multi_az_enabled.yaml renamed successfully. +./pending/aws/aws_cis_compute_service_v100_2_7.yaml renamed successfully. +./pending/aws/aws_cis_v200_1_9.yaml renamed successfully. +./pending/aws/aws_cis_v300_2_1_4.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_13.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_15.yaml renamed successfully. +./pending/aws/aws_foundational_security_dms_7.yaml renamed successfully. +./pending/aws/aws_foundational_security_elb_5.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_4.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_3.yaml renamed successfully. +./pending/aws/aws_cis_v300_1_13.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_9.yaml renamed successfully. +./pending/aws/aws_ec2_instance_no_iam_role_with_new_user_creation_with_attached_policy_access.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_13.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_10.yaml renamed successfully. +./pending/aws/aws_foundational_security_iam_6.yaml renamed successfully. +./pending/aws/aws_cis_v140_3_1.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_9.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_15.yaml renamed successfully. +./pending/aws/aws_cis_v150_5_1.yaml renamed successfully. +./pending/aws/aws_guardduty_centrally_configured.yaml renamed successfully. +./pending/aws/aws_elb_application_lb_listener_certificate_expire_7_days.yaml renamed successfully. +./pending/aws/aws_cis_v150_1_6.yaml renamed successfully. +./pending/aws/aws_emr_cluster_encryption_in_transit_enabled.yaml renamed successfully. +./pending/aws/aws_foundational_security_s3_2.yaml renamed successfully. +./pending/aws/aws_cis_v150_2_1_5.yaml renamed successfully. +./pending/aws/aws_cis_v200_1_6.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_10.yaml renamed successfully. +./pending/aws/aws_cis_v200_5_1.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_11.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_5.yaml renamed successfully. +./pending/aws/aws_cis_v300_5_4.yaml renamed successfully. +./pending/aws/aws_vpc_subnet_public_and_private.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_10.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_4.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_1.yaml renamed successfully. +./pending/aws/aws_foundational_security_rds_1.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_1.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_4.yaml renamed successfully. +./pending/aws/aws_elb_application_lb_listener_certificate_expire_30_days.yaml renamed successfully. +./pending/aws/aws_cis_v120_4_3.yaml renamed successfully. +./pending/aws/aws_foundational_security_s3_3.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_9.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_14.yaml renamed successfully. +./pending/aws/aws_glue_dev_endpoint_job_bookmarks_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_8.yaml renamed successfully. +./pending/aws/aws_foundational_security_iam_7.yaml renamed successfully. +./pending/aws/aws_foundational_security_rds_23.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_12.yaml renamed successfully. +./pending/aws/aws_cis_v130_1_6.yaml renamed successfully. +./pending/aws/aws_cis_v130_5_1.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_2.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_5.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_13.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_9.yaml renamed successfully. +./pending/aws/aws_cis_v200_3_1.yaml renamed successfully. +./pending/aws/aws_cloudfront_distribution_non_s3_origins_encryption_in_transit_enabled.yaml renamed successfully. +./pending/aws/aws_ec2_instance_no_iam_role_with_database_management_write_access.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_7.yaml renamed successfully. +./pending/aws/aws_foundational_security_ec2_25.yaml renamed successfully. +./pending/aws/aws_foundational_security_docdb_3.yaml renamed successfully. +./pending/aws/aws_cis_v150_1_20.yaml renamed successfully. +./pending/aws/aws_cis_v150_3_1.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_6.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_6.yaml renamed successfully. +./pending/aws/aws_foundational_security_rds_6.yaml renamed successfully. +./pending/aws/aws_cis_v130_4_2.yaml renamed successfully. +./pending/aws/aws_backup_report_plan_configured.yaml renamed successfully. +./pending/aws/aws_ec2_instance_no_iam_role_with_write_access_to_resource_based_policies.yaml renamed successfully. +./pending/aws/aws_ecs_cluster_instance_in_vpc.yaml renamed successfully. +./pending/aws/aws_cis_v140_1_6.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_15.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_16.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_10.yaml renamed successfully. +./pending/aws/aws_cis_v300_1_9.yaml renamed successfully. +./pending/aws/aws_lightsail_instance_ssh_restricted_ip.yaml renamed successfully. +./pending/aws/aws_cis_v130_3_1.yaml renamed successfully. +./pending/aws/aws_glue_job_cloudwatch_logs_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_11.yaml renamed successfully. +./pending/aws/aws_foundational_security_lambda_5.yaml renamed successfully. +./pending/aws/aws_cis_v140_4_4.yaml renamed successfully. +./pending/aws/aws_glue_job_s3_encryption_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v200_4_2.yaml renamed successfully. +./pending/aws/aws_iam_user_hardware_mfa_enabled.yaml renamed successfully. +./pending/aws/aws_cis_v120_3_7.yaml renamed successfully. +./pending/aws/aws_cis_v300_4_7.yaml renamed successfully. +./pending/aws/aws_cis_v300_1_22.yaml renamed successfully. +./pending/aws/aws_cis_v150_4_2.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_10.yaml renamed successfully. +./pending/aws/aws_cis_v120_1_6.yaml renamed successfully. diff --git a/queries/1-aws_insight_lambda_function_not_cmk_encrypted.yaml b/queries/1-aws_insight_lambda_function_not_cmk_encrypted.yaml old mode 100755 new mode 100644 index e86e4e3e5..eada871ea --- a/queries/1-aws_insight_lambda_function_not_cmk_encrypted.yaml +++ b/queries/1-aws_insight_lambda_function_not_cmk_encrypted.yaml @@ -1,16 +1,25 @@ Description: List of lambda functions which are not encrypted with CMK ID: aws_insight_lambda_function_not_cmk_encrypted IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_lambda_function + - aws_lambda_function Parameters: [] PrimaryTable: aws_lambda_function - QueryToExecute: "select\n name,\n kms_key_arn, account_id, og_account_id, og_resource_id\n\ - from\n aws_lambda_function\nwhere\n kms_key_arn is null;" + QueryToExecute: | + SELECT + name, + kms_key_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_lambda_function + WHERE + kms_key_arn IS NULL; Tags: category: - - Security -Title: Unencrypted Lambda + - Security +Title: Unencrypted Lambda \ No newline at end of file diff --git a/queries/10-aws_insight_acm_certificate_transparency_logging_disabled.yaml b/queries/10-aws_insight_acm_certificate_transparency_logging_disabled.yaml old mode 100755 new mode 100644 index dc1b76b74..913813d3f --- a/queries/10-aws_insight_acm_certificate_transparency_logging_disabled.yaml +++ b/queries/10-aws_insight_acm_certificate_transparency_logging_disabled.yaml @@ -1,19 +1,20 @@ Description: List certificates for which transparency logging is disabled ID: aws_insight_acm_certificate_transparency_logging_disabled IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_acm_certificate + - aws_acm_certificate Parameters: [] PrimaryTable: aws_acm_certificate - QueryToExecute: "select certificate_arn, domain_name, status, account_id, og_account_id,\ - \ og_resource_id from\n aws_acm_certificate\nwhere\n certificate_transparency_logging_preference\ - \ <> 'ENABLED';" + QueryToExecute: | + SELECT certificate_arn, domain_name, status, account_id, og_account_id, og_resource_id + FROM aws_acm_certificate + WHERE certificate_transparency_logging_preference <> 'ENABLED'; Tags: category: - - Security - - Technical Debt - - Resiliency -Title: Certificates with no Logging + - Security + - Technical Debt + - Resiliency +Title: Certificates with no Logging \ No newline at end of file diff --git a/queries/11-aws_insight_acm_certificate_expired.yaml b/queries/11-aws_insight_acm_certificate_expired.yaml old mode 100755 new mode 100644 index de2403e14..8fff50e34 --- a/queries/11-aws_insight_acm_certificate_expired.yaml +++ b/queries/11-aws_insight_acm_certificate_expired.yaml @@ -1,19 +1,26 @@ Description: List of expired certificates ID: aws_insight_acm_certificate_expired IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_acm_certificate + - aws_acm_certificate Parameters: [] PrimaryTable: aws_acm_certificate - QueryToExecute: "select certificate_arn, domain_name, status, account_id, og_account_id,\ - \ og_resource_id from\n aws_acm_certificate\nwhere\n status = 'EXPIRED';" + QueryToExecute: | + SELECT certificate_arn, + domain_name, + status, + account_id, + og_account_id, + og_resource_id + FROM aws_acm_certificate + WHERE status = 'EXPIRED'; Tags: category: - - Security - - Technical Debt - - Resiliency - - Cost Management -Title: Expired Certificates + - Security + - Technical Debt + - Resiliency + - Cost Management +Title: Expired Certificates \ No newline at end of file diff --git a/queries/12-aws_insight_ebs_snapshot_older_than_year.yaml b/queries/12-aws_insight_ebs_snapshot_older_than_year.yaml old mode 100755 new mode 100644 index bed4eee59..dff4210b7 --- a/queries/12-aws_insight_ebs_snapshot_older_than_year.yaml +++ b/queries/12-aws_insight_ebs_snapshot_older_than_year.yaml @@ -1,18 +1,20 @@ Description: List Snapshots older than 365 days ID: aws_insight_ebs_snapshot_older_than_year IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ebs_snapshot + - aws_ebs_snapshot Parameters: [] PrimaryTable: aws_ebs_snapshot - QueryToExecute: SELECT snapshot_id, arn, start_time, account_id, og_account_id, - og_resource_id FROM aws_ebs_snapshot WHERE start_time < now() - interval '1 year'; + QueryToExecute: | + SELECT snapshot_id, arn, start_time, account_id, og_account_id, og_resource_id + FROM aws_ebs_snapshot + WHERE start_time < NOW() - INTERVAL '1 year'; Tags: category: - - Security - - Technical Debt - - Cost Management -Title: Snapshots older than a year + - Security + - Technical Debt + - Cost Management +Title: Snapshots older than a year \ No newline at end of file diff --git a/queries/13-aws_insight_ec2_classic_load_balancer.yaml b/queries/13-aws_insight_ec2_classic_load_balancer.yaml old mode 100755 new mode 100644 index 74118958a..b7dd6bb1a --- a/queries/13-aws_insight_ec2_classic_load_balancer.yaml +++ b/queries/13-aws_insight_ec2_classic_load_balancer.yaml @@ -1,22 +1,29 @@ Description: List all Classic Load Balancer. Link here. ID: aws_insight_ec2_classic_load_balancer IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_classic_load_balancer + - aws_ec2_classic_load_balancer Parameters: [] PrimaryTable: aws_ec2_classic_load_balancer - QueryToExecute: SELECT name, arn, account_id, og_account_id, og_resource_id FROM - aws_ec2_classic_load_balancer + QueryToExecute: | + SELECT + NAME, + ARN, + ACCOUNT_ID, + OG_ACCOUNT_ID, + OG_RESOURCE_ID + FROM + AWS_EC2_CLASSIC_LOAD_BALANCER Tags: category: - - Security - - Technical Debt - - Resiliency + - Security + - Technical Debt + - Resiliency persona: - - Executive - - Product - - FinOps -Title: Classic Load Balancers + - Executive + - Product + - FinOps +Title: Classic Load Balancers \ No newline at end of file diff --git a/queries/14-aws_insight_elb_classic_lb_use_ssl_certificate.yaml b/queries/14-aws_insight_elb_classic_lb_use_ssl_certificate.yaml old mode 100755 new mode 100644 index b917d3792..c0aaf2f4b --- a/queries/14-aws_insight_elb_classic_lb_use_ssl_certificate.yaml +++ b/queries/14-aws_insight_elb_classic_lb_use_ssl_certificate.yaml @@ -1,29 +1,43 @@ -Description: List all Load Balancers with out SSL +Description: List all Load Balancers without SSL ID: aws_insight_elb_classic_lb_use_ssl_certificate IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_classic_load_balancer + - aws_ec2_classic_load_balancer Parameters: [] PrimaryTable: aws_ec2_classic_load_balancer - QueryToExecute: "with detailed_classic_listeners as (\n select\n name\n from\n\ - \ aws_ec2_classic_load_balancer,\n jsonb_array_elements(listener_descriptions)\ - \ as listener_description\n where\n listener_description -> 'Listener' ->>\ - \ 'Protocol' in ('HTTPS', 'SSL', 'TLS')\n and listener_description -> 'Listener'\ - \ ->> 'SSLCertificateId' like 'arn:aws:acm%'\n)\nselect\n -- Required Columns\n\ - \ 'arn:' || a.partition || ':elasticloadbalancing:' || a.region || ':' || a.account_id\ - \ || ':loadbalancer/' || a.name as resource,\n case\n when a.listener_descriptions\ - \ is null then 'skip'\n when b.name is not null then 'alarm'\n else 'ok'\n\ - \ end as status,\n case\n when a.listener_descriptions is null then a.title\ - \ || ' has no listener.'\n when b.name is not null then a.title || ' does not\ - \ use certificates provided by ACM.'\n else a.title || ' uses certificates\ - \ provided by ACM.'\n end as reason,\n -- Additional Dimensions\n region,\n\ - \ account_id, og_account_id, og_resource_id\nfrom\n aws_ec2_classic_load_balancer\ - \ as a\n left join detailed_classic_listeners as b on a.name = b.name;" + QueryToExecute: | + WITH detailed_classic_listeners AS ( + SELECT + name + FROM + aws_ec2_classic_load_balancer, + jsonb_array_elements(listener_descriptions) AS listener_description + WHERE + listener_description -> 'Listener' ->> 'Protocol' IN ('HTTPS', 'SSL', 'TLS') + AND listener_description -> 'Listener' ->> 'SSLCertificateId' LIKE 'arn:aws:acm%' + ) + SELECT + 'arn:' || a.partition || ':elasticloadbalancing:' || a.region || ':' || a.account_id || ':loadbalancer/' || a.name AS resource, + CASE + WHEN a.listener_descriptions IS NULL THEN 'skip' + WHEN b.name IS NOT NULL THEN 'alarm' + ELSE 'ok' + END AS status, + CASE + WHEN a.listener_descriptions IS NULL THEN a.title || ' has no listener.' + WHEN b.name IS NOT NULL THEN a.title || ' does not use certificates provided by ACM.' + ELSE a.title || ' uses certificates provided by ACM.' + END AS reason, + region, + account_id, og_account_id, og_resource_id + FROM + aws_ec2_classic_load_balancer AS a + LEFT JOIN detailed_classic_listeners AS b ON a.name = b.name; Tags: category: - - Security - - Technical Debt -Title: Load Balancers with no SSL + - Security + - Technical Debt +Title: Load Balancers with no SSL \ No newline at end of file diff --git a/queries/15-aws_insight_elb_application_lb_waf_enabled.yaml b/queries/15-aws_insight_elb_application_lb_waf_enabled.yaml old mode 100755 new mode 100644 index 997544bc6..db36833be --- a/queries/15-aws_insight_elb_application_lb_waf_enabled.yaml +++ b/queries/15-aws_insight_elb_application_lb_waf_enabled.yaml @@ -1,22 +1,32 @@ Description: List all ELB with no WAF. ID: aws_insight_elb_application_lb_waf_enabled IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_application_load_balancer + - aws_ec2_application_load_balancer Parameters: [] PrimaryTable: aws_ec2_application_load_balancer - QueryToExecute: "select\n -- Required Columns\n arn as resource, account_id, og_account_id,\ - \ og_resource_id,\n case\n when load_balancer_attributes @> '[{\"Key\":\"\ - waf.fail_open.enabled\",\"Value\":\"true\"}]' then 'ok'\n else 'alarm'\n end\ - \ as status,\n case\n when load_balancer_attributes @> '[{\"Key\":\"waf.fail_open.enabled\"\ - ,\"Value\":\"true\"}]' then title || ' WAF enabled.'\n else title || ' WAF\ - \ disabled.'\n end as reason,\n -- Additional Dimensions\n region \nfrom\n\ - \ aws_ec2_application_load_balancer;" + QueryToExecute: | + SELECT + arn AS resource, + account_id, + og_account_id, + og_resource_id, + CASE + WHEN load_balancer_attributes @> '[{"Key":"waf.fail_open.enabled","Value":"true"}]' THEN 'ok' + ELSE 'alarm' + END AS status, + CASE + WHEN load_balancer_attributes @> '[{"Key":"waf.fail_open.enabled","Value":"true"}]' THEN title || ' WAF enabled.' + ELSE title || ' WAF disabled.' + END AS reason, + region + FROM + aws_ec2_application_load_balancer; Tags: category: - - Security - - Technical Debt -Title: Load Balancers with no WAF + - Security + - Technical Debt +Title: Load Balancers with no WAF \ No newline at end of file diff --git a/queries/16-aws_insight_vpc_with_public_cidr.yaml b/queries/16-aws_insight_vpc_with_public_cidr.yaml old mode 100755 new mode 100644 index 4bce8148d..4ff71ce8b --- a/queries/16-aws_insight_vpc_with_public_cidr.yaml +++ b/queries/16-aws_insight_vpc_with_public_cidr.yaml @@ -1,21 +1,32 @@ Description: List VPCs with public CIDR blocks ID: aws_insight_vpc_with_public_cidr IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_vpc + - aws_vpc Parameters: [] PrimaryTable: aws_vpc - QueryToExecute: "select\n vpc_id,\n cidr_block,\n state,\n region, account_id,\ - \ og_account_id, og_resource_id\nfrom\n aws_vpc\nwhere\n (not cidr_block <<=\ - \ '10.0.0.0/8'\n and not cidr_block <<= '192.168.0.0/16'\n and not cidr_block\ - \ <<= '172.16.0.0/12');" + QueryToExecute: | + SELECT + vpc_id, + cidr_block, + state, + region, + account_id, + og_account_id, + og_resource_id + FROM + aws_vpc + WHERE + (NOT cidr_block <<= '10.0.0.0/8' + AND NOT cidr_block <<= '192.168.0.0/16' + AND NOT cidr_block <<= '172.16.0.0/12'); Tags: category: - - Security - - Technical Debt - - Resiliency - - Cost Management -Title: VPCs with Public IP Range + - Security + - Technical Debt + - Resiliency + - Cost Management +Title: VPCs with Public IP Range \ No newline at end of file diff --git a/queries/17-azure_insight_compute_disk_unattached.yaml b/queries/17-azure_insight_compute_disk_unattached.yaml old mode 100755 new mode 100644 index c8f6f0d8b..80770222c --- a/queries/17-azure_insight_compute_disk_unattached.yaml +++ b/queries/17-azure_insight_compute_disk_unattached.yaml @@ -1,17 +1,26 @@ Description: List of unattached Disks ID: azure_insight_compute_disk_unattached IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_compute_disk + - azure_compute_disk Parameters: [] PrimaryTable: azure_compute_disk - QueryToExecute: "select\n name,\n disk_state, subscription_id, og_account_id,\ - \ og_resource_id\nfrom\n azure_compute_disk\nwhere\n disk_state = 'Unattached';" + QueryToExecute: | + SELECT + name, + disk_state, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_compute_disk + WHERE + disk_state = 'Unattached'; Tags: category: - - Technical Debt - - Cost Management -Title: Unused Azure Disks + - Technical Debt + - Cost Management +Title: Unused Azure Disks \ No newline at end of file diff --git a/queries/18-azure_insight_compute_disk_unavailable_in_multiple_az.yaml b/queries/18-azure_insight_compute_disk_unavailable_in_multiple_az.yaml old mode 100755 new mode 100644 index 77612a5d0..2a627453d --- a/queries/18-azure_insight_compute_disk_unavailable_in_multiple_az.yaml +++ b/queries/18-azure_insight_compute_disk_unavailable_in_multiple_az.yaml @@ -1,19 +1,29 @@ Description: List of compute disks which are not available in multiple az ID: azure_insight_compute_disk_unavailable_in_multiple_az IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_compute_disk + - azure_compute_disk Parameters: [] PrimaryTable: azure_compute_disk - QueryToExecute: "select\n name,\n az,\n region, subscription_id, og_account_id,\ - \ og_resource_id\nfrom\n azure_compute_disk\n cross join jsonb_array_elements(zones)\ - \ az\nwhere\n zones is not null;" + QueryToExecute: | + SELECT + name, + az, + region, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_compute_disk + CROSS JOIN jsonb_array_elements(zones) az + WHERE + zones IS NOT NULL; Tags: category: - - Security - - Technical Debt - - Resiliency -Title: Non-Resiliency Azure Disks + - Security + - Technical Debt + - Resiliency +Title: Non-Resiliency Azure Disks \ No newline at end of file diff --git a/queries/19-azure_insight_compute_disk_not_encrypted_with_customer_key.yaml b/queries/19-azure_insight_compute_disk_not_encrypted_with_customer_key.yaml old mode 100755 new mode 100644 index 6ba8d72b7..f0ca3d8d2 --- a/queries/19-azure_insight_compute_disk_not_encrypted_with_customer_key.yaml +++ b/queries/19-azure_insight_compute_disk_not_encrypted_with_customer_key.yaml @@ -1,21 +1,30 @@ Description: List of compute disks which are not encrypted with customer key ID: azure_insight_compute_disk_not_encrypted_with_customer_key IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_compute_disk + - azure_compute_disk Parameters: [] PrimaryTable: azure_compute_disk - QueryToExecute: "select\n name,\n encryption_type, subscription_id, og_account_id,\ - \ og_resource_id\nfrom\n azure_compute_disk\nwhere\n encryption_type <> 'EncryptionAtRestWithCustomerKey';" + QueryToExecute: | + SELECT + name, + encryption_type, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_compute_disk + WHERE + encryption_type <> 'EncryptionAtRestWithCustomerKey'; Tags: category: - - Security - - Technical Debt + - Security + - Technical Debt persona: - - Security - - DevOps - - Product -Title: Unecrypted Disks + - Security + - DevOps + - Product +Title: Unecrypted Disks \ No newline at end of file diff --git a/queries/2-aws_insight_lambda_function_retention_period_less_than_30_days.yaml b/queries/2-aws_insight_lambda_function_retention_period_less_than_30_days.yaml old mode 100755 new mode 100644 index ae1998de2..08b1c3023 --- a/queries/2-aws_insight_lambda_function_retention_period_less_than_30_days.yaml +++ b/queries/2-aws_insight_lambda_function_retention_period_less_than_30_days.yaml @@ -1,21 +1,35 @@ -Description: List of lambda function whose retention period is less than 30 days +Description: List of Lambda functions whose retention period is less than 30 days ID: aws_insight_lambda_function_retention_period_less_than_30_days +Title: Lambda Functions with Retention Under 30 Days IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_lambda_function - - aws_cloudwatch_log_group + - aws_lambda_function + - aws_cloudwatch_log_group Parameters: [] PrimaryTable: null - QueryToExecute: "select\n fn.name,\n lg.name,\n lg.retention_in_days, fn.account_id,\ - \ fn.og_account_id, fn.og_resource_id\nfrom\n aws_lambda_function as fn\n inner\ - \ join aws_cloudwatch_log_group as lg on (\n lg.og_account_id = fn.og_account_id\ - \ AND ((lg.name = '/aws/lambda/')\n or (lg.name = fn.name))\n )\nwhere\n \ - \ lg.retention_in_days < 30" + QueryToExecute: | + SELECT + fn.name, + lg.name, + lg.retention_in_days, + fn.account_id, + fn.og_account_id, + fn.og_resource_id + FROM + aws_lambda_function AS fn + INNER JOIN aws_cloudwatch_log_group AS lg ON ( + lg.og_account_id = fn.og_account_id + AND ( + lg.name = '/aws/lambda/' OR + lg.name = fn.name + ) + ) + WHERE + lg.retention_in_days < 30 Tags: category: - - Technical Debt - - Resiliency -Title: '' + - Technical Debt + - Resiliency diff --git a/queries/20-azure_insight_cosmosdb_account_with_disabled_automatic_failover.yaml b/queries/20-azure_insight_cosmosdb_account_with_disabled_automatic_failover.yaml old mode 100755 new mode 100644 index dfe59aaac..81d54ef9b --- a/queries/20-azure_insight_cosmosdb_account_with_disabled_automatic_failover.yaml +++ b/queries/20-azure_insight_cosmosdb_account_with_disabled_automatic_failover.yaml @@ -1,17 +1,27 @@ Description: List of database accounts where automatic failover is not enabled ID: azure_insight_cosmosdb_account_with_disabled_automatic_failover IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_cosmosdb_account + - azure_cosmosdb_account Parameters: [] PrimaryTable: azure_cosmosdb_account - QueryToExecute: "select\n name,\n region,\n enable_automatic_failover,\n resource_group,\ - \ subscription_id, og_account_id, og_resource_id\nfrom\n azure_cosmosdb_account\n\ - where\n not enable_automatic_failover;" + QueryToExecute: | + SELECT + name, + region, + enable_automatic_failover, + resource_group, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_cosmosdb_account + WHERE + NOT enable_automatic_failover; Tags: category: - - Resiliency -Title: Database with no Auto Failover + - Resiliency +Title: Database with no Auto Failover \ No newline at end of file diff --git a/queries/21-azure_insight_cosmosdb_account_which_allows_traffic_from_all_networks_and_internet.yaml b/queries/21-azure_insight_cosmosdb_account_which_allows_traffic_from_all_networks_and_internet.yaml old mode 100755 new mode 100644 index 9635a3734..a6ac209e5 --- a/queries/21-azure_insight_cosmosdb_account_which_allows_traffic_from_all_networks_and_internet.yaml +++ b/queries/21-azure_insight_cosmosdb_account_which_allows_traffic_from_all_networks_and_internet.yaml @@ -1,19 +1,27 @@ -Description: List of database accounts which allows traffic from all networks, including - the public Internet. +Description: List of database accounts which allows traffic from all networks, including the public Internet. ID: azure_insight_cosmosdb_account_which_allows_traffic_from_all_networks_and_internet IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_cosmosdb_account + - azure_cosmosdb_account Parameters: [] PrimaryTable: azure_cosmosdb_account - QueryToExecute: "select\n name,\n region,\n virtual_network_rules, subscription_id,\ - \ og_account_id, og_resource_id\nfrom\n azure_cosmosdb_account\nwhere\n virtual_network_rules\ - \ = '[]';" + QueryToExecute: | + SELECT + name, + region, + virtual_network_rules, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_cosmosdb_account + WHERE + virtual_network_rules = '[]'; Tags: category: - - Security - - Technical Debt -Title: Database Accounts with Public access + - Security + - Technical Debt +Title: Database Accounts with Public access \ No newline at end of file diff --git a/queries/22-azure_insight_key_vault_with_disabled_soft_delete.yaml b/queries/22-azure_insight_key_vault_with_disabled_soft_delete.yaml old mode 100755 new mode 100644 index ef8d41ccc..58c5481fe --- a/queries/22-azure_insight_key_vault_with_disabled_soft_delete.yaml +++ b/queries/22-azure_insight_key_vault_with_disabled_soft_delete.yaml @@ -1,19 +1,29 @@ Description: List of key vaults where soft deletion is not enabled ID: azure_insight_key_vault_with_disabled_soft_delete IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_key_vault + - azure_key_vault Parameters: [] PrimaryTable: azure_key_vault - QueryToExecute: "select\n name,\n id,\n soft_delete_enabled,\n soft_delete_retention_in_days,\ - \ subscription_id, og_account_id, og_resource_id\nfrom\n azure_key_vault\nwhere\n\ - \ not soft_delete_enabled;" + QueryToExecute: | + SELECT + name, + id, + soft_delete_enabled, + soft_delete_retention_in_days, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_key_vault + WHERE + NOT soft_delete_enabled; Tags: category: - - Security - - Technical Debt - - Resiliency -Title: Key Vaults with no Deletion Protection + - Security + - Technical Debt + - Resiliency +Title: Key Vaults with no Deletion Protection \ No newline at end of file diff --git a/queries/23-azure_insight_kubernetes_cluster_with_rbac_disabled.yaml b/queries/23-azure_insight_kubernetes_cluster_with_rbac_disabled.yaml old mode 100755 new mode 100644 index 0707b694d..cc11a4c40 --- a/queries/23-azure_insight_kubernetes_cluster_with_rbac_disabled.yaml +++ b/queries/23-azure_insight_kubernetes_cluster_with_rbac_disabled.yaml @@ -1,17 +1,30 @@ Description: List clusters that have role-based access control (RBAC) disabled ID: azure_insight_kubernetes_cluster_with_rbac_disabled IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_kubernetes_cluster + - azure_kubernetes_cluster Parameters: [] PrimaryTable: azure_kubernetes_cluster - QueryToExecute: "select\n name,\n id,\n location,\n type,\n identity,\n enable_rbac,\n\ - \ sku, subscription_id, og_account_id, og_resource_id\nfrom\n azure_kubernetes_cluster\n\ - where\n not enable_rbac;" + QueryToExecute: | + SELECT + name, + id, + location, + type, + identity, + enable_rbac, + sku, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_kubernetes_cluster + WHERE + NOT enable_rbac; Tags: category: - - Security -Title: Clusters with no RBAC + - Security +Title: Clusters with no RBAC \ No newline at end of file diff --git a/queries/24-azure_insight_kubernetes_cluster_with_undesired_version.yaml b/queries/24-azure_insight_kubernetes_cluster_with_undesired_version.yaml old mode 100755 new mode 100644 index 2b3737f34..d948f732d --- a/queries/24-azure_insight_kubernetes_cluster_with_undesired_version.yaml +++ b/queries/24-azure_insight_kubernetes_cluster_with_undesired_version.yaml @@ -1,23 +1,34 @@ Description: List clusters with an undesirable version (older than 1.20.5) ID: azure_insight_kubernetes_cluster_with_undesired_version IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_kubernetes_cluster + - azure_kubernetes_cluster Parameters: [] PrimaryTable: azure_kubernetes_cluster - QueryToExecute: "select\n name,\n id,\n location,\n type,\n kubernetes_version,\ - \ subscription_id, og_account_id, og_resource_id\nfrom\n azure_kubernetes_cluster\n\ - where\n kubernetes_version < '1.24';" + QueryToExecute: | + SELECT + name, + id, + location, + type, + kubernetes_version, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_kubernetes_cluster + WHERE + kubernetes_version < '1.24'; Tags: category: - - Security - - Technical Debt - - Resiliency + - Security + - Technical Debt + - Resiliency persona: - - Executive - - Product - - FinOps -Title: Legacy Kubernetes Clusters + - Executive + - Product + - FinOps +Title: Legacy Kubernetes Clusters \ No newline at end of file diff --git a/queries/25-azure_insight_lb_failed.yaml b/queries/25-azure_insight_lb_failed.yaml old mode 100755 new mode 100644 index 19fe4c6c3..b3a91e606 --- a/queries/25-azure_insight_lb_failed.yaml +++ b/queries/25-azure_insight_lb_failed.yaml @@ -1,20 +1,30 @@ Description: List failed load balancers ID: azure_insight_lb_failed IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_lb + - azure_lb Parameters: [] PrimaryTable: azure_lb - QueryToExecute: "select\n id,\n name,\n type,\n provisioning_state, subscription_id,\ - \ og_account_id, og_resource_id\nfrom\n azure_lb\nwhere\n provisioning_state\ - \ = 'Failed';" + QueryToExecute: | + SELECT + id, + name, + type, + provisioning_state, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_lb + WHERE + provisioning_state = 'Failed'; Tags: category: - - Security - - Technical Debt - - Resiliency - - Cost Management -Title: Unhealthy Load Balancers + - Security + - Technical Debt + - Resiliency + - Cost Management +Title: Unhealthy Load Balancers \ No newline at end of file diff --git a/queries/26-azure_insight_compute_availability_set_without_managed_disk_configuration.yaml b/queries/26-azure_insight_compute_availability_set_without_managed_disk_configuration.yaml old mode 100755 new mode 100644 index bf476ca3c..7d45ac6d7 --- a/queries/26-azure_insight_compute_availability_set_without_managed_disk_configuration.yaml +++ b/queries/26-azure_insight_compute_availability_set_without_managed_disk_configuration.yaml @@ -1,19 +1,28 @@ Description: List of availability sets which does not use managed disks configuration ID: azure_insight_compute_availability_set_without_managed_disk_configuration IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_compute_availability_set + - azure_compute_availability_set Parameters: [] PrimaryTable: azure_compute_availability_set - QueryToExecute: "select\n name,\n sku_name, subscription_id, og_account_id, og_resource_id\n\ - from\n azure_compute_availability_set\nwhere\n sku_name = 'Classic';" + QueryToExecute: | + SELECT + name, + sku_name, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_compute_availability_set + WHERE + sku_name = 'Classic'; Tags: category: - - Security - - Technical Debt - - Resiliency - - Cost Management -Title: AV Sets with Legacy Disks + - Security + - Technical Debt + - Resiliency + - Cost Management +Title: AV Sets with Legacy Disks \ No newline at end of file diff --git a/queries/27-azure_insight_mysql_server_with_minimum_ssl_older_than_1_point_2.yaml b/queries/27-azure_insight_mysql_server_with_minimum_ssl_older_than_1_point_2.yaml old mode 100755 new mode 100644 index 1e923cbab..725204140 --- a/queries/27-azure_insight_mysql_server_with_minimum_ssl_older_than_1_point_2.yaml +++ b/queries/27-azure_insight_mysql_server_with_minimum_ssl_older_than_1_point_2.yaml @@ -1,19 +1,29 @@ Description: List servers with minimum TLS version lower than 1.2 ID: azure_insight_mysql_server_with_minimum_ssl_older_than_1_point_2 IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_mysql_server + - azure_mysql_server Parameters: [] PrimaryTable: azure_mysql_server - QueryToExecute: "select\n name,\n id,\n minimal_tls_version, subscription_id,\ - \ og_account_id, og_resource_id\nfrom\n azure_mysql_server\nwhere\n (minimal_tls_version\ - \ = 'TLS1_0'\n or minimal_tls_version = 'TLS1_1');" + QueryToExecute: | + SELECT + name, + id, + minimal_tls_version, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_mysql_server + WHERE + minimal_tls_version = 'TLS1_0' + OR minimal_tls_version = 'TLS1_1'; Tags: category: - - Security - - Technical Debt - - Cost Management -Title: Servers with Vulnerable TLSA + - Security + - Technical Debt + - Cost Management +Title: Servers with Vulnerable TLS \ No newline at end of file diff --git a/queries/28-azure_insight_virtual_network_with_public_cidr.yaml b/queries/28-azure_insight_virtual_network_with_public_cidr.yaml old mode 100755 new mode 100644 index 7824b3950..5f13f6f4d --- a/queries/28-azure_insight_virtual_network_with_public_cidr.yaml +++ b/queries/28-azure_insight_virtual_network_with_public_cidr.yaml @@ -1,21 +1,34 @@ Description: List Virtual Networks with public CIDR blocks ID: azure_insight_virtual_network_with_public_cidr IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_virtual_network + - azure_virtual_network Parameters: [] PrimaryTable: azure_virtual_network - QueryToExecute: "select\n name,\n cidr_block,\n region,\n resource_group, subscription_id,\ - \ og_account_id, og_resource_id\nfrom\n azure_virtual_network\n cross join jsonb_array_elements_text(address_prefixes)\ - \ as cidr_block\nwhere\n (not cidr_block :: cidr <<= '10.0.0.0/16'\n and not\ - \ cidr_block :: cidr <<= '192.168.0.0/16'\n and not cidr_block :: cidr <<= '172.16.0.0/12');" + QueryToExecute: | + SELECT + name, + cidr_block, + region, + resource_group, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_virtual_network + CROSS JOIN + jsonb_array_elements_text(address_prefixes) AS cidr_block + WHERE + NOT cidr_block::cidr <<= '10.0.0.0/16' + AND NOT cidr_block::cidr <<= '192.168.0.0/16' + AND NOT cidr_block::cidr <<= '172.16.0.0/12'; Tags: category: - - Security - - Technical Debt - - Resiliency - - Resiliency -Title: vNets with Public IP Range + - Security + - Technical Debt + - Resiliency + - Resiliency +Title: vNets with Public IP Range \ No newline at end of file diff --git a/queries/29-azure_insight_storage_account_with_public_blob_access.yaml b/queries/29-azure_insight_storage_account_with_public_blob_access.yaml old mode 100755 new mode 100644 index 351c60d49..7cfcf8ddb --- a/queries/29-azure_insight_storage_account_with_public_blob_access.yaml +++ b/queries/29-azure_insight_storage_account_with_public_blob_access.yaml @@ -1,18 +1,27 @@ Description: List storage accounts that allow blob public access ID: azure_insight_storage_account_with_public_blob_access IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_storage_account + - azure_storage_account Parameters: [] PrimaryTable: azure_storage_account - QueryToExecute: "select\n name,\n allow_blob_public_access, subscription_id, og_account_id,\ - \ og_resource_id\nfrom\n azure_storage_account\nwhere\n allow_blob_public_access;" + QueryToExecute: | + SELECT + name, + allow_blob_public_access, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_storage_account + WHERE + allow_blob_public_access; Tags: category: - - Security - - Technical Debt - - Resiliency -Title: Storage Accounts with Public Internet + - Security + - Technical Debt + - Resiliency +Title: Storage Accounts with Public Internet \ No newline at end of file diff --git a/queries/3-aws_insight_lambda_function_with_unsupported_engine.yaml b/queries/3-aws_insight_lambda_function_with_unsupported_engine.yaml old mode 100755 new mode 100644 index 961be6f56..898c43a09 --- a/queries/3-aws_insight_lambda_function_with_unsupported_engine.yaml +++ b/queries/3-aws_insight_lambda_function_with_unsupported_engine.yaml @@ -1,27 +1,52 @@ Description: List Lambda Functions which are using unsupported engines ID: aws_insight_lambda_function_with_unsupported_engine IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_lambda_function + - aws_lambda_function Parameters: [] PrimaryTable: aws_lambda_function - QueryToExecute: select name, runtime, handler, arn, account_id, og_account_id, og_resource_id - from aws_lambda_function WHERE (runtime != 'nodejs18.x' AND runtime != 'nodejs16.x' - AND runtime != 'nodejs14.x' AND runtime != 'python3.11' AND runtime != 'python3.10' - AND runtime != 'python3.9' AND runtime != 'python3.8' AND runtime != 'python3.7' - AND runtime != 'java17' AND runtime != 'java11' AND runtime != 'java8.al2' AND - runtime != 'java8' AND runtime != 'dotnet7' AND runtime != 'dotnet6' AND runtime - != 'go1.x' AND runtime != 'ruby3.2' AND runtime != 'ruby2.7' AND runtime != 'provided.al2' - AND runtime != 'provided'); + QueryToExecute: | + SELECT + name, + runtime, + handler, + arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_lambda_function + WHERE + runtime NOT IN ( + 'nodejs18.x', + 'nodejs16.x', + 'nodejs14.x', + 'python3.11', + 'python3.10', + 'python3.9', + 'python3.8', + 'python3.7', + 'java17', + 'java11', + 'java8.al2', + 'java8', + 'dotnet7', + 'dotnet6', + 'go1.x', + 'ruby3.2', + 'ruby2.7', + 'provided.al2', + 'provided' + ); Tags: category: - - Technical Debt - - Resiliency + - Technical Debt + - Resiliency persona: - - Executive - - Product - - FinOps -Title: List Lambda Functions with unsupported engines + - Executive + - Product + - FinOps +Title: List Lambda Functions with unsupported engines \ No newline at end of file diff --git a/queries/30-azure_insight_storage_account_with_disabled_encryption_in_transit.yaml b/queries/30-azure_insight_storage_account_with_disabled_encryption_in_transit.yaml old mode 100755 new mode 100644 index f78b57479..e0107273c --- a/queries/30-azure_insight_storage_account_with_disabled_encryption_in_transit.yaml +++ b/queries/30-azure_insight_storage_account_with_disabled_encryption_in_transit.yaml @@ -1,18 +1,27 @@ Description: List storage accounts with encryption in transit disabled ID: azure_insight_storage_account_with_disabled_encryption_in_transit IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_storage_account + - azure_storage_account Parameters: [] PrimaryTable: azure_storage_account - QueryToExecute: "select\n name,\n enable_https_traffic_only, subscription_id,\ - \ og_account_id, og_resource_id\nfrom\n azure_storage_account\nwhere\n not enable_https_traffic_only;" + QueryToExecute: | + SELECT + name, + enable_https_traffic_only, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_storage_account + WHERE + NOT enable_https_traffic_only; Tags: category: - - Security - - Technical Debt - - Resiliency -Title: Storage Accounts No Unecrypted Transit + - Security + - Technical Debt + - Resiliency +Title: Storage Accounts No Unencrypted Transit \ No newline at end of file diff --git a/queries/31-azure_compute_vm_remote_access_restricted_all_ports.yaml b/queries/31-azure_compute_vm_remote_access_restricted_all_ports.yaml old mode 100755 new mode 100644 index 22371883f..a3042472e --- a/queries/31-azure_compute_vm_remote_access_restricted_all_ports.yaml +++ b/queries/31-azure_compute_vm_remote_access_restricted_all_ports.yaml @@ -1,31 +1,49 @@ Description: VMs with restricts remote access from internet ID: azure_insight_compute_vm_remote_access_restricted_all_ports IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_compute_disk + - azure_compute_disk Parameters: [] PrimaryTable: azure_compute_disk - QueryToExecute: "with network_sg as (\n select\n distinct name as sg_name,\n\ - \ network_interfaces\n from\n azure_network_security_group as nsg,\n \ - \ jsonb_array_elements(security_rules) as sg,\n jsonb_array_elements_text(sg\ - \ -> 'properties' -> 'destinationPortRanges' || (sg -> 'properties' -> 'destinationPortRange')\ - \ :: jsonb) as dport,\n jsonb_array_elements_text(sg -> 'properties' -> 'sourceAddressPrefixes'\ - \ || (sg -> 'properties' -> 'sourceAddressPrefix') :: jsonb) as sip\n where\n\ - \ sg -> 'properties' ->> 'access' = 'Allow'\n and sg -> 'properties' ->>\ - \ 'direction' = 'Inbound'\n and sg -> 'properties' ->> 'protocol' in ('TCP','*')\n\ - \ and sip in ('*', '0.0.0.0', '0.0.0.0/0', 'Internet', '/0', '/0')\n)\n\ - select\n vm.vm_id as resource,\n vm.subscription_id, vm.og_account_id, vm.og_resource_id,\n\ - \ case\n when sg.sg_name is null then 'ok'\n else 'alarm'\n end as status,\n\ - \ case\n when sg.sg_name is null then vm.title || ' restricts remote access\ - \ from internet.'\n else vm.title || ' allows remote access from internet.'\n\ - \ end as reason\n \n , vm.resource_group as resource_group\n , sub.display_name\ - \ as subscription\nfrom\n azure_compute_virtual_machine as vm\n left join network_sg\ - \ as sg on sg.network_interfaces @> vm.network_interfaces\n join azure_subscription\ - \ as sub on sub.subscription_id = vm.subscription_id;" + QueryToExecute: | + WITH network_sg AS ( + SELECT + DISTINCT name AS sg_name, + network_interfaces + FROM + azure_network_security_group AS nsg, + jsonb_array_elements(security_rules) AS sg, + jsonb_array_elements_text(sg -> 'properties' -> 'destinationPortRanges' || (sg -> 'properties' -> 'destinationPortRange')::jsonb) AS dport, + jsonb_array_elements_text(sg -> 'properties' -> 'sourceAddressPrefixes' || (sg -> 'properties' -> 'sourceAddressPrefix')::jsonb) AS sip + WHERE + sg -> 'properties' ->> 'access' = 'Allow' + AND sg -> 'properties' ->> 'direction' = 'Inbound' + AND sg -> 'properties' ->> 'protocol' IN ('TCP', '*') + AND sip IN ('*', '0.0.0.0', '0.0.0.0/0', 'Internet', '/0', '/0') + ) + SELECT + vm.vm_id AS resource, + vm.subscription_id, + vm.og_account_id, + vm.og_resource_id, + CASE + WHEN sg.sg_name IS NULL THEN 'ok' + ELSE 'alarm' + END AS status, + CASE + WHEN sg.sg_name IS NULL THEN vm.title || ' restricts remote access from internet.' + ELSE vm.title || ' allows remote access from internet.' + END AS reason, + vm.resource_group AS resource_group, + sub.display_name AS subscription + FROM + azure_compute_virtual_machine AS vm + LEFT JOIN network_sg AS sg ON sg.network_interfaces @> vm.network_interfaces + JOIN azure_subscription AS sub ON sub.subscription_id = vm.subscription_id Tags: category: - - Security -Title: VMs with restricts remote access from internet + - Security +Title: VMs with restricts remote access from internet \ No newline at end of file diff --git a/queries/32-aws_insight_loadbalancer_classic_no_logging.yaml b/queries/32-aws_insight_loadbalancer_classic_no_logging.yaml old mode 100755 new mode 100644 index 604cb06f5..da750f110 --- a/queries/32-aws_insight_loadbalancer_classic_no_logging.yaml +++ b/queries/32-aws_insight_loadbalancer_classic_no_logging.yaml @@ -1,20 +1,28 @@ Description: List classic Load Balancers without logging ID: aws_insight_loadbalancer_classic_no_logging IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_classic_load_balancer + - aws_ec2_classic_load_balancer Parameters: [] PrimaryTable: aws_ec2_classic_load_balancer - QueryToExecute: "select\n name,\n access_log_enabled, account_id, og_account_id,\ - \ og_resource_id\nfrom\n aws_ec2_classic_load_balancer\nwhere\n access_log_enabled\ - \ = 'false';" + QueryToExecute: | + SELECT + name, + access_log_enabled, + account_id, + og_account_id, + og_resource_id + FROM + aws_ec2_classic_load_balancer + WHERE + access_log_enabled = 'false'; Tags: category: - - Technical Debt + - Technical Debt persona: - - Security - - DevOps -Title: Classic Load Balancers without logging + - Security + - DevOps +Title: Classic Load Balancers without logging \ No newline at end of file diff --git a/queries/33-aws_insight_loadbalancer_application_no_logging.yaml b/queries/33-aws_insight_loadbalancer_application_no_logging.yaml old mode 100755 new mode 100644 index eb5a57e91..f8dc4bfa7 --- a/queries/33-aws_insight_loadbalancer_application_no_logging.yaml +++ b/queries/33-aws_insight_loadbalancer_application_no_logging.yaml @@ -1,21 +1,32 @@ Description: List application Load Balancers without logging ID: aws_insight_loadbalancer_application_no_logging IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_application_load_balancer + - aws_ec2_application_load_balancer Parameters: [] PrimaryTable: aws_ec2_application_load_balancer - QueryToExecute: "select\n name,\n lb ->> 'Key' as logging_key,\n lb ->> 'Value'\ - \ as logging_value, account_id, og_account_id, og_resource_id \nfrom\n aws_ec2_application_load_balancer\n\ - \ cross join jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb\ - \ ->> 'Key' = 'access_logs.s3.enabled'\n and lb ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS logging_key, + lb ->> 'Value' AS logging_value, + account_id, + og_account_id, + og_resource_id + FROM + aws_ec2_application_load_balancer + CROSS JOIN + jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'access_logs.s3.enabled' + AND lb ->> 'Value' = 'false'; Tags: category: - - Technical Debt + - Technical Debt persona: - - Security - - DevOps -Title: Application Load Balancers without logging + - Security + - DevOps +Title: Application Load Balancers without logging \ No newline at end of file diff --git a/queries/34-aws_insight_loadbalancer_network_no_logging.yaml b/queries/34-aws_insight_loadbalancer_network_no_logging.yaml old mode 100755 new mode 100644 index 13ea69811..13dbd6edf --- a/queries/34-aws_insight_loadbalancer_network_no_logging.yaml +++ b/queries/34-aws_insight_loadbalancer_network_no_logging.yaml @@ -1,21 +1,31 @@ Description: List network Load Balancers without logging ID: aws_insight_loadbalancer_network_no_logging IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_network_load_balancer + - aws_ec2_network_load_balancer Parameters: [] PrimaryTable: aws_ec2_network_load_balancer - QueryToExecute: "select\n name,\n lb ->> 'Key' as logging_key,\n lb ->> 'Value'\ - \ as logging_value, account_id, og_account_id, og_resource_id\nfrom\n aws_ec2_network_load_balancer\n\ - \ cross join jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb\ - \ ->> 'Key' = 'access_logs.s3.enabled'\n and lb ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS logging_key, + lb ->> 'Value' AS logging_value, + account_id, + og_account_id, + og_resource_id + FROM + aws_ec2_network_load_balancer + CROSS JOIN jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'access_logs.s3.enabled' + AND lb ->> 'Value' = 'false'; Tags: category: - - Technical Debt + - Technical Debt persona: - - Security - - DevOps -Title: Network Load Balancers without logging + - Security + - DevOps +Title: Network Load Balancers without logging \ No newline at end of file diff --git a/queries/35-azure_insight_functionapp_with_unsupported_runtime.yaml b/queries/35-azure_insight_functionapp_with_unsupported_runtime.yaml old mode 100755 new mode 100644 index 9d4ce1668..b3272c337 --- a/queries/35-azure_insight_functionapp_with_unsupported_runtime.yaml +++ b/queries/35-azure_insight_functionapp_with_unsupported_runtime.yaml @@ -1,33 +1,80 @@ Description: List Function Apps with unsupported runtime ID: azure_insight_functionapp_with_unsupported_runtime IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_app_service_function_app + - azure_app_service_function_app Parameters: [] PrimaryTable: azure_app_service_function_app - QueryToExecute: "SELECT \n id, language_runtime_type, language_runtime_version,\ - \ subscription_id, og_account_id, og_resource_id\nFROM azure_app_service_function_app\n\ - WHERE ( \n (\n language_runtime_type = 'dotnet' AND (\n language_runtime_version\ - \ != '6' AND\n language_runtime_version != '7'\n )\n ) OR (\n language_runtime_type\ - \ = 'dotnetcore' AND (\n language_runtime_version != 'v4.0' AND\n language_runtime_version\ - \ != 'v6.0' AND\n language_runtime_version != 'v7.0' AND\n language_runtime_version\ - \ != '6' AND\n language_runtime_version != '7' AND\n language_runtime_version\ - \ != '4' AND\n language_runtime_version != '4.8'\n )\n ) OR (\n language_runtime_type\ - \ = 'python' AND (\n language_runtime_version != '3.7' AND\n language_runtime_version\ - \ != '3.8' AND\n language_runtime_version != '3.9' AND\n language_runtime_version\ - \ != '3.10' AND\n language_runtime_version != '3.11'\n )\n ) OR (\n \ - \ language_runtime_type = 'java' AND (\n language_runtime_version != '8'\ - \ AND\n language_runtime_version != '11' AND\n language_runtime_version\ - \ != '17'\n )\n ) OR (\n language_runtime_type = 'powershell' AND (\n \ - \ language_runtime_version != '7.2'\n )\n ) OR (\n language_runtime_type\ - \ = 'node' AND (\n language_runtime_version != '14' AND\n language_runtime_version\ - \ != '16' AND\n language_runtime_version != '18' AND\n language_runtime_version\ - \ != '~14' AND\n language_runtime_version != '~16' AND\n language_runtime_version\ - \ != '~18'\n )\n )\n);" + QueryToExecute: | + SELECT + id, + language_runtime_type, + language_runtime_version, + subscription_id, + og_account_id, + og_resource_id + FROM azure_app_service_function_app + WHERE + ( + ( + language_runtime_type = 'dotnet' + AND ( + language_runtime_version != '6' + AND language_runtime_version != '7' + ) + ) + OR ( + language_runtime_type = 'dotnetcore' + AND ( + language_runtime_version != 'v4.0' + AND language_runtime_version != 'v6.0' + AND language_runtime_version != 'v7.0' + AND language_runtime_version != '6' + AND language_runtime_version != '7' + AND language_runtime_version != '4' + AND language_runtime_version != '4.8' + ) + ) + OR ( + language_runtime_type = 'python' + AND ( + language_runtime_version != '3.7' + AND language_runtime_version != '3.8' + AND language_runtime_version != '3.9' + AND language_runtime_version != '3.10' + AND language_runtime_version != '3.11' + ) + ) + OR ( + language_runtime_type = 'java' + AND ( + language_runtime_version != '8' + AND language_runtime_version != '11' + AND language_runtime_version != '17' + ) + ) + OR ( + language_runtime_type = 'powershell' + AND ( + language_runtime_version != '7.2' + ) + ) + OR ( + language_runtime_type = 'node' + AND ( + language_runtime_version != '14' + AND language_runtime_version != '16' + AND language_runtime_version != '18' + AND language_runtime_version != '~14' + AND language_runtime_version != '~16' + AND language_runtime_version != '~18' + ) + ) + ); Tags: category: - - Technical Debt -Title: Function Apps with unsupported runtime + - Technical Debt +Title: Function Apps with unsupported runtime \ No newline at end of file diff --git a/queries/36-aws_insight_deprecated_eks.yaml b/queries/36-aws_insight_deprecated_eks.yaml old mode 100755 new mode 100644 index a48451115..3315fc944 --- a/queries/36-aws_insight_deprecated_eks.yaml +++ b/queries/36-aws_insight_deprecated_eks.yaml @@ -1,21 +1,34 @@ Description: EKS clusters running anything other than 1.27, 1.26, 1.25, 1.24, 1.23 ID: aws_insight_deprecated_eks IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_eks_cluster + - aws_eks_cluster Parameters: [] PrimaryTable: aws_eks_cluster - QueryToExecute: SELECT name, arn, version, account_id, og_account_id, og_resource_id - FROM aws_eks_cluster WHERE version != '1.27' AND version != '1.26' AND version - != '1.25' AND version != '1.24' AND version != '1.23' + QueryToExecute: | + SELECT + name, + arn, + version, + account_id, + og_account_id, + og_resource_id + FROM + aws_eks_cluster + WHERE + version != '1.27' + AND version != '1.26' + AND version != '1.25' + AND version != '1.24' + AND version != '1.23' Tags: category: - - Technical Debt + - Technical Debt persona: - - Executive - - Product - - FinOps -Title: Deprecated EKS clusters + - Executive + - Product + - FinOps +Title: Deprecated EKS clusters \ No newline at end of file diff --git a/queries/37-azure_insight_legacy_application_gateway.yaml b/queries/37-azure_insight_legacy_application_gateway.yaml old mode 100755 new mode 100644 index e66f92c2d..4719eef23 --- a/queries/37-azure_insight_legacy_application_gateway.yaml +++ b/queries/37-azure_insight_legacy_application_gateway.yaml @@ -1,21 +1,31 @@ Description: This insight returns all legacy application gateways. ID: azure_insight_legacy_application_gateway IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_application_gateway + - azure_application_gateway Parameters: [] PrimaryTable: azure_application_gateway - QueryToExecute: SELECT name, id, sku->'tier' AS tier, subscription_id, og_account_id, - og_resource_id FROM azure_application_gateway WHERE NOT sku IS NULL AND sku->>'tier' - = 'Standard_v2'; + QueryToExecute: | + SELECT + name, + id, + sku->'tier' AS tier, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_application_gateway + WHERE + NOT sku IS NULL + AND sku->>'tier' = 'Standard_v2'; Tags: category: - - Technical Debt + - Technical Debt persona: - - Executive - - Product - - FinOps -Title: Legacy Application Gateways + - Executive + - Product + - FinOps +Title: Legacy Application Gateways \ No newline at end of file diff --git a/queries/38-azure_insight_legacy_virtual_machine.yaml b/queries/38-azure_insight_legacy_virtual_machine.yaml old mode 100755 new mode 100644 index a6ea5010a..83737beae --- a/queries/38-azure_insight_legacy_virtual_machine.yaml +++ b/queries/38-azure_insight_legacy_virtual_machine.yaml @@ -1,46 +1,105 @@ Description: This insight identifies virtual machines that are running on legacy hardware. ID: azure_insight_legacy_virtual_machine IntegrationType: -- azure_subscription + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: - - azure_application_gateway + - azure_application_gateway Parameters: [] PrimaryTable: azure_application_gateway - QueryToExecute: 'SELECT name, power_state, id, subscription_id, og_account_id, og_resource_id - FROM azure_compute_virtual_machine WHERE (size = ''Standard_F1'' OR size = ''Standard_F2'' - OR size = ''Standard_F4'' OR size = ''Standard_F8'' OR size = ''Standard_F16'' - OR size = ''Standard_F1s'' OR size = ''Standard_F2s'' OR size = ''Standard_F4s'' - OR size = ''Standard_F8s'' OR size = ''Standard_F16s'' OR size = ''Standard_NV6s_v2'' - OR size = ''Standard_NV12s_v2'' OR size = ''Standard_NV24s_v2'' OR size = ''A0\Basic_A0'' - OR size = ''A1\Basic_A1'' OR size = ''A2\Basic_A2'' OR size = ''A3\Basic_A3'' - OR size = ''A4\Basic_A4'' OR size = ''Standard_A0'' OR size = ''Standard_A1'' - OR size = ''Standard_A2'' OR size = ''Standard_A3'' OR size = ''Standard_A4'' - OR size = ''Standard_A5'' OR size = ''Standard_A6'' OR size = ''Standard_A7'' - OR size = ''Standard_A8'' OR size = ''Standard_A9'' OR size = ''Standard_A10'' - OR size = ''Standard_A11'' OR size = ''Standard_D1'' OR size = ''Standard_D2'' - OR size = ''Standard_D3'' OR size = ''Standard_D4'' OR size = ''Standard_D11'' - OR size = ''Standard_D12'' OR size = ''Standard_D13'' OR size = ''Standard_D14'' - OR size = ''Standard_DC2s'' OR size = ''Standard_DC4s'' OR size = ''Standard_DS1'' - OR size = ''Standard_DS2'' OR size = ''Standard_DS3'' OR size = ''Standard_DS4'' - OR size = ''Standard_DS11'' OR size = ''Standard_DS12'' OR size = ''Standard_DS13'' - OR size = ''Standard_DS14'' OR size = ''Standard_L4s'' OR size = ''Standard_L8s'' - OR size = ''Standard_L16s'' OR size = ''Standard_L32s'' OR size = ''Standard_GS1'' - OR size = ''Standard_GS2'' OR size = ''Standard_GS3'' OR size = ''Standard_GS4'' - OR size = ''Standard_GS5'' OR size = ''Standard_G1'' OR size = ''Standard_G2'' - OR size = ''Standard_G3'' OR size = ''Standard_G4'' OR size = ''Standard_G5'' - OR size = ''Standard_NC6'' OR size = ''Standard_NC12'' OR size = ''Standard_NC24'' - OR size = ''Standard_NC24r'' OR size = ''Standard_NC6s_v2'' OR size = ''Standard_NC12s_v2'' - OR size = ''Standard_NC24s_v2'' OR size = ''Standard_NC24rs_v2'' OR size = ''Standard_ND6s'' - OR size = ''Standard_ND12s'' OR size = ''Standard_ND24s'' OR size = ''Standard_ND24rs'') - - ;' + QueryToExecute: | + SELECT + name, + power_state, + id, + subscription_id, + og_account_id, + og_resource_id + FROM + azure_compute_virtual_machine + WHERE + size IN ( + 'Standard_F1', + 'Standard_F2', + 'Standard_F4', + 'Standard_F8', + 'Standard_F16', + 'Standard_F1s', + 'Standard_F2s', + 'Standard_F4s', + 'Standard_F8s', + 'Standard_F16s', + 'Standard_NV6s_v2', + 'Standard_NV12s_v2', + 'Standard_NV24s_v2', + 'A0/Basic_A0', + 'A1/Basic_A1', + 'A2/Basic_A2', + 'A3/Basic_A3', + 'A4/Basic_A4', + 'Standard_A0', + 'Standard_A1', + 'Standard_A2', + 'Standard_A3', + 'Standard_A4', + 'Standard_A5', + 'Standard_A6', + 'Standard_A7', + 'Standard_A8', + 'Standard_A9', + 'Standard_A10', + 'Standard_A11', + 'Standard_D1', + 'Standard_D2', + 'Standard_D3', + 'Standard_D4', + 'Standard_D11', + 'Standard_D12', + 'Standard_D13', + 'Standard_D14', + 'Standard_DC2s', + 'Standard_DC4s', + 'Standard_DS1', + 'Standard_DS2', + 'Standard_DS3', + 'Standard_DS4', + 'Standard_DS11', + 'Standard_DS12', + 'Standard_DS13', + 'Standard_DS14', + 'Standard_L4s', + 'Standard_L8s', + 'Standard_L16s', + 'Standard_L32s', + 'Standard_GS1', + 'Standard_GS2', + 'Standard_GS3', + 'Standard_GS4', + 'Standard_GS5', + 'Standard_G1', + 'Standard_G2', + 'Standard_G3', + 'Standard_G4', + 'Standard_G5', + 'Standard_NC6', + 'Standard_NC12', + 'Standard_NC24', + 'Standard_NC24r', + 'Standard_NC6s_v2', + 'Standard_NC12s_v2', + 'Standard_NC24s_v2', + 'Standard_NC24rs_v2', + 'Standard_ND6s', + 'Standard_ND12s', + 'Standard_ND24s', + 'Standard_ND24rs' + ); Tags: category: - - Technical Debt + - Technical Debt persona: - - Executive - - Product - - FinOps -Title: Legacy Virtual Machine + - Executive + - Product + - FinOps +Title: Legacy Virtual Machine \ No newline at end of file diff --git a/queries/39-aws_insight_legacy_rds_instances.yaml b/queries/39-aws_insight_legacy_rds_instances.yaml old mode 100755 new mode 100644 index 36b5c19e9..5204f70e0 --- a/queries/39-aws_insight_legacy_rds_instances.yaml +++ b/queries/39-aws_insight_legacy_rds_instances.yaml @@ -1,20 +1,28 @@ Description: RDS instances that are not using the supported instance types ID: aws_insight_legacy_rds_instances IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_rds_db_instance + - aws_rds_db_instance Parameters: [] PrimaryTable: aws_rds_db_instance - QueryToExecute: SELECT db_instance_identifier, arn, status, class, account_id, og_account_id, - og_resource_id FROM aws_rds_db_instance WHERE (class LIKE ANY(ARRAY['db.m1.%','db.m2.%','db.r3.%'])) + QueryToExecute: | + SELECT db_instance_identifier, + arn, + status, + class, + account_id, + og_account_id, + og_resource_id + FROM aws_rds_db_instance + WHERE class LIKE ANY(ARRAY['db.m1.%', 'db.m2.%', 'db.r3.%']) Tags: category: - - Technical Debt + - Technical Debt persona: - - Executive - - Product - - FinOps -Title: Legacy RDS Instances + - Executive + - Product + - FinOps +Title: Legacy RDS Instances \ No newline at end of file diff --git a/queries/4-aws_insight_ebs_volume_unencrypted.yaml b/queries/4-aws_insight_ebs_volume_unencrypted.yaml old mode 100755 new mode 100644 index 2a0ce7546..e5cb264ba --- a/queries/4-aws_insight_ebs_volume_unencrypted.yaml +++ b/queries/4-aws_insight_ebs_volume_unencrypted.yaml @@ -1,21 +1,30 @@ Description: List of unencrypted EBS volumes ID: aws_insight_ebs_volume_unencrypted IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ebs_volume + - aws_ebs_volume Parameters: [] PrimaryTable: aws_ebs_volume - QueryToExecute: "select volume_id, encrypted, account_id, og_account_id, og_resource_id\ - \ from\n aws_ebs_volume\nwhere\n not encrypted;" + QueryToExecute: | + SELECT + volume_id, + encrypted, + account_id, + og_account_id, + og_resource_id + FROM + aws_ebs_volume + WHERE + NOT encrypted; Tags: category: - - Security - - Technical Debt + - Security + - Technical Debt persona: - - Security - - DevOps - - Product -Title: Unencrypted EBS Disks + - Security + - DevOps + - Product +Title: Unencrypted EBS Disks \ No newline at end of file diff --git a/queries/40-aws_insight_accounts_without_cloudtrail.yaml b/queries/40-aws_insight_accounts_without_cloudtrail.yaml old mode 100755 new mode 100644 index b7931b1c6..29bf40431 --- a/queries/40-aws_insight_accounts_without_cloudtrail.yaml +++ b/queries/40-aws_insight_accounts_without_cloudtrail.yaml @@ -1,23 +1,33 @@ Description: AWS Accounts with CloudTrail disabled ID: aws_insight_accounts_without_cloudtrail IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - og_connections - - aws_cloudtrail_trail + - og_connections + - aws_cloudtrail_trail Parameters: [] PrimaryTable: null - QueryToExecute: select id AS account_id, og_id AS og_account_id from og_connections - where (connector = 'AWS' AND lifecycle_state = 'onboard' AND id NOT IN (select - distinct account_id from aws_cloudtrail_trail)) + QueryToExecute: | + SELECT + id AS account_id, + og_id AS og_account_id + FROM + og_connections + WHERE + connector = 'AWS' + AND lifecycle_state = 'onboard' + AND id NOT IN ( + SELECT DISTINCT account_id + FROM aws_cloudtrail_trail + ) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive - - Product -Title: AWS Accounts without CloudTrail + - DevOps + - Security + - Executive + - Product +Title: AWS Accounts without CloudTrail \ No newline at end of file diff --git a/queries/41-aws_insight_root_login_last_90_days.yaml b/queries/41-aws_insight_root_login_last_90_days.yaml old mode 100755 new mode 100644 index 91aaf1e55..e41358f2f --- a/queries/41-aws_insight_root_login_last_90_days.yaml +++ b/queries/41-aws_insight_root_login_last_90_days.yaml @@ -1,22 +1,31 @@ Description: AWS accounts whose root user has logged in within the last 90 days ID: aws_insight_root_login_last_90_days IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select user_arn, password_last_used, account_id, og_account_id, - og_resource_id from aws_iam_credential_report where (user_name = '' - AND (current_date - DATE(password_last_used)) > 90) + QueryToExecute: | + SELECT + user_arn, + password_last_used, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + user_name = '' + AND (CURRENT_DATE - DATE(password_last_used)) > 90 Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive - - Product -Title: AWS accounts with root login in the last 90 days + - DevOps + - Security + - Executive + - Product +Title: AWS accounts with root login in the last 90 days \ No newline at end of file diff --git a/queries/42-aws_insight_account_with_root_access_key.yaml b/queries/42-aws_insight_account_with_root_access_key.yaml old mode 100755 new mode 100644 index e11f7efe6..4e79ed2fe --- a/queries/42-aws_insight_account_with_root_access_key.yaml +++ b/queries/42-aws_insight_account_with_root_access_key.yaml @@ -1,22 +1,30 @@ Description: AWS Account whose root user has an access key enabled. ID: aws_insight_account_with_root_access_key IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select user_arn, account_id, og_account_id, og_resource_id from - aws_iam_credential_report where (user_name = '' AND (access_key_1_active - = true OR access_key_2_active = true)) + QueryToExecute: | + SELECT + user_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + user_name = '' + AND (access_key_1_active = TRUE OR access_key_2_active = TRUE) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive - - Product -Title: AWS Account with Root Access Key Enabled + - DevOps + - Security + - Executive + - Product +Title: AWS Account with Root Access Key Enabled \ No newline at end of file diff --git a/queries/43-aws_insight_account_without_root_mfa.yaml b/queries/43-aws_insight_account_without_root_mfa.yaml old mode 100755 new mode 100644 index 2ca5e1549..d9b03dd13 --- a/queries/43-aws_insight_account_without_root_mfa.yaml +++ b/queries/43-aws_insight_account_without_root_mfa.yaml @@ -1,22 +1,30 @@ Description: AWS account whose root user does not have MFA enabled. ID: aws_insight_account_without_root_mfa IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select user_arn, account_id, og_account_id, og_resource_id from - aws_iam_credential_report where (user_name = '' AND mfa_active = - false) + QueryToExecute: | + SELECT + user_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + (user_name = '' + AND mfa_active = FALSE) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive - - Product -Title: AWS Account without Root MFA + - DevOps + - Security + - Executive + - Product +Title: AWS Account without Root MFA \ No newline at end of file diff --git a/queries/44-aws_insight_account_with_many_saml_providers.yaml b/queries/44-aws_insight_account_with_many_saml_providers.yaml old mode 100755 new mode 100644 index 85a393fcd..838e2dadf --- a/queries/44-aws_insight_account_with_many_saml_providers.yaml +++ b/queries/44-aws_insight_account_with_many_saml_providers.yaml @@ -1,25 +1,49 @@ Description: AWS Account with more than 1 SAML provider ID: aws_insight_account_with_many_saml_providers IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: "SELECT account_id, og_account_id, CAST(SUM(saml_provider_count)\ - \ AS INTEGER) AS saml_provider_count FROM (\n SELECT account_id, og_account_id,\ - \ COUNT(*) as saml_provider_count FROM aws_iam_saml_provider GROUP BY account_id,\ - \ og_account_id\n UNION\n SELECT account_id, og_account_id, COUNT(*) as saml_provider_count\ - \ FROM aws_iam_open_id_connect_provider GROUP BY account_id, og_account_id\n)\ - \ AS final WHERE saml_provider_count > 1 GROUP BY account_id, og_account_id" + QueryToExecute: | + SELECT + account_id, + og_account_id, + CAST(SUM(saml_provider_count) AS INTEGER) AS saml_provider_count + FROM ( + SELECT + account_id, + og_account_id, + COUNT(*) AS saml_provider_count + FROM + aws_iam_saml_provider + GROUP BY + account_id, + og_account_id + + UNION + + SELECT + account_id, + og_account_id, + COUNT(*) AS saml_provider_count + FROM + aws_iam_open_id_connect_provider + GROUP BY + account_id, + og_account_id + ) AS final + WHERE saml_provider_count > 1 + GROUP BY account_id, og_account_id Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive - - Product -Title: AWS Account with many SAML providers + - DevOps + - Security + - Executive + - Product +Title: AWS Account with many SAML providers \ No newline at end of file diff --git a/queries/45-aws_insight_account_without_mfa.yaml b/queries/45-aws_insight_account_without_mfa.yaml old mode 100755 new mode 100644 index 6c165bdd6..9e8369e46 --- a/queries/45-aws_insight_account_without_mfa.yaml +++ b/queries/45-aws_insight_account_without_mfa.yaml @@ -1,20 +1,26 @@ Description: AWS accounts without MFA enabled ID: aws_insight_account_without_mfa IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select account_id, og_account_id from aws_iam_account_summary where - account_mfa_enabled = false + QueryToExecute: | + SELECT + account_id, + og_account_id + FROM + aws_iam_account_summary + WHERE + account_mfa_enabled = FALSE Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive -Title: AWS Account without MFA + - DevOps + - Security + - Executive +Title: AWS Account without MFA \ No newline at end of file diff --git a/queries/46-aws_insight_account_with_key_and_password.yaml b/queries/46-aws_insight_account_with_key_and_password.yaml old mode 100755 new mode 100644 index 4ab6a89bd..229f2c237 --- a/queries/46-aws_insight_account_with_key_and_password.yaml +++ b/queries/46-aws_insight_account_with_key_and_password.yaml @@ -1,21 +1,27 @@ Description: AWS accounts with access key and console password both enabled ID: aws_insight_account_with_key_and_password IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select user_arn, account_id, og_account_id, og_resource_id from - aws_iam_credential_report where (password_enabled = true AND (access_key_1_active - = true OR access_key_2_active = true)) + QueryToExecute: | + SELECT user_arn, + account_id, + og_account_id, + og_resource_id + FROM aws_iam_credential_report + WHERE password_enabled = TRUE + AND (access_key_1_active = TRUE + OR access_key_2_active = TRUE) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive -Title: AWS Account with Access Key and Console Password + - DevOps + - Security + - Executive +Title: AWS Account with Access Key and Console Password \ No newline at end of file diff --git a/queries/47-aws_insight_account_with_unused_key.yaml b/queries/47-aws_insight_account_with_unused_key.yaml old mode 100755 new mode 100644 index 044520a92..948fa390e --- a/queries/47-aws_insight_account_with_unused_key.yaml +++ b/queries/47-aws_insight_account_with_unused_key.yaml @@ -1,24 +1,35 @@ Description: This insight returns a list of AWS accounts with unused access keys. ID: aws_insight_account_with_unused_key IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select access_key_1_active, access_key_1_last_used_date, access_key_2_active, - access_key_2_last_used_date, user_arn, account_id, og_account_id, og_resource_id - from aws_iam_credential_report where ((access_key_1_active = true AND (access_key_1_last_used_date - IS NULL OR (current_date - DATE(access_key_1_last_used_date)) > 90)) OR (access_key_2_active - = true AND (access_key_2_last_used_date IS NULL OR (current_date - DATE(access_key_2_last_used_date)) - > 90))) + QueryToExecute: | + SELECT + access_key_1_active, + access_key_1_last_used_date, + access_key_2_active, + access_key_2_last_used_date, + user_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + ( + (access_key_1_active = TRUE AND (access_key_1_last_used_date IS NULL OR (CURRENT_DATE - DATE(access_key_1_last_used_date)) > 90)) OR + (access_key_2_active = TRUE AND (access_key_2_last_used_date IS NULL OR (CURRENT_DATE - DATE(access_key_2_last_used_date)) > 90)) + ) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive -Title: AWS Accounts with Unused Access Keys + - DevOps + - Security + - Executive +Title: AWS Accounts with Unused Access Keys \ No newline at end of file diff --git a/queries/48-aws_insight_iam_user_with_old_keys.yaml b/queries/48-aws_insight_iam_user_with_old_keys.yaml old mode 100755 new mode 100644 index 9c4fadc40..e030f4722 --- a/queries/48-aws_insight_iam_user_with_old_keys.yaml +++ b/queries/48-aws_insight_iam_user_with_old_keys.yaml @@ -1,24 +1,38 @@ Description: IAM users with access keys older than 90 days ID: aws_insight_iam_user_with_old_keys IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select access_key_1_active, access_key_1_last_rotated, access_key_2_active, - access_key_2_last_rotated, user_arn, account_id, og_account_id, og_resource_id - from aws_iam_credential_report where ((access_key_1_active = true AND (access_key_1_last_rotated - IS NULL OR (current_date - DATE(access_key_1_last_rotated)) > 90)) OR (access_key_2_active - = true AND (access_key_2_last_rotated IS NULL OR (current_date - DATE(access_key_2_last_rotated)) - > 90))) + QueryToExecute: | + SELECT + access_key_1_active, + access_key_1_last_rotated, + access_key_2_active, + access_key_2_last_rotated, + user_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + ( + (access_key_1_active = TRUE AND + (access_key_1_last_rotated IS NULL OR (CURRENT_DATE - DATE(access_key_1_last_rotated)) > 90)) + OR + (access_key_2_active = TRUE AND + (access_key_2_last_rotated IS NULL OR (CURRENT_DATE - DATE(access_key_2_last_rotated)) > 90)) + ) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive -Title: IAM Users with old access keys + - DevOps + - Security + - Executive +Title: IAM Users with old access keys \ No newline at end of file diff --git a/queries/49-aws_insight_iam_user_with_old_password.yaml b/queries/49-aws_insight_iam_user_with_old_password.yaml old mode 100755 new mode 100644 index 877b910e6..8b570c4b7 --- a/queries/49-aws_insight_iam_user_with_old_password.yaml +++ b/queries/49-aws_insight_iam_user_with_old_password.yaml @@ -1,22 +1,32 @@ Description: IAM users with password older than 90 days ID: aws_insight_iam_user_with_old_password IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_credential_report + - aws_iam_credential_report Parameters: [] PrimaryTable: aws_iam_credential_report - QueryToExecute: select password_enabled, password_last_changed, user_arn, account_id, - og_account_id, og_resource_id from aws_iam_credential_report where (password_enabled - = true AND (password_last_changed IS NULL OR (current_date - DATE(password_last_changed)) - > 90)) + QueryToExecute: | + SELECT + password_enabled, + password_last_changed, + user_arn, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_credential_report + WHERE + password_enabled = TRUE + AND (password_last_changed IS NULL + OR (CURRENT_DATE - DATE(password_last_changed)) > 90) Tags: category: - - Security + - Security persona: - - DevOps - - Security - - Executive -Title: IAM Users with old access password + - DevOps + - Security + - Executive +Title: IAM Users with old access password \ No newline at end of file diff --git a/queries/5-aws_insight_ebs_volume_unattached.yaml b/queries/5-aws_insight_ebs_volume_unattached.yaml old mode 100755 new mode 100644 index a8017d911..02a623456 --- a/queries/5-aws_insight_ebs_volume_unattached.yaml +++ b/queries/5-aws_insight_ebs_volume_unattached.yaml @@ -1,17 +1,26 @@ Description: List of unattached EBS Volumes ID: aws_insight_ebs_volume_unattached IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ebs_volume + - aws_ebs_volume Parameters: [] PrimaryTable: aws_ebs_volume - QueryToExecute: "select volume_id, volume_type, account_id, og_account_id, og_resource_id\n\ - from\n aws_ebs_volume\nwhere\n jsonb_array_length(attachments) = 0;" + QueryToExecute: | + SELECT + volume_id, + volume_type, + account_id, + og_account_id, + og_resource_id + FROM + aws_ebs_volume + WHERE + jsonb_array_length(attachments) = 0; Tags: category: - - Technical Debt - - Cost Management -Title: Unused EBS Disks + - Technical Debt + - Cost Management +Title: Unused EBS Disks \ No newline at end of file diff --git a/queries/6-aws_insight_ec2_instance_of_undesired_type.yaml b/queries/6-aws_insight_ec2_instance_of_undesired_type.yaml old mode 100755 new mode 100644 index 4874e71b5..754961963 --- a/queries/6-aws_insight_ec2_instance_of_undesired_type.yaml +++ b/queries/6-aws_insight_ec2_instance_of_undesired_type.yaml @@ -1,21 +1,43 @@ Description: List of Instances which are not of the desired type. ID: aws_insight_ec2_instance_of_undesired_type IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_ec2_instance + - aws_ec2_instance Parameters: [] PrimaryTable: aws_ec2_instance - QueryToExecute: SELECT instance_id, arn, instance_type, instance_state, account_id, - og_account_id, og_resource_id FROM aws_ec2_instance WHERE instance_type LIKE ANY(array['m1.%', - 'm2.%', 'm3.%', 'c1.%', 'c3.%', 'g2.%', 'cr1.%', 'r3.%', 'i2.%', 'hs1.%', 't1.%']); + QueryToExecute: | + SELECT + instance_id, + arn, + instance_type, + instance_state, + account_id, + og_account_id, + og_resource_id + FROM + aws_ec2_instance + WHERE + instance_type LIKE ANY(ARRAY[ + 'm1.%', + 'm2.%', + 'm3.%', + 'c1.%', + 'c3.%', + 'g2.%', + 'cr1.%', + 'r3.%', + 'i2.%', + 'hs1.%', + 't1.%' + ]); Tags: category: - - Technical Debt + - Technical Debt persona: - - Executive - - Product - - FinOps -Title: Legacy Instance Types + - Executive + - Product + - FinOps +Title: Legacy Instance Types \ No newline at end of file diff --git a/queries/7-aws_insight_iam_user_with_admin_access.yaml b/queries/7-aws_insight_iam_user_with_admin_access.yaml old mode 100755 new mode 100644 index ed5b29945..f4289dfa3 --- a/queries/7-aws_insight_iam_user_with_admin_access.yaml +++ b/queries/7-aws_insight_iam_user_with_admin_access.yaml @@ -1,18 +1,26 @@ Description: List all the users having Administrator access ID: aws_insight_iam_user_with_admin_access IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_user + - aws_iam_user Parameters: [] PrimaryTable: aws_iam_user - QueryToExecute: "select name as user_name, split_part(attachments, '/', 2) as attached_policies,\ - \ aws_iam_user.account_id, aws_iam_user.og_account_id, aws_iam_user.og_resource_id\n\ - from\n aws_iam_user\n cross join jsonb_array_elements_text(attached_policy_arns)\ - \ as attachments\nwhere\n split_part(attachments, '/', 2) = 'AdministratorAccess';" + QueryToExecute: | + SELECT + name AS user_name, + SPLIT_PART(attachments, '/', 2) AS attached_policies, + aws_iam_user.account_id, + aws_iam_user.og_account_id, + aws_iam_user.og_resource_id + FROM + aws_iam_user + CROSS JOIN jsonb_array_elements_text(attached_policy_arns) AS attachments + WHERE + SPLIT_PART(attachments, '/', 2) = 'AdministratorAccess'; Tags: category: - - Security -Title: Admin Users + - Security +Title: Admin Users \ No newline at end of file diff --git a/queries/8-aws_insight_iam_user_with_mfa_disabled.yaml b/queries/8-aws_insight_iam_user_with_mfa_disabled.yaml old mode 100755 new mode 100644 index 6c3f95f29..79b2ef810 --- a/queries/8-aws_insight_iam_user_with_mfa_disabled.yaml +++ b/queries/8-aws_insight_iam_user_with_mfa_disabled.yaml @@ -1,17 +1,27 @@ Description: List all the users for whom MFA is not enabled ID: aws_insight_iam_user_with_mfa_disabled IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_user + - aws_iam_user Parameters: [] PrimaryTable: aws_iam_user - QueryToExecute: "select\n name,\n user_id,\n mfa_enabled, account_id, og_account_id,\ - \ og_resource_id\nfrom\n aws_iam_user\nwhere\n not mfa_enabled;" + QueryToExecute: | + SELECT + name, + user_id, + mfa_enabled, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_user + WHERE + NOT mfa_enabled; Tags: category: - - Security - - Technical Debt -Title: Users with no MFA + - Security + - Technical Debt +Title: Users with no MFA \ No newline at end of file diff --git a/queries/9-aws_insight_iam_user_with_inline_policies.yaml b/queries/9-aws_insight_iam_user_with_inline_policies.yaml old mode 100755 new mode 100644 index eea11bba6..b18917c90 --- a/queries/9-aws_insight_iam_user_with_inline_policies.yaml +++ b/queries/9-aws_insight_iam_user_with_inline_policies.yaml @@ -1,17 +1,26 @@ Description: List users that have inline policies ID: aws_insight_iam_user_with_inline_policies IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: - - aws_iam_user + - aws_iam_user Parameters: [] PrimaryTable: aws_iam_user - QueryToExecute: "select\n name as user_name,\n inline_policies, account_id, og_account_id,\ - \ og_resource_id\nfrom\n aws_iam_user\nwhere\n inline_policies is not null;" + QueryToExecute: | + SELECT + name AS user_name, + inline_policies, + account_id, + og_account_id, + og_resource_id + FROM + aws_iam_user + WHERE + inline_policies IS NOT NULL; Tags: category: - - Security - - Technical Debt -Title: Users with Inline Policies + - Security + - Technical Debt +Title: Users with Inline Policies \ No newline at end of file diff --git a/queries/ai_workload.yaml b/queries/ai_workload.yaml old mode 100755 new mode 100644 index c148e7c04..52f7a0c84 --- a/queries/ai_workload.yaml +++ b/queries/ai_workload.yaml @@ -1,30 +1,43 @@ Description: AI Workload ID: ai_workload IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('microsoft.cognitiveservices/accounts')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN og_connections c + ON r.connection_id = c.og_id + WHERE + resource_type IN ('microsoft.cognitiveservices/accounts') Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Cognitive Services + - Cognitive Services platform_queries_bookmark: - - 'true' -Title: AI Workload + - "true" +Title: AI Workload \ No newline at end of file diff --git a/queries/autoscaling_workload.yaml b/queries/autoscaling_workload.yaml old mode 100755 new mode 100644 index d156a8876..f5b250025 --- a/queries/autoscaling_workload.yaml +++ b/queries/autoscaling_workload.yaml @@ -1,29 +1,41 @@ Description: List All Autoscaling Groups and VM Scale Sets ID: autoscaling_workload IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::autoscaling::autoscalinggroup', 'microsoft.compute/virtualmachinescalesets')\ - \ " + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::autoscaling::autoscalinggroup', 'microsoft.compute/virtualmachinescalesets') Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Auto Scaling and VM Scale Set -Title: List All Autoscaling Groups and VM Scale Sets + - Auto Scaling and VM Scale Set +Title: List All Autoscaling Groups and VM Scale Sets \ No newline at end of file diff --git a/queries/aws_accessanalyzer_analyzer_1.yaml b/queries/aws_accessanalyzer_analyzer_1.yaml old mode 100755 new mode 100644 index 737a6e416..52d890cfb --- a/queries/aws_accessanalyzer_analyzer_1.yaml +++ b/queries/aws_accessanalyzer_analyzer_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve - information about analyzers. +Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve information about analyzers. ID: aws_accessanalyzer_analyzer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n last_resource_analyzed,\n last_resource_analyzed_at,\n\ - \ status,\n type\nfrom\n aws_accessanalyzer_analyzer;" + QueryToExecute: | + SELECT + name, + last_resource_analyzed, + last_resource_analyzed_at, + status, + type + FROM + aws_accessanalyzer_analyzer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: List all AWS Access Analyzer Information + - Access Analyzer +Title: List all AWS Access Analyzer Information \ No newline at end of file diff --git a/queries/aws_accessanalyzer_analyzer_2.yaml b/queries/aws_accessanalyzer_analyzer_2.yaml old mode 100755 new mode 100644 index d9b0e37ac..21e0a0dc9 --- a/queries/aws_accessanalyzer_analyzer_2.yaml +++ b/queries/aws_accessanalyzer_analyzer_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve - information about analyzers. +Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve information about analyzers. ID: aws_accessanalyzer_analyzer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n status\n last_resource_analyzed,\n last_resource_analyzed_at,\n\ - \ tags\nfrom\n aws_accessanalyzer_analyzer\nwhere\n status = 'ACTIVE';" + QueryToExecute: | + SELECT + name, + status, + last_resource_analyzed, + last_resource_analyzed_at, + tags + FROM + aws_accessanalyzer_analyzer + WHERE + status = 'ACTIVE'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Analyzer -Title: Find AWS IAM Access Analyzer Analyzers Information + - IAM Access Analyzer +Title: Find AWS IAM Access Analyzer Analyzers Information \ No newline at end of file diff --git a/queries/aws_accessanalyzer_analyzer_3.yaml b/queries/aws_accessanalyzer_analyzer_3.yaml old mode 100755 new mode 100644 index e6b337776..302216c12 --- a/queries/aws_accessanalyzer_analyzer_3.yaml +++ b/queries/aws_accessanalyzer_analyzer_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve - information about analyzers. +Description: Allows users to query Access Analyzer Analyzer in AWS IAM to retrieve information about analyzers. ID: aws_accessanalyzer_analyzer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n status,\n type,\n last_resource_analyzed\n\ - from\n aws_accessanalyzer_analyzer\nwhere\n status = 'ACTIVE'\n and findings\ - \ is not null;" + QueryToExecute: | + SELECT + name, + status, + type, + last_resource_analyzed + FROM + aws_accessanalyzer_analyzer + WHERE + status = 'ACTIVE' + AND findings IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: Find AWS IAM Access Analyzer Details + - Access Analyzer +Title: Find AWS IAM Access Analyzer Details \ No newline at end of file diff --git a/queries/aws_accessanalyzer_finding_1.yaml b/queries/aws_accessanalyzer_finding_1.yaml old mode 100755 new mode 100644 index 6d5bb0135..80da629db --- a/queries/aws_accessanalyzer_finding_1.yaml +++ b/queries/aws_accessanalyzer_finding_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve - detailed information about potential security risks. +Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve detailed information about potential security risks. ID: aws_accessanalyzer_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n access_analyzer_arn,\n analyzed_at,\n resource_type,\n\ - \ status,\n is_public\nfrom\n aws_accessanalyzer_finding;" + QueryToExecute: | + SELECT + id, + access_analyzer_arn, + analyzed_at, + resource_type, + status, + is_public + FROM + aws_accessanalyzer_finding; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: Find AWS IAM Access Analyzer Findings for Security Risks + - Access Analyzer +Title: Find AWS IAM Access Analyzer Findings for Security Risks \ No newline at end of file diff --git a/queries/aws_accessanalyzer_finding_2.yaml b/queries/aws_accessanalyzer_finding_2.yaml old mode 100755 new mode 100644 index 6c19200bc..bd4c48330 --- a/queries/aws_accessanalyzer_finding_2.yaml +++ b/queries/aws_accessanalyzer_finding_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve - detailed information about potential security risks. +Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve detailed information about potential security risks. ID: aws_accessanalyzer_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n resource_type,\n access_analyzer_arn,\n status,\n\ - \ is_public\nfrom\n aws_accessanalyzer_finding\nwhere\n is_public = true;" + QueryToExecute: | + SELECT + id, + resource_type, + access_analyzer_arn, + status, + is_public + FROM + aws_accessanalyzer_finding + WHERE + is_public = true; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: Find all AWS IAM Access Analyzer public findings + - Access Analyzer +Title: Find all AWS IAM Access Analyzer public findings \ No newline at end of file diff --git a/queries/aws_accessanalyzer_finding_3.yaml b/queries/aws_accessanalyzer_finding_3.yaml old mode 100755 new mode 100644 index 37145ecbe..29ca6b725 --- a/queries/aws_accessanalyzer_finding_3.yaml +++ b/queries/aws_accessanalyzer_finding_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve - detailed information about potential security risks. +Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve detailed information about potential security risks. ID: aws_accessanalyzer_finding_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_type,\n count(*) as findings_count\nfrom\n\ - \ aws_accessanalyzer_finding\ngroup by\n resource_type;" + QueryToExecute: | + SELECT + resource_type, + COUNT(*) AS findings_count + FROM + aws_accessanalyzer_finding + GROUP BY + resource_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: List AWS Access Analyzer Findings Security Risks + - Access Analyzer +Title: List AWS Access Analyzer Findings Security Risks \ No newline at end of file diff --git a/queries/aws_accessanalyzer_finding_4.yaml b/queries/aws_accessanalyzer_finding_4.yaml old mode 100755 new mode 100644 index 58aabba29..3e2725b9c --- a/queries/aws_accessanalyzer_finding_4.yaml +++ b/queries/aws_accessanalyzer_finding_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve - detailed information about potential security risks. +Description: Allows users to query Access Analyzer findings in AWS IAM to retrieve detailed information about potential security risks. ID: aws_accessanalyzer_finding_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n resource,\n status,\n analyzed_at\nfrom\n aws_accessanalyzer_finding\n\ - where\n analyzed_at > current_date - interval '30 days';" + QueryToExecute: | + SELECT + id, + resource, + status, + analyzed_at + FROM + aws_accessanalyzer_finding + WHERE + analyzed_at > CURRENT_DATE - INTERVAL '30 days'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Access Analyzer -Title: Find AWS Access Analyzer Findings in Last 30 Days + - Access Analyzer +Title: Find AWS Access Analyzer Findings in Last 30 Days \ No newline at end of file diff --git a/queries/aws_account_1.yaml b/queries/aws_account_1.yaml old mode 100755 new mode 100644 index 2e39e3e64..a2cf4a79c --- a/queries/aws_account_1.yaml +++ b/queries/aws_account_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Account information, including details about - the account''s status, owner, and associated resources. +Description: Allows users to query AWS Account information, including details about the account's status, owner, and associated resources. ID: aws_account_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n alias,\n arn,\n organization_id,\n organization_master_account_email,\n\ - \ organization_master_account_id\nfrom\n aws_account\n cross join jsonb_array_elements(account_aliases)\ - \ as alias;" + QueryToExecute: | + SELECT + alias, + arn, + organization_id, + organization_master_account_email, + organization_master_account_id + FROM + aws_account + CROSS JOIN + jsonb_array_elements(account_aliases) AS alias; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Account -Title: List all AWS Account Details with Status and Owner + - AWS Account +Title: List all AWS Account Details with Status and Owner \ No newline at end of file diff --git a/queries/aws_account_2.yaml b/queries/aws_account_2.yaml old mode 100755 new mode 100644 index e16b6cf06..c596cd2d4 --- a/queries/aws_account_2.yaml +++ b/queries/aws_account_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Account information, including details about - the account''s status, owner, and associated resources. +Description: Allows users to query AWS Account information, including details about the account's status, owner, and associated resources. ID: aws_account_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n organization_id,\n policy ->> 'Type' as policy_type,\n\ - \ policy ->> 'Status' as policy_status\nfrom\n aws_account\n cross join jsonb_array_elements(organization_available_policy_types)\ - \ as policy;" + QueryToExecute: | + SELECT + organization_id, + policy ->> 'Type' AS policy_type, + policy ->> 'Status' AS policy_status + FROM + aws_account + CROSS JOIN + jsonb_array_elements(organization_available_policy_types) AS policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Account -Title: Find AWS Account Information and Associated Resources + - AWS Account +Title: Find AWS Account Information and Associated Resources \ No newline at end of file diff --git a/queries/aws_account_alternate_contact_1.yaml b/queries/aws_account_alternate_contact_1.yaml old mode 100755 new mode 100644 index 438515f69..e743cd830 --- a/queries/aws_account_alternate_contact_1.yaml +++ b/queries/aws_account_alternate_contact_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Account Alternate Contact to fetch details - about the alternate contacts associated with an AWS account. +Description: Allows users to query AWS Account Alternate Contact to fetch details about the alternate contacts associated with an AWS account. ID: aws_account_alternate_contact_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n linked_account_id,\n contact_type,\n email_address,\n\ - \ phone_number,\n contact_title\nfrom\n aws_account_alternate_contact;" + QueryToExecute: | + SELECT + name, + linked_account_id, + contact_type, + email_address, + phone_number, + contact_title + FROM + aws_account_alternate_contact; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Account -Title: Find AWS Account Alternate Contact Details + - AWS Account +Title: Find AWS Account Alternate Contact Details \ No newline at end of file diff --git a/queries/aws_account_alternate_contact_2.yaml b/queries/aws_account_alternate_contact_2.yaml old mode 100755 new mode 100644 index 3f908609e..eaf81fdec --- a/queries/aws_account_alternate_contact_2.yaml +++ b/queries/aws_account_alternate_contact_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Account Alternate Contact to fetch details - about the alternate contacts associated with an AWS account. +Description: Allows users to query AWS Account Alternate Contact to fetch details about the alternate contacts associated with an AWS account. ID: aws_account_alternate_contact_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n linked_account_id,\n contact_type,\n email_address,\n\ - \ phone_number,\n contact_title\nfrom\n aws_account_alternate_contact\nwhere\n\ - \ contact_type = 'BILLING';" + QueryToExecute: | + SELECT + name, + linked_account_id, + contact_type, + email_address, + phone_number, + contact_title + FROM + aws_account_alternate_contact + WHERE + contact_type = 'BILLING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Account -Title: Find AWS Account Alternate Contact Details + - AWS Account +Title: Find AWS Account Alternate Contact Details \ No newline at end of file diff --git a/queries/aws_account_alternate_contact_3.yaml b/queries/aws_account_alternate_contact_3.yaml old mode 100755 new mode 100644 index 7d0d0053e..08e893a87 --- a/queries/aws_account_alternate_contact_3.yaml +++ b/queries/aws_account_alternate_contact_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Account Alternate Contact to fetch details - about the alternate contacts associated with an AWS account. +Description: Allows users to query AWS Account Alternate Contact to fetch details about the alternate contacts associated with an AWS account. ID: aws_account_alternate_contact_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n linked_account_id,\n contact_type,\n email_address,\n\ - \ phone_number,\n contact_title\nfrom\n aws_account_alternate_contact\nwhere\n\ - \ linked_account_id = '123456789012';" + QueryToExecute: | + SELECT + name, + linked_account_id, + contact_type, + email_address, + phone_number, + contact_title + FROM + aws_account_alternate_contact + WHERE + linked_account_id = '123456789012'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Account Management -Title: Find AWS Account Alternate Contact Details + - AWS Account Management +Title: Find AWS Account Alternate Contact Details \ No newline at end of file diff --git a/queries/aws_account_alternate_contact_4.yaml b/queries/aws_account_alternate_contact_4.yaml old mode 100755 new mode 100644 index 56cb158e3..8db95d8c5 --- a/queries/aws_account_alternate_contact_4.yaml +++ b/queries/aws_account_alternate_contact_4.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Account Alternate Contact to fetch details - about the alternate contacts associated with an AWS account. +Description: Allows users to query AWS Account Alternate Contact to fetch details about the alternate contacts associated with an AWS account. ID: aws_account_alternate_contact_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n linked_account_id,\n contact_type,\n email_address,\n\ - \ phone_number,\n contact_title\nfrom\n aws_account_alternate_contact\nwhere\n\ - \ linked_account_id = '123456789012'\n and contact_type = 'SECURITY';" + QueryToExecute: | + SELECT + name, + linked_account_id, + contact_type, + email_address, + phone_number, + contact_title + FROM + aws_account_alternate_contact + WHERE + linked_account_id = '123456789012' + AND contact_type = 'SECURITY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Account Management -Title: Find all AWS Account Alternate Contacts using SQL + - Account Management +Title: Find all AWS Account Alternate Contacts using SQL \ No newline at end of file diff --git a/queries/aws_account_contact_1.yaml b/queries/aws_account_contact_1.yaml old mode 100755 new mode 100644 index d7310d58b..4644971b3 --- a/queries/aws_account_contact_1.yaml +++ b/queries/aws_account_contact_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Account Contact details, including email, mobile, - and address information associated with an AWS account. +Description: Allows users to query AWS Account Contact details, including email, mobile, and address information associated with an AWS account. ID: aws_account_contact_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n full_name,\n company_name,\n city,\n phone_number,\n\ - \ postal_code,\n state_or_region,\n website_url\nfrom\n aws_account_contact;" + QueryToExecute: | + SELECT + full_name, + company_name, + city, + phone_number, + postal_code, + state_or_region, + website_url + FROM + aws_account_contact; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Account Contact -Title: List AWS Account Contact Details using SQL + - Account Contact +Title: List AWS Account Contact Details using SQL \ No newline at end of file diff --git a/queries/aws_account_contact_2.yaml b/queries/aws_account_contact_2.yaml old mode 100755 new mode 100644 index b18e9a82f..69bb586b4 --- a/queries/aws_account_contact_2.yaml +++ b/queries/aws_account_contact_2.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Account Contact details, including email, mobile, - and address information associated with an AWS account. +Description: Allows users to query AWS Account Contact details, including email, mobile, and address information associated with an AWS account. ID: aws_account_contact_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n full_name,\n company_name,\n city,\n phone_number,\n\ - \ postal_code,\n state_or_region,\n website_url\nfrom\n aws_account_contact\n\ - where\n linked_account_id = '123456789012';" + QueryToExecute: | + SELECT + full_name, + company_name, + city, + phone_number, + postal_code, + state_or_region, + website_url + FROM + aws_account_contact + WHERE + linked_account_id = '123456789012'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Account Contact -Title: Find AWS Account Contact details using SQL + - Account Contact +Title: Find AWS Account Contact details using SQL \ No newline at end of file diff --git a/queries/aws_acm_certificate_1.yaml b/queries/aws_acm_certificate_1.yaml old mode 100755 new mode 100644 index e5e9be83f..5cbc9c946 --- a/queries/aws_acm_certificate_1.yaml +++ b/queries/aws_acm_certificate_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Certificate Manager certificates. This table - provides information about each certificate, including the domain name, status, - issuer, and more. It can be used to monitor certificate details, validity, and expiration - data. +Description: Allows users to query AWS Certificate Manager certificates. This table provides information about each certificate, including the domain name, status, issuer, and more. It can be used to monitor certificate details, validity, and expiration data. ID: aws_acm_certificate_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_arn,\n domain_name,\n failure_reason,\n\ - \ in_use_by,\n status,\n key_algorithm\nfrom\n aws_acm_certificate;" + QueryToExecute: | + SELECT + certificate_arn, + domain_name, + failure_reason, + in_use_by, + status, + key_algorithm + FROM + aws_acm_certificate; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Certificate Manager -Title: Find AWS ACM Certificates and Their Details + - Certificate Manager +Title: Find AWS ACM Certificates and Their Details \ No newline at end of file diff --git a/queries/aws_acm_certificate_2.yaml b/queries/aws_acm_certificate_2.yaml old mode 100755 new mode 100644 index b5b3e283b..048d85a2a --- a/queries/aws_acm_certificate_2.yaml +++ b/queries/aws_acm_certificate_2.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Certificate Manager certificates. This table - provides information about each certificate, including the domain name, status, - issuer, and more. It can be used to monitor certificate details, validity, and expiration - data. +Description: Allows users to query AWS Certificate Manager certificates. This table provides information about each certificate, including the domain name, status, issuer, and more. It can be used to monitor certificate details, validity, and expiration data. ID: aws_acm_certificate_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_arn,\n domain_name,\n status\nfrom\n aws_acm_certificate\n\ - where\n status = 'EXPIRED';" + QueryToExecute: | + SELECT + certificate_arn, + domain_name, + status + FROM + aws_acm_certificate + WHERE + status = 'EXPIRED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Certificate Manager -Title: List all AWS Certificate Manager certificates status + - Certificate Manager +Title: List all AWS Certificate Manager certificates status \ No newline at end of file diff --git a/queries/aws_acm_certificate_3.yaml b/queries/aws_acm_certificate_3.yaml old mode 100755 new mode 100644 index 76ca78e9b..bdfa32b80 --- a/queries/aws_acm_certificate_3.yaml +++ b/queries/aws_acm_certificate_3.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Certificate Manager certificates. This table - provides information about each certificate, including the domain name, status, - issuer, and more. It can be used to monitor certificate details, validity, and expiration - data. +Description: Allows users to query AWS Certificate Manager certificates. This table provides information about each certificate, including the domain name, status, issuer, and more. It can be used to monitor certificate details, validity, and expiration data. ID: aws_acm_certificate_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_arn,\n domain_name,\n status\nfrom\n aws_acm_certificate\n\ - where\n certificate_transparency_logging_preference <> 'ENABLED';" + QueryToExecute: | + SELECT + certificate_arn, + domain_name, + status + FROM + aws_acm_certificate + WHERE + certificate_transparency_logging_preference <> 'ENABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Certificate Manager -Title: Find all AWS Certificate Manager certificates details + - Certificate Manager +Title: Find all AWS Certificate Manager certificates details \ No newline at end of file diff --git a/queries/aws_acm_certificate_4.yaml b/queries/aws_acm_certificate_4.yaml old mode 100755 new mode 100644 index 772f4e088..996a4d778 --- a/queries/aws_acm_certificate_4.yaml +++ b/queries/aws_acm_certificate_4.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS Certificate Manager certificates. This table - provides information about each certificate, including the domain name, status, - issuer, and more. It can be used to monitor certificate details, validity, and expiration - data. +Description: Allows users to query AWS Certificate Manager certificates. This table provides information about each certificate, including the domain name, status, issuer, and more. It can be used to monitor certificate details, validity, and expiration data. ID: aws_acm_certificate_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_arn,\n tags\nfrom\n aws_acm_certificate\n\ - where\n not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + certificate_arn, + tags + FROM + aws_acm_certificate + WHERE + NOT tags :: JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Certificate Manager -Title: List all AWS Certificate Manager certificates with SQL + - Certificate Manager +Title: List all AWS Certificate Manager certificates with SQL \ No newline at end of file diff --git a/queries/aws_acmpca_certificate_authority_1.yaml b/queries/aws_acmpca_certificate_authority_1.yaml old mode 100755 new mode 100644 index bc84e3c67..6432a5976 --- a/queries/aws_acmpca_certificate_authority_1.yaml +++ b/queries/aws_acmpca_certificate_authority_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be - used to monitor certificate authorities details, validity, usage mode and expiration - data. +Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be used to monitor certificate authorities details, validity, usage mode and expiration data. ID: aws_acmpca_certificate_authority_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n created_at,\n not_before,\n not_after,\n\ - \ key_storage_security_standard,\n failure_reason\nfrom\n aws_acmpca_certificate_authority;" + QueryToExecute: | + SELECT + arn, + status, + created_at, + not_before, + not_after, + key_storage_security_standard, + failure_reason + FROM + aws_acmpca_certificate_authority; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ACM PCA -Title: List all AWS ACM PCA Certificate Authorities details + - ACM PCA +Title: List all AWS ACM PCA Certificate Authorities details \ No newline at end of file diff --git a/queries/aws_acmpca_certificate_authority_2.yaml b/queries/aws_acmpca_certificate_authority_2.yaml old mode 100755 new mode 100644 index f4d0d5cca..60ceeec5c --- a/queries/aws_acmpca_certificate_authority_2.yaml +++ b/queries/aws_acmpca_certificate_authority_2.yaml @@ -1,32 +1,36 @@ -Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be - used to monitor certificate authorities details, validity, usage mode and expiration - data. +Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be used to monitor certificate authorities details, validity, usage mode, and expiration data. ID: aws_acmpca_certificate_authority_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n key_storage_security_standard\nfrom\n\ - \ aws_acmpca_certificate_authority\nwhere\n key_storage_security_standard =\ - \ 'FIPS_140_2_LEVEL_3_OR_HIGHER';" + QueryToExecute: | + SELECT + arn, + status, + key_storage_security_standard + FROM + aws_acmpca_certificate_authority + WHERE + key_storage_security_standard = 'FIPS_140_2_LEVEL_3_OR_HIGHER'; Tags: cloud_asset_management: - - 'false' + - "false" cloud_data_security: - - 'false' + - "false" cloud_finops: - - 'false' + - "false" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'false' + - "false" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ACM PCA -Title: List all AWS ACM PCA Certificate Authority Details + - ACM PCA +Title: List all AWS ACM PCA Certificate Authority Details \ No newline at end of file diff --git a/queries/aws_acmpca_certificate_authority_3.yaml b/queries/aws_acmpca_certificate_authority_3.yaml old mode 100755 new mode 100644 index cdf73e7fb..96a9f5ff0 --- a/queries/aws_acmpca_certificate_authority_3.yaml +++ b/queries/aws_acmpca_certificate_authority_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be - used to monitor certificate authorities details, validity, usage mode and expiration - data. +Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be used to monitor certificate authorities details, validity, usage mode and expiration data. ID: aws_acmpca_certificate_authority_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n created_at,\n last_state_change_at\n\ - from\n aws_acmpca_certificate_authority\nwhere\n status = 'ACTIVE';" + QueryToExecute: | + SELECT + arn, + status, + created_at, + last_state_change_at + FROM + aws_acmpca_certificate_authority + WHERE + status = 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ACM PCA -Title: List all AWS ACM PCA Certificate Authorities details and status + - ACM PCA +Title: List all AWS ACM PCA Certificate Authorities details and status \ No newline at end of file diff --git a/queries/aws_acmpca_certificate_authority_4.yaml b/queries/aws_acmpca_certificate_authority_4.yaml old mode 100755 new mode 100644 index 77f273edc..ba9d273cc --- a/queries/aws_acmpca_certificate_authority_4.yaml +++ b/queries/aws_acmpca_certificate_authority_4.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be - used to monitor certificate authorities details, validity, usage mode and expiration - data. +Description: Allows users to query AWS ACM PCA Certificate Authorities. It can be used to monitor certificate authorities details, validity, usage mode and expiration data. ID: aws_acmpca_certificate_authority_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n tags\nfrom\n aws_acmpca_certificate_authority\n\ - where\n (tags ->> 'Project') = 'MyProject';" + QueryToExecute: | + SELECT + arn, + tags + FROM + aws_acmpca_certificate_authority + WHERE + (tags ->> 'Project') = 'MyProject'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ACM PCA -Title: List all AWS ACM PCA Certificate Authorities details + - ACM PCA +Title: List all AWS ACM PCA Certificate Authorities details \ No newline at end of file diff --git a/queries/aws_amplify_app_1.yaml b/queries/aws_amplify_app_1.yaml old mode 100755 new mode 100644 index 9af48f014..ed6b97a0c --- a/queries/aws_amplify_app_1.yaml +++ b/queries/aws_amplify_app_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n app_id,\n name,\n description,\n arn,\n platform,\n\ - \ create_time,\n build_spec\nfrom\n aws_amplify_app;" + QueryToExecute: | + SELECT + app_id, + name, + description, + arn, + platform, + create_time, + build_spec + FROM + aws_amplify_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Amplify -Title: Find all detailed information about AWS Amplify Apps + - AWS Amplify +Title: Find all detailed information about AWS Amplify Apps \ No newline at end of file diff --git a/queries/aws_amplify_app_2.yaml b/queries/aws_amplify_app_2.yaml old mode 100755 new mode 100644 index 010d71249..e4b64cc02 --- a/queries/aws_amplify_app_2.yaml +++ b/queries/aws_amplify_app_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n app_id,\n create_time\nfrom\n aws_amplify_app\n\ - where\n create_time >= (now() - interval '90' day)\norder by\n create_time;" + QueryToExecute: | + SELECT + name, + app_id, + create_time + FROM + aws_amplify_app + WHERE + create_time >= (NOW() - INTERVAL '90' DAY) + ORDER BY + create_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Amplify -Title: List AWS Amplify Apps with Details Including Creation Date + - AWS Amplify +Title: List AWS Amplify Apps with Details Including Creation Date \ No newline at end of file diff --git a/queries/aws_amplify_app_3.yaml b/queries/aws_amplify_app_3.yaml old mode 100755 new mode 100644 index 69adc547b..9e2c914e4 --- a/queries/aws_amplify_app_3.yaml +++ b/queries/aws_amplify_app_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n app_id,\n update_time\nfrom\n aws_amplify_app\n\ - where\n update_time >= (now() - interval '1' hour)\norder by\n update_time;" + QueryToExecute: | + SELECT + name, + app_id, + update_time + FROM + aws_amplify_app + WHERE + update_time >= (NOW() - INTERVAL '1' HOUR) + ORDER BY + update_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amplify -Title: List all AWS Amplify Apps with Recent Update Time + - Amplify +Title: List all AWS Amplify Apps with Recent Update Time \ No newline at end of file diff --git a/queries/aws_amplify_app_4.yaml b/queries/aws_amplify_app_4.yaml old mode 100755 new mode 100644 index 0e87ade3b..c366ec68d --- a/queries/aws_amplify_app_4.yaml +++ b/queries/aws_amplify_app_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n production_branch ->> 'BranchName' as branch_name,\n\ - \ production_branch ->> 'LastDeployTime' as last_deploy_time,\n production_branch\ - \ ->> 'Status' as status\nfrom\n aws_amplify_app\nwhere\n name = 'amplify_app_name';" + QueryToExecute: | + SELECT + production_branch ->> 'BranchName' AS branch_name, + production_branch ->> 'LastDeployTime' AS last_deploy_time, + production_branch ->> 'Status' AS status + FROM + aws_amplify_app + WHERE + name = 'amplify_app_name'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amplify -Title: Find AWS Amplify Apps with Branch Details + - Amplify +Title: Find AWS Amplify Apps with Branch Details \ No newline at end of file diff --git a/queries/aws_amplify_app_5.yaml b/queries/aws_amplify_app_5.yaml old mode 100755 new mode 100644 index a08a85f95..ab01a4e74 --- a/queries/aws_amplify_app_5.yaml +++ b/queries/aws_amplify_app_5.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n app_id,\n build_spec ->> 'backend' as build_backend_spec,\n\ - \ build_spec ->> 'frontend' as build_frontend_spec,\n build_spec ->> 'test'\ - \ as build_test_spec,\n build_spec ->> 'env' as build_env_settings\nfrom\n aws_amplify_app\n\ - where\n name = 'amplify_app_name';" + QueryToExecute: | + SELECT + name, + app_id, + build_spec ->> 'backend' AS build_backend_spec, + build_spec ->> 'frontend' AS build_frontend_spec, + build_spec ->> 'test' AS build_test_spec, + build_spec ->> 'env' AS build_env_settings + FROM + aws_amplify_app + WHERE + name = 'amplify_app_name'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amplify -Title: List all AWS Amplify Apps with Detailed Information + - Amplify +Title: List all AWS Amplify Apps with Detailed Information \ No newline at end of file diff --git a/queries/aws_amplify_app_6.yaml b/queries/aws_amplify_app_6.yaml old mode 100755 new mode 100644 index 284e1c78a..90d2abbd9 --- a/queries/aws_amplify_app_6.yaml +++ b/queries/aws_amplify_app_6.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n redirects_array ->> 'Condition' as country_code,\n\ - \ redirects_array ->> 'Source' as source_address,\n redirects_array ->> 'Status'\ - \ as redirect_type,\n redirects_array ->> 'Target' as destination_address\nfrom\n\ - \ aws_amplify_app,\n jsonb_array_elements(custom_rules) as redirects_array\n\ - where\n redirects_array ->> 'Status' = '200'\n and name = 'amplify_app_name';" + QueryToExecute: | + SELECT + name, + redirects_array ->> 'Condition' AS country_code, + redirects_array ->> 'Source' AS source_address, + redirects_array ->> 'Status' AS redirect_type, + redirects_array ->> 'Target' AS destination_address + FROM + aws_amplify_app, + jsonb_array_elements(custom_rules) AS redirects_array + WHERE + redirects_array ->> 'Status' = '200' + AND name = 'amplify_app_name'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amplify -Title: Find AWS Amplify Apps with Detailed Information + - Amplify +Title: Find AWS Amplify Apps with Detailed Information \ No newline at end of file diff --git a/queries/aws_amplify_app_7.yaml b/queries/aws_amplify_app_7.yaml old mode 100755 new mode 100644 index ff7f1c6c7..1b87e32a0 --- a/queries/aws_amplify_app_7.yaml +++ b/queries/aws_amplify_app_7.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Amplify Apps to retrieve detailed information - about each application, including its name, ARN, creation date, default domain, - and more. +Description: Allows users to query AWS Amplify Apps to retrieve detailed information about each application, including its name, ARN, creation date, default domain, and more. ID: aws_amplify_app_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n app_id,\n name,\n description,\n arn\nfrom\n aws_amplify_app\n\ - where\n enable_branch_auto_build = true;" + QueryToExecute: | + SELECT + app_id, + name, + description, + arn + FROM + aws_amplify_app + WHERE + enable_branch_auto_build = TRUE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amplify -Title: List all AWS Amplify Apps with Auto Build enabled + - Amplify +Title: List all AWS Amplify Apps with Auto Build enabled \ No newline at end of file diff --git a/queries/aws_api_gateway_api_key_1.yaml b/queries/aws_api_gateway_api_key_1.yaml old mode 100755 new mode 100644 index 3067ae890..b30e83c54 --- a/queries/aws_api_gateway_api_key_1.yaml +++ b/queries/aws_api_gateway_api_key_1.yaml @@ -1,27 +1,30 @@ -Description: Allows users to query API Keys in AWS API Gateway. The `aws_api_gateway_api_key` - table in Steampipe provides information about API Keys within AWS API Gateway. This - table allows DevOps engineers to query API Key-specific details, including its ID, - value, enabled status, and associated metadata. Users can utilize this table to - gather insights on API Keys, such as keys that are enabled, keys associated with - specific stages, and more. The schema outlines the various attributes of the API - Key, including the key ID, creation date, enabled status, and associated tags. +Description: Allows users to query API Keys in AWS API Gateway. The `aws_api_gateway_api_key` table in Steampipe provides information about API Keys within AWS API Gateway. This table allows DevOps engineers to query API Key-specific details, including its ID, value, enabled status, and associated metadata. Users can utilize this table to gather insights on API Keys, such as keys that are enabled, keys associated with specific stages, and more. The schema outlines the various attributes of the API Key, including the key ID, creation date, enabled status, and associated tags. ID: aws_api_gateway_api_key_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n enabled,\n created_date,\n last_updated_date,\n\ - \ customer_id,\n stage_keys\nfrom\n aws_api_gateway_api_key;" + QueryToExecute: | + SELECT + name, + id, + enabled, + created_date, + last_updated_date, + customer_id, + stage_keys + FROM + aws_api_gateway_api_key; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List All API Keys Details in AWS API Gateway + - API Gateway +Title: List All API Keys Details in AWS API Gateway \ No newline at end of file diff --git a/queries/aws_api_gateway_api_key_2.yaml b/queries/aws_api_gateway_api_key_2.yaml old mode 100755 new mode 100644 index f88fa83fd..2c0738280 --- a/queries/aws_api_gateway_api_key_2.yaml +++ b/queries/aws_api_gateway_api_key_2.yaml @@ -1,27 +1,28 @@ -Description: Allows users to query API Keys in AWS API Gateway. The `aws_api_gateway_api_key` - table in Steampipe provides information about API Keys within AWS API Gateway. This - table allows DevOps engineers to query API Key-specific details, including its ID, - value, enabled status, and associated metadata. Users can utilize this table to - gather insights on API Keys, such as keys that are enabled, keys associated with - specific stages, and more. The schema outlines the various attributes of the API - Key, including the key ID, creation date, enabled status, and associated tags. +Description: Allows users to query API Keys in AWS API Gateway. The `aws_api_gateway_api_key` table in Steampipe provides information about API Keys within AWS API Gateway. This table allows DevOps engineers to query API Key-specific details, including its ID, value, enabled status, and associated metadata. Users can utilize this table to gather insights on API Keys, such as keys that are enabled, keys associated with specific stages, and more. The schema outlines the various attributes of the API Key, including the key ID, creation date, enabled status, and associated tags. ID: aws_api_gateway_api_key_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n customer_id\nfrom\n aws_api_gateway_api_key\n\ - where\n not enabled;" + QueryToExecute: | + SELECT + name, + id, + customer_id + FROM + aws_api_gateway_api_key + WHERE + NOT enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway API Keys That Are Disabled + - API Gateway +Title: Find AWS API Gateway API Keys That Are Disabled \ No newline at end of file diff --git a/queries/aws_api_gateway_authorizer_1.yaml b/queries/aws_api_gateway_authorizer_1.yaml old mode 100755 new mode 100644 index b86cafe01..341e7c0aa --- a/queries/aws_api_gateway_authorizer_1.yaml +++ b/queries/aws_api_gateway_authorizer_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS API Gateway Authorizer and access data about - API Gateway Authorizers in an AWS account. This data includes the authorizer''s - ID, name, type, provider ARNs, and other configuration details. +Description: Allows users to query AWS API Gateway Authorizer and access data about API Gateway Authorizers in an AWS account. This data includes the authorizer's ID, name, type, provider ARNs, and other configuration details. ID: aws_api_gateway_authorizer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n rest_api_id,\n auth_type,\n authorizer_credentials,\n\ - \ identity_validation_expression,\n identity_source\nfrom\n aws_api_gateway_authorizer;" + QueryToExecute: | + SELECT + id, + name, + rest_api_id, + auth_type, + authorizer_credentials, + identity_validation_expression, + identity_source + FROM + aws_api_gateway_authorizer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Authorizer Configuration Details + - API Gateway +Title: Find AWS API Gateway Authorizer Configuration Details \ No newline at end of file diff --git a/queries/aws_api_gateway_authorizer_2.yaml b/queries/aws_api_gateway_authorizer_2.yaml old mode 100755 new mode 100644 index ab011fb7c..01da71cf7 --- a/queries/aws_api_gateway_authorizer_2.yaml +++ b/queries/aws_api_gateway_authorizer_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS API Gateway Authorizer and access data about - API Gateway Authorizers in an AWS account. This data includes the authorizer''s - ID, name, type, provider ARNs, and other configuration details. +Description: Allows users to query AWS API Gateway Authorizer and access data about API Gateway Authorizers in an AWS account. This data includes the authorizer's ID, name, type, provider ARNs, and other configuration details. ID: aws_api_gateway_authorizer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n rest_api_id,\n auth_type\nfrom\n aws_api_gateway_authorizer\n\ - where\n auth_type = 'cognito_user_pools';" + QueryToExecute: | + SELECT + id, + name, + rest_api_id, + auth_type + FROM + aws_api_gateway_authorizer + WHERE + auth_type = 'cognito_user_pools'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Authorizers with Cognito User Pools + - API Gateway +Title: List all AWS API Gateway Authorizers with Cognito User Pools \ No newline at end of file diff --git a/queries/aws_api_gateway_domain_name_1.yaml b/queries/aws_api_gateway_domain_name_1.yaml old mode 100755 new mode 100644 index 34a7434d9..16b88fa88 --- a/queries/aws_api_gateway_domain_name_1.yaml +++ b/queries/aws_api_gateway_domain_name_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS API Gateway Domain Names and retrieve details - about each domain''s configuration, certificate, and associated API. +Description: Allows users to query AWS API Gateway Domain Names and retrieve details about each domain's configuration, certificate, and associated API. ID: aws_api_gateway_domain_name_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n certificate_arn,\n distribution_domain_name,\n\ - \ distribution_hosted_zone_id,\n domain_name_status,\n ownership_verification_certificate_arn\n\ - from\n aws_api_gateway_domain_name;" + QueryToExecute: | + SELECT + domain_name, + certificate_arn, + distribution_domain_name, + distribution_hosted_zone_id, + domain_name_status, + ownership_verification_certificate_arn + FROM + aws_api_gateway_domain_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Domain Names with Configuration + - API Gateway +Title: List all AWS API Gateway Domain Names with Configuration \ No newline at end of file diff --git a/queries/aws_api_gateway_domain_name_2.yaml b/queries/aws_api_gateway_domain_name_2.yaml old mode 100755 new mode 100644 index cb3ee46bf..0b2d94870 --- a/queries/aws_api_gateway_domain_name_2.yaml +++ b/queries/aws_api_gateway_domain_name_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS API Gateway Domain Names and retrieve details - about each domain''s configuration, certificate, and associated API. +Description: Allows users to query AWS API Gateway Domain Names and retrieve details about each domain's configuration, certificate, and associated API. ID: aws_api_gateway_domain_name_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n certificate_arn,\n certificate_upload_date,\n\ - \ regional_certificate_arn,\n domain_name_status\nfrom\n aws_api_gateway_domain_name\n\ - where\n domain_name_status = 'AVAILABLE';" + QueryToExecute: | + SELECT + domain_name, + certificate_arn, + certificate_upload_date, + regional_certificate_arn, + domain_name_status + FROM + aws_api_gateway_domain_name + WHERE + domain_name_status = 'AVAILABLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Domain Names and Configurations + - API Gateway +Title: Find AWS API Gateway Domain Names and Configurations \ No newline at end of file diff --git a/queries/aws_api_gateway_domain_name_3.yaml b/queries/aws_api_gateway_domain_name_3.yaml old mode 100755 new mode 100644 index 88e208876..ec267911c --- a/queries/aws_api_gateway_domain_name_3.yaml +++ b/queries/aws_api_gateway_domain_name_3.yaml @@ -1,22 +1,33 @@ -Description: Allows users to query AWS API Gateway Domain Names and retrieve details - about each domain''s configuration, certificate, and associated API. +Description: Allows users to query AWS API Gateway Domain Names and retrieve details about each domain's configuration, certificate, and associated API. ID: aws_api_gateway_domain_name_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.domain_name,\n d.regional_certificate_arn,\n c.certificate,\n\ - \ c.certificate_transparency_logging_preference,\n c.created_at,\n c.imported_at,\n\ - \ c.issuer,\n c.issued_at,\n c.key_algorithm\nfrom\n aws_api_gateway_domain_name\ - \ as d,\n aws_acm_certificate as c\nwhere\n c.certificate_arn = d.regional_certificate_arn;" + QueryToExecute: | + SELECT + d.domain_name, + d.regional_certificate_arn, + c.certificate, + c.certificate_transparency_logging_preference, + c.created_at, + c.imported_at, + c.issuer, + c.issued_at, + c.key_algorithm + FROM + aws_api_gateway_domain_name AS d, + aws_acm_certificate AS c + WHERE + c.certificate_arn = d.regional_certificate_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Domain Names and Certificates + - API Gateway +Title: Find AWS API Gateway Domain Names and Certificates \ No newline at end of file diff --git a/queries/aws_api_gateway_domain_name_4.yaml b/queries/aws_api_gateway_domain_name_4.yaml old mode 100755 new mode 100644 index 9cf846140..1825912e8 --- a/queries/aws_api_gateway_domain_name_4.yaml +++ b/queries/aws_api_gateway_domain_name_4.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS API Gateway Domain Names and retrieve details - about each domain''s configuration, certificate, and associated API. +Description: Allows users to query AWS API Gateway Domain Names and retrieve details about each domain's configuration, certificate, and associated API. ID: aws_api_gateway_domain_name_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n endpoint_configuration -> 'Types' as\ - \ endpoint_types,\n endpoint_configuration -> 'VpcEndpointIds' as vpc_endpoint_ids\n\ - from\n aws_api_gateway_domain_name;" + QueryToExecute: | + SELECT + domain_name, + endpoint_configuration -> 'Types' AS endpoint_types, + endpoint_configuration -> 'VpcEndpointIds' AS vpc_endpoint_ids + FROM + aws_api_gateway_domain_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Domain Names Configuration Certificates + - API Gateway +Title: Find AWS API Gateway Domain Names Configuration Certificates \ No newline at end of file diff --git a/queries/aws_api_gateway_domain_name_5.yaml b/queries/aws_api_gateway_domain_name_5.yaml old mode 100755 new mode 100644 index 94a7020ca..d14f6257f --- a/queries/aws_api_gateway_domain_name_5.yaml +++ b/queries/aws_api_gateway_domain_name_5.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS API Gateway Domain Names and retrieve details - about each domain''s configuration, certificate, and associated API. +Description: Allows users to query AWS API Gateway Domain Names and retrieve details about each domain's configuration, certificate, and associated API. ID: aws_api_gateway_domain_name_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n mutual_tls_authentication ->> 'TruststoreUri'\ - \ as truststore_uri,\n mutual_tls_authentication ->> 'TruststoreVersion' as truststore_version,\n\ - \ mutual_tls_authentication ->> 'TruststoreWarnings' as truststore_warnings\n\ - from\n aws_api_gateway_domain_name;" + QueryToExecute: | + SELECT + domain_name, + mutual_tls_authentication ->> 'TruststoreUri' AS truststore_uri, + mutual_tls_authentication ->> 'TruststoreVersion' AS truststore_version, + mutual_tls_authentication ->> 'TruststoreWarnings' AS truststore_warnings + FROM + aws_api_gateway_domain_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Domain Configuration and Certificates + - API Gateway +Title: Find AWS API Gateway Domain Configuration and Certificates \ No newline at end of file diff --git a/queries/aws_api_gateway_method_1.yaml b/queries/aws_api_gateway_method_1.yaml old mode 100755 new mode 100644 index 746130c0b..fc62ae3c9 --- a/queries/aws_api_gateway_method_1.yaml +++ b/queries/aws_api_gateway_method_1.yaml @@ -1,29 +1,28 @@ -Description: Represents a client-facing interface by which the client calls the API - to access back-end resources. A Method resource is integrated with an Integration - resource. Both consist of a request and one or more responses. The method request - takes the client input that is passed to the back end through the integration request. - A method response returns the output from the back end to the client through an - integration response. A method request is embodied in a Method resource, whereas - an integration request is embodied in an Integration resource. On the other hand, - a method response is represented by a MethodResponse resource, whereas an integration - response is represented by an IntegrationResponse resource. +Description: Represents a client-facing interface by which the client calls the API to access back-end resources. A Method resource is integrated with an Integration resource. Both consist of a request and one or more responses. The method request takes the client input that is passed to the back end through the integration request. A method response returns the output from the back end to the client through an integration response. A method request is embodied in a Method resource, whereas an integration request is embodied in an Integration resource. On the other hand, a method response is represented by a MethodResponse resource, whereas an integration response is represented by an IntegrationResponse resource. ID: aws_api_gateway_method_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rest_api_id,\n resource_id,\n http_method,\n path,\n\ - \ api_key_required\nfrom\n aws_api_gateway_method;" + QueryToExecute: | + SELECT + rest_api_id, + resource_id, + http_method, + path, + api_key_required + FROM + aws_api_gateway_method; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Methods + - API Gateway +Title: List all AWS API Gateway Methods \ No newline at end of file diff --git a/queries/aws_api_gateway_method_2.yaml b/queries/aws_api_gateway_method_2.yaml old mode 100755 new mode 100644 index 55396c3ff..d02d08713 --- a/queries/aws_api_gateway_method_2.yaml +++ b/queries/aws_api_gateway_method_2.yaml @@ -1,27 +1,27 @@ -Description: Represents a client-facing interface by which the client calls the API - to access back-end resources. A Method resource is integrated with an Integration - resource. Both consist of a request and one or more responses. The method request - takes the client input that is passed to the back end through the integration request. - A method response returns the output from the back end to the client through an - integration response. A method request is embodied in a Method resource, whereas - an integration request is embodied in an Integration resource. On the other hand, - a method response is represented by a MethodResponse resource, whereas an integration - response is represented by an IntegrationResponse resource. +Description: Represents a client-facing interface by which the client calls the API to access back-end resources. A Method resource is integrated with an Integration resource. Both consist of a request and one or more responses. The method request takes the client input that is passed to the back end through the integration request. A method response returns the output from the back end to the client through an integration response. A method request is embodied in a Method resource, whereas an integration request is embodied in an Integration resource. On the other hand, a method response is represented by a MethodResponse resource, whereas an integration response is represented by an IntegrationResponse resource. ID: aws_api_gateway_method_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rest_api_id,\n resource_id,\n http_method,\n operation_name\n\ - from\n aws_api_gateway_method\nwhere\n http_method = 'GET';" + QueryToExecute: | + SELECT + rest_api_id, + resource_id, + http_method, + operation_name + FROM + aws_api_gateway_method + WHERE + http_method = 'GET'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Methods with SQL Queries + - API Gateway +Title: Find AWS API Gateway Methods with SQL Queries \ No newline at end of file diff --git a/queries/aws_api_gateway_method_3.yaml b/queries/aws_api_gateway_method_3.yaml old mode 100755 new mode 100644 index 0524c9d37..19d0068b7 --- a/queries/aws_api_gateway_method_3.yaml +++ b/queries/aws_api_gateway_method_3.yaml @@ -1,30 +1,31 @@ -Description: Represents a client-facing interface by which the client calls the API - to access back-end resources. A Method resource is integrated with an Integration - resource. Both consist of a request and one or more responses. The method request - takes the client input that is passed to the back end through the integration request. - A method response returns the output from the back end to the client through an - integration response. A method request is embodied in a Method resource, whereas - an integration request is embodied in an Integration resource. On the other hand, - a method response is represented by a MethodResponse resource, whereas an integration - response is represented by an IntegrationResponse resource. +Description: Represents a client-facing interface by which the client calls the API to access back-end resources. A Method resource is integrated with an Integration resource. Both consist of a request and one or more responses. The method request takes the client input that is passed to the back end through the integration request. A method response returns the output from the back end to the client through an integration response. A method request is embodied in a Method resource, whereas an integration request is embodied in an Integration resource. On the other hand, a method response is represented by a MethodResponse resource, whereas an integration response is represented by an IntegrationResponse resource. ID: aws_api_gateway_method_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rest_api_id,\n resource_id,\n http_method,\n path,\n\ - \ authorization_type,\n authorizer_id\nfrom\n aws_api_gateway_method\nwhere\n\ - \ authorization_type = 'none';" + QueryToExecute: | + SELECT + rest_api_id, + resource_id, + http_method, + path, + authorization_type, + authorizer_id + FROM + aws_api_gateway_method + WHERE + authorization_type = 'none'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List AWS API Gateway Methods Using SQL + - API Gateway +Title: List AWS API Gateway Methods Using SQL \ No newline at end of file diff --git a/queries/aws_api_gateway_method_4.yaml b/queries/aws_api_gateway_method_4.yaml old mode 100755 new mode 100644 index 8f22f9192..1848f37de --- a/queries/aws_api_gateway_method_4.yaml +++ b/queries/aws_api_gateway_method_4.yaml @@ -1,39 +1,41 @@ -Description: Represents a client-facing interface by which the client calls the API - to access back-end resources. A Method resource is integrated with an Integration - resource. Both consist of a request and one or more responses. The method request - takes the client input that is passed to the back end through the integration request. - A method response returns the output from the back end to the client through an - integration response. A method request is embodied in a Method resource, whereas - an integration request is embodied in an Integration resource. On the other hand, - a method response is represented by a MethodResponse resource, whereas an integration - response is represented by an IntegrationResponse resource. +Description: Represents a client-facing interface by which the client calls the API to access back-end resources. A Method resource is integrated with an Integration resource. Both consist of a request and one or more responses. The method request takes the client input that is passed to the back end through the integration request. A method response returns the output from the back end to the client through an integration response. A method request is embodied in a Method resource, whereas an integration request is embodied in an Integration resource. On the other hand, a method response is represented by a MethodResponse resource, whereas an integration response is represented by an IntegrationResponse resource. ID: aws_api_gateway_method_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rest_api_id,\n resource_id,\n http_method,\n method_integration\ - \ -> 'CacheKeyParameters' as cache_key_parameters,\n method_integration ->> 'CacheNamespace'\ - \ as cache_namespace,\n method_integration ->> 'ConnectionId' as connection_id,\n\ - \ method_integration ->> 'ConnectionType' as connection_type,\n method_integration\ - \ ->> 'ContentHandling' as content_handling,\n method_integration ->> 'Credentials'\ - \ as credentials,\n method_integration ->> 'HttpMethod' as http_method,\n method_integration\ - \ ->> 'PassthroughBehavior' as passthrough_behavior,\n method_integration ->>\ - \ 'RequestParameters' as request_parameters,\n method_integration -> 'RequestTemplates'\ - \ as request_templates,\n method_integration ->> 'TimeoutInMillis' as timeout_in_millis,\n\ - \ method_integration ->> 'tls_config' as tls_config,\n method_integration ->>\ - \ 'Type' as type,\n method_integration ->> 'Uri' as uri,\n method_integration\ - \ -> 'IntegrationResponses' as integration_responses\nfrom\n aws_api_gateway_method;" + QueryToExecute: | + SELECT + rest_api_id, + resource_id, + http_method, + method_integration -> 'CacheKeyParameters' AS cache_key_parameters, + method_integration ->> 'CacheNamespace' AS cache_namespace, + method_integration ->> 'ConnectionId' AS connection_id, + method_integration ->> 'ConnectionType' AS connection_type, + method_integration ->> 'ContentHandling' AS content_handling, + method_integration ->> 'Credentials' AS credentials, + method_integration ->> 'HttpMethod' AS http_method, + method_integration ->> 'PassthroughBehavior' AS passthrough_behavior, + method_integration ->> 'RequestParameters' AS request_parameters, + method_integration -> 'RequestTemplates' AS request_templates, + method_integration ->> 'TimeoutInMillis' AS timeout_in_millis, + method_integration ->> 'tls_config' AS tls_config, + method_integration ->> 'Type' AS type, + method_integration ->> 'Uri' AS uri, + method_integration -> 'IntegrationResponses' AS integration_responses + FROM + aws_api_gateway_method; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Methods using SQL + - API Gateway +Title: List all AWS API Gateway Methods using SQL \ No newline at end of file diff --git a/queries/aws_api_gateway_rest_api_1.yaml b/queries/aws_api_gateway_rest_api_1.yaml old mode 100755 new mode 100644 index b78786a3a..24b480395 --- a/queries/aws_api_gateway_rest_api_1.yaml +++ b/queries/aws_api_gateway_rest_api_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS API Gateway Rest APIs to retrieve information - about API Gateway REST APIs in an AWS account. +Description: Allows users to query AWS API Gateway Rest APIs to retrieve information about API Gateway REST APIs in an AWS account. ID: aws_api_gateway_rest_api_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_key_source,\n minimum_compression_size,\n\ - \ binary_media_types\nfrom\n aws_api_gateway_rest_api;" + QueryToExecute: | + SELECT + name, + api_id, + api_key_source, + minimum_compression_size, + binary_media_types + FROM + aws_api_gateway_rest_api; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway REST APIs with details + - API Gateway +Title: List all AWS API Gateway REST APIs with details \ No newline at end of file diff --git a/queries/aws_api_gateway_rest_api_2.yaml b/queries/aws_api_gateway_rest_api_2.yaml old mode 100755 new mode 100644 index 54662c578..e3e58d21a --- a/queries/aws_api_gateway_rest_api_2.yaml +++ b/queries/aws_api_gateway_rest_api_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS API Gateway Rest APIs to retrieve information - about API Gateway REST APIs in an AWS account. +Description: Allows users to query AWS API Gateway Rest APIs to retrieve information about API Gateway REST APIs in an AWS account. ID: aws_api_gateway_rest_api_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_key_source,\n minimum_compression_size\n\ - from\n aws_api_gateway_rest_api\nwhere\n minimum_compression_size is null;" + QueryToExecute: | + SELECT + name, + api_id, + api_key_source, + minimum_compression_size + FROM + aws_api_gateway_rest_api + WHERE + minimum_compression_size IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway REST APIs with SQL + - API Gateway +Title: List all AWS API Gateway REST APIs with SQL \ No newline at end of file diff --git a/queries/aws_api_gateway_rest_api_3.yaml b/queries/aws_api_gateway_rest_api_3.yaml old mode 100755 new mode 100644 index 761d33b6e..6493ec3e1 --- a/queries/aws_api_gateway_rest_api_3.yaml +++ b/queries/aws_api_gateway_rest_api_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS API Gateway Rest APIs to retrieve information - about API Gateway REST APIs in an AWS account. +Description: Allows users to query AWS API Gateway Rest APIs to retrieve information about API Gateway REST APIs in an AWS account. ID: aws_api_gateway_rest_api_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_key_source,\n endpoint_configuration_types,\n\ - \ endpoint_configuration_vpc_endpoint_ids\nfrom\n aws_api_gateway_rest_api\n\ - where\n not endpoint_configuration_types ? 'PRIVATE';" + QueryToExecute: | + SELECT + name, + api_id, + api_key_source, + endpoint_configuration_types, + endpoint_configuration_vpc_endpoint_ids + FROM + aws_api_gateway_rest_api + WHERE + NOT endpoint_configuration_types ? 'PRIVATE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List AWS API Gateway REST APIs Information + - API Gateway +Title: List AWS API Gateway REST APIs Information \ No newline at end of file diff --git a/queries/aws_api_gateway_rest_api_4.yaml b/queries/aws_api_gateway_rest_api_4.yaml old mode 100755 new mode 100644 index b0087dabe..6451acc3b --- a/queries/aws_api_gateway_rest_api_4.yaml +++ b/queries/aws_api_gateway_rest_api_4.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query AWS API Gateway Rest APIs to retrieve information - about API Gateway REST APIs in an AWS account. +Description: Allows users to query AWS API Gateway Rest APIs to retrieve information about API Gateway REST APIs in an AWS account. ID: aws_api_gateway_rest_api_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_api_gateway_rest_api,\n\ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n string_to_array(p, ':') as pa,\n jsonb_array_elements_text(s\ - \ -> 'Action') as a\nwhere\n s ->> 'Effect' = 'Allow'\n and (\n pa [5] !=\ - \ account_id\n or p = '*'\n );" + QueryToExecute: | + SELECT + name, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_api_gateway_rest_api, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + string_to_array(p, ':') AS pa, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND ( + pa[5] != account_id + OR p = '*' + ); Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway REST APIs Information + - API Gateway +Title: Find AWS API Gateway REST APIs Information \ No newline at end of file diff --git a/queries/aws_api_gateway_rest_api_5.yaml b/queries/aws_api_gateway_rest_api_5.yaml old mode 100755 new mode 100644 index 2379302f2..f8e154196 --- a/queries/aws_api_gateway_rest_api_5.yaml +++ b/queries/aws_api_gateway_rest_api_5.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS API Gateway Rest APIs to retrieve information - about API Gateway REST APIs in an AWS account. +Description: Allows users to query AWS API Gateway Rest APIs to retrieve information about API Gateway REST APIs in an AWS account. ID: aws_api_gateway_rest_api_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_api_gateway_rest_api,\n\ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n p = '*'\n and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_api_gateway_rest_api, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + p = '*' + AND s ->> 'Effect' = 'Allow'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway REST APIs and Their Policies + - API Gateway +Title: List all AWS API Gateway REST APIs and Their Policies \ No newline at end of file diff --git a/queries/aws_api_gateway_stage_1.yaml b/queries/aws_api_gateway_stage_1.yaml old mode 100755 new mode 100644 index 5ea8149f5..d3bde3e4a --- a/queries/aws_api_gateway_stage_1.yaml +++ b/queries/aws_api_gateway_stage_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS API Gateway Stages for information related - to deployment, API, and stage details. +Description: Allows users to query AWS API Gateway Stages for information related to deployment, API, and stage details. ID: aws_api_gateway_stage_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rest_api_id,\n count(name) stage_count\nfrom\n aws_api_gateway_stage\n\ - group by\n rest_api_id;" + QueryToExecute: | + SELECT + rest_api_id, + COUNT(name) AS stage_count + FROM + aws_api_gateway_stage + GROUP BY + rest_api_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Stages and Deployment Details + - API Gateway +Title: Find AWS API Gateway Stages and Deployment Details \ No newline at end of file diff --git a/queries/aws_api_gateway_stage_2.yaml b/queries/aws_api_gateway_stage_2.yaml old mode 100755 new mode 100644 index 042f3db22..3cb550abc --- a/queries/aws_api_gateway_stage_2.yaml +++ b/queries/aws_api_gateway_stage_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS API Gateway Stages for information related - to deployment, API, and stage details. +Description: Allows users to query AWS API Gateway Stages for information related to deployment, API, and stage details. ID: aws_api_gateway_stage_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rest_api_id,\n cache_cluster_enabled,\n cache_cluster_size\n\ - from\n aws_api_gateway_stage\nwhere\n cache_cluster_enabled;" + QueryToExecute: | + SELECT + name, + rest_api_id, + cache_cluster_enabled, + cache_cluster_size + FROM + aws_api_gateway_stage + WHERE + cache_cluster_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway stages with cache enabled + - API Gateway +Title: List all AWS API Gateway stages with cache enabled \ No newline at end of file diff --git a/queries/aws_api_gateway_stage_3.yaml b/queries/aws_api_gateway_stage_3.yaml old mode 100755 new mode 100644 index b3cf88d6b..15fe12f9d --- a/queries/aws_api_gateway_stage_3.yaml +++ b/queries/aws_api_gateway_stage_3.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS API Gateway Stages for information related - to deployment, API, and stage details. +Description: Allows users to query AWS API Gateway Stages for information related to deployment, API, and stage details. ID: aws_api_gateway_stage_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n split_part(web_acl_arn, '/', 3) as web_acl_name\n\ - from\n aws_api_gateway_stage;" + QueryToExecute: | + SELECT + name, + SPLIT_PART(web_acl_arn, '/', 3) AS web_acl_name + FROM + aws_api_gateway_stage; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Stages for deployments and APIs + - API Gateway +Title: Find AWS API Gateway Stages for deployments and APIs \ No newline at end of file diff --git a/queries/aws_api_gateway_stage_4.yaml b/queries/aws_api_gateway_stage_4.yaml old mode 100755 new mode 100644 index 2cbdc01bd..68a0950f4 --- a/queries/aws_api_gateway_stage_4.yaml +++ b/queries/aws_api_gateway_stage_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS API Gateway Stages for information related - to deployment, API, and stage details. +Description: Allows users to query AWS API Gateway Stages for information related to deployment, API, and stage details. ID: aws_api_gateway_stage_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n deployment_id,\n name,\n tracing_enabled,\n method_settings\ - \ -> '*/*' ->> 'LoggingLevel' as cloudwatch_log_level\nfrom\n aws_api_gateway_stage\n\ - where\n method_settings -> '*/*' ->> 'LoggingLevel' = 'OFF';" + QueryToExecute: | + SELECT + deployment_id, + name, + tracing_enabled, + method_settings -> '*/*' ->> 'LoggingLevel' AS cloudwatch_log_level + FROM + aws_api_gateway_stage + WHERE + method_settings -> '*/*' ->> 'LoggingLevel' = 'OFF'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Stages for Deployment and API Details + - API Gateway +Title: Find AWS API Gateway Stages for Deployment and API Details \ No newline at end of file diff --git a/queries/aws_api_gateway_usage_plan_1.yaml b/queries/aws_api_gateway_usage_plan_1.yaml old mode 100755 new mode 100644 index 9b33a3734..c4d2e355b --- a/queries/aws_api_gateway_usage_plan_1.yaml +++ b/queries/aws_api_gateway_usage_plan_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve - information about the usage plans configured in the AWS API Gateway service. +Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve information about the usage plans configured in the AWS API Gateway service. ID: aws_api_gateway_usage_plan_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n product_code,\n description,\n api_stages\n\ - from\n aws_api_gateway_usage_plan;" + QueryToExecute: | + SELECT + name, + id, + product_code, + description, + api_stages + FROM + aws_api_gateway_usage_plan; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Usage Plans Information + - API Gateway +Title: Find AWS API Gateway Usage Plans Information \ No newline at end of file diff --git a/queries/aws_api_gateway_usage_plan_2.yaml b/queries/aws_api_gateway_usage_plan_2.yaml old mode 100755 new mode 100644 index 1fae94e3f..e9180f477 --- a/queries/aws_api_gateway_usage_plan_2.yaml +++ b/queries/aws_api_gateway_usage_plan_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve - information about the usage plans configured in the AWS API Gateway service. +Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve information about the usage plans configured in the AWS API Gateway service. ID: aws_api_gateway_usage_plan_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n quota\nfrom\n aws_api_gateway_usage_plan\n\ - where\n quota is null;" + QueryToExecute: | + SELECT + name, + id, + quota + FROM + aws_api_gateway_usage_plan + WHERE + quota IS NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Usage Plans Information + - API Gateway +Title: List all AWS API Gateway Usage Plans Information \ No newline at end of file diff --git a/queries/aws_api_gateway_usage_plan_3.yaml b/queries/aws_api_gateway_usage_plan_3.yaml old mode 100755 new mode 100644 index 1e0992097..a5f5f24dd --- a/queries/aws_api_gateway_usage_plan_3.yaml +++ b/queries/aws_api_gateway_usage_plan_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve - information about the usage plans configured in the AWS API Gateway service. +Description: Allows users to query AWS API Gateway Usage Plans in order to retrieve information about the usage plans configured in the AWS API Gateway service. ID: aws_api_gateway_usage_plan_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n throttle\nfrom\n aws_api_gateway_usage_plan\n\ - where\n throttle is null;" + QueryToExecute: | + SELECT + name, + id, + throttle + FROM + aws_api_gateway_usage_plan + WHERE + throttle IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Usage Plans Details via SQL + - API Gateway +Title: Find AWS API Gateway Usage Plans Details via SQL \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_api_1.yaml b/queries/aws_api_gatewayv2_api_1.yaml old mode 100755 new mode 100644 index c2246097f..d416659b9 --- a/queries/aws_api_gatewayv2_api_1.yaml +++ b/queries/aws_api_gatewayv2_api_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query API Gateway APIs and retrieve detailed information - about each API, including its ID, name, protocol type, and more. +Description: Allows users to query API Gateway APIs and retrieve detailed information about each API, including its ID, name, protocol type, and more. ID: aws_api_gatewayv2_api_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_endpoint,\n protocol_type,\n\ - \ api_key_selection_expression,\n route_selection_expression\nfrom\n aws_api_gatewayv2_api;" + QueryToExecute: | + SELECT + name, + api_id, + api_endpoint, + protocol_type, + api_key_selection_expression, + route_selection_expression + FROM + aws_api_gatewayv2_api; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all Details of AWS API Gateway APIs + - API Gateway +Title: List all Details of AWS API Gateway APIs \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_api_2.yaml b/queries/aws_api_gatewayv2_api_2.yaml old mode 100755 new mode 100644 index e9605ab43..502d92ec6 --- a/queries/aws_api_gatewayv2_api_2.yaml +++ b/queries/aws_api_gatewayv2_api_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query API Gateway APIs and retrieve detailed information - about each API, including its ID, name, protocol type, and more. +Description: Allows users to query API Gateway APIs and retrieve detailed information about each API, including its ID, name, protocol type, and more. ID: aws_api_gatewayv2_api_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n protocol_type\nfrom\n aws_api_gatewayv2_api\n\ - where\n protocol_type = 'WEBSOCKET';" + QueryToExecute: | + SELECT + name, + api_id, + protocol_type + FROM + aws_api_gatewayv2_api + WHERE + protocol_type = 'WEBSOCKET'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all API Gateway APIs with name, ID, and protocol + - API Gateway +Title: List all API Gateway APIs with name, ID, and protocol \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_api_3.yaml b/queries/aws_api_gatewayv2_api_3.yaml old mode 100755 new mode 100644 index 0d13adfee..0698292dd --- a/queries/aws_api_gatewayv2_api_3.yaml +++ b/queries/aws_api_gatewayv2_api_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query API Gateway APIs and retrieve detailed information - about each API, including its ID, name, protocol type, and more. +Description: Allows users to query API Gateway APIs and retrieve detailed information about each API, including its ID, name, protocol type, and more. ID: aws_api_gatewayv2_api_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_endpoint\nfrom\n aws_api_gatewayv2_api\n\ - where\n not disable_execute_api_endpoint;" + QueryToExecute: | + SELECT + name, + api_id, + api_endpoint + FROM + aws_api_gatewayv2_api + WHERE + NOT disable_execute_api_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List All AWS API Gateway APIs and Retrieve Details + - API Gateway +Title: List All AWS API Gateway APIs and Retrieve Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_domain_name_1.yaml b/queries/aws_api_gatewayv2_domain_name_1.yaml old mode 100755 new mode 100644 index 10d248b59..fefa00740 --- a/queries/aws_api_gatewayv2_domain_name_1.yaml +++ b/queries/aws_api_gatewayv2_domain_name_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS API Gateway Domain Names and provides information - about each domain name within the AWS API Gateway Service. This table can be used - to query domain name details, including associated API mappings, security policy, - and associated tags. +Description: Allows users to query AWS API Gateway Domain Names and provides information about each domain name within the AWS API Gateway Service. This table can be used to query domain name details, including associated API mappings, security policy, and associated tags. ID: aws_api_gatewayv2_domain_name_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n mutual_tls_authentication,\n tags,\n\ - \ title,\n akas\nfrom\n aws_api_gatewayv2_domain_name;" + QueryToExecute: | + SELECT + domain_name, + mutual_tls_authentication, + tags, + title, + akas + FROM + aws_api_gatewayv2_domain_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find all AWS API Gateway Domain Names Details using SQL + - API Gateway +Title: Find all AWS API Gateway Domain Names Details using SQL \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_domain_name_2.yaml b/queries/aws_api_gatewayv2_domain_name_2.yaml old mode 100755 new mode 100644 index b54f89101..fb91df9fb --- a/queries/aws_api_gatewayv2_domain_name_2.yaml +++ b/queries/aws_api_gatewayv2_domain_name_2.yaml @@ -1,25 +1,28 @@ -Description: Allows users to query AWS API Gateway Domain Names and provides information - about each domain name within the AWS API Gateway Service. This table can be used - to query domain name details, including associated API mappings, security policy, - and associated tags. +Description: Allows users to query AWS API Gateway Domain Names and provides information about each domain name within the AWS API Gateway Service. This table can be used to query domain name details, including associated API mappings, security policy, and associated tags. ID: aws_api_gatewayv2_domain_name_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n config ->> 'EndpointType' as endpoint_type\n\ - from\n aws_api_gatewayv2_domain_name\n cross join jsonb_array_elements(domain_name_configurations)\ - \ as config\nwhere\n config ->> 'EndpointType' = 'EDGE';" + QueryToExecute: | + SELECT + domain_name, + config ->> 'EndpointType' AS endpoint_type + FROM + aws_api_gatewayv2_domain_name + CROSS JOIN jsonb_array_elements(domain_name_configurations) AS config + WHERE + config ->> 'EndpointType' = 'EDGE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Domain Names with Details + - API Gateway +Title: List all AWS API Gateway Domain Names with Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_domain_name_3.yaml b/queries/aws_api_gatewayv2_domain_name_3.yaml old mode 100755 new mode 100644 index 447babece..e68d902a6 --- a/queries/aws_api_gatewayv2_domain_name_3.yaml +++ b/queries/aws_api_gatewayv2_domain_name_3.yaml @@ -1,33 +1,38 @@ -Description: Allows users to query AWS API Gateway Domain Names and provides information - about each domain name within the AWS API Gateway Service. This table can be used - to query domain name details, including associated API mappings, security policy, - and associated tags. +Description: Allows users to query AWS API Gateway Domain Names and provides information about each domain name within the AWS API Gateway Service. This table can be used to query domain name details, including associated API mappings, security policy, and associated tags. ID: aws_api_gatewayv2_domain_name_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n config ->> 'EndpointType' as endpoint_type,\n\ - \ config ->> 'CertificateName' as certificate_name,\n config ->> 'CertificateArn'\ - \ as certificate_arn,\n config ->> 'CertificateUploadDate' as certificate_upload_date,\n\ - \ config ->> 'DomainNameStatus' as domain_name_status,\n config ->> 'DomainNameStatusMessage'\ - \ as domain_name_status_message,\n config ->> 'ApiGatewayDomainName' as api_gateway_domain_name,\n\ - \ config ->> 'HostedZoneId' as hosted_zone_id,\n config ->> 'OwnershipVerificationCertificateArn'\ - \ as ownership_verification_certificate_arn,\n config -> 'SecurityPolicy' as\ - \ security_policy\nfrom\n aws_api_gatewayv2_domain_name\n cross join jsonb_array_elements(domain_name_configurations)\ - \ as config;" + QueryToExecute: | + SELECT + domain_name, + config ->> 'EndpointType' AS endpoint_type, + config ->> 'CertificateName' AS certificate_name, + config ->> 'CertificateArn' AS certificate_arn, + config ->> 'CertificateUploadDate' AS certificate_upload_date, + config ->> 'DomainNameStatus' AS domain_name_status, + config ->> 'DomainNameStatusMessage' AS domain_name_status_message, + config ->> 'ApiGatewayDomainName' AS api_gateway_domain_name, + config ->> 'HostedZoneId' AS hosted_zone_id, + config ->> 'OwnershipVerificationCertificateArn' AS ownership_verification_certificate_arn, + config -> 'SecurityPolicy' AS security_policy + FROM + aws_api_gatewayv2_domain_name + CROSS JOIN + jsonb_array_elements(domain_name_configurations) AS config; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Domain Names and Details + - API Gateway +Title: List all AWS API Gateway Domain Names and Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_domain_name_4.yaml b/queries/aws_api_gatewayv2_domain_name_4.yaml old mode 100755 new mode 100644 index 5118141f2..17644a62c --- a/queries/aws_api_gatewayv2_domain_name_4.yaml +++ b/queries/aws_api_gatewayv2_domain_name_4.yaml @@ -1,26 +1,27 @@ -Description: Allows users to query AWS API Gateway Domain Names and provides information - about each domain name within the AWS API Gateway Service. This table can be used - to query domain name details, including associated API mappings, security policy, - and associated tags. +Description: Allows users to query AWS API Gateway Domain Names and provides information about each domain name within the AWS API Gateway Service. This table can be used to query domain name details, including associated API mappings, security policy, and associated tags. ID: aws_api_gatewayv2_domain_name_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n mutual_tls_authentication ->> 'TruststoreUri'\ - \ as truststore_uri,\n mutual_tls_authentication ->> 'TruststoreVersion' as truststore_version,\n\ - \ mutual_tls_authentication ->> 'TruststoreWarnings' as truststore_warnings\n\ - from\n aws_api_gatewayv2_domain_name;" + QueryToExecute: | + SELECT + domain_name, + mutual_tls_authentication ->> 'TruststoreUri' AS truststore_uri, + mutual_tls_authentication ->> 'TruststoreVersion' AS truststore_version, + mutual_tls_authentication ->> 'TruststoreWarnings' AS truststore_warnings + FROM + aws_api_gatewayv2_domain_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find all AWS API Gateway Domain Names and Their Details + - API Gateway +Title: Find all AWS API Gateway Domain Names and Their Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_domain_name_5.yaml b/queries/aws_api_gatewayv2_domain_name_5.yaml old mode 100755 new mode 100644 index cfae0e7d0..be17f92b7 --- a/queries/aws_api_gatewayv2_domain_name_5.yaml +++ b/queries/aws_api_gatewayv2_domain_name_5.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS API Gateway Domain Names and provides information - about each domain name within the AWS API Gateway Service. This table can be used - to query domain name details, including associated API mappings, security policy, - and associated tags. +Description: Allows users to query AWS API Gateway Domain Names and provides information about each domain name within the AWS API Gateway Service. This table can be used to query domain name details, including associated API mappings, security policy, and associated tags. ID: aws_api_gatewayv2_domain_name_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.domain_name,\n config ->> 'CertificateArn' as certificate_arn,\n\ - \ c.certificate,\n c.certificate_transparency_logging_preference,\n c.created_at,\n\ - \ c.imported_at,\n c.issuer,\n c.issued_at,\n c.key_algorithm\nfrom\n aws_api_gatewayv2_domain_name\ - \ AS d\n cross join jsonb_array_elements(d.domain_name_configurations) AS config\n\ - \ left join aws_acm_certificate AS c ON c.certificate_arn = config ->> 'CertificateArn';" + QueryToExecute: | + SELECT + d.domain_name, + config ->> 'CertificateArn' AS certificate_arn, + c.certificate, + c.certificate_transparency_logging_preference, + c.created_at, + c.imported_at, + c.issuer, + c.issued_at, + c.key_algorithm + FROM + aws_api_gatewayv2_domain_name AS d + CROSS JOIN jsonb_array_elements(d.domain_name_configurations) AS config + LEFT JOIN aws_acm_certificate AS c + ON c.certificate_arn = config ->> 'CertificateArn'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List AWS API Gateway Domain Name Details with Certificate Info + - API Gateway +Title: List AWS API Gateway Domain Name Details with Certificate Info \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_integration_1.yaml b/queries/aws_api_gatewayv2_integration_1.yaml old mode 100755 new mode 100644 index 981763e42..f9d3b61a8 --- a/queries/aws_api_gatewayv2_integration_1.yaml +++ b/queries/aws_api_gatewayv2_integration_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS API Gateway Integrations to retrieve detailed - information about each integration within the API Gateway. +Description: Allows users to query AWS API Gateway Integrations to retrieve detailed information about each integration within the API Gateway. ID: aws_api_gatewayv2_integration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n integration_id,\n api_id,\n integration_type,\n integration_uri,\n\ - \ description\nfrom\n aws_api_gatewayv2_integration;" + QueryToExecute: | + SELECT + integration_id, + api_id, + integration_type, + integration_uri, + description + FROM + aws_api_gatewayv2_integration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Integrations with SQL + - API Gateway +Title: Find AWS API Gateway Integrations with SQL \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_integration_2.yaml b/queries/aws_api_gatewayv2_integration_2.yaml old mode 100755 new mode 100644 index f38712737..57349f9e5 --- a/queries/aws_api_gatewayv2_integration_2.yaml +++ b/queries/aws_api_gatewayv2_integration_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS API Gateway Integrations to retrieve detailed - information about each integration within the API Gateway. +Description: Allows users to query AWS API Gateway Integrations to retrieve detailed information about each integration within the API Gateway. ID: aws_api_gatewayv2_integration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n api_id,\n count(integration_id) as integration_count\n\ - from \n aws_api_gatewayv2_integration\ngroup by\n api_id;" + QueryToExecute: | + SELECT + api_id, + COUNT(integration_id) AS integration_count + FROM + aws_api_gatewayv2_integration + GROUP BY + api_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find all AWS API Gateway Integrations Details + - API Gateway +Title: Find all AWS API Gateway Integrations Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_route_1.yaml b/queries/aws_api_gatewayv2_route_1.yaml old mode 100755 new mode 100644 index 7853e2883..924629555 --- a/queries/aws_api_gatewayv2_route_1.yaml +++ b/queries/aws_api_gatewayv2_route_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information - about each route, including the route key, route response selection expression, - and target. +Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information about each route, including the route key, route response selection expression, and target. ID: aws_api_gatewayv2_route_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_key,\n api_id,\n route_id,\n api_gateway_managed,\n\ - \ api_key_required\nfrom\n aws_api_gatewayv2_route;" + QueryToExecute: | + SELECT + route_key, + api_id, + route_id, + api_gateway_managed, + api_key_required + FROM + aws_api_gatewayv2_route; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway V2 -Title: Find AWS API Gateway V2 Route Details + - API Gateway V2 +Title: Find AWS API Gateway V2 Route Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_route_2.yaml b/queries/aws_api_gatewayv2_route_2.yaml old mode 100755 new mode 100644 index 5dc48f6c8..74df3bff7 --- a/queries/aws_api_gatewayv2_route_2.yaml +++ b/queries/aws_api_gatewayv2_route_2.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information - about each route, including the route key, route response selection expression, - and target. +Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information about each route, including the route key, route response selection expression, and target. ID: aws_api_gatewayv2_route_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_key,\n api_id,\n route_id\nfrom\n aws_api_gatewayv2_route\n\ - where\n api_id = 'w5n71b2m85';" + QueryToExecute: | + SELECT + route_key, + api_id, + route_id + FROM + aws_api_gatewayv2_route + WHERE + api_id = 'w5n71b2m85'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway V2 -Title: List all AWS API Gateway V2 Routes including details + - API Gateway V2 +Title: List all AWS API Gateway V2 Routes including details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_route_3.yaml b/queries/aws_api_gatewayv2_route_3.yaml old mode 100755 new mode 100644 index fa014cee0..36f496db8 --- a/queries/aws_api_gatewayv2_route_3.yaml +++ b/queries/aws_api_gatewayv2_route_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information - about each route, including the route key, route response selection expression, - and target. +Description: Allows users to query AWS API Gateway V2 Routes and obtain detailed information about each route, including the route key, route response selection expression, and target. ID: aws_api_gatewayv2_route_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.route_id,\n a.name,\n a.api_id,\n a.api_endpoint\n\ - from\n aws_api_gatewayv2_route as r,\n aws_api_gatewayv2_api as a\nwhere\n \ - \ not a.disable_execute_api_endpoint;" + QueryToExecute: | + SELECT + r.route_id, + a.name, + a.api_id, + a.api_endpoint + FROM + aws_api_gatewayv2_route AS r, + aws_api_gatewayv2_api AS a + WHERE + NOT a.disable_execute_api_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway V2 -Title: Find all AWS API Gateway V2 Routes with Details + - API Gateway V2 +Title: Find all AWS API Gateway V2 Routes with Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_stage_1.yaml b/queries/aws_api_gatewayv2_stage_1.yaml old mode 100755 new mode 100644 index a63f1cb46..35c44674a --- a/queries/aws_api_gatewayv2_stage_1.yaml +++ b/queries/aws_api_gatewayv2_stage_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS API Gateway Stages, providing detailed information - about each stage of the API Gateway. +Description: Allows users to query AWS API Gateway Stages, providing detailed information about each stage of the API Gateway. ID: aws_api_gatewayv2_stage_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stage_name,\n api_id,\n default_route_data_trace_enabled\n\ - from\n aws_api_gatewayv2_stage\nwhere\n not default_route_data_trace_enabled;" + QueryToExecute: | + SELECT + stage_name, + api_id, + default_route_data_trace_enabled + FROM + aws_api_gatewayv2_stage + WHERE + NOT default_route_data_trace_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Stages with Trace Data Disabled + - API Gateway +Title: List all AWS API Gateway Stages with Trace Data Disabled \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_stage_2.yaml b/queries/aws_api_gatewayv2_stage_2.yaml old mode 100755 new mode 100644 index 8055dccc6..9267e6aa8 --- a/queries/aws_api_gatewayv2_stage_2.yaml +++ b/queries/aws_api_gatewayv2_stage_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS API Gateway Stages, providing detailed information - about each stage of the API Gateway. +Description: Allows users to query AWS API Gateway Stages, providing detailed information about each stage of the API Gateway. ID: aws_api_gatewayv2_stage_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stage_name,\n api_id,\n default_route_data_trace_enabled,\n\ - \ default_route_detailed_metrics_enabled,\n default_route_throttling_burst_limit,\n\ - \ default_route_throttling_rate_limit\nfrom\n aws_api_gatewayv2_stage;" + QueryToExecute: | + SELECT + stage_name, + api_id, + default_route_data_trace_enabled, + default_route_detailed_metrics_enabled, + default_route_throttling_burst_limit, + default_route_throttling_rate_limit + FROM + aws_api_gatewayv2_stage; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Stages and Details + - API Gateway +Title: Find AWS API Gateway Stages and Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_stage_3.yaml b/queries/aws_api_gatewayv2_stage_3.yaml old mode 100755 new mode 100644 index c929f3d1e..c5a7b2911 --- a/queries/aws_api_gatewayv2_stage_3.yaml +++ b/queries/aws_api_gatewayv2_stage_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS API Gateway Stages, providing detailed information - about each stage of the API Gateway. +Description: Allows users to query AWS API Gateway Stages, providing detailed information about each stage of the API Gateway. ID: aws_api_gatewayv2_stage_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n api_id,\n count(stage_name) stage_count\nfrom\n aws_api_gatewayv2_stage\n\ - group by\n api_id;" + QueryToExecute: | + SELECT + api_id, + COUNT(stage_name) AS stage_count + FROM + aws_api_gatewayv2_stage + GROUP BY + api_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: List all AWS API Gateway Stages and Details + - API Gateway +Title: List all AWS API Gateway Stages and Details \ No newline at end of file diff --git a/queries/aws_api_gatewayv2_stage_4.yaml b/queries/aws_api_gatewayv2_stage_4.yaml old mode 100755 new mode 100644 index 80af2613e..a27b75462 --- a/queries/aws_api_gatewayv2_stage_4.yaml +++ b/queries/aws_api_gatewayv2_stage_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS API Gateway Stages, providing detailed information - about each stage of the API Gateway. +Description: Allows users to query AWS API Gateway Stages, providing detailed information about each stage of the API Gateway. ID: aws_api_gatewayv2_stage_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stage_name,\n api_id,\n default_route_data_trace_enabled,\n\ - \ jsonb_pretty(access_log_settings) as access_log_settings\nfrom\n aws_api_gatewayv2_stage;" + QueryToExecute: | + SELECT + stage_name, + api_id, + default_route_data_trace_enabled, + jsonb_pretty(access_log_settings) AS access_log_settings + FROM + aws_api_gatewayv2_stage; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - API Gateway -Title: Find AWS API Gateway Stages and Details using SQL + - API Gateway +Title: Find AWS API Gateway Stages and Details using SQL \ No newline at end of file diff --git a/queries/aws_app_runner_service_1.yaml b/queries/aws_app_runner_service_1.yaml old mode 100755 new mode 100644 index 667f913e6..c57540a59 --- a/queries/aws_app_runner_service_1.yaml +++ b/queries/aws_app_runner_service_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n region,\n created_at,\n updated_at\n\ - from\n aws_app_runner_service;" + QueryToExecute: | + SELECT + service_name, + arn, + region, + created_at, + updated_at + FROM + aws_app_runner_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: Find all AWS App Runner Services with configurations + - App Runner +Title: Find all AWS App Runner Services with configurations \ No newline at end of file diff --git a/queries/aws_app_runner_service_2.yaml b/queries/aws_app_runner_service_2.yaml old mode 100755 new mode 100644 index 28c553d6d..73d55c3bf --- a/queries/aws_app_runner_service_2.yaml +++ b/queries/aws_app_runner_service_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n network_configuration\nfrom\n\ - \ aws_app_runner_service\nwhere\n (network_configuration -> 'EgressConfiguration'\ - \ ->> 'VpcConnectorArn') is not null;" + QueryToExecute: | + SELECT + service_name, + arn, + network_configuration + FROM + aws_app_runner_service + WHERE + (network_configuration -> 'EgressConfiguration' ->> 'VpcConnectorArn') IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: List all AWS App Runner Services with Network Configurations + - App Runner +Title: List all AWS App Runner Services with Network Configurations \ No newline at end of file diff --git a/queries/aws_app_runner_service_3.yaml b/queries/aws_app_runner_service_3.yaml old mode 100755 new mode 100644 index d05b5eef2..c12cbf9ea --- a/queries/aws_app_runner_service_3.yaml +++ b/queries/aws_app_runner_service_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n auto_scaling_configuration_summary\n\ - from\n aws_app_runner_service\nwhere\n jsonb_path_exists(auto_scaling_configuration_summary,\ - \ '$.AutoScalingConfigurationArn');" + QueryToExecute: | + SELECT + service_name, + arn, + auto_scaling_configuration_summary + FROM + aws_app_runner_service + WHERE + jsonb_path_exists(auto_scaling_configuration_summary, '$.AutoScalingConfigurationArn'); Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: List all AWS App Runner Services with Auto Scaling Info + - App Runner +Title: List all AWS App Runner Services with Auto Scaling Info \ No newline at end of file diff --git a/queries/aws_app_runner_service_4.yaml b/queries/aws_app_runner_service_4.yaml old mode 100755 new mode 100644 index 4ca424f91..8ba3e9f48 --- a/queries/aws_app_runner_service_4.yaml +++ b/queries/aws_app_runner_service_4.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n observability_configuration\n\ - from\n aws_app_runner_service\nwhere\n (observability_configuration ->> 'ObservabilityConfigurationArn')\ - \ is not null;" + QueryToExecute: | + SELECT + service_name, + arn, + observability_configuration + FROM + aws_app_runner_service + WHERE + (observability_configuration ->> 'ObservabilityConfigurationArn') IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: Find all AWS App Runner services and configurations + - App Runner +Title: Find all AWS App Runner services and configurations \ No newline at end of file diff --git a/queries/aws_app_runner_service_5.yaml b/queries/aws_app_runner_service_5.yaml old mode 100755 new mode 100644 index d07203fa4..468538fe5 --- a/queries/aws_app_runner_service_5.yaml +++ b/queries/aws_app_runner_service_5.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n created_at\nfrom\n aws_app_runner_service\n\ - where\n created_at >= '2023-01-01T00:00:00Z' and created_at <= '2023-12-31T23:59:59Z';" + QueryToExecute: | + SELECT + service_name, + arn, + created_at + FROM + aws_app_runner_service + WHERE + created_at >= '2023-01-01T00:00:00Z' + AND created_at <= '2023-12-31T23:59:59Z'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: List All AWS App Runner Services with Configs and Networking + - App Runner +Title: List All AWS App Runner Services with Configs and Networking \ No newline at end of file diff --git a/queries/aws_app_runner_service_6.yaml b/queries/aws_app_runner_service_6.yaml old mode 100755 new mode 100644 index c03f9d468..def2e1863 --- a/queries/aws_app_runner_service_6.yaml +++ b/queries/aws_app_runner_service_6.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query AWS App Runner services, providing detailed information - on service configurations, scaling, and network settings. +Description: Allows users to query AWS App Runner services, providing detailed information on service configurations, scaling, and network settings. ID: aws_app_runner_service_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n service_url\nfrom\n aws_app_runner_service;" + QueryToExecute: | + SELECT + service_name, + arn, + service_url + FROM + aws_app_runner_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - App Runner -Title: Find AWS App Runner Service Details and Configurations + - App Runner +Title: Find AWS App Runner Service Details and Configurations \ No newline at end of file diff --git a/queries/aws_appautoscaling_policy_1.yaml b/queries/aws_appautoscaling_policy_1.yaml old mode 100755 new mode 100644 index ace0c2909..d9d27ed15 --- a/queries/aws_appautoscaling_policy_1.yaml +++ b/queries/aws_appautoscaling_policy_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Application Auto Scaling Policies to obtain - information about their configuration, attached resources, and other metadata. +Description: Allows users to query AWS Application Auto Scaling Policies to obtain information about their configuration, attached resources, and other metadata. ID: aws_appautoscaling_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_namespace,\n scalable_dimension,\n policy_type,\n\ - \ resource_id,\n creation_time\nfrom\n aws_appautoscaling_policy\nwhere\n \ - \ service_namespace = 'ecs';" + QueryToExecute: | + SELECT + service_namespace, + scalable_dimension, + policy_type, + resource_id, + creation_time + FROM + aws_appautoscaling_policy + WHERE + service_namespace = 'ecs'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: List AWS Application Auto Scaling Policies Configuration + - Application Auto Scaling +Title: List AWS Application Auto Scaling Policies Configuration \ No newline at end of file diff --git a/queries/aws_appautoscaling_policy_2.yaml b/queries/aws_appautoscaling_policy_2.yaml old mode 100755 new mode 100644 index f2fca6a4c..64d18cbb2 --- a/queries/aws_appautoscaling_policy_2.yaml +++ b/queries/aws_appautoscaling_policy_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Application Auto Scaling Policies to obtain - information about their configuration, attached resources, and other metadata. +Description: Allows users to query AWS Application Auto Scaling Policies to obtain information about their configuration, attached resources, and other metadata. ID: aws_appautoscaling_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_id,\n policy_type\nfrom\n aws_appautoscaling_policy\n\ - where\n service_namespace = 'ecs'\n and policy_type = 'StepScaling';" + QueryToExecute: | + SELECT + resource_id, + policy_type + FROM + aws_appautoscaling_policy + WHERE + service_namespace = 'ecs' + AND policy_type = 'StepScaling'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: Find AWS Application Auto Scaling Policies Configuration + - Application Auto Scaling +Title: Find AWS Application Auto Scaling Policies Configuration \ No newline at end of file diff --git a/queries/aws_appautoscaling_policy_3.yaml b/queries/aws_appautoscaling_policy_3.yaml old mode 100755 new mode 100644 index cef7d98e9..0ba4f88b0 --- a/queries/aws_appautoscaling_policy_3.yaml +++ b/queries/aws_appautoscaling_policy_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Application Auto Scaling Policies to obtain - information about their configuration, attached resources, and other metadata. +Description: Allows users to query AWS Application Auto Scaling Policies to obtain information about their configuration, attached resources, and other metadata. ID: aws_appautoscaling_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_id,\n policy_type\nfrom\n aws_appautoscaling_policy\n\ - where\n service_namespace = 'ecs'\n and creation_time > now() - interval '30\ - \ days';" + QueryToExecute: | + SELECT + resource_id, + policy_type + FROM + aws_appautoscaling_policy + WHERE + service_namespace = 'ecs' + AND creation_time > NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: Find AWS Auto Scaling Policies for ECS Resources + - Application Auto Scaling +Title: Find AWS Auto Scaling Policies for ECS Resources \ No newline at end of file diff --git a/queries/aws_appautoscaling_policy_4.yaml b/queries/aws_appautoscaling_policy_4.yaml old mode 100755 new mode 100644 index 17539313d..99cc19b4c --- a/queries/aws_appautoscaling_policy_4.yaml +++ b/queries/aws_appautoscaling_policy_4.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Application Auto Scaling Policies to obtain - information about their configuration, attached resources, and other metadata. +Description: Allows users to query AWS Application Auto Scaling Policies to obtain information about their configuration, attached resources, and other metadata. ID: aws_appautoscaling_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_id,\n policy_type,\n jsonb_array_elements(alarms)\ - \ -> 'AlarmName' as alarm_name\nfrom\n aws_appautoscaling_policy\nwhere\n service_namespace\ - \ = 'ecs';" + QueryToExecute: | + SELECT + resource_id, + policy_type, + jsonb_array_elements(alarms) -> 'AlarmName' AS alarm_name + FROM + aws_appautoscaling_policy + WHERE + service_namespace = 'ecs'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: Find all AWS Auto Scaling Policies and Configurations + - Application Auto Scaling +Title: Find all AWS Auto Scaling Policies and Configurations \ No newline at end of file diff --git a/queries/aws_appautoscaling_policy_5.yaml b/queries/aws_appautoscaling_policy_5.yaml old mode 100755 new mode 100644 index a94b36915..d2b6de428 --- a/queries/aws_appautoscaling_policy_5.yaml +++ b/queries/aws_appautoscaling_policy_5.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Application Auto Scaling Policies to obtain - information about their configuration, attached resources, and other metadata. +Description: Allows users to query AWS Application Auto Scaling Policies to obtain information about their configuration, attached resources, and other metadata. ID: aws_appautoscaling_policy_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_id,\n policy_type,\n step_scaling_policy_configuration\n\ - from\n aws_appautoscaling_policy\nwhere\n service_namespace = 'ecs'\n and policy_type\ - \ = 'StepScaling';" + QueryToExecute: | + SELECT + resource_id, + policy_type, + step_scaling_policy_configuration + FROM + aws_appautoscaling_policy + WHERE + service_namespace = 'ecs' + AND policy_type = 'StepScaling'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: List AWS App Auto Scaling Policies and Configurations + - Application Auto Scaling +Title: List AWS App Auto Scaling Policies and Configurations \ No newline at end of file diff --git a/queries/aws_appautoscaling_target_1.yaml b/queries/aws_appautoscaling_target_1.yaml old mode 100755 new mode 100644 index 434f6eef7..72d86482f --- a/queries/aws_appautoscaling_target_1.yaml +++ b/queries/aws_appautoscaling_target_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Application Auto Scaling Targets. This table - provides information about each target, including the service namespace, scalable - dimension, resource ID, and the associated scaling policies. +Description: Allows users to query AWS Application Auto Scaling Targets. This table provides information about each target, including the service namespace, scalable dimension, resource ID, and the associated scaling policies. ID: aws_appautoscaling_target_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_namespace,\n scalable_dimension,\n resource_id,\n\ - \ creation_time\nfrom\n aws_appautoscaling_target\nwhere\n service_namespace\ - \ = 'dynamodb';" + QueryToExecute: | + SELECT + service_namespace, + scalable_dimension, + resource_id, + creation_time + FROM + aws_appautoscaling_target + WHERE + service_namespace = 'dynamodb'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: Find AWS Application Auto Scaling Targets using SQL + - Application Auto Scaling +Title: Find AWS Application Auto Scaling Targets using SQL \ No newline at end of file diff --git a/queries/aws_appautoscaling_target_2.yaml b/queries/aws_appautoscaling_target_2.yaml old mode 100755 new mode 100644 index 163f3a343..ac9a7822d --- a/queries/aws_appautoscaling_target_2.yaml +++ b/queries/aws_appautoscaling_target_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Application Auto Scaling Targets. This table - provides information about each target, including the service namespace, scalable - dimension, resource ID, and the associated scaling policies. +Description: Allows users to query AWS Application Auto Scaling Targets. This table provides information about each target, including the service namespace, scalable dimension, resource ID, and the associated scaling policies. ID: aws_appautoscaling_target_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_id,\n scalable_dimension\nfrom\n aws_appautoscaling_target\n\ - where\n service_namespace = 'dynamodb'\n and scalable_dimension = 'dynamodb:table:ReadCapacityUnits'\n\ - \ or scalable_dimension = 'dynamodb:table:WriteCapacityUnits';" + QueryToExecute: | + SELECT + resource_id, + scalable_dimension + FROM + aws_appautoscaling_target + WHERE + service_namespace = 'dynamodb' + AND (scalable_dimension = 'dynamodb:table:ReadCapacityUnits' + OR scalable_dimension = 'dynamodb:table:WriteCapacityUnits'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Application Auto Scaling -Title: Find AWS Application Auto Scaling Targets Details + - Application Auto Scaling +Title: Find AWS Application Auto Scaling Targets Details \ No newline at end of file diff --git a/queries/aws_appconfig_application_1.yaml b/queries/aws_appconfig_application_1.yaml old mode 100755 new mode 100644 index 58e656453..bbb896c90 --- a/queries/aws_appconfig_application_1.yaml +++ b/queries/aws_appconfig_application_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS AppConfig Applications to gather detailed information - about each application, including its name, description, associated environments, - and more. +Description: Allows users to query AWS AppConfig Applications to gather detailed information about each application, including its name, description, associated environments, and more. ID: aws_appconfig_application_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n id,\n name,\n description,\n tags\nfrom\n\ - \ aws_appconfig_application;" + QueryToExecute: | + SELECT + arn, + id, + name, + description, + tags + FROM + aws_appconfig_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppConfig -Title: Find AWS AppConfig Application Details + - AppConfig +Title: Find AWS AppConfig Application Details \ No newline at end of file diff --git a/queries/aws_appstream_fleet_1.yaml b/queries/aws_appstream_fleet_1.yaml old mode 100755 new mode 100644 index ab8fd1da0..3db032b78 --- a/queries/aws_appstream_fleet_1.yaml +++ b/queries/aws_appstream_fleet_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n instance_type,\n description,\n created_time,\n\ - \ display_name,\n state,\n directory_name,\n enable_default_internet_access\n\ - from\n aws_appstream_fleet;" + QueryToExecute: | + SELECT + name, + arn, + instance_type, + description, + created_time, + display_name, + state, + directory_name, + enable_default_internet_access + FROM + aws_appstream_fleet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Fleets with detailed information + - AppStream +Title: List all AWS AppStream Fleets with detailed information \ No newline at end of file diff --git a/queries/aws_appstream_fleet_10.yaml b/queries/aws_appstream_fleet_10.yaml old mode 100755 new mode 100644 index 4df2cf181..5d62970d8 --- a/queries/aws_appstream_fleet_10.yaml +++ b/queries/aws_appstream_fleet_10.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state,\n created_time,\n description\n\ - from\n aws_appstream_fleet\nwhere\n state = 'RUNNING';" + QueryToExecute: | + SELECT + name, + arn, + state, + created_time, + description + FROM + aws_appstream_fleet + WHERE + state = 'RUNNING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Fleets with State and Details + - AppStream +Title: List all AWS AppStream Fleets with State and Details \ No newline at end of file diff --git a/queries/aws_appstream_fleet_2.yaml b/queries/aws_appstream_fleet_2.yaml old mode 100755 new mode 100644 index 1e3d4cd46..5b86929bb --- a/queries/aws_appstream_fleet_2.yaml +++ b/queries/aws_appstream_fleet_2.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n instance_type,\n description,\n created_time,\n\ - \ display_name,\n state,\n enable_default_internet_access\nfrom\n aws_appstream_fleet\n\ - where enable_default_internet_access;" + QueryToExecute: | + SELECT + name, + arn, + instance_type, + description, + created_time, + display_name, + state, + enable_default_internet_access + FROM + aws_appstream_fleet + WHERE + enable_default_internet_access; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Fleets with Detailed Information + - AppStream +Title: List all AWS AppStream Fleets with Detailed Information \ No newline at end of file diff --git a/queries/aws_appstream_fleet_3.yaml b/queries/aws_appstream_fleet_3.yaml old mode 100755 new mode 100644 index a31166c22..5e494c003 --- a/queries/aws_appstream_fleet_3.yaml +++ b/queries/aws_appstream_fleet_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n fleet_type,\n instance_type,\n\ - \ display_name,\n image_arn,\n image_name\nfrom\n aws_appstream_fleet\nwhere\n\ - \ fleet_type = 'ON_DEMAND';" + QueryToExecute: | + SELECT + name, + created_time, + fleet_type, + instance_type, + display_name, + image_arn, + image_name + FROM + aws_appstream_fleet + WHERE + fleet_type = 'ON_DEMAND'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Fleets with Details + - AppStream +Title: List all AWS AppStream Fleets with Details \ No newline at end of file diff --git a/queries/aws_appstream_fleet_4.yaml b/queries/aws_appstream_fleet_4.yaml old mode 100755 new mode 100644 index 80845e921..fdd174008 --- a/queries/aws_appstream_fleet_4.yaml +++ b/queries/aws_appstream_fleet_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n display_name,\n enable_default_internet_access,\n\ - \ max_concurrent_sessions,\n max_user_duration_in_seconds\nfrom\n aws_appstream_fleet\n\ - where\n created_time >= now() - interval '30' day;" + QueryToExecute: | + SELECT + name, + created_time, + display_name, + enable_default_internet_access, + max_concurrent_sessions, + max_user_duration_in_seconds + FROM + aws_appstream_fleet + WHERE + created_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Fleets and their details + - AppStream +Title: List all AWS AppStream Fleets and their details \ No newline at end of file diff --git a/queries/aws_appstream_fleet_5.yaml b/queries/aws_appstream_fleet_5.yaml old mode 100755 new mode 100644 index 026e489d0..a225bcf7a --- a/queries/aws_appstream_fleet_5.yaml +++ b/queries/aws_appstream_fleet_5.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.name,\n f.created_time,\n f.display_name,\n f.image_arn,\n\ - \ i.base_image_arn,\n i.image_builder_name,\n i.visibility\nfrom\n aws_appstream_fleet\ - \ as f,\n aws_appstream_image as i\nwhere\n i.arn = f.image_arn\nand\n i.visibility\ - \ = 'PRIVATE';" + QueryToExecute: | + SELECT + f.name, + f.created_time, + f.display_name, + f.image_arn, + i.base_image_arn, + i.image_builder_name, + i.visibility + FROM + aws_appstream_fleet AS f, + aws_appstream_image AS i + WHERE + i.arn = f.image_arn + AND + i.visibility = 'PRIVATE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find AWS AppStream Fleets and Detailed Stack Info + - AppStream +Title: Find AWS AppStream Fleets and Detailed Stack Info \ No newline at end of file diff --git a/queries/aws_appstream_fleet_6.yaml b/queries/aws_appstream_fleet_6.yaml old mode 100755 new mode 100644 index 6f7c02da3..1b394823a --- a/queries/aws_appstream_fleet_6.yaml +++ b/queries/aws_appstream_fleet_6.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n compute_capacity_status ->> 'Available'\ - \ as available,\n compute_capacity_status ->> 'Desired' as desired,\n compute_capacity_status\ - \ ->> 'InUse' as in_use,\n compute_capacity_status ->> 'Running' as running\n\ - from\n aws_appstream_fleet;" + QueryToExecute: | + SELECT + name, + arn, + compute_capacity_status ->> 'Available' AS available, + compute_capacity_status ->> 'Desired' AS desired, + compute_capacity_status ->> 'InUse' AS in_use, + compute_capacity_status ->> 'Running' AS running + FROM + aws_appstream_fleet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS AppStream -Title: List AWS AppStream Fleet details including state and type + - AWS AppStream +Title: List AWS AppStream Fleet details including state and type \ No newline at end of file diff --git a/queries/aws_appstream_fleet_7.yaml b/queries/aws_appstream_fleet_7.yaml old mode 100755 new mode 100644 index 641abe698..fded31be6 --- a/queries/aws_appstream_fleet_7.yaml +++ b/queries/aws_appstream_fleet_7.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n e ->> 'ErrorCode' as error_code,\n \ - \ e ->> 'ErrorMessage' as error_message\nfrom\n aws_appstream_fleet,\n jsonb_array_elements(fleet_errors)\ - \ as e;" + QueryToExecute: | + SELECT + name, + arn, + e ->> 'ErrorCode' AS error_code, + e ->> 'ErrorMessage' AS error_message + FROM + aws_appstream_fleet, + jsonb_array_elements(fleet_errors) AS e; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find AWS AppStream Fleet Details Including State and Instance Type + - AppStream +Title: Find AWS AppStream Fleet Details Including State and Instance Type \ No newline at end of file diff --git a/queries/aws_appstream_fleet_8.yaml b/queries/aws_appstream_fleet_8.yaml old mode 100755 new mode 100644 index 36855d08c..c08ceeeca --- a/queries/aws_appstream_fleet_8.yaml +++ b/queries/aws_appstream_fleet_8.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n vpc_config -> 'SecurityGroupIds' as\ - \ security_group_ids,\n vpc_config -> 'SubnetIds' as subnet_ids\nfrom\n aws_appstream_fleet;" + QueryToExecute: | + SELECT + name, + arn, + vpc_config -> 'SecurityGroupIds' AS security_group_ids, + vpc_config -> 'SubnetIds' AS subnet_ids + FROM + aws_appstream_fleet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS AppStream Fleet -Title: Find All AWS AppStream Fleet Details and States + - AWS AppStream Fleet +Title: Find All AWS AppStream Fleet Details and States \ No newline at end of file diff --git a/queries/aws_appstream_fleet_9.yaml b/queries/aws_appstream_fleet_9.yaml old mode 100755 new mode 100644 index 7fa7ac3b9..903380240 --- a/queries/aws_appstream_fleet_9.yaml +++ b/queries/aws_appstream_fleet_9.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS AppStream Fleets for detailed information about - each fleet, including its state, instance type, and associated stack details. +Description: Allows users to query AWS AppStream Fleets for detailed information about each fleet, including its state, instance type, and associated stack details. ID: aws_appstream_fleet_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n instance_type,\n Count(instance_type) as number_of_fleets\n\ - from\n aws_appstream_fleet\ngroup by\n instance_type,\n name;" + QueryToExecute: | + SELECT + name, + instance_type, + COUNT(instance_type) AS number_of_fleets + FROM + aws_appstream_fleet + GROUP BY + instance_type, + name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List AWS AppStream Fleet Details by Instance Type + - AppStream +Title: List AWS AppStream Fleet Details by Instance Type \ No newline at end of file diff --git a/queries/aws_appstream_image_1.yaml b/queries/aws_appstream_image_1.yaml old mode 100755 new mode 100644 index 9f472eae8..03a493828 --- a/queries/aws_appstream_image_1.yaml +++ b/queries/aws_appstream_image_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n base_image_arn,\n description,\n created_time,\n\ - \ display_name,\n image_builder_name,\n tags\nfrom\n aws_appstream_image;" + QueryToExecute: | + SELECT + name, + arn, + base_image_arn, + description, + created_time, + display_name, + image_builder_name, + tags + FROM + aws_appstream_image; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List AWS AppStream Images and Metadata + - AppStream +Title: List AWS AppStream Images and Metadata \ No newline at end of file diff --git a/queries/aws_appstream_image_2.yaml b/queries/aws_appstream_image_2.yaml old mode 100755 new mode 100644 index ede3a71e7..bf060a0c6 --- a/queries/aws_appstream_image_2.yaml +++ b/queries/aws_appstream_image_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n platform,\n state\n\ - from\n aws_appstream_image\nwhere\n state = 'AVAILABLE';" + QueryToExecute: | + SELECT + name, + arn, + display_name, + platform, + state + FROM + aws_appstream_image + WHERE + state = 'AVAILABLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find AWS AppStream Images and Their Properties + - AppStream +Title: Find AWS AppStream Images and Their Properties \ No newline at end of file diff --git a/queries/aws_appstream_image_3.yaml b/queries/aws_appstream_image_3.yaml old mode 100755 new mode 100644 index 9f8094b06..d59a801f4 --- a/queries/aws_appstream_image_3.yaml +++ b/queries/aws_appstream_image_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n base_image_arn,\n display_name,\n\ - \ image_builder_supported,\n image_builder_name\nfrom\n aws_appstream_image\n\ - where\n platform = 'WINDOWS';" + QueryToExecute: | + SELECT + name, + created_time, + base_image_arn, + display_name, + image_builder_supported, + image_builder_name + FROM + aws_appstream_image + WHERE + platform = 'WINDOWS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find all AWS AppStream Image Details and Metadata + - AppStream +Title: Find all AWS AppStream Image Details and Metadata \ No newline at end of file diff --git a/queries/aws_appstream_image_4.yaml b/queries/aws_appstream_image_4.yaml old mode 100755 new mode 100644 index aa6353ad4..27adf116f --- a/queries/aws_appstream_image_4.yaml +++ b/queries/aws_appstream_image_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n base_image_arn,\n display_name,\n\ - \ image_builder_supported,\n image_builder_name\nfrom\n aws_appstream_image\n\ - where\n image_builder_supported;" + QueryToExecute: | + SELECT + name, + created_time, + base_image_arn, + display_name, + image_builder_supported, + image_builder_name + FROM + aws_appstream_image + WHERE + image_builder_supported; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List all AWS AppStream Image properties and states + - AppStream +Title: List all AWS AppStream Image properties and states \ No newline at end of file diff --git a/queries/aws_appstream_image_5.yaml b/queries/aws_appstream_image_5.yaml old mode 100755 new mode 100644 index 2d97d6902..0357ab367 --- a/queries/aws_appstream_image_5.yaml +++ b/queries/aws_appstream_image_5.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n base_image_arn,\n display_name,\n\ - \ image_builder_name,\n visibility\nfrom\n aws_appstream_image\nwhere\n visibility\ - \ = 'PRIVATE';" + QueryToExecute: | + SELECT + name, + created_time, + base_image_arn, + display_name, + image_builder_name, + visibility + FROM + aws_appstream_image + WHERE + visibility = 'PRIVATE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find AWS AppStream Images and Their States + - AppStream +Title: Find AWS AppStream Images and Their States \ No newline at end of file diff --git a/queries/aws_appstream_image_6.yaml b/queries/aws_appstream_image_6.yaml old mode 100755 new mode 100644 index 0ea620dea..b341283f0 --- a/queries/aws_appstream_image_6.yaml +++ b/queries/aws_appstream_image_6.yaml @@ -1,29 +1,40 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n a ->> 'AppBlockArn' as app_block_arn,\n\ - \ a ->> 'Arn' as app_arn,\n a ->> 'CreatedTime' as app_created_time,\n a ->>\ - \ 'Description' as app_description,\n a ->> 'DisplayName' as app_display_name,\n\ - \ a ->> 'Enabled' as app_enabled,\n a ->> 'IconS3Location' as app_icon_s3_location,\n\ - \ a ->> 'IconURL' as app_icon_url,\n a ->> 'InstanceFamilies' as app_instance_families,\n\ - \ a ->> 'LaunchParameters' as app_launch_parameters,\n a ->> 'LaunchPath' as\ - \ app_launch_path,\n a ->> 'Name' as app_name,\n a ->> 'Platforms' as app_platforms,\n\ - \ a ->> 'WorkingDirectory' as app_WorkingDirectory\nfrom\n aws_appstream_image,\n\ - \ jsonb_array_elements(applications) as a;" + QueryToExecute: | + SELECT + name, + arn, + a ->> 'AppBlockArn' AS app_block_arn, + a ->> 'Arn' AS app_arn, + a ->> 'CreatedTime' AS app_created_time, + a ->> 'Description' AS app_description, + a ->> 'DisplayName' AS app_display_name, + a ->> 'Enabled' AS app_enabled, + a ->> 'IconS3Location' AS app_icon_s3_location, + a ->> 'IconURL' AS app_icon_url, + a ->> 'InstanceFamilies' AS app_instance_families, + a ->> 'LaunchParameters' AS app_launch_parameters, + a ->> 'LaunchPath' AS app_launch_path, + a ->> 'Name' AS app_name, + a ->> 'Platforms' AS app_platforms, + a ->> 'WorkingDirectory' AS app_working_directory + FROM + aws_appstream_image, + JSONB_ARRAY_ELEMENTS(applications) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List AWS AppStream Images and Metadata + - AppStream +Title: List AWS AppStream Images and Metadata \ No newline at end of file diff --git a/queries/aws_appstream_image_7.yaml b/queries/aws_appstream_image_7.yaml old mode 100755 new mode 100644 index 5e1426999..ac70cd3a8 --- a/queries/aws_appstream_image_7.yaml +++ b/queries/aws_appstream_image_7.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n image_permissions ->> 'AllowFleet' as\ - \ allow_fleet,\n image_permissions ->> 'AllowImageBuilder' as allow_image_builder\n\ - from\n aws_appstream_image;" + QueryToExecute: | + SELECT + name, + arn, + image_permissions ->> 'AllowFleet' AS allow_fleet, + image_permissions ->> 'AllowImageBuilder' AS allow_image_builder + FROM + aws_appstream_image; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: Find AWS AppStream Images Properties and States + - AppStream +Title: Find AWS AppStream Images Properties and States \ No newline at end of file diff --git a/queries/aws_appstream_image_8.yaml b/queries/aws_appstream_image_8.yaml old mode 100755 new mode 100644 index 09ba6ea83..4d6584f23 --- a/queries/aws_appstream_image_8.yaml +++ b/queries/aws_appstream_image_8.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS AppStream Images to gain insights into their - properties, states, and associated metadata. +Description: Allows users to query AWS AppStream Images to gain insights into their properties, states, and associated metadata. ID: aws_appstream_image_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n e ->> 'ErrorCode' as error_code,\n \ - \ e ->> 'ErrorMessage' as error_message,\n e ->> 'ErrorTimestamp' as error_timestamp\n\ - from\n aws_appstream_image,\n jsonb_array_elements(image_errors) as e;" + QueryToExecute: | + SELECT + name, + arn, + e ->> 'ErrorCode' AS error_code, + e ->> 'ErrorMessage' AS error_message, + e ->> 'ErrorTimestamp' AS error_timestamp + FROM + aws_appstream_image, + jsonb_array_elements(image_errors) AS e; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppStream -Title: List AWS AppStream Images and Their Error Details + - AppStream +Title: List AWS AppStream Images and Their Error Details \ No newline at end of file diff --git a/queries/aws_appsync_graphql_api_1.yaml b/queries/aws_appsync_graphql_api_1.yaml old mode 100755 new mode 100644 index 2f250467e..69d402c77 --- a/queries/aws_appsync_graphql_api_1.yaml +++ b/queries/aws_appsync_graphql_api_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information - about each individual GraphQL API. +Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information about each individual GraphQL API. ID: aws_appsync_graphql_api_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n arn,\n api_type,\n authentication_type,\n\ - \ owner,\n owner_contact\nfrom\n aws_appsync_graphql_api\nwhere\n api_type\ - \ = 'MERGED';" + QueryToExecute: | + SELECT + name, + api_id, + arn, + api_type, + authentication_type, + owner, + owner_contact + FROM + aws_appsync_graphql_api + WHERE + api_type = 'MERGED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppSync -Title: Find details of AWS AppSync GraphQL APIs using SQL + - AppSync +Title: Find details of AWS AppSync GraphQL APIs using SQL \ No newline at end of file diff --git a/queries/aws_appsync_graphql_api_2.yaml b/queries/aws_appsync_graphql_api_2.yaml old mode 100755 new mode 100644 index ff46939aa..a4303edd8 --- a/queries/aws_appsync_graphql_api_2.yaml +++ b/queries/aws_appsync_graphql_api_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information - about each individual GraphQL API. +Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information about each individual GraphQL API. ID: aws_appsync_graphql_api_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n api_type,\n visibility\nfrom\n \ - \ aws_appsync_graphql_api\nwhere\n visibility = 'GLOBAL'\n and owner = account_id;" + QueryToExecute: | + SELECT + name, + api_id, + api_type, + visibility + FROM + aws_appsync_graphql_api + WHERE + visibility = 'GLOBAL' + AND owner = account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppSync -Title: List all AWS AppSync GraphQL API details + - AppSync +Title: List all AWS AppSync GraphQL API details \ No newline at end of file diff --git a/queries/aws_appsync_graphql_api_3.yaml b/queries/aws_appsync_graphql_api_3.yaml old mode 100755 new mode 100644 index 9526f94f3..9f1f709f9 --- a/queries/aws_appsync_graphql_api_3.yaml +++ b/queries/aws_appsync_graphql_api_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information - about each individual GraphQL API. +Description: Allows users to query AppSync GraphQL APIs to retrieve detailed information about each individual GraphQL API. ID: aws_appsync_graphql_api_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n api_id,\n owner,\n log_config ->> 'CloudWatchLogsRoleArn'\ - \ as cloud_watch_logs_role_arn,\n log_config ->> 'FieldLogLevel' as field_log_level,\n\ - \ log_config ->> 'ExcludeVerboseContent' as exclude_verbose_content\nfrom\n \ - \ aws_appsync_graphql_api;" + QueryToExecute: | + SELECT + name, + api_id, + owner, + log_config ->> 'CloudWatchLogsRoleArn' AS cloud_watch_logs_role_arn, + log_config ->> 'FieldLogLevel' AS field_log_level, + log_config ->> 'ExcludeVerboseContent' AS exclude_verbose_content + FROM + aws_appsync_graphql_api; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AppSync -Title: Find AWS AppSync GraphQL API Details + - AppSync +Title: Find AWS AppSync GraphQL API Details \ No newline at end of file diff --git a/queries/aws_athena_query_execution_1.yaml b/queries/aws_athena_query_execution_1.yaml old mode 100755 new mode 100644 index 4e3d93722..2fc72da12 --- a/queries/aws_athena_query_execution_1.yaml +++ b/queries/aws_athena_query_execution_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Athena Query Executions to retrieve detailed - information about each individual query execution. +Description: Allows users to query AWS Athena Query Executions to retrieve detailed information about each individual query execution. ID: aws_athena_query_execution_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n query,\n error_message,\n error_type\nfrom\n\ - \ aws_athena_query_execution\nwhere\n error_message is not null;" + QueryToExecute: | + SELECT + id, + query, + error_message, + error_type + FROM + aws_athena_query_execution + WHERE + error_message IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena -Title: List AWS Athena Queries with Errors + - Athena +Title: List AWS Athena Queries with Errors \ No newline at end of file diff --git a/queries/aws_athena_query_execution_2.yaml b/queries/aws_athena_query_execution_2.yaml old mode 100755 new mode 100644 index f889a9996..eb2220b31 --- a/queries/aws_athena_query_execution_2.yaml +++ b/queries/aws_athena_query_execution_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Athena Query Executions to retrieve detailed - information about each individual query execution. +Description: Allows users to query AWS Athena Query Executions to retrieve detailed information about each individual query execution. ID: aws_athena_query_execution_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n workgroup, \n sum(data_scanned_in_bytes) \nfrom \n\ - \ aws_athena_query_execution\ngroup by \n workgroup;" + QueryToExecute: | + SELECT + workgroup, + SUM(data_scanned_in_bytes) + FROM + aws_athena_query_execution + GROUP BY + workgroup; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena -Title: Find AWS Athena Query Executions Detailed Information + - Athena +Title: Find AWS Athena Query Executions Detailed Information \ No newline at end of file diff --git a/queries/aws_athena_query_execution_3.yaml b/queries/aws_athena_query_execution_3.yaml old mode 100755 new mode 100644 index 38ebab1ee..f2ab20ff2 --- a/queries/aws_athena_query_execution_3.yaml +++ b/queries/aws_athena_query_execution_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Athena Query Executions to retrieve detailed - information about each individual query execution. +Description: Allows users to query AWS Athena Query Executions to retrieve detailed information about each individual query execution. ID: aws_athena_query_execution_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n query,\n workgroup,\n engine_execution_time_in_millis\ - \ \nfrom\n aws_athena_query_execution \norder by\n engine_execution_time_in_millis\ - \ limit 5;" + QueryToExecute: | + SELECT + id, + query, + workgroup, + engine_execution_time_in_millis + FROM + aws_athena_query_execution + ORDER BY + engine_execution_time_in_millis + LIMIT 5; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena -Title: Find AWS Athena Query Executions with Execution Time + - Athena +Title: Find AWS Athena Query Executions with Execution Time \ No newline at end of file diff --git a/queries/aws_athena_query_execution_4.yaml b/queries/aws_athena_query_execution_4.yaml old mode 100755 new mode 100644 index 584d9031e..1bca940d8 --- a/queries/aws_athena_query_execution_4.yaml +++ b/queries/aws_athena_query_execution_4.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Athena Query Executions to retrieve detailed - information about each individual query execution. +Description: Allows users to query AWS Athena Query Executions to retrieve detailed information about each individual query execution. ID: aws_athena_query_execution_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database,\n count(id) as nb_query \nfrom\n aws_athena_query_execution\ - \ \ngroup by\n database \norder by\n nb_query limit 5;" + QueryToExecute: | + SELECT + database, + COUNT(id) AS nb_query + FROM + aws_athena_query_execution + GROUP BY + database + ORDER BY + nb_query + LIMIT 5; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Athena -Title: Find top AWS Athena query executions + - AWS Athena +Title: Find top AWS Athena query executions \ No newline at end of file diff --git a/queries/aws_athena_workgroup_1.yaml b/queries/aws_athena_workgroup_1.yaml old mode 100755 new mode 100644 index 6d829e803..d5dc6b728 --- a/queries/aws_athena_workgroup_1.yaml +++ b/queries/aws_athena_workgroup_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Athena Workgroup details such as workgroup - name, state, description, creation time, and more. +Description: Allows users to query AWS Athena Workgroup details such as workgroup name, state, description, creation time, and more. ID: aws_athena_workgroup_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name, \n description, \n effective_engine_version,\ - \ \n output_location, \n creation_time \nfrom \n aws_athena_workgroup \norder\ - \ by \n creation_time;" + QueryToExecute: | + SELECT + name, + description, + effective_engine_version, + output_location, + creation_time + FROM + aws_athena_workgroup + ORDER BY + creation_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Athena -Title: List all AWS Athena Workgroup details and creation time + - AWS Athena +Title: List all AWS Athena Workgroup details and creation time \ No newline at end of file diff --git a/queries/aws_athena_workgroup_2.yaml b/queries/aws_athena_workgroup_2.yaml old mode 100755 new mode 100644 index 7bd86f35d..67b0f9c8c --- a/queries/aws_athena_workgroup_2.yaml +++ b/queries/aws_athena_workgroup_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Athena Workgroup details such as workgroup - name, state, description, creation time, and more. +Description: Allows users to query AWS Athena Workgroup details such as workgroup name, state, description, creation time, and more. ID: aws_athena_workgroup_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name, \n description \nfrom \n aws_athena_workgroup\ - \ \nwhere \n effective_engine_version = 'Athena engine version 3';" + QueryToExecute: | + SELECT + name, + description + FROM + aws_athena_workgroup + WHERE + effective_engine_version = 'Athena engine version 3'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena Workgroup -Title: Find AWS Athena Workgroup Details Including Name and State + - Athena Workgroup +Title: Find AWS Athena Workgroup Details Including Name and State \ No newline at end of file diff --git a/queries/aws_athena_workgroup_3.yaml b/queries/aws_athena_workgroup_3.yaml old mode 100755 new mode 100644 index 03b878280..75f6ea38f --- a/queries/aws_athena_workgroup_3.yaml +++ b/queries/aws_athena_workgroup_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Athena Workgroup details such as workgroup - name, state, description, creation time, and more. +Description: Allows users to query AWS Athena Workgroup details such as workgroup name, state, description, creation time, and more. ID: aws_athena_workgroup_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n region, \n count(*) \nfrom \n aws_athena_workgroup\ - \ \ngroup by \n region;" + QueryToExecute: | + SELECT + region, + COUNT(*) + FROM + aws_athena_workgroup + GROUP BY + region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena -Title: List AWS Athena Workgroup details including state + - Athena +Title: List AWS Athena Workgroup details including state \ No newline at end of file diff --git a/queries/aws_athena_workgroup_4.yaml b/queries/aws_athena_workgroup_4.yaml old mode 100755 new mode 100644 index 36487251d..1112655dc --- a/queries/aws_athena_workgroup_4.yaml +++ b/queries/aws_athena_workgroup_4.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Athena Workgroup details such as workgroup - name, state, description, creation time, and more. +Description: Allows users to query AWS Athena Workgroup details such as workgroup name, state, description, creation time, and more. ID: aws_athena_workgroup_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name, \n description, \n creation_time\nfrom \n aws_athena_workgroup\ - \ \nwhere\n state = 'DISABLED';" + QueryToExecute: | + SELECT + name, + description, + creation_time + FROM + aws_athena_workgroup + WHERE + state = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Athena -Title: List all AWS Athena Workgroup details using SQL + - Athena +Title: List all AWS Athena Workgroup details using SQL \ No newline at end of file diff --git a/queries/aws_auditmanager_assessment_1.yaml b/queries/aws_auditmanager_assessment_1.yaml old mode 100755 new mode 100644 index 879a0b675..9a038700c --- a/queries/aws_auditmanager_assessment_1.yaml +++ b/queries/aws_auditmanager_assessment_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed - information about each assessment. +Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed information about each assessment. ID: aws_auditmanager_assessment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n compliance_type\nfrom\n \ - \ aws_auditmanager_assessment;" + QueryToExecute: | + SELECT + name, + arn, + status, + compliance_type + FROM + aws_auditmanager_assessment; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: List all AWS Audit Manager Assessments + - AWS Audit Manager +Title: List all AWS Audit Manager Assessments \ No newline at end of file diff --git a/queries/aws_auditmanager_assessment_2.yaml b/queries/aws_auditmanager_assessment_2.yaml old mode 100755 new mode 100644 index feb9e8cc5..d6cd7f695 --- a/queries/aws_auditmanager_assessment_2.yaml +++ b/queries/aws_auditmanager_assessment_2.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed - information about each assessment. +Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed information about each assessment. ID: aws_auditmanager_assessment_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.name,\n a.arn,\n a.assessment_report_destination,\n\ - \ a.assessment_report_destination_type,\n b.bucket_policy_is_public as is_public_bucket\n\ - from\n aws_auditmanager_assessment as a\njoin aws_s3_bucket as b on a.assessment_report_destination\ - \ = 's3://' || b.Name and b.bucket_policy_is_public;" + QueryToExecute: | + SELECT + a.name, + a.arn, + a.assessment_report_destination, + a.assessment_report_destination_type, + b.bucket_policy_is_public AS is_public_bucket + FROM + aws_auditmanager_assessment AS a + JOIN + aws_s3_bucket AS b + ON + a.assessment_report_destination = 's3://' || b.name + AND b.bucket_policy_is_public; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Audit Manager -Title: Find all AWS Audit Manager Assessment details + - Audit Manager +Title: Find all AWS Audit Manager Assessment details \ No newline at end of file diff --git a/queries/aws_auditmanager_assessment_3.yaml b/queries/aws_auditmanager_assessment_3.yaml old mode 100755 new mode 100644 index 8b1c1a8db..92126df46 --- a/queries/aws_auditmanager_assessment_3.yaml +++ b/queries/aws_auditmanager_assessment_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed - information about each assessment. +Description: Allows users to query AWS Audit Manager Assessments to retrieve detailed information about each assessment. ID: aws_auditmanager_assessment_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status\nfrom\n aws_auditmanager_assessment\n\ - where\n status <> 'ACTIVE';" + QueryToExecute: | + SELECT + name, + arn, + status + FROM + aws_auditmanager_assessment + WHERE + status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Audit Manager -Title: List all AWS Audit Manager assessments information + - Audit Manager +Title: List all AWS Audit Manager assessments information \ No newline at end of file diff --git a/queries/aws_auditmanager_control_1.yaml b/queries/aws_auditmanager_control_1.yaml old mode 100755 new mode 100644 index 4e939c0c7..ddc7dac28 --- a/queries/aws_auditmanager_control_1.yaml +++ b/queries/aws_auditmanager_control_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Audit Manager Control data, providing information - about controls within AWS Audit Manager. This table enables users to access detailed - information about controls, such as control source, control type, description, and - associated metadata. +Description: Allows users to query AWS Audit Manager Control data, providing information about controls within AWS Audit Manager. This table enables users to access detailed information about controls, such as control source, control type, description, and associated metadata. ID: aws_auditmanager_control_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n description,\n type\nfrom\n aws_auditmanager_control;" + QueryToExecute: | + SELECT + name, + id, + description, + type + FROM + aws_auditmanager_control; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: List all AWS Audit Manager Controls with Details + - AWS Audit Manager +Title: List all AWS Audit Manager Controls with Details \ No newline at end of file diff --git a/queries/aws_auditmanager_control_2.yaml b/queries/aws_auditmanager_control_2.yaml old mode 100755 new mode 100644 index 271f7df28..8894a82a5 --- a/queries/aws_auditmanager_control_2.yaml +++ b/queries/aws_auditmanager_control_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Audit Manager Control data, providing information - about controls within AWS Audit Manager. This table enables users to access detailed - information about controls, such as control source, control type, description, and - associated metadata. +Description: Allows users to query AWS Audit Manager Control data, providing information about controls within AWS Audit Manager. This table enables users to access detailed information about controls, such as control source, control type, description, and associated metadata. ID: aws_auditmanager_control_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n type\nfrom\n aws_auditmanager_control\n\ - where\n type = 'Custom';" + QueryToExecute: | + SELECT + name, + id, + type + FROM + aws_auditmanager_control + WHERE + type = 'Custom'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: List AWS Audit Manager Control Data + - AWS Audit Manager +Title: List AWS Audit Manager Control Data \ No newline at end of file diff --git a/queries/aws_auditmanager_evidence_1.yaml b/queries/aws_auditmanager_evidence_1.yaml old mode 100755 new mode 100644 index 21d77abd4..3a5d9efd3 --- a/queries/aws_auditmanager_evidence_1.yaml +++ b/queries/aws_auditmanager_evidence_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Audit Manager Evidence, providing detailed - information about evidence resources associated with assessments in AWS Audit Manager. +Description: Allows users to query AWS Audit Manager Evidence, providing detailed information about evidence resources associated with assessments in AWS Audit Manager. ID: aws_auditmanager_evidence_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n evidence_folder_id,\n evidence_by_type,\n\ - \ iam_id,\n control_set_id\nfrom\n aws_auditmanager_evidence;" + QueryToExecute: | + SELECT + id, + arn, + evidence_folder_id, + evidence_by_type, + iam_id, + control_set_id + FROM + aws_auditmanager_evidence; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: Find AWS Audit Manager Evidence with Detailed Info + - AWS Audit Manager +Title: Find AWS Audit Manager Evidence with Detailed Info \ No newline at end of file diff --git a/queries/aws_auditmanager_evidence_2.yaml b/queries/aws_auditmanager_evidence_2.yaml old mode 100755 new mode 100644 index bae32a164..7d8ea3743 --- a/queries/aws_auditmanager_evidence_2.yaml +++ b/queries/aws_auditmanager_evidence_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Audit Manager Evidence, providing detailed - information about evidence resources associated with assessments in AWS Audit Manager. +Description: Allows users to query AWS Audit Manager Evidence, providing detailed information about evidence resources associated with assessments in AWS Audit Manager. ID: aws_auditmanager_evidence_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n evidence_folder_id,\n count(id) as evidence_count\n\ - from\n aws_auditmanager_evidence\ngroup by\n evidence_folder_id;" + QueryToExecute: | + SELECT + evidence_folder_id, + COUNT(id) AS evidence_count + FROM + aws_auditmanager_evidence + GROUP BY + evidence_folder_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Audit Manager -Title: List all evidence resources in AWS Audit Manager + - Audit Manager +Title: List all evidence resources in AWS Audit Manager \ No newline at end of file diff --git a/queries/aws_auditmanager_evidence_folder_1.yaml b/queries/aws_auditmanager_evidence_folder_1.yaml old mode 100755 new mode 100644 index a43ac0dd3..9c62a63fe --- a/queries/aws_auditmanager_evidence_folder_1.yaml +++ b/queries/aws_auditmanager_evidence_folder_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Audit Manager Evidence Folders to get comprehensive - details about the evidence folders in the AWS Audit Manager service. +Description: Allows users to query AWS Audit Manager Evidence Folders to get comprehensive details about the evidence folders in the AWS Audit Manager service. ID: aws_auditmanager_evidence_folder_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n assessment_id,\n control_set_id,\n\ - \ control_id,\n total_evidence\nfrom\n aws_auditmanager_evidence_folder;" + QueryToExecute: | + SELECT + name, + id, + arn, + assessment_id, + control_set_id, + control_id, + total_evidence + FROM + aws_auditmanager_evidence_folder; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: List all AWS Audit Manager Evidence Folders + - AWS Audit Manager +Title: List all AWS Audit Manager Evidence Folders \ No newline at end of file diff --git a/queries/aws_auditmanager_evidence_folder_2.yaml b/queries/aws_auditmanager_evidence_folder_2.yaml old mode 100755 new mode 100644 index a66c9b33c..7ce3e2ff0 --- a/queries/aws_auditmanager_evidence_folder_2.yaml +++ b/queries/aws_auditmanager_evidence_folder_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Audit Manager Evidence Folders to get comprehensive - details about the evidence folders in the AWS Audit Manager service. +Description: Allows users to query AWS Audit Manager Evidence Folders to get comprehensive details about the evidence folders in the AWS Audit Manager service. ID: aws_auditmanager_evidence_folder_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n assessment_id,\n count(id) as evidence_folder_count\n\ - from\n aws_auditmanager_evidence_folder\ngroup by\n assessment_id;" + QueryToExecute: | + SELECT + assessment_id, + COUNT(id) AS evidence_folder_count + FROM + aws_auditmanager_evidence_folder + GROUP BY + assessment_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Audit Manager -Title: List all Evidence Folders in AWS Audit Manager + - AWS Audit Manager +Title: List all Evidence Folders in AWS Audit Manager \ No newline at end of file diff --git a/queries/aws_auditmanager_framework_1.yaml b/queries/aws_auditmanager_framework_1.yaml old mode 100755 new mode 100644 index 95cf92383..617caa25f --- a/queries/aws_auditmanager_framework_1.yaml +++ b/queries/aws_auditmanager_framework_1.yaml @@ -1,18 +1,25 @@ Description: Allows users to query AWS Audit Manager Frameworks ID: aws_auditmanager_framework_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n id,\n type\nfrom\n aws_auditmanager_framework;" + QueryToExecute: | + SELECT + name, + arn, + id, + type + FROM + aws_auditmanager_framework; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Audit Manager -Title: Find all AWS Audit Manager Frameworks + - Audit Manager +Title: Find all AWS Audit Manager Frameworks \ No newline at end of file diff --git a/queries/aws_auditmanager_framework_2.yaml b/queries/aws_auditmanager_framework_2.yaml old mode 100755 new mode 100644 index d00844937..7c1cecaf9 --- a/queries/aws_auditmanager_framework_2.yaml +++ b/queries/aws_auditmanager_framework_2.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Audit Manager Frameworks ID: aws_auditmanager_framework_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n id,\n type\nfrom\n aws_auditmanager_framework\n\ - where\n type = 'Custom';" + QueryToExecute: | + SELECT + name, + arn, + id, + type + FROM + aws_auditmanager_framework + WHERE + type = 'Custom'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Audit Manager -Title: Find AWS Audit Manager Frameworks with SQL + - Audit Manager +Title: Find AWS Audit Manager Frameworks with SQL \ No newline at end of file diff --git a/queries/aws_availability_zone_1.yaml b/queries/aws_availability_zone_1.yaml old mode 100755 new mode 100644 index df8a01b00..3ada759d2 --- a/queries/aws_availability_zone_1.yaml +++ b/queries/aws_availability_zone_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query EC2 Availability Zones in AWS, providing details - such as zone ID, name, region, and state. +Description: Allows users to query EC2 Availability Zones in AWS, providing details such as zone ID, name, region, and state. ID: aws_availability_zone_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n zone_id,\n zone_type,\n group_name,\n region_name\n\ - from\n aws_availability_zone;" + QueryToExecute: | + SELECT + name, + zone_id, + zone_type, + group_name, + region_name + FROM + aws_availability_zone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all EC2 Availability Zones with Details + - EC2 +Title: List all EC2 Availability Zones with Details \ No newline at end of file diff --git a/queries/aws_availability_zone_2.yaml b/queries/aws_availability_zone_2.yaml old mode 100755 new mode 100644 index 7f2f057ea..8f51eb6c5 --- a/queries/aws_availability_zone_2.yaml +++ b/queries/aws_availability_zone_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query EC2 Availability Zones in AWS, providing details - such as zone ID, name, region, and state. +Description: Allows users to query EC2 Availability Zones in AWS, providing details such as zone ID, name, region, and state. ID: aws_availability_zone_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n region_name,\n count(name) as zone_count\nfrom\n aws_availability_zone\n\ - group by\n region_name;" + QueryToExecute: | + SELECT + region_name, + COUNT(name) AS zone_count + FROM + aws_availability_zone + GROUP BY + region_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all EC2 Availability Zones details in AWS + - EC2 +Title: List all EC2 Availability Zones details in AWS \ No newline at end of file diff --git a/queries/aws_availability_zone_3.yaml b/queries/aws_availability_zone_3.yaml old mode 100755 new mode 100644 index 5577c335a..df068c71d --- a/queries/aws_availability_zone_3.yaml +++ b/queries/aws_availability_zone_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query EC2 Availability Zones in AWS, providing details - such as zone ID, name, region, and state. +Description: Allows users to query EC2 Availability Zones in AWS, providing details such as zone ID, name, region, and state. ID: aws_availability_zone_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n zone_id,\n region_name,\n opt_in_status\n\ - from\n aws_availability_zone\nwhere\n opt_in_status = 'not-opted-in';" + QueryToExecute: | + SELECT + name, + zone_id, + region_name, + opt_in_status + FROM + aws_availability_zone + WHERE + opt_in_status = 'not-opted-in'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all EC2 Availability Zones with details in AWS + - EC2 +Title: List all EC2 Availability Zones with details in AWS \ No newline at end of file diff --git a/queries/aws_backup_framework_1.yaml b/queries/aws_backup_framework_1.yaml old mode 100755 new mode 100644 index f37130348..2e8f67b13 --- a/queries/aws_backup_framework_1.yaml +++ b/queries/aws_backup_framework_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_id,\n arn,\n creation_time,\n deployment_status,\n\ - \ framework_controls,\n framework_description,framework_name,\n framework_status,\n\ - \ number_of_controls,\n region,\n tags\nfrom\n aws_backup_framework;" + QueryToExecute: | + SELECT + account_id, + arn, + creation_time, + deployment_status, + framework_controls, + framework_description, + framework_name, + framework_status, + number_of_controls, + region, + tags + FROM + aws_backup_framework; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List AWS Backup Frameworks with Comprehensive Details + - AWS Backup +Title: List AWS Backup Frameworks with Comprehensive Details \ No newline at end of file diff --git a/queries/aws_backup_framework_2.yaml b/queries/aws_backup_framework_2.yaml old mode 100755 new mode 100644 index 0261dc8eb..8d59272f0 --- a/queries/aws_backup_framework_2.yaml +++ b/queries/aws_backup_framework_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n framework_name,\n arn,\n creation_time,\n number_of_controls\n\ - from\n aws_backup_framework\nwhere\n creation_time >= (current_date - interval\ - \ '90' day)\norder by\n creation_time;" + QueryToExecute: | + SELECT + framework_name, + arn, + creation_time, + number_of_controls + FROM + aws_backup_framework + WHERE + creation_time >= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + creation_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Frameworks and Detailed Information + - AWS Backup +Title: List all AWS Backup Frameworks and Detailed Information \ No newline at end of file diff --git a/queries/aws_backup_framework_3.yaml b/queries/aws_backup_framework_3.yaml old mode 100755 new mode 100644 index cf4cecc2b..10040ade2 --- a/queries/aws_backup_framework_3.yaml +++ b/queries/aws_backup_framework_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n framework_name\nfrom\n aws_backup_framework,\n jsonb_array_elements(framework_controls)\ - \ as controls\nwhere\n controls ->> 'ControlName' = 'BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK';" + QueryToExecute: | + SELECT + framework_name + FROM + aws_backup_framework, + jsonb_array_elements(framework_controls) AS controls + WHERE + controls ->> 'ControlName' = 'BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List AWS Backup Frameworks and Detailed Plans + - AWS Backup +Title: List AWS Backup Frameworks and Detailed Plans \ No newline at end of file diff --git a/queries/aws_backup_framework_4.yaml b/queries/aws_backup_framework_4.yaml old mode 100755 new mode 100644 index 7fe79e359..82bbfb3d3 --- a/queries/aws_backup_framework_4.yaml +++ b/queries/aws_backup_framework_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n framework_name,\n controls ->> 'ControlName' as control_name,\n\ - \ control_scope\nfrom\n aws_backup_framework,\n jsonb_array_elements(framework_controls)\ - \ as controls,\n json_array_elements_text(coalesce(controls -> 'ControlScope'\ - \ ->> 'ComplianceResourceTypes', '[\"\"]')::json) as control_scope\nwhere\n framework_name\ - \ = 'framework_name';" + QueryToExecute: | + SELECT + framework_name, + controls ->> 'ControlName' AS control_name, + control_scope + FROM + aws_backup_framework, + jsonb_array_elements(framework_controls) AS controls, + json_array_elements_text( + COALESCE(controls -> 'ControlScope' ->> 'ComplianceResourceTypes', '[""]')::json + ) AS control_scope + WHERE + framework_name = 'framework_name'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Frameworks and Retrieve Comprehensive Data + - AWS Backup +Title: Find AWS Backup Frameworks and Retrieve Comprehensive Data \ No newline at end of file diff --git a/queries/aws_backup_framework_5.yaml b/queries/aws_backup_framework_5.yaml old mode 100755 new mode 100644 index 64a2f0949..62a6de65e --- a/queries/aws_backup_framework_5.yaml +++ b/queries/aws_backup_framework_5.yaml @@ -1,35 +1,49 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_name,\n compliance_result -> 'Compliance' ->> 'ComplianceType'\ - \ as compliance_type,\n compliance_result -> 'Compliance' -> 'ComplianceContributorCount'\ - \ ->> 'CappedCount' as count_of_noncompliant_resources\nfrom\n aws_config_rule\n\ - inner join\n(\n -- The sub-query will create the AWS Config rule name from information\ - \ stored in the AWS Backup framework table.\n select\n case when framework_information.control_scope\ - \ = '' then concat(framework_information.control_name, '-', framework_information.framework_uuid)\n\ - \ else concat(upper(framework_information.control_scope), '-', framework_information.control_name,\ - \ '-', framework_information.framework_uuid)\n end as rule_name\n from\n \ - \ (\n select\n framework_name,\n controls ->> 'ControlName' as control_name,\n\ - \ control_scope,\n right(arn, 36) as framework_uuid\n from\n \ - \ aws_backup_framework,\n jsonb_array_elements(framework_controls) as controls,\n\ - \ json_array_elements_text(coalesce(controls -> 'ControlScope' ->> 'ComplianceResourceTypes',\ - \ '[\"\"]')::json) as control_scope\n ) as framework_information\n) as backup_framework\n\ - on\n aws_config_rule.name = backup_framework.rule_name,\n jsonb_array_elements(compliance_by_config_rule)\ - \ as compliance_result\nwhere\n compliance_result -> 'Compliance' ->> 'ComplianceType'\ - \ = 'NON_COMPLIANT';" + QueryToExecute: | + SELECT + rule_name, + compliance_result -> 'Compliance' ->> 'ComplianceType' AS compliance_type, + compliance_result -> 'Compliance' -> 'ComplianceContributorCount' ->> 'CappedCount' AS count_of_noncompliant_resources + FROM + aws_config_rule + INNER JOIN + ( + SELECT + CASE + WHEN framework_information.control_scope = '' THEN CONCAT(framework_information.control_name, '-', framework_information.framework_uuid) + ELSE CONCAT(UPPER(framework_information.control_scope), '-', framework_information.control_name, '-', framework_information.framework_uuid) + END AS rule_name + FROM + ( + SELECT + framework_name, + controls ->> 'ControlName' AS control_name, + control_scope, + RIGHT(arn, 36) AS framework_uuid + FROM + aws_backup_framework, + jsonb_array_elements(framework_controls) AS controls, + json_array_elements_text(COALESCE(controls -> 'ControlScope' ->> 'ComplianceResourceTypes', '[""]')::json) AS control_scope + ) AS framework_information + ) AS backup_framework + ON + aws_config_rule.name = backup_framework.rule_name + , jsonb_array_elements(compliance_by_config_rule) AS compliance_result + WHERE + compliance_result -> 'Compliance' ->> 'ComplianceType' = 'NON_COMPLIANT'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Frameworks and Compliance Types + - AWS Backup +Title: Find AWS Backup Frameworks and Compliance Types \ No newline at end of file diff --git a/queries/aws_backup_framework_6.yaml b/queries/aws_backup_framework_6.yaml old mode 100755 new mode 100644 index 44dfe5892..ac0a1f708 --- a/queries/aws_backup_framework_6.yaml +++ b/queries/aws_backup_framework_6.yaml @@ -1,36 +1,49 @@ -Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive - data about each backup plan, including its unique ARN, version, creation and deletion - dates, and more. +Description: Allows users to query AWS Backup Frameworks and retrieve comprehensive data about each backup plan, including its unique ARN, version, creation and deletion dates, and more. ID: aws_backup_framework_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_name,\n compliance_result -> 'Compliance' ->> 'ComplianceType'\ - \ as compliance_type\nfrom\n aws_config_rule\ninner join\n(\n -- The sub-query\ - \ will create the AWS Config rule name from information stored in the AWS Backup\ - \ framework table.\n select\n case when framework_information.control_scope\ - \ = '' then concat(framework_information.control_name, '-', framework_information.framework_uuid)\n\ - \ else concat(upper(framework_information.control_scope), '-', framework_information.control_name,\ - \ '-', framework_information.framework_uuid)\n end as rule_name\n from\n \ - \ (\n select\n framework_name,\n controls ->> 'ControlName' as control_name,\n\ - \ control_scope,\n right(arn, 36) as framework_uuid\n from\n \ - \ aws_backup_framework,\n jsonb_array_elements(framework_controls) as controls,\n\ - \ json_array_elements_text(coalesce(controls -> 'ControlScope' ->> 'ComplianceResourceTypes',\ - \ '[\"\"]')::json) as control_scope\n ) as framework_information\n) as backup_framework\n\ - on\n aws_config_rule.name = backup_framework.rule_name,\n jsonb_array_elements(compliance_by_config_rule)\ - \ as compliance_result\nwhere\n compliance_result -> 'Compliance' ->> 'ComplianceType'\ - \ = 'COMPLIANT';" + QueryToExecute: | + SELECT + rule_name, + compliance_result -> 'Compliance' ->> 'ComplianceType' AS compliance_type + FROM + aws_config_rule + INNER JOIN + ( + SELECT + CASE WHEN framework_information.control_scope = '' THEN CONCAT(framework_information.control_name, '-', framework_information.framework_uuid) + ELSE CONCAT(UPPER(framework_information.control_scope), '-', framework_information.control_name, '-', framework_information.framework_uuid) + END AS rule_name + FROM + ( + SELECT + framework_name, + controls ->> 'ControlName' AS control_name, + control_scope, + RIGHT(arn, 36) AS framework_uuid + FROM + aws_backup_framework, + jsonb_array_elements(framework_controls) AS controls, + json_array_elements_text(COALESCE(controls -> 'ControlScope' ->> 'ComplianceResourceTypes', '[""]')::json) AS control_scope + ) AS framework_information + ) AS backup_framework + ON + aws_config_rule.name = backup_framework.rule_name, + jsonb_array_elements(compliance_by_config_rule) AS compliance_result + WHERE + compliance_result -> 'Compliance' ->> 'ComplianceType' = 'COMPLIANT'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Frameworks with Compliance Status + - AWS Backup +Title: Find AWS Backup Frameworks with Compliance Status \ No newline at end of file diff --git a/queries/aws_backup_job_1.yaml b/queries/aws_backup_job_1.yaml old mode 100755 new mode 100644 index 8d902bfdf..db9c0e0a6 --- a/queries/aws_backup_job_1.yaml +++ b/queries/aws_backup_job_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Backup Jobs, providing detailed information - about the status of backups jobs. +Description: Allows users to query AWS Backup Jobs, providing detailed information about the status of backups jobs. ID: aws_backup_job_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n recovery_point_arn,\n backup_vault_arn,\n\ - \ status\nfrom\n aws_backup_job" + QueryToExecute: | + SELECT + job_id, + recovery_point_arn, + backup_vault_arn, + status + FROM + aws_backup_job Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: Find all AWS Backup Job details including status + - Backup +Title: Find all AWS Backup Job details including status \ No newline at end of file diff --git a/queries/aws_backup_job_2.yaml b/queries/aws_backup_job_2.yaml old mode 100755 new mode 100644 index fcca918f0..71ff6b124 --- a/queries/aws_backup_job_2.yaml +++ b/queries/aws_backup_job_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Backup Jobs, providing detailed information - about the status of backups jobs. +Description: Allows users to query AWS Backup Jobs, providing detailed information about the status of backups jobs. ID: aws_backup_job_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n recovery_point_arn,\n backup_vault_arn,\n\ - \ status,\n current_date\nfrom\n aws_backup_job\nwhere\n status != 'COMPLETED'\n\ - \ and creation_date > current_date" + QueryToExecute: | + SELECT + job_id, + recovery_point_arn, + backup_vault_arn, + status, + current_date + FROM + aws_backup_job + WHERE + status != 'COMPLETED' + AND creation_date > current_date Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: List All Incomplete AWS Backup Jobs + - Backup +Title: List All Incomplete AWS Backup Jobs \ No newline at end of file diff --git a/queries/aws_backup_job_3.yaml b/queries/aws_backup_job_3.yaml old mode 100755 new mode 100644 index ecf224f27..2ab782c9c --- a/queries/aws_backup_job_3.yaml +++ b/queries/aws_backup_job_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Backup Jobs, providing detailed information - about the status of backups jobs. +Description: Allows users to query AWS Backup Jobs, providing detailed information about the status of backup jobs. ID: aws_backup_job_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_type,\n count(*)\nfrom\n aws_backup_job\n\ - group by\n resource_type" + QueryToExecute: | + SELECT + resource_type, + COUNT(*) + FROM + aws_backup_job + GROUP BY + resource_type Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: List all AWS Backup Jobs with Status Details + - Backup +Title: List all AWS Backup Jobs with Status Details \ No newline at end of file diff --git a/queries/aws_backup_legal_hold_1.yaml b/queries/aws_backup_legal_hold_1.yaml old mode 100755 new mode 100644 index 72aab9c83..7e907d8ae --- a/queries/aws_backup_legal_hold_1.yaml +++ b/queries/aws_backup_legal_hold_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Backup Legal Hold to obtain information about - the legal hold settings of AWS backup resources. +Description: Allows users to query AWS Backup Legal Hold to obtain information about the legal hold settings of AWS backup resources. ID: aws_backup_legal_hold_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n legal_hold_id,\n arn,\n creation_date,\n cancellation_date\n\ - from\n aws_backup_legal_hold;" + QueryToExecute: | + SELECT + legal_hold_id, + arn, + creation_date, + cancellation_date + FROM + aws_backup_legal_hold; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List AWS Backup Legal Hold Settings + - AWS Backup +Title: List AWS Backup Legal Hold Settings \ No newline at end of file diff --git a/queries/aws_backup_legal_hold_2.yaml b/queries/aws_backup_legal_hold_2.yaml old mode 100755 new mode 100644 index a557183d4..a47aa957a --- a/queries/aws_backup_legal_hold_2.yaml +++ b/queries/aws_backup_legal_hold_2.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Backup Legal Hold to obtain information about - the legal hold settings of AWS backup resources. +Description: Allows users to query AWS Backup Legal Hold to obtain information about the legal hold settings of AWS backup resources. ID: aws_backup_legal_hold_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n legal_hold_id,\n arn,\n creation_date,\n creation_date,\n\ - \ retain_record_until\nfrom\n aws_backup_legal_hold\nwhere\n creation_date\ - \ <= current_date - interval '10' day\norder by\n creation_date;" + QueryToExecute: | + SELECT + legal_hold_id, + arn, + creation_date, + retain_record_until + FROM + aws_backup_legal_hold + WHERE + creation_date <= CURRENT_DATE - INTERVAL '10' DAY + ORDER BY + creation_date; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Legal Hold Settings + - AWS Backup +Title: Find AWS Backup Legal Hold Settings \ No newline at end of file diff --git a/queries/aws_backup_legal_hold_3.yaml b/queries/aws_backup_legal_hold_3.yaml old mode 100755 new mode 100644 index 76d87cd72..1de35caff --- a/queries/aws_backup_legal_hold_3.yaml +++ b/queries/aws_backup_legal_hold_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Backup Legal Hold to obtain information about - the legal hold settings of AWS backup resources. +Description: Allows users to query AWS Backup Legal Hold to obtain information about the legal hold settings of AWS backup resources. ID: aws_backup_legal_hold_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n legal_hold_id,\n recovery_point_selection\ - \ -> 'DateRange' ->> 'ToDate' as to_date,\n recovery_point_selection -> 'DateRange'\ - \ ->> 'FromDate' as from_date,\n recovery_point_selection -> 'VaultNames' as\ - \ vault_names,\n recovery_point_selection ->> 'ResourceIdentifiers' as resource_identifiers\n\ - from\n aws_backup_legal_hold;" + QueryToExecute: | + SELECT + title, + legal_hold_id, + recovery_point_selection -> 'DateRange' ->> 'ToDate' AS to_date, + recovery_point_selection -> 'DateRange' ->> 'FromDate' AS from_date, + recovery_point_selection -> 'VaultNames' AS vault_names, + recovery_point_selection ->> 'ResourceIdentifiers' AS resource_identifiers + FROM + aws_backup_legal_hold; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Legal Hold settings + - AWS Backup +Title: List all AWS Backup Legal Hold settings \ No newline at end of file diff --git a/queries/aws_backup_plan_1.yaml b/queries/aws_backup_plan_1.yaml old mode 100755 new mode 100644 index 57ae978ce..3b73a7f17 --- a/queries/aws_backup_plan_1.yaml +++ b/queries/aws_backup_plan_1.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS Backup Plan data, providing detailed information - about each backup plan created within an AWS account. Useful for DevOps engineers - to monitor and manage backup strategies and ensure data recovery processes are in - place. +Description: Allows users to query AWS Backup Plan data, providing detailed information about each backup plan created within an AWS account. Useful for DevOps engineers to monitor and manage backup strategies and ensure data recovery processes are in place. ID: aws_backup_plan_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n backup_plan_id,\n arn,\n creation_date,\n\ - \ last_execution_date\nfrom\n aws_backup_plan;" + QueryToExecute: | + SELECT + name, + backup_plan_id, + arn, + creation_date, + last_execution_date + FROM + aws_backup_plan; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Plans Information for Data Recovery + - AWS Backup +Title: Find AWS Backup Plans Information for Data Recovery \ No newline at end of file diff --git a/queries/aws_backup_plan_2.yaml b/queries/aws_backup_plan_2.yaml old mode 100755 new mode 100644 index 29c511fdb..53f259c23 --- a/queries/aws_backup_plan_2.yaml +++ b/queries/aws_backup_plan_2.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS Backup Plan data, providing detailed information - about each backup plan created within an AWS account. Useful for DevOps engineers - to monitor and manage backup strategies and ensure data recovery processes are in - place. +Description: Allows users to query AWS Backup Plan data, providing detailed information about each backup plan created within an AWS account. Useful for DevOps engineers to monitor and manage backup strategies and ensure data recovery processes are in place. ID: aws_backup_plan_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n backup_plan_id,\n arn,\n creation_date,\n\ - \ last_execution_date\nfrom\n aws_backup_plan\nwhere\n creation_date <= (current_date\ - \ - interval '90' day)\norder by\n creation_date;" + QueryToExecute: | + SELECT + name, + backup_plan_id, + arn, + creation_date, + last_execution_date + FROM + aws_backup_plan + WHERE + creation_date <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + creation_date; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup Plan -Title: List all AWS Backup Plans and details within 90 days + - AWS Backup Plan +Title: List all AWS Backup Plans and details within 90 days \ No newline at end of file diff --git a/queries/aws_backup_plan_3.yaml b/queries/aws_backup_plan_3.yaml old mode 100755 new mode 100644 index bf4724e2a..a0e76848a --- a/queries/aws_backup_plan_3.yaml +++ b/queries/aws_backup_plan_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Backup Plan data, providing detailed information - about each backup plan created within an AWS account. Useful for DevOps engineers - to monitor and manage backup strategies and ensure data recovery processes are in - place. +Description: Allows users to query AWS Backup Plan data, providing detailed information about each backup plan created within an AWS account. Useful for DevOps engineers to monitor and manage backup strategies and ensure data recovery processes are in place. ID: aws_backup_plan_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_date,\n deletion_date\nfrom\n\ - \ aws_backup_plan\nwhere\n deletion_date > current_date - 7\norder by\n deletion_date;" + QueryToExecute: | + SELECT + name, + arn, + creation_date, + deletion_date + FROM + aws_backup_plan + WHERE + deletion_date > CURRENT_DATE - 7 + ORDER BY + deletion_date; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: List all AWS Backup Plans with Details + - Backup +Title: List all AWS Backup Plans with Details \ No newline at end of file diff --git a/queries/aws_backup_protected_resource_1.yaml b/queries/aws_backup_protected_resource_1.yaml old mode 100755 new mode 100644 index 356282b8b..5f541a13a --- a/queries/aws_backup_protected_resource_1.yaml +++ b/queries/aws_backup_protected_resource_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Backup Protected Resources to retrieve detailed - information about the resources that are backed up by AWS Backup service. +Description: Allows users to query AWS Backup Protected Resources to retrieve detailed information about the resources that are backed up by AWS Backup service. ID: aws_backup_protected_resource_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_arn,\n resource_type,\n last_backup_time\n\ - from\n aws_backup_protected_resource;" + QueryToExecute: | + SELECT + resource_arn, + resource_type, + last_backup_time + FROM + aws_backup_protected_resource; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Protected Resource details + - AWS Backup +Title: List all AWS Backup Protected Resource details \ No newline at end of file diff --git a/queries/aws_backup_protected_resource_2.yaml b/queries/aws_backup_protected_resource_2.yaml old mode 100755 new mode 100644 index c38ba9b0c..55a15a2d7 --- a/queries/aws_backup_protected_resource_2.yaml +++ b/queries/aws_backup_protected_resource_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Backup Protected Resources to retrieve detailed - information about the resources that are backed up by AWS Backup service. +Description: Allows users to query AWS Backup Protected Resources to retrieve detailed information about the resources that are backed up by AWS Backup service. ID: aws_backup_protected_resource_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_arn,\n resource_type,\n last_backup_time\n\ - from\n aws_backup_protected_resource\nwhere\n resource_type = 'EBS';" + QueryToExecute: | + SELECT + resource_arn, + resource_type, + last_backup_time + FROM + aws_backup_protected_resource + WHERE + resource_type = 'EBS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Protected Resources Information + - AWS Backup +Title: Find AWS Backup Protected Resources Information \ No newline at end of file diff --git a/queries/aws_backup_recovery_point_1.yaml b/queries/aws_backup_recovery_point_1.yaml old mode 100755 new mode 100644 index 6081ba5d8..237856e29 --- a/queries/aws_backup_recovery_point_1.yaml +++ b/queries/aws_backup_recovery_point_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Backup Recovery Points to gather comprehensive - information about each recovery point within an AWS Backup vault. +Description: Allows users to query AWS Backup Recovery Points to gather comprehensive information about each recovery point within an AWS Backup vault. ID: aws_backup_recovery_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n backup_vault_name,\n recovery_point_arn,\n resource_type,\n\ - \ status\nfrom\n aws_backup_recovery_point;" + QueryToExecute: | + SELECT + backup_vault_name, + recovery_point_arn, + resource_type, + status + FROM + aws_backup_recovery_point; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Recovery Points in a Backup Vault + - AWS Backup +Title: List all AWS Backup Recovery Points in a Backup Vault \ No newline at end of file diff --git a/queries/aws_backup_recovery_point_2.yaml b/queries/aws_backup_recovery_point_2.yaml old mode 100755 new mode 100644 index eafdc7829..13a7618e5 --- a/queries/aws_backup_recovery_point_2.yaml +++ b/queries/aws_backup_recovery_point_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Backup Recovery Points to gather comprehensive - information about each recovery point within an AWS Backup vault. +Description: Allows users to query AWS Backup Recovery Points to gather comprehensive information about each recovery point within an AWS Backup vault. ID: aws_backup_recovery_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n backup_vault_name,\n recovery_point_arn,\n resource_type,\n\ - \ status,\n is_encrypted\nfrom\n aws_backup_recovery_point\nwhere\n is_encrypted;" + QueryToExecute: | + SELECT + backup_vault_name, + recovery_point_arn, + resource_type, + status, + is_encrypted + FROM + aws_backup_recovery_point + WHERE + is_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Recovery Points in Vault + - AWS Backup +Title: List all AWS Backup Recovery Points in Vault \ No newline at end of file diff --git a/queries/aws_backup_recovery_point_3.yaml b/queries/aws_backup_recovery_point_3.yaml old mode 100755 new mode 100644 index 26f30b683..e1809a3e4 --- a/queries/aws_backup_recovery_point_3.yaml +++ b/queries/aws_backup_recovery_point_3.yaml @@ -1,28 +1,45 @@ -Description: Allows users to query AWS Backup Recovery Points to gather comprehensive - information about each recovery point within an AWS Backup vault. +Description: Allows users to query AWS Backup Recovery Points to gather comprehensive information about each recovery point within an AWS Backup vault. ID: aws_backup_recovery_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.backup_vault_name as backup_vault_name,\n r.recovery_point_arn\ - \ as recovery_point_arn,\n r.resource_type as resource_type,\ncase\n when\ - \ r.resource_type = 'EBS' then (\n select tags from aws_ebs_snapshot where\ - \ arn = concat(\n (string_to_array(r.recovery_point_arn, '::'))[1],\n \ - \ ':',\n r.account_id,\n ':',\n (string_to_array(r.recovery_point_arn,\ - \ '::'))[2]\n )\n )\n when r.resource_type = 'EC2' then (\n select\ - \ tags from aws_ec2_ami where image_id = (string_to_array(r.recovery_point_arn,\ - \ '::image/'))[2]\n )\n when r.resource_type in ('S3', 'EFS') then r.tags\n\ - end as tags,\n r.region,\n r.account_id\nfrom\n aws_backup_recovery_point as\ - \ r;" + QueryToExecute: | + SELECT + r.backup_vault_name AS backup_vault_name, + r.recovery_point_arn AS recovery_point_arn, + r.resource_type AS resource_type, + CASE + WHEN r.resource_type = 'EBS' THEN ( + SELECT tags + FROM aws_ebs_snapshot + WHERE arn = CONCAT( + (STRING_TO_ARRAY(r.recovery_point_arn, '::'))[1], + ':', + r.account_id, + ':', + (STRING_TO_ARRAY(r.recovery_point_arn, '::'))[2] + ) + ) + WHEN r.resource_type = 'EC2' THEN ( + SELECT tags + FROM aws_ec2_ami + WHERE image_id = (STRING_TO_ARRAY(r.recovery_point_arn, '::image/'))[2] + ) + WHEN r.resource_type IN ('S3', 'EFS') THEN r.tags + END AS tags, + r.region, + r.account_id + FROM + aws_backup_recovery_point AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Recovery Points in a Vault + - AWS Backup +Title: List all AWS Backup Recovery Points in a Vault \ No newline at end of file diff --git a/queries/aws_backup_report_plan_1.yaml b/queries/aws_backup_report_plan_1.yaml old mode 100755 new mode 100644 index 3228dbbe3..ff27b0889 --- a/queries/aws_backup_report_plan_1.yaml +++ b/queries/aws_backup_report_plan_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n last_attempted_execution_time,\n\ - \ deployment_status\nfrom\n aws_backup_report_plan;" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + last_attempted_execution_time, + deployment_status + FROM + aws_backup_report_plan; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Report Plan details + - AWS Backup +Title: List all AWS Backup Report Plan details \ No newline at end of file diff --git a/queries/aws_backup_report_plan_2.yaml b/queries/aws_backup_report_plan_2.yaml old mode 100755 new mode 100644 index fdd355609..1240e38f1 --- a/queries/aws_backup_report_plan_2.yaml +++ b/queries/aws_backup_report_plan_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n last_attempted_execution_time,\n\ - \ deployment_status\nfrom\n aws_backup_report_plan\nwhere\n creation_time <=\ - \ (current_date - interval '90' day)\norder by\n creation_time;" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + last_attempted_execution_time, + deployment_status + FROM + aws_backup_report_plan + WHERE + creation_time <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + creation_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Report Plan data details + - AWS Backup +Title: List all AWS Backup Report Plan data details \ No newline at end of file diff --git a/queries/aws_backup_report_plan_3.yaml b/queries/aws_backup_report_plan_3.yaml old mode 100755 new mode 100644 index d9b0d28d1..44df530d5 --- a/queries/aws_backup_report_plan_3.yaml +++ b/queries/aws_backup_report_plan_3.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n last_attempted_execution_time,\n\ - \ deployment_status\nfrom\n aws_backup_report_plan\nwhere\n last_successful_execution_time\ - \ > current_date - 7\norder by\n last_successful_execution_time;" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + last_attempted_execution_time, + deployment_status + FROM + aws_backup_report_plan + WHERE + last_successful_execution_time > CURRENT_DATE - 7 + ORDER BY + last_successful_execution_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List AWS Backup Report Plan Data with Details + - AWS Backup +Title: List AWS Backup Report Plan Data with Details \ No newline at end of file diff --git a/queries/aws_backup_report_plan_4.yaml b/queries/aws_backup_report_plan_4.yaml old mode 100755 new mode 100644 index 70e3d7960..295fdae62 --- a/queries/aws_backup_report_plan_4.yaml +++ b/queries/aws_backup_report_plan_4.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n report_setting\ - \ ->> 'ReportTemplate' as report_template,\n report_setting ->> 'Accounts' as\ - \ accounts,\n report_setting ->> 'FrameworkArns' as framework_arns,\n report_setting\ - \ ->> 'NumberOfFrameworks' as number_of_frameworks,\n report_setting ->> 'OrganizationUnits'\ - \ as organization_units,\n report_setting ->> 'Regions' as regions\nfrom\n aws_backup_report_plan\n\ - where\n title = 'backup_jobs_report_12_07_2023';" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + report_setting ->> 'ReportTemplate' AS report_template, + report_setting ->> 'Accounts' AS accounts, + report_setting ->> 'FrameworkArns' AS framework_arns, + report_setting ->> 'NumberOfFrameworks' AS number_of_frameworks, + report_setting ->> 'OrganizationUnits' AS organization_units, + report_setting ->> 'Regions' AS regions + FROM + aws_backup_report_plan + WHERE + title = 'backup_jobs_report_12_07_2023'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: List AWS Backup Report Plan Data Details + - Backup +Title: List AWS Backup Report Plan Data Details \ No newline at end of file diff --git a/queries/aws_backup_report_plan_5.yaml b/queries/aws_backup_report_plan_5.yaml old mode 100755 new mode 100644 index 0b4bee913..8b7dbc5e7 --- a/queries/aws_backup_report_plan_5.yaml +++ b/queries/aws_backup_report_plan_5.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n last_attempted_execution_time,\n\ - \ deployment_status\nfrom\n aws_backup_report_plan\nwhere\n deployment_status\ - \ = 'COMPLETED';" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + last_attempted_execution_time, + deployment_status + FROM + aws_backup_report_plan + WHERE + deployment_status = 'COMPLETED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup Report Plan -Title: Query AWS Backup Report Plan Details + - Backup Report Plan +Title: Query AWS Backup Report Plan Details \ No newline at end of file diff --git a/queries/aws_backup_report_plan_6.yaml b/queries/aws_backup_report_plan_6.yaml old mode 100755 new mode 100644 index 1f7036422..3e30e4aa7 --- a/queries/aws_backup_report_plan_6.yaml +++ b/queries/aws_backup_report_plan_6.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Backup Report Plan data, including details - about backup jobs, recovery points, and backup vaults. +Description: Allows users to query AWS Backup Report Plan data, including details about backup jobs, recovery points, and backup vaults. ID: aws_backup_report_plan_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n creation_time,\n report_delivery_channel\ - \ ->> 'Formats' as formats,\n report_delivery_channel ->> 'S3BucketName' as s3_bucket_name,\n\ - \ report_delivery_channel ->> 'S3KeyPrefix' as s3_key_prefix\nfrom\n aws_backup_report_plan\n\ - where\n title = 'backup_jobs_report_12_07_2023';" + QueryToExecute: | + SELECT + arn, + description, + creation_time, + report_delivery_channel ->> 'Formats' AS formats, + report_delivery_channel ->> 'S3BucketName' AS s3_bucket_name, + report_delivery_channel ->> 'S3KeyPrefix' AS s3_key_prefix + FROM + aws_backup_report_plan + WHERE + title = 'backup_jobs_report_12_07_2023'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup Report Plan -Title: Query AWS Backup Report Plan data with details + - AWS Backup Report Plan +Title: Query AWS Backup Report Plan data with details \ No newline at end of file diff --git a/queries/aws_backup_selection_1.yaml b/queries/aws_backup_selection_1.yaml old mode 100755 new mode 100644 index 99983995d..142ecc94d --- a/queries/aws_backup_selection_1.yaml +++ b/queries/aws_backup_selection_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Backup Selections to obtain detailed information - about the backup selection resources within AWS Backup service. +Description: Allows users to query AWS Backup Selections to obtain detailed information about the backup selection resources within AWS Backup service. ID: aws_backup_selection_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n selection_name,\n backup_plan_id,\n iam_role_arn,\n\ - \ region,\n account_id\nfrom\n aws_backup_selection;" + QueryToExecute: | + SELECT + selection_name, + backup_plan_id, + iam_role_arn, + region, + account_id + FROM + aws_backup_selection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Find AWS Backup Selections Information + - AWS Backup +Title: Find AWS Backup Selections Information \ No newline at end of file diff --git a/queries/aws_backup_selection_2.yaml b/queries/aws_backup_selection_2.yaml old mode 100755 new mode 100644 index 8beb99a05..708fac981 --- a/queries/aws_backup_selection_2.yaml +++ b/queries/aws_backup_selection_2.yaml @@ -1,23 +1,34 @@ -Description: Allows users to query AWS Backup Selections to obtain detailed information - about the backup selection resources within AWS Backup service. +Description: Allows users to query AWS Backup Selections to obtain detailed information about the backup selection resources within AWS Backup service. ID: aws_backup_selection_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with filtered_data as (\n select\n backup_plan_id,\n jsonb_agg(r)\ - \ as assigned_resource\n from\n aws_backup_selection,\n jsonb_array_elements(resources)\ - \ as r\n group by backup_plan_id\n)\nselect\n v.volume_id,\n v.region,\n v.account_id\n\ - from\n aws_ebs_volume as v\n join filtered_data t on t.assigned_resource ?|\ - \ array[v.arn];" + QueryToExecute: | + WITH filtered_data AS ( + SELECT + backup_plan_id, + JSONB_AGG(r) AS assigned_resource + FROM + aws_backup_selection, + JSONB_ARRAY_ELEMENTS(resources) AS r + GROUP BY backup_plan_id + ) + SELECT + v.volume_id, + v.region, + v.account_id + FROM + aws_ebs_volume AS v + JOIN filtered_data t ON t.assigned_resource ?| ARRAY[v.arn]; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: List all AWS Backup Selection Details + - AWS Backup +Title: List all AWS Backup Selection Details \ No newline at end of file diff --git a/queries/aws_backup_vault_1.yaml b/queries/aws_backup_vault_1.yaml old mode 100755 new mode 100644 index 3180b5fdd..04e9ea387 --- a/queries/aws_backup_vault_1.yaml +++ b/queries/aws_backup_vault_1.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query AWS Backup Vaults, providing detailed information - about each backup vault, including its name, ARN, recovery points, and more. +Description: Allows users to query AWS Backup Vaults, providing detailed information about each backup vault, including its name, ARN, recovery points, and more. ID: aws_backup_vault_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_date\nfrom\n aws_backup_vault;" + QueryToExecute: | + SELECT + name, + arn, + creation_date + FROM + aws_backup_vault; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Backup -Title: Query AWS Backup Vaults for Detailed Information + - AWS Backup +Title: Query AWS Backup Vaults for Detailed Information \ No newline at end of file diff --git a/queries/aws_backup_vault_2.yaml b/queries/aws_backup_vault_2.yaml old mode 100755 new mode 100644 index d5124bf61..49168b28e --- a/queries/aws_backup_vault_2.yaml +++ b/queries/aws_backup_vault_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Backup Vaults, providing detailed information - about each backup vault, including its name, ARN, recovery points, and more. +Description: Allows users to query AWS Backup Vaults, providing detailed information about each backup vault, including its name, ARN, recovery points, and more. ID: aws_backup_vault_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_date\nfrom\n aws_backup_vault\n\ - where\n creation_date <= (current_date - interval '90' day)\norder by\n creation_date;" + QueryToExecute: | + SELECT + name, + arn, + creation_date + FROM + aws_backup_vault + WHERE + creation_date <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + creation_date; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: List all AWS Backup Vaults with Detailed Information + - Backup +Title: List all AWS Backup Vaults with Detailed Information \ No newline at end of file diff --git a/queries/aws_backup_vault_3.yaml b/queries/aws_backup_vault_3.yaml old mode 100755 new mode 100644 index b8ac2130b..a89190a56 --- a/queries/aws_backup_vault_3.yaml +++ b/queries/aws_backup_vault_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Backup Vaults, providing detailed information - about each backup vault, including its name, ARN, recovery points, and more. +Description: Allows users to query AWS Backup Vaults, providing detailed information about each backup vault, including its name, ARN, recovery points, and more. ID: aws_backup_vault_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name\nfrom\n aws_backup_vault,\n jsonb_array_elements(policy\ - \ -> 'Statement') as s\nwhere\n s ->> 'Principal' = '*'\n and s ->> 'Effect'\ - \ != 'Deny'\n and s ->> 'Action' like '%DeleteBackupVault%';" + QueryToExecute: | + SELECT + name + FROM + aws_backup_vault, + jsonb_array_elements(policy -> 'Statement') AS s + WHERE + s ->> 'Principal' = '*' + AND s ->> 'Effect' != 'Deny' + AND s ->> 'Action' LIKE '%DeleteBackupVault%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup Vault -Title: Find AWS Backup Vaults with Specific Policy Details + - Backup Vault +Title: Find AWS Backup Vaults with Specific Policy Details \ No newline at end of file diff --git a/queries/aws_backup_vault_4.yaml b/queries/aws_backup_vault_4.yaml old mode 100755 new mode 100644 index 31541a212..417e806b5 --- a/queries/aws_backup_vault_4.yaml +++ b/queries/aws_backup_vault_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Backup Vaults, providing detailed information - about each backup vault, including its name, ARN, recovery points, and more. +Description: Allows users to query AWS Backup Vaults, providing detailed information about each backup vault, including its name, ARN, recovery points, and more. ID: aws_backup_vault_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_backup_vault;" + QueryToExecute: | + SELECT + name, + JSONB_PRETTY(policy) AS policy, + JSONB_PRETTY(policy_std) AS policy_std + FROM + aws_backup_vault; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Backup -Title: Find all AWS Backup Vaults with Details + - Backup +Title: Find all AWS Backup Vaults with Details \ No newline at end of file diff --git a/queries/aws_cloudcontrol_resource_1.yaml b/queries/aws_cloudcontrol_resource_1.yaml old mode 100755 new mode 100644 index 1838390c4..820fc51b3 --- a/queries/aws_cloudcontrol_resource_1.yaml +++ b/queries/aws_cloudcontrol_resource_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Cloud Control API Resource data, providing - detailed insights into resource properties, types, and statuses. +Description: Allows users to query AWS Cloud Control API Resource data, providing detailed insights into resource properties, types, and statuses. ID: aws_cloudcontrol_resource_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identifier,\n properties ->> 'Arn' as arn,\n properties\ - \ ->> 'MemorySize' as memory_size,\n properties ->> 'Runtime' as runtime,\n \ - \ region\nfrom\n aws_cloudcontrol_resource\nwhere\n type_name = 'AWS::Lambda::Function';" + QueryToExecute: | + SELECT + identifier, + properties ->> 'Arn' AS arn, + properties ->> 'MemorySize' AS memory_size, + properties ->> 'Runtime' AS runtime, + region + FROM + aws_cloudcontrol_resource + WHERE + type_name = 'AWS::Lambda::Function'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cloud Control API -Title: Find AWS Cloud Control API Resource Data for AWS Lambda + - AWS Cloud Control API +Title: Find AWS Cloud Control API Resource Data for AWS Lambda \ No newline at end of file diff --git a/queries/aws_cloudcontrol_resource_2.yaml b/queries/aws_cloudcontrol_resource_2.yaml old mode 100755 new mode 100644 index c7bd0d1ea..99ce93dd4 --- a/queries/aws_cloudcontrol_resource_2.yaml +++ b/queries/aws_cloudcontrol_resource_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Cloud Control API Resource data, providing - detailed insights into resource properties, types, and statuses. +Description: Allows users to query AWS Cloud Control API Resource data, providing detailed insights into resource properties, types, and statuses. ID: aws_cloudcontrol_resource_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identifier,\n properties ->> 'AlpnPolicy' as alpn_policy,\n\ - \ properties ->> 'Certificates' as certificates,\n properties ->> 'Port' as\ - \ port,\n properties ->> 'Protocol' as protocol,\n region,\n account_id\nfrom\n\ - \ aws_cloudcontrol_resource\nwhere\n type_name = 'AWS::ElasticLoadBalancingV2::Listener'\n\ - \ and resource_model = '{\"LoadBalancerArn\": \"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/test-lb/4e695b8755d7003c\"\ - }'\n and region = 'us-east-1';" + QueryToExecute: | + SELECT + identifier, + properties ->> 'AlpnPolicy' AS alpn_policy, + properties ->> 'Certificates' AS certificates, + properties ->> 'Port' AS port, + properties ->> 'Protocol' AS protocol, + region, + account_id + FROM + aws_cloudcontrol_resource + WHERE + type_name = 'AWS::ElasticLoadBalancingV2::Listener' + AND resource_model = '{"LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/test-lb/4e695b8755d7003c"}' + AND region = 'us-east-1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Control -Title: Find AWS Cloud Control API Resource Data + - Cloud Control +Title: Find AWS Cloud Control API Resource Data \ No newline at end of file diff --git a/queries/aws_cloudcontrol_resource_3.yaml b/queries/aws_cloudcontrol_resource_3.yaml old mode 100755 new mode 100644 index 3b4ae3d80..2a72fe3ae --- a/queries/aws_cloudcontrol_resource_3.yaml +++ b/queries/aws_cloudcontrol_resource_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cloud Control API Resource data, providing - detailed insights into resource properties, types, and statuses. +Description: Allows users to query AWS Cloud Control API Resource data, providing detailed insights into resource properties, types, and statuses. ID: aws_cloudcontrol_resource_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identifier,\n properties ->> 'IncludeGlobalServiceEvents'\ - \ as include_global_service_events,\n properties ->> 'IsLogging' as is_logging,\n\ - \ properties ->> 'IsMultiRegionTrail' as is_multi_region_trail,\n region\nfrom\n\ - \ aws_cloudcontrol_resource\nwhere\n type_name = 'AWS::CloudTrail::Trail'\n\ - \ and identifier = 'my-trail';" + QueryToExecute: | + SELECT + identifier, + properties ->> 'IncludeGlobalServiceEvents' AS include_global_service_events, + properties ->> 'IsLogging' AS is_logging, + properties ->> 'IsMultiRegionTrail' AS is_multi_region_trail, + region + FROM + aws_cloudcontrol_resource + WHERE + type_name = 'AWS::CloudTrail::Trail' + AND identifier = 'my-trail'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Control API Resource -Title: Find AWS Cloud Control API Resource using SQL + - Cloud Control API Resource +Title: Find AWS Cloud Control API Resource using SQL \ No newline at end of file diff --git a/queries/aws_cloudcontrol_resource_4.yaml b/queries/aws_cloudcontrol_resource_4.yaml old mode 100755 new mode 100644 index a58a5c02a..a83e3028d --- a/queries/aws_cloudcontrol_resource_4.yaml +++ b/queries/aws_cloudcontrol_resource_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cloud Control API Resource data, providing - detailed insights into resource properties, types, and statuses. +Description: Allows users to query AWS Cloud Control API Resource data, providing detailed insights into resource properties, types, and statuses. ID: aws_cloudcontrol_resource_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n properties ->> 'RoleName' as name\nfrom\n aws_cloudcontrol_resource\n\ - where\n type_name = 'AWS::IAM::Role'\n and region = 'us-east-1'\norder by\n\ - \ name;" + QueryToExecute: | + SELECT + properties ->> 'RoleName' AS name + FROM + aws_cloudcontrol_resource + WHERE + type_name = 'AWS::IAM::Role' + AND region = 'us-east-1' + ORDER BY + name; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Control API -Title: List all AWS IAM Roles in us-east-1 using SQL + - Cloud Control API +Title: List all AWS IAM Roles in us-east-1 using SQL \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_1.yaml b/queries/aws_cloudformation_stack_1.yaml old mode 100755 new mode 100644 index ef240ddef..248e15887 --- a/queries/aws_cloudformation_stack_1.yaml +++ b/queries/aws_cloudformation_stack_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudFormation Stack data, including stack - name, status, creation time, and associated tags. +Description: Allows users to query AWS CloudFormation Stack data, including stack name, status, creation time, and associated tags. ID: aws_cloudformation_stack_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n status\nfrom\n aws_cloudformation_stack;" + QueryToExecute: | + SELECT + name, + id, + status + FROM + aws_cloudformation_stack; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation Stack -Title: List all AWS CloudFormation Stacks with Details + - CloudFormation Stack +Title: List all AWS CloudFormation Stacks with Details \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_2.yaml b/queries/aws_cloudformation_stack_2.yaml old mode 100755 new mode 100644 index 2b52674d7..603c7bcaa --- a/queries/aws_cloudformation_stack_2.yaml +++ b/queries/aws_cloudformation_stack_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CloudFormation Stack data, including stack - name, status, creation time, and associated tags. +Description: Allows users to query AWS CloudFormation Stack data, including stack name, status, creation time, and associated tags. ID: aws_cloudformation_stack_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n disable_rollback\nfrom\n aws_cloudformation_stack\n\ - where\n disable_rollback;" + QueryToExecute: | + SELECT + name, + disable_rollback + FROM + aws_cloudformation_stack + WHERE + disable_rollback; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List AWS CloudFormation Stack data and status + - CloudFormation +Title: List AWS CloudFormation Stack data and status \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_3.yaml b/queries/aws_cloudformation_stack_3.yaml old mode 100755 new mode 100644 index 15a5472eb..cb47fda37 --- a/queries/aws_cloudformation_stack_3.yaml +++ b/queries/aws_cloudformation_stack_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CloudFormation Stack data, including stack - name, status, creation time, and associated tags. +Description: Allows users to query AWS CloudFormation Stack data, including stack name, status, creation time, and associated tags. ID: aws_cloudformation_stack_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n enable_termination_protection\nfrom\n aws_cloudformation_stack\n\ - where\n not enable_termination_protection;" + QueryToExecute: | + SELECT + name, + enable_termination_protection + FROM + aws_cloudformation_stack + WHERE + NOT enable_termination_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List AWS CloudFormation Stack Data with SQL + - CloudFormation +Title: List AWS CloudFormation Stack Data with SQL \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_4.yaml b/queries/aws_cloudformation_stack_4.yaml old mode 100755 new mode 100644 index 286ae23b1..aca674015 --- a/queries/aws_cloudformation_stack_4.yaml +++ b/queries/aws_cloudformation_stack_4.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS CloudFormation Stack data, including stack - name, status, creation time, and associated tags. +Description: Allows users to query AWS CloudFormation Stack data, including stack name, status, creation time, and associated tags. ID: aws_cloudformation_stack_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rollback_configuration ->> 'MonitoringTimeInMinutes'\ - \ as monitoring_time_in_min,\n rollback_configuration ->> 'RollbackTriggers'\ - \ as rollback_triggers\nfrom\n aws_cloudformation_stack;" + QueryToExecute: | + SELECT + NAME, + ROLLBACK_CONFIGURATION ->> 'MonitoringTimeInMinutes' AS MONITORING_TIME_IN_MIN, + ROLLBACK_CONFIGURATION ->> 'RollbackTriggers' AS ROLLBACK_TRIGGERS + FROM + AWS_CLOUDFORMATION_STACK; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: Find AWS CloudFormation Stack Data, Status, and Tags + - CloudFormation +Title: Find AWS CloudFormation Stack Data, Status, and Tags \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_5.yaml b/queries/aws_cloudformation_stack_5.yaml old mode 100755 new mode 100644 index 2a5081ffd..538adcda3 --- a/queries/aws_cloudformation_stack_5.yaml +++ b/queries/aws_cloudformation_stack_5.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS CloudFormation Stack data, including stack - name, status, creation time, and associated tags. +Description: Allows users to query AWS CloudFormation Stack data, including stack name, status, creation time, and associated tags. ID: aws_cloudformation_stack_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_elements_text(notification_arns)\ - \ as resource_arns\nfrom\n aws_cloudformation_stack;" + QueryToExecute: | + SELECT + name, + JSONB_ARRAY_ELEMENTS_TEXT(notification_arns) AS resource_arns + FROM + aws_cloudformation_stack; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all AWS CloudFormation Stacks and Resource ARNs + - CloudFormation +Title: List all AWS CloudFormation Stacks and Resource ARNs \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_resource_1.yaml b/queries/aws_cloudformation_stack_resource_1.yaml old mode 100755 new mode 100644 index 2b7646482..4f288c384 --- a/queries/aws_cloudformation_stack_resource_1.yaml +++ b/queries/aws_cloudformation_stack_resource_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CloudFormation Stack Resources, providing details - about each resource within the stack, including its status, type, and associated - metadata. This table is useful for managing and analyzing AWS CloudFormation resources. +Description: Allows users to query AWS CloudFormation Stack Resources, providing details about each resource within the stack, including its status, type, and associated metadata. This table is useful for managing and analyzing AWS CloudFormation resources. ID: aws_cloudformation_stack_resource_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_name,\n stack_id,\n logical_resource_id,\n resource_type,\n\ - \ resource_status\nfrom\n aws_cloudformation_stack_resource;" + QueryToExecute: | + SELECT + stack_name, + stack_id, + logical_resource_id, + resource_type, + resource_status + FROM + aws_cloudformation_stack_resource; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: Find AWS CloudFormation Stack Resource Information + - CloudFormation +Title: Find AWS CloudFormation Stack Resource Information \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_resource_2.yaml b/queries/aws_cloudformation_stack_resource_2.yaml old mode 100755 new mode 100644 index 1f00878f1..b2fe220d8 --- a/queries/aws_cloudformation_stack_resource_2.yaml +++ b/queries/aws_cloudformation_stack_resource_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CloudFormation Stack Resources, providing details - about each resource within the stack, including its status, type, and associated - metadata. This table is useful for managing and analyzing AWS CloudFormation resources. +Description: Allows users to query AWS CloudFormation Stack Resources, providing details about each resource within the stack, including its status, type, and associated metadata. This table is useful for managing and analyzing AWS CloudFormation resources. ID: aws_cloudformation_stack_resource_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.name,\n s.disable_rollback,\n r.logical_resource_id,\n\ - \ r.resource_status\nfrom\n aws_cloudformation_stack_resource as r,\n aws_cloudformation_stack\ - \ as s\nwhere\n r.stack_id = s.id\n and s.disable_rollback;" + QueryToExecute: | + SELECT + s.name, + s.disable_rollback, + r.logical_resource_id, + r.resource_status + FROM + aws_cloudformation_stack_resource AS r, + aws_cloudformation_stack AS s + WHERE + r.stack_id = s.id + AND s.disable_rollback; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: Find AWS CloudFormation Stack Resource Details and Status + - CloudFormation +Title: Find AWS CloudFormation Stack Resource Details and Status \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_resource_3.yaml b/queries/aws_cloudformation_stack_resource_3.yaml old mode 100755 new mode 100644 index 4dbb46b84..5950a351a --- a/queries/aws_cloudformation_stack_resource_3.yaml +++ b/queries/aws_cloudformation_stack_resource_3.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS CloudFormation Stack Resources, providing details - about each resource within the stack, including its status, type, and associated - metadata. This table is useful for managing and analyzing AWS CloudFormation resources. +Description: Allows users to query AWS CloudFormation Stack Resources, providing details about each resource within the stack, including its status, type, and associated metadata. This table is useful for managing and analyzing AWS CloudFormation resources. ID: aws_cloudformation_stack_resource_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.name,\n s.enable_termination_protection,\n s.disable_rollback,\n\ - \ r.logical_resource_id,\n r.resource_status\nfrom\n aws_cloudformation_stack_resource\ - \ as r,\n aws_cloudformation_stack as s\nwhere\n r.stack_id = s.id\n and not\ - \ enable_termination_protection;" + QueryToExecute: | + SELECT + s.name, + s.enable_termination_protection, + s.disable_rollback, + r.logical_resource_id, + r.resource_status + FROM + aws_cloudformation_stack_resource AS r, + aws_cloudformation_stack AS s + WHERE + r.stack_id = s.id + AND NOT enable_termination_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all AWS CloudFormation Stack Resources with Details + - CloudFormation +Title: List all AWS CloudFormation Stack Resources with Details \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_resource_4.yaml b/queries/aws_cloudformation_stack_resource_4.yaml old mode 100755 new mode 100644 index 2a7f795ca..279a8d620 --- a/queries/aws_cloudformation_stack_resource_4.yaml +++ b/queries/aws_cloudformation_stack_resource_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CloudFormation Stack Resources, providing details - about each resource within the stack, including its status, type, and associated - metadata. This table is useful for managing and analyzing AWS CloudFormation resources. +Description: Allows users to query AWS CloudFormation Stack Resources, providing details about each resource within the stack, including its status, type, and associated metadata. This table is useful for managing and analyzing AWS CloudFormation resources. ID: aws_cloudformation_stack_resource_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_name,\n stack_id,\n logical_resource_id,\n resource_status,\n\ - \ resource_type\nfrom\n aws_cloudformation_stack_resource\nwhere\n resource_type\ - \ = 'AWS::EC2::VPC';" + QueryToExecute: | + SELECT + stack_name, + stack_id, + logical_resource_id, + resource_status, + resource_type + FROM + aws_cloudformation_stack_resource + WHERE + resource_type = 'AWS::EC2::VPC'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: Find AWS CloudFormation Stack Resource Details + - CloudFormation +Title: Find AWS CloudFormation Stack Resource Details \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_resource_5.yaml b/queries/aws_cloudformation_stack_resource_5.yaml old mode 100755 new mode 100644 index b06b6b10e..426f14f4c --- a/queries/aws_cloudformation_stack_resource_5.yaml +++ b/queries/aws_cloudformation_stack_resource_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CloudFormation Stack Resources, providing details - about each resource within the stack, including its status, type, and associated - metadata. This table is useful for managing and analyzing AWS CloudFormation resources. +Description: Allows users to query AWS CloudFormation Stack Resources, providing details about each resource within the stack, including its status, type, and associated metadata. This table is useful for managing and analyzing AWS CloudFormation resources. ID: aws_cloudformation_stack_resource_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_name,\n logical_resource_id,\n resource_status,\n\ - \ resource_type\nfrom\n aws_cloudformation_stack_resource\nwhere\n resource_status\ - \ = 'UPDATE_FAILED';" + QueryToExecute: | + SELECT + stack_name, + logical_resource_id, + resource_status, + resource_type + FROM + aws_cloudformation_stack_resource + WHERE + resource_status = 'UPDATE_FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: "List all AWS CloudFormation Stack Resources\u2019 Details" + - CloudFormation +Title: List all AWS CloudFormation Stack Resources’ Details \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_set_1.yaml b/queries/aws_cloudformation_stack_set_1.yaml old mode 100755 new mode 100644 index a07622c35..16d72eb56 --- a/queries/aws_cloudformation_stack_set_1.yaml +++ b/queries/aws_cloudformation_stack_set_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudFormation StackSets, providing detailed - information about each StackSet''s configuration, status, and associated AWS resources. +Description: Allows users to query AWS CloudFormation StackSets, providing detailed information about each StackSet's configuration, status, and associated AWS resources. ID: aws_cloudformation_stack_set_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_set_id,\n stack_set_name,\n status,\n arn,\n\ - \ description\nfrom\n aws_cloudformation_stack_set;" + QueryToExecute: | + SELECT + stack_set_id, + stack_set_name, + status, + arn, + description + FROM + aws_cloudformation_stack_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all AWS CloudFormation StackSets configurations + - CloudFormation +Title: List all AWS CloudFormation StackSets configurations \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_set_2.yaml b/queries/aws_cloudformation_stack_set_2.yaml old mode 100755 new mode 100644 index 6dadd068f..bedf112d5 --- a/queries/aws_cloudformation_stack_set_2.yaml +++ b/queries/aws_cloudformation_stack_set_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CloudFormation StackSets, providing detailed - information about each StackSet''s configuration, status, and associated AWS resources. +Description: Allows users to query AWS CloudFormation StackSets, providing detailed information about each StackSet's configuration, status, and associated AWS resources. ID: aws_cloudformation_stack_set_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_set_id,\n stack_set_name,\n status,\n permission_model,\n\ - \ auto_deployment\nfrom\n aws_cloudformation_stack_set\nwhere\n status = 'ACTIVE';" + QueryToExecute: | + SELECT + stack_set_id, + stack_set_name, + status, + permission_model, + auto_deployment + FROM + aws_cloudformation_stack_set + WHERE + status = 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all AWS CloudFormation StackSets and Associated Resources + - CloudFormation +Title: List all AWS CloudFormation StackSets and Associated Resources \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_set_3.yaml b/queries/aws_cloudformation_stack_set_3.yaml old mode 100755 new mode 100644 index 1b0fdb9da..cbec34a17 --- a/queries/aws_cloudformation_stack_set_3.yaml +++ b/queries/aws_cloudformation_stack_set_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS CloudFormation StackSets, providing detailed - information about each StackSet''s configuration, status, and associated AWS resources. +Description: Allows users to query AWS CloudFormation StackSets, providing detailed information about each StackSet's configuration, status, and associated AWS resources. ID: aws_cloudformation_stack_set_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_set_name,\n stack_set_id,\n p ->> 'ParameterKey'\ - \ as parameter_key,\n p ->> 'ParameterValue' as parameter_value,\n p ->> 'ResolvedValue'\ - \ as resolved_value,\n p ->> 'UsePreviousValue' as use_previous_value\nfrom\n\ - \ aws_cloudformation_stack_set,\n jsonb_array_elements(parameters) as p;" + QueryToExecute: | + SELECT + stack_set_name, + stack_set_id, + p ->> 'ParameterKey' AS parameter_key, + p ->> 'ParameterValue' AS parameter_value, + p ->> 'ResolvedValue' AS resolved_value, + p ->> 'UsePreviousValue' AS use_previous_value + FROM + aws_cloudformation_stack_set, + jsonb_array_elements(parameters) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all AWS CloudFormation StackSets with Parameters + - CloudFormation +Title: List all AWS CloudFormation StackSets with Parameters \ No newline at end of file diff --git a/queries/aws_cloudformation_stack_set_4.yaml b/queries/aws_cloudformation_stack_set_4.yaml old mode 100755 new mode 100644 index 4aeffcbe1..19dd1e5cf --- a/queries/aws_cloudformation_stack_set_4.yaml +++ b/queries/aws_cloudformation_stack_set_4.yaml @@ -1,28 +1,31 @@ -Description: Allows users to query AWS CloudFormation StackSets, providing detailed - information about each StackSet''s configuration, status, and associated AWS resources. +Description: Allows users to query AWS CloudFormation StackSets, providing detailed information about each StackSet's configuration, status, and associated AWS resources. ID: aws_cloudformation_stack_set_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stack_set_name,\n stack_set_id,\n stack_set_drift_detection_details\ - \ ->> 'DriftDetectionStatus' as drift_detection_status,\n stack_set_drift_detection_details\ - \ ->> 'DriftStatus' as drift_status,\n stack_set_drift_detection_details ->>\ - \ 'DriftedStackInstancesCount' as drifted_stack_instances_count,\n stack_set_drift_detection_details\ - \ ->> 'FailedStackInstancesCount' as failed_stack_instances_count,\n stack_set_drift_detection_details\ - \ ->> 'InProgressStackInstancesCount' as in_progress_stack_instances_count,\n\ - \ stack_set_drift_detection_details ->> 'InSyncStackInstancesCount' as in_sync_stack_instances_count,\n\ - \ stack_set_drift_detection_details ->> 'LastDriftCheckTimestamp' as last_drift_check_timestamp,\n\ - \ stack_set_drift_detection_details ->> 'TotalStackInstancesCount' as total_stack_instances_count\n\ - from\n aws_cloudformation_stack_set;" + QueryToExecute: | + SELECT + stack_set_name, + stack_set_id, + stack_set_drift_detection_details ->> 'DriftDetectionStatus' AS drift_detection_status, + stack_set_drift_detection_details ->> 'DriftStatus' AS drift_status, + stack_set_drift_detection_details ->> 'DriftedStackInstancesCount' AS drifted_stack_instances_count, + stack_set_drift_detection_details ->> 'FailedStackInstancesCount' AS failed_stack_instances_count, + stack_set_drift_detection_details ->> 'InProgressStackInstancesCount' AS in_progress_stack_instances_count, + stack_set_drift_detection_details ->> 'InSyncStackInstancesCount' AS in_sync_stack_instances_count, + stack_set_drift_detection_details ->> 'LastDriftCheckTimestamp' AS last_drift_check_timestamp, + stack_set_drift_detection_details ->> 'TotalStackInstancesCount' AS total_stack_instances_count + FROM + aws_cloudformation_stack_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFormation -Title: List all detailed AWS CloudFormation StackSets status + - CloudFormation +Title: List all detailed AWS CloudFormation StackSets status \ No newline at end of file diff --git a/queries/aws_cloudfront_cache_policy_1.yaml b/queries/aws_cloudfront_cache_policy_1.yaml old mode 100755 new mode 100644 index e89cb3cb4..ebc719539 --- a/queries/aws_cloudfront_cache_policy_1.yaml +++ b/queries/aws_cloudfront_cache_policy_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CloudFront Cache Policies for details about - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Cache Policies for details about their configuration, status, and associated metadata. ID: aws_cloudfront_cache_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n comment,\n min_ttl,\n etag,\n last_modified_time\n\ - from\n aws_cloudfront_cache_policy;" + QueryToExecute: | + SELECT + id, + name, + comment, + min_ttl, + etag, + last_modified_time + FROM + aws_cloudfront_cache_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List AWS CloudFront Cache Policies Details + - CloudFront +Title: List AWS CloudFront Cache Policies Details \ No newline at end of file diff --git a/queries/aws_cloudfront_cache_policy_2.yaml b/queries/aws_cloudfront_cache_policy_2.yaml old mode 100755 new mode 100644 index c2dfbbac4..f5e91b4ab --- a/queries/aws_cloudfront_cache_policy_2.yaml +++ b/queries/aws_cloudfront_cache_policy_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS CloudFront Cache Policies for details about - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Cache Policies for details about their configuration, status, and associated metadata. ID: aws_cloudfront_cache_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n parameters_in_cache_key_and_forwarded_to_origin\ - \ ->> 'EnableAcceptEncodingGzip' as enable_gzip\nfrom\n aws_cloudfront_cache_policy\n\ - where\n parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingGzip'\ - \ <> 'true';" + QueryToExecute: | + SELECT + id, + name, + parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingGzip' AS enable_gzip + FROM + aws_cloudfront_cache_policy + WHERE + parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingGzip' <> 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find AWS CloudFront Cache Policies and Details + - CloudFront +Title: Find AWS CloudFront Cache Policies and Details \ No newline at end of file diff --git a/queries/aws_cloudfront_cache_policy_3.yaml b/queries/aws_cloudfront_cache_policy_3.yaml old mode 100755 new mode 100644 index 8acead3fe..b2450f333 --- a/queries/aws_cloudfront_cache_policy_3.yaml +++ b/queries/aws_cloudfront_cache_policy_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS CloudFront Cache Policies for details about - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Cache Policies for details about their configuration, status, and associated metadata. ID: aws_cloudfront_cache_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n parameters_in_cache_key_and_forwarded_to_origin\ - \ ->> 'EnableAcceptEncodingBrotli' as enable_brotli\nfrom\n aws_cloudfront_cache_policy\n\ - where\n parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingBrotli'\ - \ <> 'true';" + QueryToExecute: | + SELECT + id, + name, + parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingBrotli' AS enable_brotli + FROM + aws_cloudfront_cache_policy + WHERE + parameters_in_cache_key_and_forwarded_to_origin ->> 'EnableAcceptEncodingBrotli' <> 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List AWS CloudFront Cache Policies and Their States + - CloudFront +Title: List AWS CloudFront Cache Policies and Their States \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_1.yaml b/queries/aws_cloudfront_distribution_1.yaml old mode 100755 new mode 100644 index 48b7bb6ab..d454669dd --- a/queries/aws_cloudfront_distribution_1.yaml +++ b/queries/aws_cloudfront_distribution_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n status,\n domain_name,\n enabled,\n\ - \ e_tag,\n http_version,\n is_ipv6_enabled\nfrom\n aws_cloudfront_distribution;" + QueryToExecute: | + SELECT + id, + arn, + status, + domain_name, + enabled, + e_tag, + http_version, + is_ipv6_enabled + FROM + aws_cloudfront_distribution; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Distributions and Metadata + - CloudFront +Title: List all AWS CloudFront Distributions and Metadata \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_2.yaml b/queries/aws_cloudfront_distribution_2.yaml old mode 100755 new mode 100644 index 0125f7c22..12f864e95 --- a/queries/aws_cloudfront_distribution_2.yaml +++ b/queries/aws_cloudfront_distribution_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n logging ->> 'Bucket' as bucket,\n logging ->>\ - \ 'Enabled' as logging_enabled,\n logging ->> 'IncludeCookies' as include_cookies\n\ - from\n aws_cloudfront_distribution\nwhere\n logging ->> 'Enabled' = 'false';" + QueryToExecute: | + SELECT + id, + logging ->> 'Bucket' AS bucket, + logging ->> 'Enabled' AS logging_enabled, + logging ->> 'IncludeCookies' AS include_cookies + FROM + aws_cloudfront_distribution + WHERE + logging ->> 'Enabled' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find Disabled AWS CloudFront Distribution Logging + - CloudFront +Title: Find Disabled AWS CloudFront Distribution Logging \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_3.yaml b/queries/aws_cloudfront_distribution_3.yaml old mode 100755 new mode 100644 index 3e5028a0d..bf0feee99 --- a/queries/aws_cloudfront_distribution_3.yaml +++ b/queries/aws_cloudfront_distribution_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n status,\n is_ipv6_enabled\nfrom\n aws_cloudfront_distribution\n\ - where\n is_ipv6_enabled = 'false';" + QueryToExecute: | + SELECT + id, + arn, + status, + is_ipv6_enabled + FROM + aws_cloudfront_distribution + WHERE + is_ipv6_enabled = 'false'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Distributions and Their Configurations + - CloudFront +Title: List all AWS CloudFront Distributions and Their Configurations \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_4.yaml b/queries/aws_cloudfront_distribution_4.yaml old mode 100755 new mode 100644 index ea9197c19..c41c079f4 --- a/queries/aws_cloudfront_distribution_4.yaml +++ b/queries/aws_cloudfront_distribution_4.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n default_cache_behavior ->> 'FieldLevelEncryptionId'\ - \ as field_level_encryption_id,\n default_cache_behavior ->> 'DefaultTTL' as\ - \ default_ttl\nfrom\n aws_cloudfront_distribution\nwhere\n default_cache_behavior\ - \ ->> 'FieldLevelEncryptionId' <> '';" + QueryToExecute: | + SELECT + id, + arn, + default_cache_behavior ->> 'FieldLevelEncryptionId' AS field_level_encryption_id, + default_cache_behavior ->> 'DefaultTTL' AS default_ttl + FROM + aws_cloudfront_distribution + WHERE + default_cache_behavior ->> 'FieldLevelEncryptionId' <> ''; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find details of AWS CloudFront Distributions with SQL + - CloudFront +Title: Find details of AWS CloudFront Distributions with SQL \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_5.yaml b/queries/aws_cloudfront_distribution_5.yaml old mode 100755 new mode 100644 index a06120770..ac9b79649 --- a/queries/aws_cloudfront_distribution_5.yaml +++ b/queries/aws_cloudfront_distribution_5.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n p -> 'CustomOriginConfig' -> 'HTTPPort'\ - \ as http_port,\n p -> 'CustomOriginConfig' -> 'HTTPSPort' as https_port,\n \ - \ p -> 'CustomOriginConfig' -> 'OriginKeepaliveTimeout' as origin_keepalive_timeout,\n\ - \ p -> 'CustomOriginConfig' -> 'OriginProtocolPolicy' as origin_protocol_policy\n\ - from\n aws_cloudfront_distribution,\n jsonb_array_elements(origins) as p\nwhere\n\ - \ p -> 'CustomOriginConfig' ->> 'OriginProtocolPolicy' = 'https-only';" + QueryToExecute: | + SELECT + id, + arn, + p -> 'CustomOriginConfig' -> 'HTTPPort' AS http_port, + p -> 'CustomOriginConfig' -> 'HTTPSPort' AS https_port, + p -> 'CustomOriginConfig' -> 'OriginKeepaliveTimeout' AS origin_keepalive_timeout, + p -> 'CustomOriginConfig' -> 'OriginProtocolPolicy' AS origin_protocol_policy + FROM + aws_cloudfront_distribution, + jsonb_array_elements(origins) AS p + WHERE + p -> 'CustomOriginConfig' ->> 'OriginProtocolPolicy' = 'https-only'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Query AWS CloudFront Distributions and Insights + - CloudFront +Title: Query AWS CloudFront Distributions and Insights \ No newline at end of file diff --git a/queries/aws_cloudfront_distribution_6.yaml b/queries/aws_cloudfront_distribution_6.yaml old mode 100755 new mode 100644 index 5da185741..2da6682fb --- a/queries/aws_cloudfront_distribution_6.yaml +++ b/queries/aws_cloudfront_distribution_6.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS CloudFront Distributions to gain insights into - their configuration, status, and associated metadata. +Description: Allows users to query AWS CloudFront Distributions to gain insights into their configuration, status, and associated metadata. ID: aws_cloudfront_distribution_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n p -> 'CustomOriginConfig' -> 'OriginSslProtocols'\ - \ -> 'Items' as items,\n p -> 'CustomOriginConfig' -> 'OriginSslProtocols' ->\ - \ 'Quantity' as quantity\nfrom\n aws_cloudfront_distribution,\n jsonb_array_elements(origins)\ - \ as p\nwhere\n p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items'\ - \ ?& array['SSLv3'];" + QueryToExecute: | + SELECT + id, + arn, + p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items' AS items, + p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Quantity' AS quantity + FROM + aws_cloudfront_distribution, + jsonb_array_elements(origins) AS p + WHERE + p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items' ?& ARRAY['SSLv3']; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find AWS CloudFront Distributions Configuration & Status + - CloudFront +Title: Find AWS CloudFront Distributions Configuration & Status \ No newline at end of file diff --git a/queries/aws_cloudfront_function_1.yaml b/queries/aws_cloudfront_function_1.yaml old mode 100755 new mode 100644 index bf154a421..b353b2b6c --- a/queries/aws_cloudfront_function_1.yaml +++ b/queries/aws_cloudfront_function_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudFront Functions to retrieve detailed information - about each function, including its ARN, stage, status, and more. +Description: Allows users to query AWS CloudFront Functions to retrieve detailed information about each function, including its ARN, stage, status, and more. ID: aws_cloudfront_function_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n status,\n arn,\n e_tag,\n function_config\n\ - from\n aws_cloudfront_function;" + QueryToExecute: | + SELECT + name, + status, + arn, + e_tag, + function_config + FROM + aws_cloudfront_function; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Functions with details + - CloudFront +Title: List all AWS CloudFront Functions with details \ No newline at end of file diff --git a/queries/aws_cloudfront_function_2.yaml b/queries/aws_cloudfront_function_2.yaml old mode 100755 new mode 100644 index fd9e9134a..fccb27c6c --- a/queries/aws_cloudfront_function_2.yaml +++ b/queries/aws_cloudfront_function_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS CloudFront Functions to retrieve detailed information - about each function, including its ARN, stage, status, and more. +Description: Allows users to query AWS CloudFront Functions to retrieve detailed information about each function, including its ARN, stage, status, and more. ID: aws_cloudfront_function_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n function_config ->> 'Comment' as comment,\n\ - \ arn,\n status,\n e_tag\nfrom\n aws_cloudfront_function\nwhere\n function_metadata\ - \ ->> 'Stage' = 'LIVE';" + QueryToExecute: | + SELECT + name, + function_config ->> 'Comment' AS comment, + arn, + status, + e_tag + FROM + aws_cloudfront_function + WHERE + function_metadata ->> 'Stage' = 'LIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List All AWS CloudFront Functions with Detailed Info + - CloudFront +Title: List All AWS CloudFront Functions with Detailed Info \ No newline at end of file diff --git a/queries/aws_cloudfront_function_3.yaml b/queries/aws_cloudfront_function_3.yaml old mode 100755 new mode 100644 index add2f0d28..e3ad18031 --- a/queries/aws_cloudfront_function_3.yaml +++ b/queries/aws_cloudfront_function_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CloudFront Functions to retrieve detailed information - about each function, including its ARN, stage, status, and more. +Description: Allows users to query AWS CloudFront Functions to retrieve detailed information about each function, including its ARN, stage, status, and more. ID: aws_cloudfront_function_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n function_metadata ->> 'Stage' as stage,\n\ - \ status,\n function_metadata ->> 'CreatedTime' as created_time,\n function_metadata\ - \ ->> 'LastModifiedTime' as last_modified_time\n from\n aws_cloudfront_function\n\ - order by\n function_metadata ->> 'CreatedTime' DESC;" + QueryToExecute: | + SELECT + name, + arn, + function_metadata ->> 'Stage' AS stage, + status, + function_metadata ->> 'CreatedTime' AS created_time, + function_metadata ->> 'LastModifiedTime' AS last_modified_time + FROM + aws_cloudfront_function + ORDER BY + function_metadata ->> 'CreatedTime' DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List AWS CloudFront Functions by ARN, Stage, and Status + - CloudFront +Title: List AWS CloudFront Functions by ARN, Stage, and Status \ No newline at end of file diff --git a/queries/aws_cloudfront_function_4.yaml b/queries/aws_cloudfront_function_4.yaml old mode 100755 new mode 100644 index cd045c1fe..f87f9d60c --- a/queries/aws_cloudfront_function_4.yaml +++ b/queries/aws_cloudfront_function_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS CloudFront Functions to retrieve detailed information - about each function, including its ARN, stage, status, and more. +Description: Allows users to query AWS CloudFront Functions to retrieve detailed information about each function, including its ARN, stage, status, and more. ID: aws_cloudfront_function_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n function_metadata ->> 'Stage' as stage,\n\ - \ status,\n function_metadata ->> 'LastModifiedTime' as last_modified_time\n\ - from\n aws_cloudfront_function\nwhere\n (function_metadata ->> 'LastModifiedTime')::timestamp\ - \ >= (now() - interval '1' hour)\norder by\n function_metadata ->> 'LastModifiedTime'\ - \ DESC;" + QueryToExecute: | + SELECT + name, + arn, + function_metadata ->> 'Stage' AS stage, + status, + function_metadata ->> 'LastModifiedTime' AS last_modified_time + FROM + aws_cloudfront_function + WHERE + (function_metadata ->> 'LastModifiedTime')::timestamp >= (NOW() - INTERVAL '1' HOUR) + ORDER BY + function_metadata ->> 'LastModifiedTime' DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List of AWS CloudFront Functions with Detailed Information + - CloudFront +Title: List of AWS CloudFront Functions with Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudfront_origin_access_identity_1.yaml b/queries/aws_cloudfront_origin_access_identity_1.yaml old mode 100755 new mode 100644 index 3dc667f57..04464f190 --- a/queries/aws_cloudfront_origin_access_identity_1.yaml +++ b/queries/aws_cloudfront_origin_access_identity_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CloudFront Origin Access Identity to fetch - detailed information about each identity, including its ID, S3 canonical user ID, - caller reference, and associated comment. +Description: Allows users to query AWS CloudFront Origin Access Identity to fetch detailed information about each identity, including its ID, S3 canonical user ID, caller reference, and associated comment. ID: aws_cloudfront_origin_access_identity_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n comment,\n s3_canonical_user_id,\n etag\n\ - from\n aws_cloudfront_origin_access_identity;" + QueryToExecute: | + SELECT + id, + arn, + comment, + s3_canonical_user_id, + etag + FROM + aws_cloudfront_origin_access_identity; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find AWS CloudFront Origin Access Identities and Details + - CloudFront +Title: Find AWS CloudFront Origin Access Identities and Details \ No newline at end of file diff --git a/queries/aws_cloudfront_origin_access_identity_2.yaml b/queries/aws_cloudfront_origin_access_identity_2.yaml old mode 100755 new mode 100644 index 2cc351d9d..cfb2b7da7 --- a/queries/aws_cloudfront_origin_access_identity_2.yaml +++ b/queries/aws_cloudfront_origin_access_identity_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS CloudFront Origin Access Identity to fetch - detailed information about each identity, including its ID, S3 canonical user ID, - caller reference, and associated comment. +Description: Allows users to query AWS CloudFront Origin Access Identity to fetch detailed information about each identity, including its ID, S3 canonical user ID, caller reference, and associated comment. ID: aws_cloudfront_origin_access_identity_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n comment,\n caller_reference\nfrom\n \ - \ aws_cloudfront_origin_access_identity\nwhere\n comment <> '';" + QueryToExecute: | + SELECT + id, + arn, + comment, + caller_reference + FROM + aws_cloudfront_origin_access_identity + WHERE + comment <> ''; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find all AWS CloudFront Origin Access Identity details + - CloudFront +Title: Find all AWS CloudFront Origin Access Identity details \ No newline at end of file diff --git a/queries/aws_cloudfront_origin_request_policy_1.yaml b/queries/aws_cloudfront_origin_request_policy_1.yaml old mode 100755 new mode 100644 index 21207c4ba..0529cb4a2 --- a/queries/aws_cloudfront_origin_request_policy_1.yaml +++ b/queries/aws_cloudfront_origin_request_policy_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudFront Origin Request Policies, providing - details about each policy such as ID, name, comment, cookies configuration, headers - configuration, query strings configuration, and more. +Description: Allows users to query AWS CloudFront Origin Request Policies, providing details about each policy such as ID, name, comment, cookies configuration, headers configuration, query strings configuration, and more. ID: aws_cloudfront_origin_request_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n comment,\n etag,\n last_modified_time\n\ - from\n aws_cloudfront_origin_request_policy;" + QueryToExecute: | + SELECT + name, + id, + comment, + etag, + last_modified_time + FROM + aws_cloudfront_origin_request_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Origin Request Policies + - CloudFront +Title: List all AWS CloudFront Origin Request Policies \ No newline at end of file diff --git a/queries/aws_cloudfront_origin_request_policy_2.yaml b/queries/aws_cloudfront_origin_request_policy_2.yaml old mode 100755 new mode 100644 index 431c04f4f..b7dcdacd6 --- a/queries/aws_cloudfront_origin_request_policy_2.yaml +++ b/queries/aws_cloudfront_origin_request_policy_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS CloudFront Origin Request Policies, providing - details about each policy such as ID, name, comment, cookies configuration, headers - configuration, query strings configuration, and more. +Description: Allows users to query AWS CloudFront Origin Request Policies, providing details about each policy such as ID, name, comment, cookies configuration, headers configuration, query strings configuration, and more. ID: aws_cloudfront_origin_request_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n headers_config ->> 'HeaderBehavior' as\ - \ header_behavior,\n headers_config ->> 'Headers' as headers\nfrom\n aws_cloudfront_origin_request_policy;" + QueryToExecute: | + SELECT + name, + id, + headers_config ->> 'HeaderBehavior' AS header_behavior, + headers_config ->> 'Headers' AS headers + FROM + aws_cloudfront_origin_request_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Origin Request Policies + - CloudFront +Title: List all AWS CloudFront Origin Request Policies \ No newline at end of file diff --git a/queries/aws_cloudfront_response_headers_policy_1.yaml b/queries/aws_cloudfront_response_headers_policy_1.yaml old mode 100755 new mode 100644 index 60196efc0..3d7f735ba --- a/queries/aws_cloudfront_response_headers_policy_1.yaml +++ b/queries/aws_cloudfront_response_headers_policy_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudFront Response Headers Policies, providing - information about the policy configurations that determine the headers CloudFront - includes in HTTP responses. +Description: Allows users to query AWS CloudFront Response Headers Policies, providing information about the policy configurations that determine the headers CloudFront includes in HTTP responses. ID: aws_cloudfront_response_headers_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n response_headers_policy_config ->> 'Comment'\ - \ as description,\n type,\n last_modified_time\nfrom\n aws_cloudfront_response_headers_policy;" + QueryToExecute: | + SELECT + name, + id, + response_headers_policy_config ->> 'Comment' AS description, + type, + last_modified_time + FROM + aws_cloudfront_response_headers_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: List all AWS CloudFront Response Headers Policies + - CloudFront +Title: List all AWS CloudFront Response Headers Policies \ No newline at end of file diff --git a/queries/aws_cloudfront_response_headers_policy_2.yaml b/queries/aws_cloudfront_response_headers_policy_2.yaml old mode 100755 new mode 100644 index a48d15f5b..7ac5d774c --- a/queries/aws_cloudfront_response_headers_policy_2.yaml +++ b/queries/aws_cloudfront_response_headers_policy_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CloudFront Response Headers Policies, providing - information about the policy configurations that determine the headers CloudFront - includes in HTTP responses. +Description: Allows users to query AWS CloudFront Response Headers Policies, providing information about the policy configurations that determine the headers CloudFront includes in HTTP responses. ID: aws_cloudfront_response_headers_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n response_headers_policy_config ->> 'Comment'\ - \ as description,\n type,\n last_modified_time\nfrom\n aws_cloudfront_response_headers_policy\n\ - where\n type = 'custom';" + QueryToExecute: | + SELECT + name, + id, + response_headers_policy_config ->> 'Comment' AS description, + type, + last_modified_time + FROM + aws_cloudfront_response_headers_policy + WHERE + type = 'custom'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find AWS CloudFront Response Headers Policies + - CloudFront +Title: Find AWS CloudFront Response Headers Policies \ No newline at end of file diff --git a/queries/aws_cloudfront_response_headers_policy_3.yaml b/queries/aws_cloudfront_response_headers_policy_3.yaml old mode 100755 new mode 100644 index bdfd1e48a..7b98f21bd --- a/queries/aws_cloudfront_response_headers_policy_3.yaml +++ b/queries/aws_cloudfront_response_headers_policy_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CloudFront Response Headers Policies, providing - information about the policy configurations that determine the headers CloudFront - includes in HTTP responses. +Description: Allows users to query AWS CloudFront Response Headers Policies, providing information about the policy configurations that determine the headers CloudFront includes in HTTP responses. ID: aws_cloudfront_response_headers_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n last_modified_time\nfrom\n aws_cloudfront_response_headers_policy\n\ - where\n last_modified_time >= (now() - interval '1' hour)\norder by\n last_modified_time\ - \ DESC;" + QueryToExecute: | + SELECT + name, + id, + last_modified_time + FROM + aws_cloudfront_response_headers_policy + WHERE + last_modified_time >= (NOW() - INTERVAL '1' HOUR) + ORDER BY + last_modified_time DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudFront -Title: Find AWS CloudFront Response Headers Policies Info + - CloudFront +Title: Find AWS CloudFront Response Headers Policies Info \ No newline at end of file diff --git a/queries/aws_cloudsearch_domain_1.yaml b/queries/aws_cloudsearch_domain_1.yaml old mode 100755 new mode 100644 index b63cfce55..83dc245ad --- a/queries/aws_cloudsearch_domain_1.yaml +++ b/queries/aws_cloudsearch_domain_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information - about each search domain configured within an AWS account. +Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information about each search domain configured within an AWS account. ID: aws_cloudsearch_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n arn,\n created,\n search_instance_type,\n\ - \ search_instance_count\nfrom\n aws_cloudsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + arn, + created, + search_instance_type, + search_instance_count + FROM + aws_cloudsearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudSearch -Title: List all AWS CloudSearch Domain Details + - CloudSearch +Title: List all AWS CloudSearch Domain Details \ No newline at end of file diff --git a/queries/aws_cloudsearch_domain_2.yaml b/queries/aws_cloudsearch_domain_2.yaml old mode 100755 new mode 100644 index a389975c1..ee188c514 --- a/queries/aws_cloudsearch_domain_2.yaml +++ b/queries/aws_cloudsearch_domain_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information - about each search domain configured within an AWS account. +Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information about each search domain configured within an AWS account. ID: aws_cloudsearch_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n arn,\n created,\n search_instance_type\n\ - from\n aws_cloudsearch_domain\nwhere\n search_instance_type = 'search.small';" + QueryToExecute: | + SELECT + domain_name, + domain_id, + arn, + created, + search_instance_type + FROM + aws_cloudsearch_domain + WHERE + search_instance_type = 'search.small'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudSearch -Title: List AWS CloudSearch Domains and Their Details + - CloudSearch +Title: List AWS CloudSearch Domains and Their Details \ No newline at end of file diff --git a/queries/aws_cloudsearch_domain_3.yaml b/queries/aws_cloudsearch_domain_3.yaml old mode 100755 new mode 100644 index 1caefbdd1..0f132adde --- a/queries/aws_cloudsearch_domain_3.yaml +++ b/queries/aws_cloudsearch_domain_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information - about each search domain configured within an AWS account. +Description: Allows users to query AWS CloudSearch Domain to retrieve detailed information about each search domain configured within an AWS account. ID: aws_cloudsearch_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n search_service ->> 'Endpoint'\ - \ as search_service_endpoint,\n limits ->> 'MaximumPartitionCount' as maximum_partition_count,\n\ - \ limits ->> 'MaximumReplicationCount' as maximum_replication_count\nfrom\n \ - \ aws_cloudsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + search_service ->> 'Endpoint' AS search_service_endpoint, + limits ->> 'MaximumPartitionCount' AS maximum_partition_count, + limits ->> 'MaximumReplicationCount' AS maximum_replication_count + FROM + aws_cloudsearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudSearch -Title: List All AWS CloudSearch Domains with Detailed Info + - CloudSearch +Title: List All AWS CloudSearch Domains with Detailed Info \ No newline at end of file diff --git a/queries/aws_cloudtrail_channel_1.yaml b/queries/aws_cloudtrail_channel_1.yaml old mode 100755 new mode 100644 index 093586d11..0ca9b0415 --- a/queries/aws_cloudtrail_channel_1.yaml +++ b/queries/aws_cloudtrail_channel_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, status, and associated metadata. ID: aws_cloudtrail_channel_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n source,\n apply_to_all_regions\nfrom\n\ - \ aws_cloudtrail_channel;" + QueryToExecute: | + SELECT + name, + arn, + source, + apply_to_all_regions + FROM + aws_cloudtrail_channel; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Channel Configurations with SQL + - CloudTrail +Title: Find AWS CloudTrail Channel Configurations with SQL \ No newline at end of file diff --git a/queries/aws_cloudtrail_channel_2.yaml b/queries/aws_cloudtrail_channel_2.yaml old mode 100755 new mode 100644 index d1e79b69b..d21e31a75 --- a/queries/aws_cloudtrail_channel_2.yaml +++ b/queries/aws_cloudtrail_channel_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, status, and associated metadata. ID: aws_cloudtrail_channel_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n source,\n apply_to_all_regions,\n \ - \ advanced_event_selectors\nfrom\n aws_cloudtrail_channel\nwhere\n not apply_to_all_regions;" + QueryToExecute: | + SELECT + name, + arn, + source, + apply_to_all_regions, + advanced_event_selectors + FROM + aws_cloudtrail_channel + WHERE + NOT apply_to_all_regions; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Channel data and configurations + - CloudTrail +Title: List all AWS CloudTrail Channel data and configurations \ No newline at end of file diff --git a/queries/aws_cloudtrail_channel_3.yaml b/queries/aws_cloudtrail_channel_3.yaml old mode 100755 new mode 100644 index 7f9725811..173347bb2 --- a/queries/aws_cloudtrail_channel_3.yaml +++ b/queries/aws_cloudtrail_channel_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Channel data, including trail configurations, status, and associated metadata. ID: aws_cloudtrail_channel_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n a ->> 'Name' as advanced_event_selector_name,\n\ - \ a ->> 'FieldSelectors' as field_selectors\nfrom\n aws_cloudtrail_channel,\n\ - \ jsonb_array_elements(advanced_event_selectors) as a;" + QueryToExecute: | + SELECT + name, + a ->> 'Name' AS advanced_event_selector_name, + a ->> 'FieldSelectors' AS field_selectors + FROM + aws_cloudtrail_channel, + jsonb_array_elements(advanced_event_selectors) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Channel Data and Metadata + - CloudTrail +Title: List all AWS CloudTrail Channel Data and Metadata \ No newline at end of file diff --git a/queries/aws_cloudtrail_event_data_store_1.yaml b/queries/aws_cloudtrail_event_data_store_1.yaml old mode 100755 new mode 100644 index 6e0eddc11..e06104e07 --- a/queries/aws_cloudtrail_event_data_store_1.yaml +++ b/queries/aws_cloudtrail_event_data_store_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS CloudTrail Event Data, providing information - about API activity in AWS accounts. This includes details about API calls, logins, - and other events captured by AWS CloudTrail. +Description: Allows users to query AWS CloudTrail Event Data, providing information about API activity in AWS accounts. This includes details about API calls, logins, and other events captured by AWS CloudTrail. ID: aws_cloudtrail_event_data_store_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n created_timestamp,\n multi_region_enabled,\n\ - \ organization_enabled,\n termination_protection_enabled\nfrom\n aws_cloudtrail_event_data_store;" + QueryToExecute: | + SELECT + name, + arn, + status, + created_timestamp, + multi_region_enabled, + organization_enabled, + termination_protection_enabled + FROM + aws_cloudtrail_event_data_store; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Event Data + - CloudTrail +Title: List all AWS CloudTrail Event Data \ No newline at end of file diff --git a/queries/aws_cloudtrail_event_data_store_2.yaml b/queries/aws_cloudtrail_event_data_store_2.yaml old mode 100755 new mode 100644 index 8f8e0118a..c3ad9c408 --- a/queries/aws_cloudtrail_event_data_store_2.yaml +++ b/queries/aws_cloudtrail_event_data_store_2.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS CloudTrail Event Data, providing information - about API activity in AWS accounts. This includes details about API calls, logins, - and other events captured by AWS CloudTrail. +Description: Allows users to query AWS CloudTrail Event Data, providing information about API activity in AWS accounts. This includes details about API calls, logins, and other events captured by AWS CloudTrail. ID: aws_cloudtrail_event_data_store_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n created_timestamp,\n multi_region_enabled,\n\ - \ organization_enabled,\n termination_protection_enabled\nfrom\n aws_cloudtrail_event_data_store\n\ - where\n status <> 'ENABLED';" + QueryToExecute: | + SELECT + name, + arn, + status, + created_timestamp, + multi_region_enabled, + organization_enabled, + termination_protection_enabled + FROM + aws_cloudtrail_event_data_store + WHERE + status <> 'ENABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List API Activity in AWS Accounts with CloudTrail Data + - CloudTrail +Title: List API Activity in AWS Accounts with CloudTrail Data \ No newline at end of file diff --git a/queries/aws_cloudtrail_event_data_store_3.yaml b/queries/aws_cloudtrail_event_data_store_3.yaml old mode 100755 new mode 100644 index 7c0c45547..ff5d757f1 --- a/queries/aws_cloudtrail_event_data_store_3.yaml +++ b/queries/aws_cloudtrail_event_data_store_3.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS CloudTrail Event Data, providing information - about API activity in AWS accounts. This includes details about API calls, logins, - and other events captured by AWS CloudTrail. +Description: Allows users to query AWS CloudTrail Event Data, providing information about API activity in AWS accounts. This includes details about API calls, logins, and other events captured by AWS CloudTrail. ID: aws_cloudtrail_event_data_store_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n created_timestamp,\n multi_region_enabled,\n\ - \ organization_enabled,\n termination_protection_enabled\nfrom\n aws_cloudtrail_event_data_store\n\ - where\n not termination_protection_enabled;" + QueryToExecute: | + SELECT + name, + arn, + status, + created_timestamp, + multi_region_enabled, + organization_enabled, + termination_protection_enabled + FROM + aws_cloudtrail_event_data_store + WHERE + NOT termination_protection_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Event Data and API Activity + - CloudTrail +Title: List all AWS CloudTrail Event Data and API Activity \ No newline at end of file diff --git a/queries/aws_cloudtrail_import_1.yaml b/queries/aws_cloudtrail_import_1.yaml old mode 100755 new mode 100644 index 75792d813..64579dbd3 --- a/queries/aws_cloudtrail_import_1.yaml +++ b/queries/aws_cloudtrail_import_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CloudTrail imports to extract data about imported - trail files such as the file name, import time, hash value, and more. +Description: Allows users to query AWS CloudTrail imports to extract data about imported trail files such as the file name, import time, hash value, and more. ID: aws_cloudtrail_import_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n import_id,\n created_timestamp,\n import_status,\n\ - \ destinations\nfrom\n aws_cloudtrail_import;" + QueryToExecute: | + SELECT + import_id, + created_timestamp, + import_status, + destinations + FROM + aws_cloudtrail_import; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find all imported trail files from AWS CloudTrail + - CloudTrail +Title: Find all imported trail files from AWS CloudTrail \ No newline at end of file diff --git a/queries/aws_cloudtrail_import_2.yaml b/queries/aws_cloudtrail_import_2.yaml old mode 100755 new mode 100644 index 55eecda3c..862be8d8c --- a/queries/aws_cloudtrail_import_2.yaml +++ b/queries/aws_cloudtrail_import_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudTrail imports to extract data about imported - trail files such as the file name, import time, hash value, and more. +Description: Allows users to query AWS CloudTrail imports to extract data about imported trail files such as the file name, import time, hash value, and more. ID: aws_cloudtrail_import_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n import_id,\n created_timestamp,\n import_source\nfrom\n\ - \ aws_cloudtrail_import\nwhere\n import_status <> 'COMPLETED';" + QueryToExecute: | + SELECT + import_id, + created_timestamp, + import_source + FROM + aws_cloudtrail_import + WHERE + import_status <> 'COMPLETED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List AWS CloudTrail Imports and Their Details + - CloudTrail +Title: List AWS CloudTrail Imports and Their Details \ No newline at end of file diff --git a/queries/aws_cloudtrail_import_3.yaml b/queries/aws_cloudtrail_import_3.yaml old mode 100755 new mode 100644 index ff262337a..9cd23ccdf --- a/queries/aws_cloudtrail_import_3.yaml +++ b/queries/aws_cloudtrail_import_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS CloudTrail imports to extract data about imported - trail files such as the file name, import time, hash value, and more. +Description: Allows users to query AWS CloudTrail imports to extract data about imported trail files such as the file name, import time, hash value, and more. ID: aws_cloudtrail_import_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n import_id,\n created_timestamp,\n import_status,\n\ - \ start_event_time,\n end_event_time\nfrom\n aws_cloudtrail_import\nwhere\n\ - \ created_timestamp >= now() - interval '30' day;" + QueryToExecute: | + SELECT + import_id, + created_timestamp, + import_status, + start_event_time, + end_event_time + FROM + aws_cloudtrail_import + WHERE + created_timestamp >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Import Details + - CloudTrail +Title: List all AWS CloudTrail Import Details \ No newline at end of file diff --git a/queries/aws_cloudtrail_import_4.yaml b/queries/aws_cloudtrail_import_4.yaml old mode 100755 new mode 100644 index 0c68cc41f..75431fe0a --- a/queries/aws_cloudtrail_import_4.yaml +++ b/queries/aws_cloudtrail_import_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudTrail imports to extract data about imported - trail files such as the file name, import time, hash value, and more. +Description: Allows users to query AWS CloudTrail imports to extract data about imported trail files such as the file name, import time, hash value, and more. ID: aws_cloudtrail_import_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n import_id,\n import_status,\n import_source ->> 'S3BucketAccessRoleArn'\ - \ as s3_bucket_access_role_arn,\n import_source ->> 'S3BucketRegion' as s3_bucket_region,\n\ - \ import_source ->> 'S3LocationUri' as s3_location_uri\nfrom\n aws_cloudtrail_import;" + QueryToExecute: | + SELECT + import_id, + import_status, + import_source ->> 'S3BucketAccessRoleArn' AS s3_bucket_access_role_arn, + import_source ->> 'S3BucketRegion' AS s3_bucket_region, + import_source ->> 'S3LocationUri' AS s3_location_uri + FROM + aws_cloudtrail_import; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find all AWS CloudTrail import details using SQL + - CloudTrail +Title: Find all AWS CloudTrail import details using SQL \ No newline at end of file diff --git a/queries/aws_cloudtrail_import_5.yaml b/queries/aws_cloudtrail_import_5.yaml old mode 100755 new mode 100644 index 3ac99b97e..098b8a10e --- a/queries/aws_cloudtrail_import_5.yaml +++ b/queries/aws_cloudtrail_import_5.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CloudTrail imports to extract data about imported - trail files such as the file name, import time, hash value, and more. +Description: Allows users to query AWS CloudTrail imports to extract data about imported trail files such as the file name, import time, hash value, and more. ID: aws_cloudtrail_import_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n import_id,\n import_status,\n import_statistics ->\ - \ 'EventsCompleted' as events_completed,\n import_statistics -> 'FailedEntries'\ - \ as failed_entries,\n import_statistics -> 'FilesCompleted' as files_completed,\n\ - \ import_statistics -> 'FilesCompleted' as prefixes_completed,\n import_statistics\ - \ -> 'PrefixesFound' as PrefixesFound\nfrom\n aws_cloudtrail_import;" + QueryToExecute: | + SELECT + import_id, + import_status, + import_statistics -> 'EventsCompleted' AS events_completed, + import_statistics -> 'FailedEntries' AS failed_entries, + import_statistics -> 'FilesCompleted' AS files_completed, + import_statistics -> 'FilesCompleted' AS prefixes_completed, + import_statistics -> 'PrefixesFound' AS prefixes_found + FROM + aws_cloudtrail_import; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail import details + - CloudTrail +Title: List all AWS CloudTrail import details \ No newline at end of file diff --git a/queries/aws_cloudtrail_lookup_event_1.yaml b/queries/aws_cloudtrail_lookup_event_1.yaml old mode 100755 new mode 100644 index af53578ad..b5ebe3a2c --- a/queries/aws_cloudtrail_lookup_event_1.yaml +++ b/queries/aws_cloudtrail_lookup_event_1.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS CloudTrail Lookup Events, providing information - about each trail event within AWS CloudTrail. The table can be used to retrieve - details such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Lookup Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_lookup_event_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n username,\n\ - \ jsonb_pretty(cloud_trail_event) as cloud_trail_event\nfrom\n aws_cloudtrail_lookup_event\n\ - where\n start_time = now() - interval '5 minutes'\n and end_time = now();" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + username, + jsonb_pretty(cloud_trail_event) AS cloud_trail_event + FROM + aws_cloudtrail_lookup_event + WHERE + start_time = NOW() - INTERVAL '5 minutes' + AND end_time = NOW(); Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Lookup Events with SQL + - CloudTrail +Title: Find AWS CloudTrail Lookup Events with SQL \ No newline at end of file diff --git a/queries/aws_cloudtrail_lookup_event_2.yaml b/queries/aws_cloudtrail_lookup_event_2.yaml old mode 100755 new mode 100644 index 2a3f4149b..7784211c5 --- a/queries/aws_cloudtrail_lookup_event_2.yaml +++ b/queries/aws_cloudtrail_lookup_event_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS CloudTrail Lookup Events, providing information - about each trail event within AWS CloudTrail. The table can be used to retrieve - details such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Lookup Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_lookup_event_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n username,\n\ - \ jsonb_pretty(cloud_trail_event) as cloud_trail_event\nfrom\n aws_cloudtrail_lookup_event\n\ - where\n start_time = now()\n and end_time = now() - interval '1 hour'\n and\ - \ read_only = 'true'\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + username, + jsonb_pretty(cloud_trail_event) AS cloud_trail_event + FROM + aws_cloudtrail_lookup_event + WHERE + start_time = NOW() + AND end_time = NOW() - INTERVAL '1 hour' + AND read_only = 'true' + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Lookup Events for Specific Trail Events + - CloudTrail +Title: Find AWS CloudTrail Lookup Events for Specific Trail Events \ No newline at end of file diff --git a/queries/aws_cloudtrail_lookup_event_3.yaml b/queries/aws_cloudtrail_lookup_event_3.yaml old mode 100755 new mode 100644 index 7452b51d3..02fa8cc58 --- a/queries/aws_cloudtrail_lookup_event_3.yaml +++ b/queries/aws_cloudtrail_lookup_event_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS CloudTrail Lookup Events, providing information - about each trail event within AWS CloudTrail. The table can be used to retrieve - details such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Lookup Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_lookup_event_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n jsonb_pretty(cloud_trail_event)\ - \ as cloud_trail_event\nfrom\n aws_cloudtrail_lookup_event\nwhere\n and event_source\ - \ = 'iam.amazonaws.com'\n and event_time >= now() - interval '1 hour';" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + jsonb_pretty(cloud_trail_event) AS cloud_trail_event + FROM + aws_cloudtrail_lookup_event + WHERE + event_source = 'iam.amazonaws.com' + AND event_time >= NOW() - INTERVAL '1 hour'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events with IAM Source + - CloudTrail +Title: Find AWS CloudTrail Events with IAM Source \ No newline at end of file diff --git a/queries/aws_cloudtrail_query_1.yaml b/queries/aws_cloudtrail_query_1.yaml old mode 100755 new mode 100644 index fa9f17317..374d13451 --- a/queries/aws_cloudtrail_query_1.yaml +++ b/queries/aws_cloudtrail_query_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS CloudTrail events for a detailed view of account - activity, including actions taken through the AWS Management Console, AWS SDKs, - command line tools, and other AWS services. +Description: Allows users to query AWS CloudTrail events for a detailed view of account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. ID: aws_cloudtrail_query_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n query_id,\n event_data_store_arn,\n query_status,\n\ - \ query_status,\n creation_time,\n events_matched,\n events_scanned\nfrom\n\ - \ aws_cloudtrail_query;" + QueryToExecute: | + SELECT + query_id, + event_data_store_arn, + query_status, + creation_time, + events_matched, + events_scanned + FROM + aws_cloudtrail_query; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail events for account activity + - CloudTrail +Title: Find AWS CloudTrail events for account activity \ No newline at end of file diff --git a/queries/aws_cloudtrail_query_2.yaml b/queries/aws_cloudtrail_query_2.yaml old mode 100755 new mode 100644 index 20b0e86b3..fc5ee8290 --- a/queries/aws_cloudtrail_query_2.yaml +++ b/queries/aws_cloudtrail_query_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CloudTrail events for a detailed view of account - activity, including actions taken through the AWS Management Console, AWS SDKs, - command line tools, and other AWS services. +Description: Allows users to query AWS CloudTrail events for a detailed view of account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. ID: aws_cloudtrail_query_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n query_id,\n event_data_store_arn,\n query_status,\n\ - \ creation_time,\n query_string,\n execution_time_in_millis\nfrom\n aws_cloudtrail_query\n\ - where\n query_status = 'FAILED';" + QueryToExecute: | + SELECT + query_id, + event_data_store_arn, + query_status, + creation_time, + query_string, + execution_time_in_millis + FROM + aws_cloudtrail_query + WHERE + query_status = 'FAILED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find failed AWS CloudTrail queries using SQL + - CloudTrail +Title: Find failed AWS CloudTrail queries using SQL \ No newline at end of file diff --git a/queries/aws_cloudtrail_query_3.yaml b/queries/aws_cloudtrail_query_3.yaml old mode 100755 new mode 100644 index cdfc7b1d3..938221ccb --- a/queries/aws_cloudtrail_query_3.yaml +++ b/queries/aws_cloudtrail_query_3.yaml @@ -1,29 +1,35 @@ -Description: Allows users to query AWS CloudTrail events for a detailed view of account - activity, including actions taken through the AWS Management Console, AWS SDKs, - command line tools, and other AWS services. +Description: Allows users to query AWS CloudTrail events for a detailed view of account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. ID: aws_cloudtrail_query_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n q.query_id as query_id,\n q.event_data_store_arn as\ - \ event_data_store_arn,\n s.name as event_data_store_name,\n s.status as event_data_store_status,\n\ - \ s.multi_region_enabled as multi_region_enabled,\n s.termination_protection_enabled\ - \ as termination_protection_enabled,\n s.updated_timestamp as event_data_store_updated_timestamp\n\ - from\n aws_cloudtrail_query as q,\n aws_cloudtrail_event_data_store as s\nwhere\n\ - \ s.arn = q.event_data_store_arn;" + QueryToExecute: | + SELECT + q.query_id AS query_id, + q.event_data_store_arn AS event_data_store_arn, + s.name AS event_data_store_name, + s.status AS event_data_store_status, + s.multi_region_enabled AS multi_region_enabled, + s.termination_protection_enabled AS termination_protection_enabled, + s.updated_timestamp AS event_data_store_updated_timestamp + FROM + aws_cloudtrail_query AS q, + aws_cloudtrail_event_data_store AS s + WHERE + s.arn = q.event_data_store_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find all AWS CloudTrail events account activity + - CloudTrail +Title: Find all AWS CloudTrail events account activity \ No newline at end of file diff --git a/queries/aws_cloudtrail_query_4.yaml b/queries/aws_cloudtrail_query_4.yaml old mode 100755 new mode 100644 index 7ec73c1ac..08721854c --- a/queries/aws_cloudtrail_query_4.yaml +++ b/queries/aws_cloudtrail_query_4.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS CloudTrail events for a detailed view of account - activity, including actions taken through the AWS Management Console, AWS SDKs, - command line tools, and other AWS services. +Description: Allows users to query AWS CloudTrail events for a detailed view of account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. ID: aws_cloudtrail_query_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n query_id,\n event_data_store_arn,\n query_status,\n\ - \ creation_time,\n query_string,\n execution_time_in_millis\nfrom\n aws_cloudtrail_query\n\ - where\n creation_time <= now() - interval '3' day;" + QueryToExecute: | + SELECT + query_id, + event_data_store_arn, + query_status, + creation_time, + query_string, + execution_time_in_millis + FROM + aws_cloudtrail_query + WHERE + creation_time <= NOW() - INTERVAL '3' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find all AWS CloudTrail events for account activities + - CloudTrail +Title: Find all AWS CloudTrail events for account activities \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_1.yaml b/queries/aws_cloudtrail_trail_1.yaml old mode 100755 new mode 100644 index cffe69f6b..cfd82eda6 --- a/queries/aws_cloudtrail_trail_1.yaml +++ b/queries/aws_cloudtrail_trail_1.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n home_region,\n is_multi_region_trail\nfrom\n\ - \ aws_cloudtrail_trail" + QueryToExecute: | + SELECT + name, + home_region, + is_multi_region_trail + FROM + aws_cloudtrail_trail Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Trail Records + - CloudTrail +Title: List all AWS CloudTrail Trail Records \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_2.yaml b/queries/aws_cloudtrail_trail_2.yaml old mode 100755 new mode 100644 index b6425b06f..4cb5df2da --- a/queries/aws_cloudtrail_trail_2.yaml +++ b/queries/aws_cloudtrail_trail_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n kms_key_id\nfrom\n aws_cloudtrail_trail\nwhere\n\ - \ kms_key_id is null;" + QueryToExecute: | + SELECT + name, + kms_key_id + FROM + aws_cloudtrail_trail + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Trails with Trail Records + - CloudTrail +Title: List all AWS CloudTrail Trails with Trail Records \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_3.yaml b/queries/aws_cloudtrail_trail_3.yaml old mode 100755 new mode 100644 index c234f3b5a..0365618d4 --- a/queries/aws_cloudtrail_trail_3.yaml +++ b/queries/aws_cloudtrail_trail_3.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n trail.name as trail_name,\n bucket.name as bucket_name,\n\ - \ bucket.bucket_policy_is_public as is_publicly_accessible\nfrom\n aws_cloudtrail_trail\ - \ as trail\n join aws_s3_bucket as bucket on trail.s3_bucket_name = bucket.name\n\ - where\n bucket.bucket_policy_is_public;" + QueryToExecute: | + SELECT + trail.name AS trail_name, + bucket.name AS bucket_name, + bucket.bucket_policy_is_public AS is_publicly_accessible + FROM + aws_cloudtrail_trail AS trail + JOIN aws_s3_bucket AS bucket + ON trail.s3_bucket_name = bucket.name + WHERE + bucket.bucket_policy_is_public; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Trail and Public S3 Bucket Info + - CloudTrail +Title: Find AWS CloudTrail Trail and Public S3 Bucket Info \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_4.yaml b/queries/aws_cloudtrail_trail_4.yaml old mode 100755 new mode 100644 index d969ffce9..f737f8517 --- a/queries/aws_cloudtrail_trail_4.yaml +++ b/queries/aws_cloudtrail_trail_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n trail.name as trail_name,\n bucket.name as bucket_name,\n\ - \ logging\nfrom\n aws_cloudtrail_trail as trail\n join aws_s3_bucket as bucket\ - \ on trail.s3_bucket_name = bucket.name\nwhere\n not versioning_enabled;" + QueryToExecute: | + SELECT + trail.name AS trail_name, + bucket.name AS bucket_name, + logging + FROM + aws_cloudtrail_trail AS trail + JOIN aws_s3_bucket AS bucket + ON trail.s3_bucket_name = bucket.name + WHERE + NOT versioning_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CloudTrail -Title: List all AWS CloudTrail Trails with Bucket Details + - AWS CloudTrail +Title: List all AWS CloudTrail Trails with Bucket Details \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_5.yaml b/queries/aws_cloudtrail_trail_5.yaml old mode 100755 new mode 100644 index 1a6875e25..1f6084771 --- a/queries/aws_cloudtrail_trail_5.yaml +++ b/queries/aws_cloudtrail_trail_5.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n is_logging\nfrom\n aws_cloudtrail_trail\nwhere\n\ - \ not is_logging;" + QueryToExecute: | + SELECT + name, + is_logging + FROM + aws_cloudtrail_trail + WHERE + NOT is_logging; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Trails configuration and metadata + - CloudTrail +Title: List all AWS CloudTrail Trails configuration and metadata \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_6.yaml b/queries/aws_cloudtrail_trail_6.yaml old mode 100755 new mode 100644 index eacc8d99b..7270ef610 --- a/queries/aws_cloudtrail_trail_6.yaml +++ b/queries/aws_cloudtrail_trail_6.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service''s trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n log_file_validation_enabled\nfrom\n\ - \ aws_cloudtrail_trail\nwhere\n not log_file_validation_enabled;" + QueryToExecute: | + SELECT + name, + arn, + log_file_validation_enabled + FROM + aws_cloudtrail_trail + WHERE + NOT log_file_validation_enabled; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Trails and their Status + - CloudTrail +Title: List all AWS CloudTrail Trails and their Status \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_7.yaml b/queries/aws_cloudtrail_trail_7.yaml old mode 100755 new mode 100644 index d307a7b8c..ce3a751b0 --- a/queries/aws_cloudtrail_trail_7.yaml +++ b/queries/aws_cloudtrail_trail_7.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS CloudTrail Trails for information about the - AWS CloudTrail service''s trail records. This includes trail configuration details, - status, and associated metadata. +Description: Allows users to query AWS CloudTrail Trails for information about the AWS CloudTrail service's trail records. This includes trail configuration details, status, and associated metadata. ID: aws_cloudtrail_trail_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n region,\n home_region\nfrom\n aws_cloudtrail_trail\n\ - where\n is_multi_region_trail\n and home_region <> region;" + QueryToExecute: | + SELECT + name, + arn, + region, + home_region + FROM + aws_cloudtrail_trail + WHERE + is_multi_region_trail + AND home_region <> region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List AWS CloudTrail Trails with Multi-Region Configuration + - CloudTrail +Title: List AWS CloudTrail Trails with Multi-Region Configuration \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_1.yaml b/queries/aws_cloudtrail_trail_event_1.yaml old mode 100755 new mode 100644 index f9b91b4ce..fd5adad45 --- a/queries/aws_cloudtrail_trail_event_1.yaml +++ b/queries/aws_cloudtrail_trail_event_1.yaml @@ -1,27 +1,35 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(response_elements) as response_elements\n\ - from\n aws_cloudtrail_trail_event\nwhere\n log_group_name = 'aws-cloudtrail-log-group-name'\n\ - \ and timestamp >= now() - interval '5 minutes';" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND timestamp >= NOW() - INTERVAL '5 minutes'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events with Details in Table Format + - CloudTrail +Title: Find AWS CloudTrail Events with Details in Table Format \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_2.yaml b/queries/aws_cloudtrail_trail_event_2.yaml old mode 100755 new mode 100644 index 5349e8dd8..8715e484f --- a/queries/aws_cloudtrail_trail_event_2.yaml +++ b/queries/aws_cloudtrail_trail_event_2.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(response_elements) as response_elements\n\ - from\n aws_cloudtrail_trail_event\nwhere\n log_group_name = 'aws-cloudtrail-log-group-name'\n\ - \ and timestamp between (now() - interval '10 minutes') and (now() - interval\ - \ '5 minutes')\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND timestamp BETWEEN (now() - INTERVAL '10 minutes') AND (now() - INTERVAL '5 minutes') + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find CloudTrail Events in AWS with Event Details + - CloudTrail +Title: Find CloudTrail Events in AWS with Event Details \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_3.yaml b/queries/aws_cloudtrail_trail_event_3.yaml old mode 100755 new mode 100644 index 55d85b63d..bf298369b --- a/queries/aws_cloudtrail_trail_event_3.yaml +++ b/queries/aws_cloudtrail_trail_event_3.yaml @@ -1,28 +1,38 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(response_elements) as response_elements\n\ - from\n aws_cloudtrail_trail_event\nwhere\n log_group_name = 'aws-cloudtrail-log-group-name'\n\ - \ and not read_only\n and timestamp >= now() - interval '1 hour'\norder by\n\ - \ event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND NOT read_only + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Query AWS CloudTrail Events within AWS CloudTrail + - CloudTrail +Title: Query AWS CloudTrail Events within AWS CloudTrail \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_4.yaml b/queries/aws_cloudtrail_trail_event_4.yaml old mode 100755 new mode 100644 index cace94011..d703500cc --- a/queries/aws_cloudtrail_trail_event_4.yaml +++ b/queries/aws_cloudtrail_trail_event_4.yaml @@ -1,27 +1,36 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ user_identifier,\n jsonb_pretty(request_parameters) as request_parameters,\n\ - \ jsonb_pretty(response_elements) as response_elements\nfrom\n aws_cloudtrail_trail_event\n\ - where\n log_group_name = 'aws-cloudtrail-log-group-name'\n and event_source\ - \ = 'iam.amazonaws.com'\n and timestamp >= now() - interval '1 hour'\norder by\n\ - \ event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND event_source = 'iam.amazonaws.com' + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events with Detailed Information + - CloudTrail +Title: Find AWS CloudTrail Events with Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_5.yaml b/queries/aws_cloudtrail_trail_event_5.yaml old mode 100755 new mode 100644 index af46f6e21..86ee38a7c --- a/queries/aws_cloudtrail_trail_event_5.yaml +++ b/queries/aws_cloudtrail_trail_event_5.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(request_parameters) as request_parameters,\n\ - \ jsonb_pretty(response_elements) as response_elements\nfrom\n aws_cloudtrail_trail_event\n\ - where\n log_group_name = 'aws-cloudtrail-log-group-name'\n and username = 'steampipe'\n\ - \ and timestamp >= now() - interval '1 hour'\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND username = 'steampipe' + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events with Detailed Information + - CloudTrail +Title: Find AWS CloudTrail Events with Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_6.yaml b/queries/aws_cloudtrail_trail_event_6.yaml old mode 100755 new mode 100644 index ab79caa3a..c157032b0 --- a/queries/aws_cloudtrail_trail_event_6.yaml +++ b/queries/aws_cloudtrail_trail_event_6.yaml @@ -1,26 +1,37 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(request_parameters) as request_parameters,\n\ - \ jsonb_pretty(response_elements) as response_elements\nfrom\n aws_cloudtrail_trail_event\n\ - where\n log_group_name = 'aws-cloudtrail-log-group-name'\n and user_type = 'IAMUser'\n\ - \ and timestamp >= now() - interval '1 hour'\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND user_type = 'IAMUser' + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events within AWS CloudTrail + - CloudTrail +Title: Find AWS CloudTrail Events within AWS CloudTrail \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_7.yaml b/queries/aws_cloudtrail_trail_event_7.yaml old mode 100755 new mode 100644 index 90a3de64c..1b9bd569b --- a/queries/aws_cloudtrail_trail_event_7.yaml +++ b/queries/aws_cloudtrail_trail_event_7.yaml @@ -1,26 +1,37 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n user_type,\n\ - \ username,\n user_identifier,\n jsonb_pretty(request_parameters) as request_parameters,\n\ - \ jsonb_pretty(response_elements) as response_elements\nfrom\n aws_cloudtrail_trail_event\n\ - where\n log_group_name = 'aws-cloudtrail-log-group-name'\n and user_type = 'AssumedRole'\n\ - \ and timestamp >= now() - interval '1 hour'\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + user_type, + username, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND user_type = 'AssumedRole' + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: List all AWS CloudTrail Events using SQL Queries + - CloudTrail +Title: List all AWS CloudTrail Events using SQL Queries \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_8.yaml b/queries/aws_cloudtrail_trail_event_8.yaml old mode 100755 new mode 100644 index f3005ebd2..1dd465c34 --- a/queries/aws_cloudtrail_trail_event_8.yaml +++ b/queries/aws_cloudtrail_trail_event_8.yaml @@ -1,27 +1,39 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n error_code,\n\ - \ error_message,\n user_type,\n username,\n user_identifier,\n jsonb_pretty(request_parameters)\ - \ as request_parameters,\n jsonb_pretty(response_elements) as response_elements\n\ - from\n aws_cloudtrail_trail_event\nwhere\n log_group_name = 'aws-cloudtrail-log-group-name'\n\ - \ and error_code is not null\n and timestamp >= now() - interval '1 hour'\n\ - order by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + error_code, + error_message, + user_type, + username, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND error_code IS NOT NULL + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find AWS CloudTrail Events With Errors From Last Hour + - CloudTrail +Title: Find AWS CloudTrail Events With Errors From Last Hour \ No newline at end of file diff --git a/queries/aws_cloudtrail_trail_event_9.yaml b/queries/aws_cloudtrail_trail_event_9.yaml old mode 100755 new mode 100644 index 72c1d1957..53591a5df --- a/queries/aws_cloudtrail_trail_event_9.yaml +++ b/queries/aws_cloudtrail_trail_event_9.yaml @@ -1,27 +1,39 @@ -Description: Allows users to query AWS CloudTrail Events, providing information about - each trail event within AWS CloudTrail. The table can be used to retrieve details - such as the event time, event name, resources involved, and much more. +Description: Allows users to query AWS CloudTrail Events, providing information about each trail event within AWS CloudTrail. The table can be used to retrieve details such as the event time, event name, resources involved, and much more. ID: aws_cloudtrail_trail_event_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n event_name,\n event_source,\n event_time,\n error_code,\n\ - \ error_message,\n user_type,\n username,\n user_identifier,\n jsonb_pretty(request_parameters)\ - \ as request_parameters,\n jsonb_pretty(response_elements) as response_elements\n\ - from\n aws_cloudtrail_trail_event\nwhere\n log_group_name = 'aws-cloudtrail-log-group-name'\n\ - \ and filter = '{ $.sourceIPAddress = 203.189.* }'\n and timestamp >= now()\ - \ - interval '1 hour'\norder by\n event_time asc;" + QueryToExecute: | + SELECT + event_name, + event_source, + event_time, + error_code, + error_message, + user_type, + username, + user_identifier, + jsonb_pretty(request_parameters) AS request_parameters, + jsonb_pretty(response_elements) AS response_elements + FROM + aws_cloudtrail_trail_event + WHERE + log_group_name = 'aws-cloudtrail-log-group-name' + AND filter = '{ $.sourceIPAddress = 203.189.* }' + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + event_time ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudTrail -Title: Find All AWS CloudTrail Events with Detailed Information + - CloudTrail +Title: Find All AWS CloudTrail Events with Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudwatch_alarm_1.yaml b/queries/aws_cloudwatch_alarm_1.yaml old mode 100755 new mode 100644 index 25d4b6b92..7d296399f --- a/queries/aws_cloudwatch_alarm_1.yaml +++ b/queries/aws_cloudwatch_alarm_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CloudWatch Alarms, providing detailed information - about each alarm, including its configuration, state, and associated actions. +Description: Allows users to query AWS CloudWatch Alarms, providing detailed information about each alarm, including its configuration, state, and associated actions. ID: aws_cloudwatch_alarm_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state_value,\n metric_name,\n actions_enabled,\n\ - \ comparison_operator,\n namespace,\n statistic\nfrom\n aws_cloudwatch_alarm;" + QueryToExecute: | + SELECT + name, + state_value, + metric_name, + actions_enabled, + comparison_operator, + namespace, + statistic + FROM + aws_cloudwatch_alarm; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Alarms with Detailed Configuration + - CloudWatch +Title: List all AWS CloudWatch Alarms with Detailed Configuration \ No newline at end of file diff --git a/queries/aws_cloudwatch_alarm_2.yaml b/queries/aws_cloudwatch_alarm_2.yaml old mode 100755 new mode 100644 index 86479ae6e..94e08a41b --- a/queries/aws_cloudwatch_alarm_2.yaml +++ b/queries/aws_cloudwatch_alarm_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS CloudWatch Alarms, providing detailed information - about each alarm, including its configuration, state, and associated actions. +Description: Allows users to query AWS CloudWatch Alarms, providing detailed information about each alarm, including its configuration, state, and associated actions. ID: aws_cloudwatch_alarm_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state_value,\n state_reason\nfrom\n\ - \ aws_cloudwatch_alarm\nwhere\n state_value = 'ALARM';" + QueryToExecute: | + SELECT + name, + arn, + state_value, + state_reason + FROM + aws_cloudwatch_alarm + WHERE + state_value = 'ALARM'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Alarms with Detailed Information + - CloudWatch +Title: List AWS CloudWatch Alarms with Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudwatch_alarm_3.yaml b/queries/aws_cloudwatch_alarm_3.yaml old mode 100755 new mode 100644 index f4315cf8e..c9fb2499d --- a/queries/aws_cloudwatch_alarm_3.yaml +++ b/queries/aws_cloudwatch_alarm_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudWatch Alarms, providing detailed information - about each alarm, including its configuration, state, and associated actions. +Description: Allows users to query AWS CloudWatch Alarms, providing detailed information about each alarm, including its configuration, state, and associated actions. ID: aws_cloudwatch_alarm_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n actions_enabled,\n alarm_actions\nfrom\n aws_cloudwatch_alarm\n\ - where\n actions_enabled;" + QueryToExecute: | + SELECT + arn, + actions_enabled, + alarm_actions + FROM + aws_cloudwatch_alarm + WHERE + actions_enabled; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Alarms with Details + - CloudWatch +Title: List all AWS CloudWatch Alarms with Details \ No newline at end of file diff --git a/queries/aws_cloudwatch_alarm_4.yaml b/queries/aws_cloudwatch_alarm_4.yaml old mode 100755 new mode 100644 index 0017f8cc2..7f4fea14e --- a/queries/aws_cloudwatch_alarm_4.yaml +++ b/queries/aws_cloudwatch_alarm_4.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS CloudWatch Alarms, providing detailed information - about each alarm, including its configuration, state, and associated actions. +Description: Allows users to query AWS CloudWatch Alarms, providing detailed information about each alarm, including its configuration, state, and associated actions. ID: aws_cloudwatch_alarm_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n period,\n statistic,\n\ - \ dimensions\nfrom\n aws_cloudwatch_alarm\nwhere\n metric_name is not null;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + period, + statistic, + dimensions + FROM + aws_cloudwatch_alarm + WHERE + metric_name IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Alarms with Metric Names + - CloudWatch +Title: List AWS CloudWatch Alarms with Metric Names \ No newline at end of file diff --git a/queries/aws_cloudwatch_alarm_5.yaml b/queries/aws_cloudwatch_alarm_5.yaml old mode 100755 new mode 100644 index 0396adda4..17c133a69 --- a/queries/aws_cloudwatch_alarm_5.yaml +++ b/queries/aws_cloudwatch_alarm_5.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS CloudWatch Alarms, providing detailed information - about each alarm, including its configuration, state, and associated actions. +Description: Allows users to query AWS CloudWatch Alarms, providing detailed information about each alarm, including its configuration, state, and associated actions. ID: aws_cloudwatch_alarm_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric ->> 'Id' as metric_id,\n metric ->>\ - \ 'Expression' as metric_expression,\n metric -> 'MetricStat' -> 'Metric' ->>\ - \ 'MetricName' as metric_name,\n metric -> 'MetricStat' -> 'Metric' ->> 'Namespace'\ - \ as metric_namespace,\n metric -> 'MetricStat' -> 'Metric' ->> 'Dimensions'\ - \ as metric_dimensions,\n metric ->> 'ReturnData' as metric_return_data\nfrom\n\ - \ aws_cloudwatch_alarm,\n jsonb_array_elements(metrics) as metric;" + QueryToExecute: | + SELECT + name, + metric ->> 'Id' AS metric_id, + metric ->> 'Expression' AS metric_expression, + metric -> 'MetricStat' -> 'Metric' ->> 'MetricName' AS metric_name, + metric -> 'MetricStat' -> 'Metric' ->> 'Namespace' AS metric_namespace, + metric -> 'MetricStat' -> 'Metric' ->> 'Dimensions' AS metric_dimensions, + metric ->> 'ReturnData' AS metric_return_data + FROM + aws_cloudwatch_alarm, + jsonb_array_elements(metrics) AS metric; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Query AWS CloudWatch Alarms for Detailed Information + - CloudWatch +Title: Query AWS CloudWatch Alarms for Detailed Information \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_1.yaml b/queries/aws_cloudwatch_log_event_1.yaml old mode 100755 new mode 100644 index 10001a3fd..80b85cdc0 --- a/queries/aws_cloudwatch_log_event_1.yaml +++ b/queries/aws_cloudwatch_log_event_1.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and timestamp >= now() - interval '5\ - \ minutes';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND timestamp >= NOW() - INTERVAL '5 minutes'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Log Events for Monitoring + - CloudWatch +Title: List AWS CloudWatch Log Events for Monitoring \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_2.yaml b/queries/aws_cloudwatch_log_event_2.yaml old mode 100755 new mode 100644 index 5179e03c2..8af625b7d --- a/queries/aws_cloudwatch_log_event_2.yaml +++ b/queries/aws_cloudwatch_log_event_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and timestamp between (now() - interval\ - \ '10 minutes') and (now() - interval '5 minutes')\norder by\n timestamp asc;" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND timestamp BETWEEN (NOW() - INTERVAL '10 minutes') AND (NOW() - INTERVAL '5 minutes') + ORDER BY + timestamp ASC; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Log Events for Monitoring + - CloudWatch +Title: List all AWS CloudWatch Log Events for Monitoring \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_3.yaml b/queries/aws_cloudwatch_log_event_3.yaml old mode 100755 new mode 100644 index 68d1192dc..effb1b9d8 --- a/queries/aws_cloudwatch_log_event_3.yaml +++ b/queries/aws_cloudwatch_log_event_3.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and filter = '{$.eventName=\"DescribeVpcs\"\ - }'\n and timestamp >= now() - interval '1 hour';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND filter = '{$.eventName="DescribeVpcs"}' + AND timestamp >= NOW() - INTERVAL '1 hour'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Log Events to Monitor Systems + - CloudWatch +Title: Find AWS CloudWatch Log Events to Monitor Systems \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_4.yaml b/queries/aws_cloudwatch_log_event_4.yaml old mode 100755 new mode 100644 index 40ecdf0cc..38167ea43 --- a/queries/aws_cloudwatch_log_event_4.yaml +++ b/queries/aws_cloudwatch_log_event_4.yaml @@ -1,28 +1,35 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and filter = '{ ($.errorCode = \"*UnauthorizedOperation\"\ - ) || ($.errorCode = \"AccessDenied*\") }'\n and timestamp >= now() - interval\ - \ '1 hour';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND filter = '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") }' + AND timestamp >= NOW() - INTERVAL '1 hour'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Query AWS CloudWatch Log Events for Unauthorized Access + - CloudWatch +Title: Query AWS CloudWatch Log Events for Unauthorized Access \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_5.yaml b/queries/aws_cloudwatch_log_event_5.yaml old mode 100755 new mode 100644 index 3c22217a1..b595a83b4 --- a/queries/aws_cloudwatch_log_event_5.yaml +++ b/queries/aws_cloudwatch_log_event_5.yaml @@ -1,28 +1,34 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and filter = '{($.eventName = AuthorizeSecurityGroupIngress)\ - \ || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress)\ - \ || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup)\ - \ || ($.eventName = DeleteSecurityGroup)}'\n and region = 'us-east-1'\n and\ - \ timestamp >= now() - interval '1 hour';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND filter = '{($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}' + AND region = 'us-east-1' + AND timestamp >= NOW() - INTERVAL '1 hour'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find All AWS CloudWatch Log Events for Security Groups + - CloudWatch +Title: Find All AWS CloudWatch Log Events for Security Groups \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_event_6.yaml b/queries/aws_cloudwatch_log_event_6.yaml old mode 100755 new mode 100644 index 303e76ae5..856241dd3 --- a/queries/aws_cloudwatch_log_event_6.yaml +++ b/queries/aws_cloudwatch_log_event_6.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS CloudWatch Log Events to retrieve information - about log events from a specified log group. Users can utilize this table to monitor - and troubleshoot systems and applications using their existing log data. +Description: Allows users to query AWS CloudWatch Log Events to retrieve information about log events from a specified log group. Users can utilize this table to monitor and troubleshoot systems and applications using their existing log data. ID: aws_cloudwatch_log_event_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n event_id,\n timestamp,\n\ - \ ingestion_time,\n message\nfrom\n aws_cloudwatch_log_event\nwhere\n log_group_name\ - \ = 'cloudwatch-log-event-group-name'\n and filter = '{$.userIdentity.sessionContext.sessionIssuer.userName=\"\ - turbot_superuser\"}'\n and timestamp >= now() - interval '1 day';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + event_id, + timestamp, + ingestion_time, + message + FROM + aws_cloudwatch_log_event + WHERE + log_group_name = 'cloudwatch-log-event-group-name' + AND filter = '{$.userIdentity.sessionContext.sessionIssuer.userName="turbot_superuser"}' + AND timestamp >= NOW() - INTERVAL '1 day'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Log Events within 1 Day + - CloudWatch +Title: List all AWS CloudWatch Log Events within 1 Day \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_group_1.yaml b/queries/aws_cloudwatch_log_group_1.yaml old mode 100755 new mode 100644 index d14ff3b93..633a6c7e5 --- a/queries/aws_cloudwatch_log_group_1.yaml +++ b/queries/aws_cloudwatch_log_group_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes - such as ARN, creation time, stored bytes, metric filter count, and more. +Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes such as ARN, creation time, stored bytes, metric filter count, and more. ID: aws_cloudwatch_log_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n kms_key_id,\n metric_filter_count,\n retention_in_days\n\ - from\n aws_cloudwatch_log_group\nwhere\n kms_key_id is null;" + QueryToExecute: | + SELECT + name, + kms_key_id, + metric_filter_count, + retention_in_days + FROM + aws_cloudwatch_log_group + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Log Groups Details Including Metrics + - CloudWatch +Title: List AWS CloudWatch Log Groups Details Including Metrics \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_group_2.yaml b/queries/aws_cloudwatch_log_group_2.yaml old mode 100755 new mode 100644 index cd8341683..dd4402c57 --- a/queries/aws_cloudwatch_log_group_2.yaml +++ b/queries/aws_cloudwatch_log_group_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes - such as ARN, creation time, stored bytes, metric filter count, and more. +Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes such as ARN, creation time, stored bytes, metric filter count, and more. ID: aws_cloudwatch_log_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n retention_in_days\nfrom\n aws_cloudwatch_log_group\n\ - where\n retention_in_days < 7;" + QueryToExecute: | + SELECT + name, + retention_in_days + FROM + aws_cloudwatch_log_group + WHERE + retention_in_days < 7; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Log Groups with Retention Time < 7 Days + - CloudWatch +Title: Find AWS CloudWatch Log Groups with Retention Time < 7 Days \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_group_3.yaml b/queries/aws_cloudwatch_log_group_3.yaml old mode 100755 new mode 100644 index 15e043499..6cd0f497b --- a/queries/aws_cloudwatch_log_group_3.yaml +++ b/queries/aws_cloudwatch_log_group_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes - such as ARN, creation time, stored bytes, metric filter count, and more. +Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes such as ARN, creation time, stored bytes, metric filter count, and more. ID: aws_cloudwatch_log_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n groups.name as log_group_name,\n metric.name as metric_filter_name,\n\ - \ metric.filter_pattern,\n metric.metric_transformation_name,\n metric.metric_transformation_value\n\ - from\n aws_cloudwatch_log_group groups\n join aws_cloudwatch_log_metric_filter\ - \ metric on groups.name = metric.log_group_name;" + QueryToExecute: | + SELECT + groups.name AS log_group_name, + metric.name AS metric_filter_name, + metric.filter_pattern, + metric.metric_transformation_name, + metric.metric_transformation_value + FROM + aws_cloudwatch_log_group groups + JOIN + aws_cloudwatch_log_metric_filter metric + ON + groups.name = metric.log_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Log Groups and Their Attributes + - CloudWatch +Title: Find AWS CloudWatch Log Groups and Their Attributes \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_group_4.yaml b/queries/aws_cloudwatch_log_group_4.yaml old mode 100755 new mode 100644 index 0fd893192..00ea2a377 --- a/queries/aws_cloudwatch_log_group_4.yaml +++ b/queries/aws_cloudwatch_log_group_4.yaml @@ -1,28 +1,32 @@ -Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes - such as ARN, creation time, stored bytes, metric filter count, and more. +Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes such as ARN, creation time, stored bytes, metric filter count, and more. ID: aws_cloudwatch_log_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i as data_identifier,\n s -> 'Operation' -> 'Audit'\ - \ -> 'FindingsDestination' -> 'S3' -> 'Bucket' as destination_bucket,\n s ->\ - \ 'Operation' -> 'Audit' -> 'FindingsDestination' -> 'CloudWatchLogs' -> 'LogGroup'as\ - \ destination_log_group,\n s -> 'Operation' -> 'Audit' -> 'FindingsDestination'\ - \ -> 'Firehose' -> 'DeliveryStream'as destination_delivery_stream\nfrom\n aws_cloudwatch_log_group,\n\ - \ jsonb_array_elements(data_protection_policy -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'DataIdentifier') as i\nwhere\n s ->> 'Sid' = 'audit-policy'\n and name\ - \ = 'log-group-name';" + QueryToExecute: | + SELECT + i AS data_identifier, + s -> 'Operation' -> 'Audit' -> 'FindingsDestination' -> 'S3' -> 'Bucket' AS destination_bucket, + s -> 'Operation' -> 'Audit' -> 'FindingsDestination' -> 'CloudWatchLogs' -> 'LogGroup' AS destination_log_group, + s -> 'Operation' -> 'Audit' -> 'FindingsDestination' -> 'Firehose' -> 'DeliveryStream' AS destination_delivery_stream + FROM + aws_cloudwatch_log_group, + jsonb_array_elements(data_protection_policy -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'DataIdentifier') AS i + WHERE + s ->> 'Sid' = 'audit-policy' + AND name = 'log-group-name'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch Log Groups -Title: Find AWS CloudWatch Log Groups and Retrieve Attributes + - CloudWatch Log Groups +Title: Find AWS CloudWatch Log Groups and Retrieve Attributes \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_group_5.yaml b/queries/aws_cloudwatch_log_group_5.yaml old mode 100755 new mode 100644 index 774b3d713..9ff72a786 --- a/queries/aws_cloudwatch_log_group_5.yaml +++ b/queries/aws_cloudwatch_log_group_5.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes - such as ARN, creation time, stored bytes, metric filter count, and more. +Description: Allows users to query AWS CloudWatch Log Groups and retrieve their attributes such as ARN, creation time, stored bytes, metric filter count, and more. ID: aws_cloudwatch_log_group_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n creation_time\nfrom\n aws_cloudwatch_log_group\n\ - where\n data_protection_policy is null;" + QueryToExecute: | + SELECT + arn, + name, + creation_time + FROM + aws_cloudwatch_log_group + WHERE + data_protection_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Log Groups and Retrieve Attributes + - CloudWatch +Title: Find AWS CloudWatch Log Groups and Retrieve Attributes \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_metric_filter_1.yaml b/queries/aws_cloudwatch_log_metric_filter_1.yaml old mode 100755 new mode 100644 index 185bb8f06..afb27d510 --- a/queries/aws_cloudwatch_log_metric_filter_1.yaml +++ b/queries/aws_cloudwatch_log_metric_filter_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed - information about each filter, including its name, creation date, associated log - group, filter pattern, metric transformations and more. +Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed information about each filter, including its name, creation date, associated log group, filter pattern, metric transformations and more. ID: aws_cloudwatch_log_metric_filter_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n log_group_name,\n creation_time,\n filter_pattern,\n\ - \ metric_transformation_name,\n metric_transformation_namespace,\n metric_transformation_value\n\ - from\n aws_cloudwatch_log_metric_filter;" + QueryToExecute: | + SELECT + name, + log_group_name, + creation_time, + filter_pattern, + metric_transformation_name, + metric_transformation_namespace, + metric_transformation_value + FROM + aws_cloudwatch_log_metric_filter; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find all AWS CloudWatch log metric filters + - CloudWatch +Title: Find all AWS CloudWatch log metric filters \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_metric_filter_2.yaml b/queries/aws_cloudwatch_log_metric_filter_2.yaml old mode 100755 new mode 100644 index febdcb989..201bd572a --- a/queries/aws_cloudwatch_log_metric_filter_2.yaml +++ b/queries/aws_cloudwatch_log_metric_filter_2.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed - information about each filter, including its name, creation date, associated log - group, filter pattern, metric transformations and more. +Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed information about each filter, including its name, creation date, associated log group, filter pattern, metric transformations and more. ID: aws_cloudwatch_log_metric_filter_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n log_group_name,\n filter_pattern\nfrom\n aws_cloudwatch_log_metric_filter\n\ - where\n filter_pattern ilike '%error%';" + QueryToExecute: | + SELECT + name, + log_group_name, + filter_pattern + FROM + aws_cloudwatch_log_metric_filter + WHERE + filter_pattern ILIKE '%error%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch log metric filters and details + - CloudWatch +Title: List all AWS CloudWatch log metric filters and details \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_metric_filter_3.yaml b/queries/aws_cloudwatch_log_metric_filter_3.yaml old mode 100755 new mode 100644 index 771ddff3a..fda7785dd --- a/queries/aws_cloudwatch_log_metric_filter_3.yaml +++ b/queries/aws_cloudwatch_log_metric_filter_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed - information about each filter, including its name, creation date, associated log - group, filter pattern, metric transformations and more. +Description: Allows users to query AWS CloudWatch log metric filters to obtain detailed information about each filter, including its name, creation date, associated log group, filter pattern, metric transformations and more. ID: aws_cloudwatch_log_metric_filter_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n count(name) as metric_filter_count\n\ - from\n aws_cloudwatch_log_metric_filter\ngroup by\n log_group_name;" + QueryToExecute: | + SELECT + log_group_name, + COUNT(name) AS metric_filter_count + FROM + aws_cloudwatch_log_metric_filter + GROUP BY + log_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch log metric filters with details + - CloudWatch +Title: Find AWS CloudWatch log metric filters with details \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_resource_policy_1.yaml b/queries/aws_cloudwatch_log_resource_policy_1.yaml old mode 100755 new mode 100644 index f36ade972..65e99ce63 --- a/queries/aws_cloudwatch_log_resource_policy_1.yaml +++ b/queries/aws_cloudwatch_log_resource_policy_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CloudWatch Log Resource Policies, providing - details such as the policy name, policy document, and last updated timestamp. +Description: Allows users to query AWS CloudWatch Log Resource Policies, providing details such as the policy name, policy document, and last updated timestamp. ID: aws_cloudwatch_log_resource_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_name,\n last_updated_time,\n jsonb_pretty(policy)\ - \ as policy,\n jsonb_pretty(policy_std) as policy_std\nfrom\n aws_cloudwatch_log_resource_policy;" + QueryToExecute: | + SELECT + policy_name, + last_updated_time, + JSONB_PRETTY(policy) AS policy, + JSONB_PRETTY(policy_std) AS policy_std + FROM + aws_cloudwatch_log_resource_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find all AWS CloudWatch Log Resource Policies + - CloudWatch +Title: Find all AWS CloudWatch Log Resource Policies \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_stream_1.yaml b/queries/aws_cloudwatch_log_stream_1.yaml old mode 100755 new mode 100644 index 32e3473aa..d6fdb6e07 --- a/queries/aws_cloudwatch_log_stream_1.yaml +++ b/queries/aws_cloudwatch_log_stream_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudWatch Log Stream to retrieve detailed - information about each log stream within a log group. +Description: Allows users to query AWS CloudWatch Log Stream to retrieve detailed information about each log stream within a log group. ID: aws_cloudwatch_log_stream_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n log_group_name,\n region\nfrom\n aws_cloudwatch_log_stream;" + QueryToExecute: | + SELECT + name, + log_group_name, + region + FROM + aws_cloudwatch_log_stream; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch Log Stream -Title: Find AWS CloudWatch Log Streams Using SQL + - CloudWatch Log Stream +Title: Find AWS CloudWatch Log Streams Using SQL \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_stream_2.yaml b/queries/aws_cloudwatch_log_stream_2.yaml old mode 100755 new mode 100644 index 9db06eab0..6c078de1d --- a/queries/aws_cloudwatch_log_stream_2.yaml +++ b/queries/aws_cloudwatch_log_stream_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CloudWatch Log Stream to retrieve detailed - information about each log stream within a log group. +Description: Allows users to query AWS CloudWatch Log Stream to retrieve detailed information about each log stream within a log group. ID: aws_cloudwatch_log_stream_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n count(*) as log_stream_count\nfrom\n\ - \ aws_cloudwatch_log_stream\ngroup by\n log_group_name;" + QueryToExecute: | + SELECT + log_group_name, + COUNT(*) AS log_stream_count + FROM + aws_cloudwatch_log_stream + GROUP BY + log_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch Log Stream -Title: List all AWS CloudWatch Log Stream information + - CloudWatch Log Stream +Title: List all AWS CloudWatch Log Stream information \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_subscription_filter_1.yaml b/queries/aws_cloudwatch_log_subscription_filter_1.yaml old mode 100755 new mode 100644 index ad7b821ca..cc9c8bb7b --- a/queries/aws_cloudwatch_log_subscription_filter_1.yaml +++ b/queries/aws_cloudwatch_log_subscription_filter_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing - information about each subscription filter associated with the specified log group. +Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing information about each subscription filter associated with the specified log group. ID: aws_cloudwatch_log_subscription_filter_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n log_group_name,\n creation_time,\n filter_pattern,\n\ - \ destination_arn\nfrom\n aws_cloudwatch_log_subscription_filter;" + QueryToExecute: | + SELECT + name, + log_group_name, + creation_time, + filter_pattern, + destination_arn + FROM + aws_cloudwatch_log_subscription_filter; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Log Subscription Filters + - CloudWatch +Title: List AWS CloudWatch Log Subscription Filters \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_subscription_filter_2.yaml b/queries/aws_cloudwatch_log_subscription_filter_2.yaml old mode 100755 new mode 100644 index dd4cded4d..b8f85390a --- a/queries/aws_cloudwatch_log_subscription_filter_2.yaml +++ b/queries/aws_cloudwatch_log_subscription_filter_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing - information about each subscription filter associated with the specified log group. +Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing information about each subscription filter associated with the specified log group. ID: aws_cloudwatch_log_subscription_filter_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n log_group_name,\n filter_pattern\nfrom\n aws_cloudwatch_log_subscription_filter\n\ - where\n filter_pattern ilike '%error%';" + QueryToExecute: | + SELECT + name, + log_group_name, + filter_pattern + FROM + aws_cloudwatch_log_subscription_filter + WHERE + filter_pattern ILIKE '%error%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Log Subscription Filters + - CloudWatch +Title: List all AWS CloudWatch Log Subscription Filters \ No newline at end of file diff --git a/queries/aws_cloudwatch_log_subscription_filter_3.yaml b/queries/aws_cloudwatch_log_subscription_filter_3.yaml old mode 100755 new mode 100644 index 24a2d3a6f..cfa763f0c --- a/queries/aws_cloudwatch_log_subscription_filter_3.yaml +++ b/queries/aws_cloudwatch_log_subscription_filter_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing - information about each subscription filter associated with the specified log group. +Description: Allows users to query AWS CloudWatch Log Subscription Filters, providing information about each subscription filter associated with the specified log group. ID: aws_cloudwatch_log_subscription_filter_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n count(name) as subscription_filter_count\n\ - from\n aws_cloudwatch_log_subscription_filter\ngroup by\n log_group_name;" + QueryToExecute: | + SELECT + log_group_name, + COUNT(name) AS subscription_filter_count + FROM + aws_cloudwatch_log_subscription_filter + GROUP BY + log_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Log Subscription Filters + - CloudWatch +Title: List all AWS CloudWatch Log Subscription Filters \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_1.yaml b/queries/aws_cloudwatch_metric_1.yaml old mode 100755 new mode 100644 index a9da116fd..64d4aa0b6 --- a/queries/aws_cloudwatch_metric_1.yaml +++ b/queries/aws_cloudwatch_metric_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudWatch Metrics to gather information about - the performance of their AWS resources and applications. +Description: Allows users to query AWS CloudWatch Metrics to gather information about the performance of their AWS resources and applications. ID: aws_cloudwatch_metric_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n namespace,\n dimensions\nfrom\n aws_cloudwatch_metric;" + QueryToExecute: | + SELECT + metric_name, + namespace, + dimensions + FROM + aws_cloudwatch_metric; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Metrics with SQL Queries + - CloudWatch +Title: List AWS CloudWatch Metrics with SQL Queries \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_2.yaml b/queries/aws_cloudwatch_metric_2.yaml old mode 100755 new mode 100644 index d6fccc0bd..66c3aa351 --- a/queries/aws_cloudwatch_metric_2.yaml +++ b/queries/aws_cloudwatch_metric_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CloudWatch Metrics to gather information about - the performance of their AWS resources and applications. +Description: Allows users to query AWS CloudWatch Metrics to gather information about the performance of their AWS resources and applications. ID: aws_cloudwatch_metric_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n namespace,\n dimensions\nfrom\n aws_cloudwatch_metric\n\ - where\n namespace = 'AWS/EBS';" + QueryToExecute: | + SELECT + metric_name, + namespace, + dimensions + FROM + aws_cloudwatch_metric + WHERE + namespace = 'AWS/EBS'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS Resources Performance via CloudWatch Metrics + - CloudWatch +Title: Find AWS Resources Performance via CloudWatch Metrics \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_3.yaml b/queries/aws_cloudwatch_metric_3.yaml old mode 100755 new mode 100644 index dee9fc057..bf948d37a --- a/queries/aws_cloudwatch_metric_3.yaml +++ b/queries/aws_cloudwatch_metric_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS CloudWatch Metrics to gather information about - the performance of their AWS resources and applications. +Description: Allows users to query AWS CloudWatch Metrics to gather information about the performance of their AWS resources and applications. ID: aws_cloudwatch_metric_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n namespace,\n dimensions\nfrom\n aws_cloudwatch_metric\n\ - where\n namespace = 'AWS/EBS'\n and metric_name = 'VolumeReadOps';" + QueryToExecute: | + SELECT + metric_name, + namespace, + dimensions + FROM + aws_cloudwatch_metric + WHERE + namespace = 'AWS/EBS' + AND metric_name = 'VolumeReadOps'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch metrics for EBS VolumeReadOps + - CloudWatch +Title: List all AWS CloudWatch metrics for EBS VolumeReadOps \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_4.yaml b/queries/aws_cloudwatch_metric_4.yaml old mode 100755 new mode 100644 index 89a0518a6..65af30cd6 --- a/queries/aws_cloudwatch_metric_4.yaml +++ b/queries/aws_cloudwatch_metric_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CloudWatch Metrics to gather information about - the performance of their AWS resources and applications. +Description: Allows users to query AWS CloudWatch Metrics to gather information about the performance of their AWS resources and applications. ID: aws_cloudwatch_metric_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n namespace,\n dimensions\nfrom\n aws_cloudwatch_metric\n\ - where\n dimensions_filter = '[\n {\"Name\": \"ClusterIdentifier\", \"Value\"\ - : \"my-cluster-1\"}\n ]'::jsonb;" + QueryToExecute: | + SELECT + metric_name, + namespace, + dimensions + FROM + aws_cloudwatch_metric + WHERE + dimensions_filter = '[{"Name": "ClusterIdentifier", "Value": "my-cluster-1"}]'::jsonb; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch Metrics -Title: Find AWS CloudWatch Metrics for Resource Performance + - CloudWatch Metrics +Title: Find AWS CloudWatch Metrics for Resource Performance \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_5.yaml b/queries/aws_cloudwatch_metric_5.yaml old mode 100755 new mode 100644 index 556782dde..f23ecb16e --- a/queries/aws_cloudwatch_metric_5.yaml +++ b/queries/aws_cloudwatch_metric_5.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS CloudWatch Metrics to gather information about - the performance of their AWS resources and applications. +Description: Allows users to query AWS CloudWatch Metrics to gather information about the performance of their AWS resources and applications. ID: aws_cloudwatch_metric_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n namespace,\n dimensions\nfrom\n aws_cloudwatch_metric\n\ - where\n dimensions_filter = '[\n {\"Name\": \"Type\", \"Value\": \"API\"},\n\ - \ {\"Name\": \"Service\", \"Value\": \"EC2\"}\n ]'::jsonb;" + QueryToExecute: | + SELECT + metric_name, + namespace, + dimensions + FROM + aws_cloudwatch_metric + WHERE + dimensions_filter = '[ + {"Name": "Type", "Value": "API"}, + {"Name": "Service", "Value": "EC2"} + ]'::jsonb; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Metrics for Performance Information + - CloudWatch +Title: Find AWS CloudWatch Metrics for Performance Information \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_1.yaml b/queries/aws_cloudwatch_metric_data_point_1.yaml old mode 100755 new mode 100644 index 89fde6057..905d44c14 --- a/queries/aws_cloudwatch_metric_data_point_1.yaml +++ b/queries/aws_cloudwatch_metric_data_point_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for a defined metric. ID: aws_cloudwatch_metric_data_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n period,\n value,\n expression\n\ - from\n aws_cloudwatch_metric_data_point\nwhere\n id = 'm1'\n and expression\ - \ = 'select max(CPUUtilization) from schema(\"AWS/EC2\", InstanceId)'\norder by\n\ - \ timestamp;" + QueryToExecute: | + SELECT + id, + label, + timestamp, + period, + value, + expression + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'm1' + AND expression = 'SELECT MAX(CPUUtilization) FROM schema("AWS/EC2", InstanceId)' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List All AWS CloudWatch Metric Data Points + - CloudWatch +Title: List All AWS CloudWatch Metric Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_2.yaml b/queries/aws_cloudwatch_metric_data_point_2.yaml old mode 100755 new mode 100644 index c24b2f2ef..7f6f4da4e --- a/queries/aws_cloudwatch_metric_data_point_2.yaml +++ b/queries/aws_cloudwatch_metric_data_point_2.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for a defined metric. ID: aws_cloudwatch_metric_data_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n period,\n value,\n expression\n\ - from\n aws_cloudwatch_metric_data_point\nwhere\n id = 'e1'\n and expression\ - \ = 'SUM(METRICS(''error''))'\norder by\n timestamp;" + QueryToExecute: | + SELECT + id, + label, + timestamp, + period, + value, + expression + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'e1' + AND expression = 'SUM(METRICS(''error''))' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch MetricDataPoints details + - CloudWatch +Title: Find AWS CloudWatch MetricDataPoints details \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_3.yaml b/queries/aws_cloudwatch_metric_data_point_3.yaml old mode 100755 new mode 100644 index d0013df31..bac4ed3e8 --- a/queries/aws_cloudwatch_metric_data_point_3.yaml +++ b/queries/aws_cloudwatch_metric_data_point_3.yaml @@ -1,26 +1,50 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for a defined metric. ID: aws_cloudwatch_metric_data_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n period,\n round(value::numeric,\ - \ 2) as avg_cpu,\n metric_stat\nfrom\n aws_cloudwatch_metric_data_point\nwhere\n\ - \ id = 'm1'\n and value > 80\n and timestamp >= now() - interval '5 day'\n\ - \ and metric_stat = '{\n \"Metric\": {\n \"Namespace\": \"AWS/EC2\",\n\ - \ \"MetricName\": \"CPUUtilization\",\n \"Dimensions\": [\n {\n \ - \ \"Name\": \"InstanceId\",\n \"Value\": \"i-0353536c53f7c8235\"\n\ - \ },\n {\n \"Name\": \"InstanceId\",\n \"Value\": \"i-0dd7043e0f6f0f36d\"\ - \n }\n ]},\n \"Stat\": \"Average\"}'\norder by\n timestamp;" + QueryToExecute: | + SELECT + id, + label, + timestamp, + period, + ROUND(value::numeric, 2) AS avg_cpu, + metric_stat + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'm1' + AND value > 80 + AND timestamp >= NOW() - INTERVAL '5 day' + AND metric_stat = '{ + "Metric": { + "Namespace": "AWS/EC2", + "MetricName": "CPUUtilization", + "Dimensions": [ + { + "Name": "InstanceId", + "Value": "i-0353536c53f7c8235" + }, + { + "Name": "InstanceId", + "Value": "i-0dd7043e0f6f0f36d" + } + ] + }, + "Stat": "Average" + }' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List All AWS CloudWatch MetricDataPoints + - CloudWatch +Title: List All AWS CloudWatch MetricDataPoints \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_4.yaml b/queries/aws_cloudwatch_metric_data_point_4.yaml old mode 100755 new mode 100644 index 685081f06..7b5fecacb --- a/queries/aws_cloudwatch_metric_data_point_4.yaml +++ b/queries/aws_cloudwatch_metric_data_point_4.yaml @@ -1,28 +1,46 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for a defined metric. ID: aws_cloudwatch_metric_data_point_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n value,\n metric_stat\n\ - from\n aws_cloudwatch_metric_data_point\nwhere\n id = 'm1'\n and value > 1000\n\ - \ and period = 86400\n and scan_by = 'TimestampDescending'\n and timestamp\ - \ between '2023-03-10T00:00:00Z' and '2023-03-16T00:00:00Z'\n and metric_stat\ - \ = '{\n \"Metric\": {\n \"Namespace\": \"AWS/EBS\",\n \"MetricName\"\ - : \"VolumeReadOps\",\n \"Dimensions\": [\n {\n \"Name\": \"VolumeId\"\ - ,\n \"Value\": \"vol-00607053b218c6d74\"\n }\n ]},\n \"Stat\"\ - : \"Average\"}';" + QueryToExecute: | + SELECT + id, + label, + timestamp, + value, + metric_stat + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'm1' + AND value > 1000 + AND period = 86400 + AND scan_by = 'TimestampDescending' + AND timestamp BETWEEN '2023-03-10T00:00:00Z' AND '2023-03-16T00:00:00Z' + AND metric_stat = '{ + "Metric": { + "Namespace": "AWS/EBS", + "MetricName": "VolumeReadOps", + "Dimensions": [ + { + "Name": "VolumeId", + "Value": "vol-00607053b218c6d74" + } + ]}, + "Stat": "Average" + }'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch MetricDataPoints for defined metric + - CloudWatch +Title: Find AWS CloudWatch MetricDataPoints for defined metric \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_5.yaml b/queries/aws_cloudwatch_metric_data_point_5.yaml old mode 100755 new mode 100644 index 90e6bb6b4..34852e79f --- a/queries/aws_cloudwatch_metric_data_point_5.yaml +++ b/queries/aws_cloudwatch_metric_data_point_5.yaml @@ -1,25 +1,44 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for + a defined metric. ID: aws_cloudwatch_metric_data_point_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n value,\n metric_stat\n\ - from\n aws_cloudwatch_metric_data_point\nwhere\n id = 'e1'\n and value < 10\n\ - \ and timestamp >= now() - interval '7 day'\n and metric_stat = '{\n \"Metric\"\ - : {\n \"Namespace\": \"AWS/ElastiCache\",\n \"MetricName\": \"CacheHits\"\ - ,\n \"Dimensions\": [\n {\n \"Name\": \"CacheClusterId\",\n \ - \ \"Value\": \"cluster-delete-001\"\n }\n ]},\n \"Stat\": \"Sum\"\ - }'\norder by\n timestamp;" + QueryToExecute: | + SELECT + id, + label, + timestamp, + value, + metric_stat + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'e1' + AND value < 10 + AND timestamp >= NOW() - INTERVAL '7 DAY' + AND metric_stat = '{ + "Metric": { + "Namespace": "AWS/ElastiCache", + "MetricName": "CacheHits", + "Dimensions": [ + { + "Name": "CacheClusterId", + "Value": "cluster-delete-001" + } + ]}, + "Stat": "Sum"}' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List all AWS CloudWatch Metric Data Points + - CloudWatch +Title: List all AWS CloudWatch Metric Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_data_point_6.yaml b/queries/aws_cloudwatch_metric_data_point_6.yaml old mode 100755 new mode 100644 index 32c7c9b0b..79ad436e1 --- a/queries/aws_cloudwatch_metric_data_point_6.yaml +++ b/queries/aws_cloudwatch_metric_data_point_6.yaml @@ -1,28 +1,51 @@ -Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed - information about the data points for a defined metric. +Description: Allows users to query AWS CloudWatch MetricDataPoints to fetch detailed information about the data points for a defined metric. ID: aws_cloudwatch_metric_data_point_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n label,\n timestamp,\n value,\n metric_stat\n\ - from\n aws_cloudwatch_metric_data_point\nwhere\n id = 'e1'\n and source_account_id\ - \ = '533743456432100'\n and timestamp between '2023-03-10T00:00:00Z' and '2023-03-16T00:00:00Z'\n\ - \ and metric_stat = '{\n \"Metric\": {\n \"Namespace\": \"AWS/S3\",\n \ - \ \"MetricName\": \"BucketSizeBytes\",\n \"Dimensions\": [\n {\n \ - \ \"Name\": \"BucketName\",\n \"Value\": \"steampipe-test\"\n \ - \ },\n {\n \"Name\": \"StorageType\",\n \"Value\": \"StandardStorage\"\ - \n }\n ]},\n \"Stat\": \"Maximum\"}'\norder by\n timestamp;" + QueryToExecute: | + SELECT + id, + label, + timestamp, + value, + metric_stat + FROM + aws_cloudwatch_metric_data_point + WHERE + id = 'e1' + AND source_account_id = '533743456432100' + AND timestamp BETWEEN '2023-03-10T00:00:00Z' AND '2023-03-16T00:00:00Z' + AND metric_stat = '{ + "Metric": { + "Namespace": "AWS/S3", + "MetricName": "BucketSizeBytes", + "Dimensions": [ + { + "Name": "BucketName", + "Value": "steampipe-test" + }, + { + "Name": "StorageType", + "Value": "StandardStorage" + } + ] + }, + "Stat": "Maximum" + }' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Query AWS CloudWatch Metric Data Points for Detailed Info + - CloudWatch +Title: Query AWS CloudWatch Metric Data Points for Detailed Info \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_1.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_1.yaml old mode 100755 new mode 100644 index 9336d0391..d6fb71ef0 --- a/queries/aws_cloudwatch_metric_statistic_data_point_1.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_1.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n timestamp,\n round(minimum::numeric,\ - \ 2) as min_cpu,\n round(maximum::numeric, 2) as max_cpu,\n round(average::numeric,\ - \ 2) as avg_cpu,\n sum,\n sample_count\nfrom\n aws_cloudwatch_metric_statistic_data_point\n\ - where\n namespace = 'AWS/EC2'\n and metric_name = 'CPUUtilization'\norder by\n\ - \ timestamp;" + QueryToExecute: | + SELECT + metric_name, + timestamp, + ROUND(minimum::numeric, 2) AS min_cpu, + ROUND(maximum::numeric, 2) AS max_cpu, + ROUND(average::numeric, 2) AS avg_cpu, + sum, + sample_count + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/EC2' + AND metric_name = 'CPUUtilization' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Query AWS CloudWatch Metric Statistics Data Points + - CloudWatch +Title: Query AWS CloudWatch Metric Statistics Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_2.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_2.yaml old mode 100755 new mode 100644 index afcf126c0..17a771485 --- a/queries/aws_cloudwatch_metric_statistic_data_point_2.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ round(average::numeric, 2) as avg_cpu\nfrom\n aws_cloudwatch_metric_statistic_data_point\n\ - where\n namespace = 'AWS/EC2'\n and metric_name = 'CPUUtilization'\n and average\ - \ > 80\n and timestamp >= now() - interval '5 day'\n and dimensions = '[\n \ - \ {\"Name\": \"InstanceId\", \"Value\": \"i-0dd7043e0f6f0f36d\"}\n ]'\norder\ - \ by\n timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + ROUND(average::numeric, 2) AS avg_cpu + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/EC2' + AND metric_name = 'CPUUtilization' + AND average > 80 + AND timestamp >= NOW() - INTERVAL '5 day' + AND dimensions = '[ + {"Name": "InstanceId", "Value": "i-0dd7043e0f6f0f36d"} + ]' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Metric Statistics Data Points + - CloudWatch +Title: List AWS CloudWatch Metric Statistics Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_3.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_3.yaml old mode 100755 new mode 100644 index f0f9c7ee6..b9e455f98 --- a/queries/aws_cloudwatch_metric_statistic_data_point_3.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_3.yaml @@ -1,26 +1,37 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ average\nfrom\n aws_cloudwatch_metric_statistic_data_point\nwhere\n namespace\ - \ = 'AWS/EBS'\n and metric_name = 'VolumeReadOps'\n and average > 1000\n and\ - \ timestamp between '2023-03-10T00:00:00Z' and '2023-03-16T00:00:00Z'\n and period\ - \ = 300\n and dimensions = '[\n {\"Name\": \"VolumeId\", \"Value\": \"vol-00607053b218c6d74\"\ - }\n ]'\norder by\n timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + average + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/EBS' + AND metric_name = 'VolumeReadOps' + AND average > 1000 + AND timestamp BETWEEN '2023-03-10T00:00:00Z' AND '2023-03-16T00:00:00Z' + AND period = 300 + AND dimensions = '[ + {"Name": "VolumeId", "Value": "vol-00607053b218c6d74"} + ]' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Metric Statistic Data Points + - CloudWatch +Title: Find AWS CloudWatch Metric Statistic Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_4.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_4.yaml old mode 100755 new mode 100644 index 80d1c1559..42511b328 --- a/queries/aws_cloudwatch_metric_statistic_data_point_4.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_4.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ sum\nfrom\n aws_cloudwatch_metric_statistic_data_point\nwhere\n namespace\ - \ = 'AWS/ElastiCache'\n and metric_name = 'CacheHits'\n and sum < 10\n and\ - \ timestamp >= now() - interval '7 day'\n and dimensions = '[\n {\"Name\"\ - : \"CacheClusterId\", \"Value\": \"cluster-delete-001\"}\n ]'\norder by\n \ - \ timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + SUM + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/ElastiCache' + AND metric_name = 'CacheHits' + AND sum < 10 + AND timestamp >= NOW() - INTERVAL '7 day' + AND dimensions = '[ + {"Name": "CacheClusterId", "Value": "cluster-delete-001"} + ]' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch Metric Statistics -Title: Find AWS CloudWatch Metric Statistics Data Points + - CloudWatch Metric Statistics +Title: Find AWS CloudWatch Metric Statistics Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_5.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_5.yaml old mode 100755 new mode 100644 index 2e418fe77..4328913b5 --- a/queries/aws_cloudwatch_metric_statistic_data_point_5.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_5.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ maximum\nfrom\n aws_cloudwatch_metric_statistic_data_point\nwhere\n namespace\ - \ = 'AWS/Lambda'\n and metric_name = 'Duration'\n and maximum > 100\n and timestamp\ - \ >= '2023-02-15T00:00:00Z'\n and timestamp <= '2023-03-15T00:00:00Z'\n and\ - \ period = 86400\n and dimensions = '[\n {\"Name\": \"FunctionName\", \"Value\"\ - : \"test\"}\n ]'\norder by\n timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + maximum + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/Lambda' + AND metric_name = 'Duration' + AND maximum > 100 + AND timestamp >= '2023-02-15T00:00:00Z' + AND timestamp <= '2023-03-15T00:00:00Z' + AND period = 86400 + AND dimensions = '[ + {"Name": "FunctionName", "Value": "test"} + ]' + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List All AWS CloudWatch Metric Statistics Data Points + - CloudWatch +Title: List All AWS CloudWatch Metric Statistics Data Points \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_6.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_6.yaml old mode 100755 new mode 100644 index e4f3c4cea..3712a42d3 --- a/queries/aws_cloudwatch_metric_statistic_data_point_6.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_6.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ round(average::numeric, 2) as avg_cpu\nfrom\n aws_cloudwatch_metric_statistic_data_point\n\ - where\n namespace = 'AWS/RDS'\n and metric_name = 'CPUUtilization'\n and average\ - \ > 80\n and timestamp >= now() - interval '30 day'\n and dimensions = '[\n\ - \ {\"Name\": \"DBInstanceIdentifier\", \"Value\": \"database-1\"}\n ]'\n\ - order by\n timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + ROUND(average::NUMERIC, 2) AS avg_cpu + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/RDS' + AND metric_name = 'CPUUtilization' + AND average > 80 + AND timestamp >= NOW() - INTERVAL '30 day' + AND dimensions = '[ + {"Name": "DBInstanceIdentifier", "Value": "database-1"} + ]' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS CloudWatch Metric Statistics Data for RDS CPU Utilization + - CloudWatch +Title: Find AWS CloudWatch Metric Statistics Data for RDS CPU Utilization \ No newline at end of file diff --git a/queries/aws_cloudwatch_metric_statistic_data_point_7.yaml b/queries/aws_cloudwatch_metric_statistic_data_point_7.yaml old mode 100755 new mode 100644 index 4b06023ee..51396b69f --- a/queries/aws_cloudwatch_metric_statistic_data_point_7.yaml +++ b/queries/aws_cloudwatch_metric_statistic_data_point_7.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to - obtain detailed metrics data. +Description: Allows users to query AWS CloudWatch Metric Statistics Data Point to obtain detailed metrics data. ID: aws_cloudwatch_metric_statistic_data_point_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(dimensions) as dimensions,\n timestamp,\n\ - \ minimum\nfrom\n aws_cloudwatch_metric_statistic_data_point\nwhere\n namespace\ - \ = 'AWS/S3'\n and metric_name = 'BucketSizeBytes'\n and timestamp between '2023-03-6T00:00:00Z'\ - \ and '2023-03-15T00:00:00Z'\n and period = 86400\n and dimensions = '[\n \ - \ {\"Name\": \"BucketName\", \"Value\": \"steampipe-test\"},\n {\"Name\":\ - \ \"StorageType\", \"Value\": \"StandardStorage\"}\n ]'\norder by\n timestamp;" + QueryToExecute: | + SELECT + jsonb_pretty(dimensions) AS dimensions, + timestamp, + minimum + FROM + aws_cloudwatch_metric_statistic_data_point + WHERE + namespace = 'AWS/S3' + AND metric_name = 'BucketSizeBytes' + AND timestamp BETWEEN '2023-03-06T00:00:00Z' AND '2023-03-15T00:00:00Z' + AND period = 86400 + AND dimensions = '[ + {"Name": "BucketName", "Value": "steampipe-test"}, + {"Name": "StorageType", "Value": "StandardStorage"} + ]' + ORDER BY + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: List AWS CloudWatch Metric Statistics for S3 Buckets + - CloudWatch +Title: List AWS CloudWatch Metric Statistics for S3 Buckets \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_1.yaml b/queries/aws_codeartifact_domain_1.yaml old mode 100755 new mode 100644 index 6bb37d16e..87b44b7d1 --- a/queries/aws_codeartifact_domain_1.yaml +++ b/queries/aws_codeartifact_domain_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n created_time,\n encryption_key,\n status,\n\ - \ owner,\n tags\nfrom\n aws_codeartifact_domain;" + QueryToExecute: | + SELECT + arn, + created_time, + encryption_key, + status, + owner, + tags + FROM + aws_codeartifact_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domains and Details + - CodeArtifact +Title: Find AWS CodeArtifact Domains and Details \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_2.yaml b/queries/aws_codeartifact_domain_2.yaml old mode 100755 new mode 100644 index 0da46cafe..d325ad948 --- a/queries/aws_codeartifact_domain_2.yaml +++ b/queries/aws_codeartifact_domain_2.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n created_time,\n status,\n s3_bucket_arn,\n\ - \ tags\nfrom\n aws_codeartifact_domain\nwhere\n encryption_key is null;" + QueryToExecute: | + SELECT + arn, + created_time, + status, + s3_bucket_arn, + tags + FROM + aws_codeartifact_domain + WHERE + encryption_key IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domains and Their Details + - CodeArtifact +Title: Find AWS CodeArtifact Domains and Their Details \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_3.yaml b/queries/aws_codeartifact_domain_3.yaml old mode 100755 new mode 100644 index c0472c348..d288229d4 --- a/queries/aws_codeartifact_domain_3.yaml +++ b/queries/aws_codeartifact_domain_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n created_time,\n status,\n s3_bucket_arn,\n\ - \ tags\nfrom\n aws_codeartifact_domain\nwhere\n status != 'Active';" + QueryToExecute: | + SELECT + arn, + created_time, + status, + s3_bucket_arn, + tags + FROM + aws_codeartifact_domain + WHERE + status != 'Active'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domains Ownership, Encryption, Policy Info + - CodeArtifact +Title: Find AWS CodeArtifact Domains Ownership, Encryption, Policy Info \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_4.yaml b/queries/aws_codeartifact_domain_4.yaml old mode 100755 new mode 100644 index 67064d0d7..996e11181 --- a/queries/aws_codeartifact_domain_4.yaml +++ b/queries/aws_codeartifact_domain_4.yaml @@ -1,26 +1,37 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect\nfrom\n aws_codeartifact_domain,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n string_to_array(p, ':') as pa,\n jsonb_array_elements_text(s -> 'Action')\ - \ as a\nwhere\n s ->> 'Effect' = 'Allow'\n and (\n pa [5] != account_id\n\ - \ or p = '*'\n );" + QueryToExecute: | + SELECT + arn, + p AS principal, + a AS action, + s ->> 'Effect' AS effect + FROM + aws_codeartifact_domain, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + string_to_array(p, ':') AS pa, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND ( + pa[5] != account_id + OR p = '*' + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domains for Ownership, Key, Policy + - CodeArtifact +Title: Find AWS CodeArtifact Domains for Ownership, Key, Policy \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_5.yaml b/queries/aws_codeartifact_domain_5.yaml old mode 100755 new mode 100644 index ececfb210..ffedece6a --- a/queries/aws_codeartifact_domain_5.yaml +++ b/queries/aws_codeartifact_domain_5.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.arn as domain_arn,\n b.arn as bucket_arn,\n d.encryption_key\ - \ domain_encryption_key,\n bucket_policy_is_public\nfrom\n aws_codeartifact_domain\ - \ d\n join aws_s3_bucket b on d.s3_bucket_arn = b.arn;" + QueryToExecute: | + SELECT + d.arn AS domain_arn, + b.arn AS bucket_arn, + d.encryption_key AS domain_encryption_key, + bucket_policy_is_public + FROM + aws_codeartifact_domain d + JOIN + aws_s3_bucket b ON d.s3_bucket_arn = b.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domain Ownership & Encryption Key + - CodeArtifact +Title: Find AWS CodeArtifact Domain Ownership & Encryption Key \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_6.yaml b/queries/aws_codeartifact_domain_6.yaml old mode 100755 new mode 100644 index 8257221d8..44ff4fd0b --- a/queries/aws_codeartifact_domain_6.yaml +++ b/queries/aws_codeartifact_domain_6.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.arn as domain_arn,\n d.encryption_key domain_encryption_key,\n\ - \ key_manager,\n key_state\nfrom\n aws_codeartifact_domain d\n join aws_kms_key\ - \ k on d.encryption_key = k.arn;" + QueryToExecute: | + SELECT + d.arn AS domain_arn, + d.encryption_key AS domain_encryption_key, + key_manager, + key_state + FROM + aws_codeartifact_domain d + JOIN + aws_kms_key k + ON + d.encryption_key = k.arn; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Domains with Metadata + - CodeArtifact +Title: Find AWS CodeArtifact Domains with Metadata \ No newline at end of file diff --git a/queries/aws_codeartifact_domain_7.yaml b/queries/aws_codeartifact_domain_7.yaml old mode 100755 new mode 100644 index 09a09d757..3913bc738 --- a/queries/aws_codeartifact_domain_7.yaml +++ b/queries/aws_codeartifact_domain_7.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS CodeArtifact Domains for details such as domain - ownership, encryption key, and policy information. +Description: Allows users to query AWS CodeArtifact Domains for details such as domain ownership, encryption key, and policy information. ID: aws_codeartifact_domain_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.arn as domain_arn,\n d.encryption_key domain_encryption_key,\n\ - \ key_manager,\n key_state\nfrom\n aws_codeartifact_domain d\n join aws_kms_key\ - \ k on d.encryption_key = k.arn\nwhere \n key_manager = 'CUSTOMER';" + QueryToExecute: | + SELECT + d.arn AS domain_arn, + d.encryption_key AS domain_encryption_key, + key_manager, + key_state + FROM + aws_codeartifact_domain d + JOIN aws_kms_key k ON d.encryption_key = k.arn + WHERE + key_manager = 'CUSTOMER'; Tags: cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find all AWS CodeArtifact Domains and Encryption Details + - CodeArtifact +Title: Find all AWS CodeArtifact Domains and Encryption Details \ No newline at end of file diff --git a/queries/aws_codeartifact_repository_1.yaml b/queries/aws_codeartifact_repository_1.yaml old mode 100755 new mode 100644 index 003b05f9d..767444d37 --- a/queries/aws_codeartifact_repository_1.yaml +++ b/queries/aws_codeartifact_repository_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CodeArtifact Repository data, including details - about the repository, its domain ownership, and associated metadata. +Description: Allows users to query AWS CodeArtifact Repository data, including details about the repository, its domain ownership, and associated metadata. ID: aws_codeartifact_repository_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n domain_name,\n domain_owner,\n upstreams,\n\ - \ tags\nfrom\n aws_codeartifact_repository;" + QueryToExecute: | + SELECT + arn, + domain_name, + domain_owner, + upstreams, + tags + FROM + aws_codeartifact_repository; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeArtifact -Title: List all AWS CodeArtifact Repository with Domain Details + - AWS CodeArtifact +Title: List all AWS CodeArtifact Repository with Domain Details \ No newline at end of file diff --git a/queries/aws_codeartifact_repository_2.yaml b/queries/aws_codeartifact_repository_2.yaml old mode 100755 new mode 100644 index df1d915b1..c5657c2a2 --- a/queries/aws_codeartifact_repository_2.yaml +++ b/queries/aws_codeartifact_repository_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS CodeArtifact Repository data, including details - about the repository, its domain ownership, and associated metadata. +Description: Allows users to query AWS CodeArtifact Repository data, including details about the repository, its domain ownership, and associated metadata. ID: aws_codeartifact_repository_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n domain_name,\n domain_owner,\n tags,\n repository_endpoint\n\ - from\n aws_codeartifact_repository\nwhere\n repository_endpoint is not null;" + QueryToExecute: | + SELECT + arn, + domain_name, + domain_owner, + tags, + repository_endpoint + FROM + aws_codeartifact_repository + WHERE + repository_endpoint IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: List all details about AWS CodeArtifact Repositories + - CodeArtifact +Title: List all details about AWS CodeArtifact Repositories \ No newline at end of file diff --git a/queries/aws_codeartifact_repository_3.yaml b/queries/aws_codeartifact_repository_3.yaml old mode 100755 new mode 100644 index 295e9a971..2d4ac0a51 --- a/queries/aws_codeartifact_repository_3.yaml +++ b/queries/aws_codeartifact_repository_3.yaml @@ -1,26 +1,37 @@ -Description: Allows users to query AWS CodeArtifact Repository data, including details - about the repository, its domain ownership, and associated metadata. +Description: Allows users to query AWS CodeArtifact Repository data, including details about the repository, its domain ownership, and associated metadata. ID: aws_codeartifact_repository_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect\nfrom\n aws_codeartifact_repository,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n string_to_array(p, ':') as pa,\n jsonb_array_elements_text(s -> 'Action')\ - \ as a\nwhere\n s ->> 'Effect' = 'Allow'\n and (\n pa [5] != account_id\n\ - \ or p = '*'\n );" + QueryToExecute: | + SELECT + arn, + p AS principal, + a AS action, + s ->> 'Effect' AS effect + FROM + aws_codeartifact_repository, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + string_to_array(p, ':') AS pa, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND ( + pa[5] != account_id + OR p = '*' + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeArtifact -Title: List all AWS CodeArtifact Repositories with SQL Queries + - AWS CodeArtifact +Title: List all AWS CodeArtifact Repositories with SQL Queries \ No newline at end of file diff --git a/queries/aws_codeartifact_repository_4.yaml b/queries/aws_codeartifact_repository_4.yaml old mode 100755 new mode 100644 index 7e0e59391..fb5e2d271 --- a/queries/aws_codeartifact_repository_4.yaml +++ b/queries/aws_codeartifact_repository_4.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CodeArtifact Repository data, including details - about the repository, its domain ownership, and associated metadata. +Description: Allows users to query AWS CodeArtifact Repository data, including details about the repository, its domain ownership, and associated metadata. ID: aws_codeartifact_repository_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n domain_name,\n domain_owner,\n u ->> 'RepositoryName'\ - \ as upstream_repo_name\nfrom\n aws_codeartifact_repository,\n jsonb_array_elements(upstreams)\ - \ u;" + QueryToExecute: | + SELECT + arn, + domain_name, + domain_owner, + u ->> 'RepositoryName' AS upstream_repo_name + FROM + aws_codeartifact_repository, + jsonb_array_elements(upstreams) u; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeArtifact -Title: Find AWS CodeArtifact Repository Details with SQL + - CodeArtifact +Title: Find AWS CodeArtifact Repository Details with SQL \ No newline at end of file diff --git a/queries/aws_codebuild_build_1.yaml b/queries/aws_codebuild_build_1.yaml old mode 100755 new mode 100644 index 46e2b0c8e..f073f8c7f --- a/queries/aws_codebuild_build_1.yaml +++ b/queries/aws_codebuild_build_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n id,\n build_complete,\n timeout_in_minutes,\n\ - \ project_name,\n build_status,\n encryption_key,\n end_time,\n region\n\ - from\n aws_codebuild_build;" + QueryToExecute: | + SELECT + arn, + id, + build_complete, + timeout_in_minutes, + project_name, + build_status, + encryption_key, + end_time, + region + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild Build Information + - CodeBuild +Title: List all AWS CodeBuild Build Information \ No newline at end of file diff --git a/queries/aws_codebuild_build_10.yaml b/queries/aws_codebuild_build_10.yaml old mode 100755 new mode 100644 index fdcdc9f00..94cb182f0 --- a/queries/aws_codebuild_build_10.yaml +++ b/queries/aws_codebuild_build_10.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects'' builds. ID: aws_codebuild_build_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n source ->> 'Auth' as source_auth,\n source ->>\ - \ 'BuildStatusConfig' as source_BuildStatusConfig,\n source ->> 'Buildspec' as\ - \ source_buildspec,\n source ->> 'GitCloneDepth' as source_git_clone_depth,\n\ - \ source ->> 'GitSubmodulesConfig' as source_git_submodules_config,\n source\ - \ ->> 'GitCloneDepth' as source_git_clone_depth,\n source ->> 'InsecureSsl' as\ - \ source_insecure_ssl,\n source ->> 'Location' as source_location,\n source\ - \ ->> 'ReportBuildStatus' as source_report_build_status,\n source ->> 'SourceIdentifier'\ - \ as source_identifier,\n source ->> 'Type' as source_type\nfrom\n aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + source ->> 'Auth' AS source_auth, + source ->> 'BuildStatusConfig' AS source_build_status_config, + source ->> 'Buildspec' AS source_buildspec, + source ->> 'GitCloneDepth' AS source_git_clone_depth, + source ->> 'GitSubmodulesConfig' AS source_git_submodules_config, + source ->> 'InsecureSsl' AS source_insecure_ssl, + source ->> 'Location' AS source_location, + source ->> 'ReportBuildStatus' AS source_report_build_status, + source ->> 'SourceIdentifier' AS source_identifier, + source ->> 'Type' AS source_type + FROM + aws_codebuild_build; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeBuild -Title: Find AWS CodeBuild Build Projects Details + - AWS CodeBuild +Title: Find AWS CodeBuild Build Projects Details \ No newline at end of file diff --git a/queries/aws_codebuild_build_11.yaml b/queries/aws_codebuild_build_11.yaml old mode 100755 new mode 100644 index b17ec9623..6bc095438 --- a/queries/aws_codebuild_build_11.yaml +++ b/queries/aws_codebuild_build_11.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n f ->> 'Identifier' as file_system_identifier,\n\ - \ f ->> 'Location' as file_system_location,\n f ->> 'MountOptions' as file_system_mount_options,\n\ - \ f ->> 'MountPoint' as file_system_mount_point,\n f ->> 'Type' as file_system_type\n\ - from\n aws_codebuild_build,\n jsonb_array_elements(file_system_locations) as\ - \ f;" + QueryToExecute: | + SELECT + id, + f ->> 'Identifier' AS file_system_identifier, + f ->> 'Location' AS file_system_location, + f ->> 'MountOptions' AS file_system_mount_options, + f ->> 'MountPoint' AS file_system_mount_point, + f ->> 'Type' AS file_system_type + FROM + aws_codebuild_build, + jsonb_array_elements(file_system_locations) AS f; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeBuild -Title: Find all AWS CodeBuild project builds information + - AWS CodeBuild +Title: Find all AWS CodeBuild project builds information \ No newline at end of file diff --git a/queries/aws_codebuild_build_2.yaml b/queries/aws_codebuild_build_2.yaml old mode 100755 new mode 100644 index 371860f7e..51f05351f --- a/queries/aws_codebuild_build_2.yaml +++ b/queries/aws_codebuild_build_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n id,\n encryption_key\nfrom\n aws_codebuild_build\n\ - where\n encryption_key is not null;" + QueryToExecute: | + SELECT + arn, + id, + encryption_key + FROM + aws_codebuild_build + WHERE + encryption_key IS NOT NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List AWS CodeBuild Build details with encryption key + - CodeBuild +Title: List AWS CodeBuild Build details with encryption key \ No newline at end of file diff --git a/queries/aws_codebuild_build_3.yaml b/queries/aws_codebuild_build_3.yaml old mode 100755 new mode 100644 index ad0bddc7d..8026f7608 --- a/queries/aws_codebuild_build_3.yaml +++ b/queries/aws_codebuild_build_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n artifacts,\n build_complete\nfrom\n \ - \ aws_codebuild_build\nwhere\n build_complete;" + QueryToExecute: | + SELECT + id, + arn, + artifacts, + build_complete + FROM + aws_codebuild_build + WHERE + build_complete; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find completed builds of AWS CodeBuild projects + - CodeBuild +Title: Find completed builds of AWS CodeBuild projects \ No newline at end of file diff --git a/queries/aws_codebuild_build_4.yaml b/queries/aws_codebuild_build_4.yaml old mode 100755 new mode 100644 index d29e15f67..d631c6bcb --- a/queries/aws_codebuild_build_4.yaml +++ b/queries/aws_codebuild_build_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n vpc_config ->> 'SecurityGroupIds' as security_group_id,\n\ - \ vpc_config ->> 'Subnets' as subnets,\n vpc_config ->> 'VpcId' as vpc_id\n\ - from\n aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + arn, + vpc_config ->> 'SecurityGroupIds' AS security_group_id, + vpc_config ->> 'Subnets' AS subnets, + vpc_config ->> 'VpcId' AS vpc_id + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild projects' builds information + - CodeBuild +Title: List all AWS CodeBuild projects' builds information \ No newline at end of file diff --git a/queries/aws_codebuild_build_5.yaml b/queries/aws_codebuild_build_5.yaml old mode 100755 new mode 100644 index 0dec3bbd0..2f0b709ec --- a/queries/aws_codebuild_build_5.yaml +++ b/queries/aws_codebuild_build_5.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n artifacts ->> 'ArtifactIdentifier' as\ - \ artifact_id,\n artifacts ->> 'BucketOwnerAccess' as bucket_owner_access,\n\ - \ artifacts ->> 'EncryptionDisabled' as encryption_disabled,\n artifacts ->>\ - \ 'OverrideArtifactName' as override_artifact_name\nfrom\n aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + arn, + artifacts ->> 'ArtifactIdentifier' AS artifact_id, + artifacts ->> 'BucketOwnerAccess' AS bucket_owner_access, + artifacts ->> 'EncryptionDisabled' AS encryption_disabled, + artifacts ->> 'OverrideArtifactName' AS override_artifact_name + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find all AWS CodeBuild Build Project Details + - CodeBuild +Title: Find all AWS CodeBuild Build Project Details \ No newline at end of file diff --git a/queries/aws_codebuild_build_6.yaml b/queries/aws_codebuild_build_6.yaml old mode 100755 new mode 100644 index c25d598cc..f606f711a --- a/queries/aws_codebuild_build_6.yaml +++ b/queries/aws_codebuild_build_6.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n environment ->> 'Certificate' as environment_certificate,\n\ - \ environment ->> 'ComputeType' as environment_compute_type,\n environment ->>\ - \ 'EnvironmentVariables' as environment_variables,\n environment ->> 'Image'\ - \ as environment_image,\n environment ->> 'ImagePullCredentialsType' as environment_image_pull_credentials_type,\n\ - \ environment ->> 'PrivilegedMode' as environment_privileged_mode,\n environment\ - \ ->> 'RegistryCredential' as environment_registry_credential,\n environment\ - \ ->> 'Type' as environment_type\nfrom\n aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + environment ->> 'Certificate' AS environment_certificate, + environment ->> 'ComputeType' AS environment_compute_type, + environment ->> 'EnvironmentVariables' AS environment_variables, + environment ->> 'Image' AS environment_image, + environment ->> 'ImagePullCredentialsType' AS environment_image_pull_credentials_type, + environment ->> 'PrivilegedMode' AS environment_privileged_mode, + environment ->> 'RegistryCredential' AS environment_registry_credential, + environment ->> 'Type' AS environment_type + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeBuild -Title: Find AWS CodeBuild Build Information with SQL + - AWS CodeBuild +Title: Find AWS CodeBuild Build Information with SQL \ No newline at end of file diff --git a/queries/aws_codebuild_build_7.yaml b/queries/aws_codebuild_build_7.yaml old mode 100755 new mode 100644 index 115fba433..9d32bb89e --- a/queries/aws_codebuild_build_7.yaml +++ b/queries/aws_codebuild_build_7.yaml @@ -1,28 +1,35 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n logs -> 'S3Logs' ->> 'Status' as s3_log_status,\n\ - \ logs -> 'S3Logs' ->> 'Location' as s3_log_location,\n logs -> 'S3Logs' ->>\ - \ 'BucketOwnerAccess' as s3_log_bucket_owner_access,\n logs -> 'S3Logs' ->> 'EncryptionDisabled'\ - \ as s3_log_encryption_disabled,\n logs ->> 'DeepLink' as deep_link,\n logs\ - \ ->> 'GroupName' as group_name,\n logs ->> 'S3LogsArn' as s3_logs_arn,\n logs\ - \ ->> 'S3DeepLink' as s3_deep_link,\n logs ->> 'StreamName' as stream_name,\n\ - \ logs ->> 'CloudWatchLogsArn' as cloud_watch_logs_arn,\n logs -> 'CloudWatchLogs'\ - \ ->> 'Status' as cloud_watch_logs_status,\n logs -> 'CloudWatchLogs' ->> 'GroupName'\ - \ as cloud_watch_logs_group_name,\n logs -> 'CloudWatchLogs' ->> 'StreamName'\ - \ as cloud_watch_logs_stream_name\nfrom\n aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + logs -> 'S3Logs' ->> 'Status' AS s3_log_status, + logs -> 'S3Logs' ->> 'Location' AS s3_log_location, + logs -> 'S3Logs' ->> 'BucketOwnerAccess' AS s3_log_bucket_owner_access, + logs -> 'S3Logs' ->> 'EncryptionDisabled' AS s3_log_encryption_disabled, + logs ->> 'DeepLink' AS deep_link, + logs ->> 'GroupName' AS group_name, + logs ->> 'S3LogsArn' AS s3_logs_arn, + logs ->> 'S3DeepLink' AS s3_deep_link, + logs ->> 'StreamName' AS stream_name, + logs ->> 'CloudWatchLogsArn' AS cloud_watch_logs_arn, + logs -> 'CloudWatchLogs' ->> 'Status' AS cloud_watch_logs_status, + logs -> 'CloudWatchLogs' ->> 'GroupName' AS cloud_watch_logs_group_name, + logs -> 'CloudWatchLogs' ->> 'StreamName' AS cloud_watch_logs_stream_name + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find AWS CodeBuild project builds using SQL + - CodeBuild +Title: Find AWS CodeBuild project builds using SQL \ No newline at end of file diff --git a/queries/aws_codebuild_build_8.yaml b/queries/aws_codebuild_build_8.yaml old mode 100755 new mode 100644 index b9c5a366b..a9e610318 --- a/queries/aws_codebuild_build_8.yaml +++ b/queries/aws_codebuild_build_8.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects' builds. ID: aws_codebuild_build_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n network_interface ->> 'NetworkInterfaceId' as\ - \ network_interface_id,\n network_interface ->> 'SubnetId' as subnet_id,\nfrom\n\ - \ aws_codebuild_build;" + QueryToExecute: | + SELECT + id, + network_interface ->> 'NetworkInterfaceId' AS network_interface_id, + network_interface ->> 'SubnetId' AS subnet_id + FROM + aws_codebuild_build; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find all AWS CodeBuild Build Information + - CodeBuild +Title: Find all AWS CodeBuild Build Information \ No newline at end of file diff --git a/queries/aws_codebuild_build_9.yaml b/queries/aws_codebuild_build_9.yaml old mode 100755 new mode 100644 index 9422abf0c..9e94996cb --- a/queries/aws_codebuild_build_9.yaml +++ b/queries/aws_codebuild_build_9.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS CodeBuild Build to retrieve information about - AWS CodeBuild projects'' builds. +Description: Allows users to query AWS CodeBuild Build to retrieve information about AWS CodeBuild projects'' builds. ID: aws_codebuild_build_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n p ->> 'EndTime' as end_time,\n p ->> 'Contexts'\ - \ as contexts,\n p ->> 'PhaseType' as phase_type,\n p ->> 'StartTime' as start_time,\n\ - \ p ->> 'DurationInSeconds' as duration_in_seconds,\n p ->> 'PhaseStatus' as\ - \ phase_status\nfrom\n aws_codebuild_build,\n jsonb_array_elements(phases) as\ - \ p;" + QueryToExecute: | + SELECT + id, + p ->> 'EndTime' AS end_time, + p ->> 'Contexts' AS contexts, + p ->> 'PhaseType' AS phase_type, + p ->> 'StartTime' AS start_time, + p ->> 'DurationInSeconds' AS duration_in_seconds, + p ->> 'PhaseStatus' AS phase_status + FROM + aws_codebuild_build, + jsonb_array_elements(phases) AS p; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List AWS CodeBuild Build Phases and Durations + - CodeBuild +Title: List AWS CodeBuild Build Phases and Durations \ No newline at end of file diff --git a/queries/aws_codebuild_project_1.yaml b/queries/aws_codebuild_project_1.yaml old mode 100755 new mode 100644 index 382897ae1..4d14c2c9f --- a/queries/aws_codebuild_project_1.yaml +++ b/queries/aws_codebuild_project_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive - information about each project. +Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive information about each project. ID: aws_codebuild_project_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n encryption_key,\n concurrent_build_limit,\n\ - \ source_version,\n service_role,\n created,\n last_modified,\n region\n\ - from\n aws_codebuild_project;" + QueryToExecute: | + SELECT + name, + description, + encryption_key, + concurrent_build_limit, + source_version, + service_role, + created, + last_modified, + region + FROM + aws_codebuild_project; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find AWS CodeBuild Projects with Comprehensive Details + - CodeBuild +Title: Find AWS CodeBuild Projects with Comprehensive Details \ No newline at end of file diff --git a/queries/aws_codebuild_project_2.yaml b/queries/aws_codebuild_project_2.yaml old mode 100755 new mode 100644 index 8343d2aaf..f95b310d8 --- a/queries/aws_codebuild_project_2.yaml +++ b/queries/aws_codebuild_project_2.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive - information about each project. +Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive information about each project. ID: aws_codebuild_project_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n source_version,\n source ->> 'Auth' as auth,\n\ - \ source ->> 'BuildStatusConfig' as build_status_config,\n source ->> 'Buildspec'\ - \ as build_spec,\n source ->> 'GitCloneDepth' as git_clone_depth,\n source ->>\ - \ 'GitSubmodulesConfig' as git_submodules_config,\n source ->> 'InsecureSsl'\ - \ as insecure_ssl,\n source ->> 'Location' as location,\n source ->> 'ReportBuildStatus'\ - \ as report_build_status,\n source ->> 'SourceIdentifier' as source_identifier,\n\ - \ source ->> 'Type' as type\nfrom\n aws_codebuild_project;" + QueryToExecute: | + SELECT + name, + source_version, + source ->> 'Auth' AS auth, + source ->> 'BuildStatusConfig' AS build_status_config, + source ->> 'Buildspec' AS build_spec, + source ->> 'GitCloneDepth' AS git_clone_depth, + source ->> 'GitSubmodulesConfig' AS git_submodules_config, + source ->> 'InsecureSsl' AS insecure_ssl, + source ->> 'Location' AS location, + source ->> 'ReportBuildStatus' AS report_build_status, + source ->> 'SourceIdentifier' AS source_identifier, + source ->> 'Type' AS type + FROM + aws_codebuild_project; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild Projects and Details + - CodeBuild +Title: List all AWS CodeBuild Projects and Details \ No newline at end of file diff --git a/queries/aws_codebuild_project_3.yaml b/queries/aws_codebuild_project_3.yaml old mode 100755 new mode 100644 index 223f228cc..6c20d0a37 --- a/queries/aws_codebuild_project_3.yaml +++ b/queries/aws_codebuild_project_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive - information about each project. +Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive information about each project. ID: aws_codebuild_project_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n vpc_config\nfrom\n aws_codebuild_project\n\ - where\n vpc_config is null;" + QueryToExecute: | + SELECT + name, + description, + vpc_config + FROM + aws_codebuild_project + WHERE + vpc_config IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild Projects and their details + - CodeBuild +Title: List all AWS CodeBuild Projects and their details \ No newline at end of file diff --git a/queries/aws_codebuild_project_4.yaml b/queries/aws_codebuild_project_4.yaml old mode 100755 new mode 100644 index 2f39b2682..202322cb2 --- a/queries/aws_codebuild_project_4.yaml +++ b/queries/aws_codebuild_project_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive - information about each project. +Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive information about each project. ID: aws_codebuild_project_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n logs_config -> 'CloudWatchLogs'\ - \ ->> 'Status' as cloud_watch_logs_status,\n logs_config -> 'S3Logs' ->> 'Status'\ - \ as s3_logs_status\nfrom\n aws_codebuild_project\nwhere\n logs_config -> 'CloudWatchLogs'\ - \ ->> 'Status' = 'DISABLED'\n and logs_config -> 'S3Logs' ->> 'Status' = 'DISABLED';" + QueryToExecute: | + SELECT + name, + description, + logs_config -> 'CloudWatchLogs' ->> 'Status' AS cloud_watch_logs_status, + logs_config -> 'S3Logs' ->> 'Status' AS s3_logs_status + FROM + aws_codebuild_project + WHERE + logs_config -> 'CloudWatchLogs' ->> 'Status' = 'DISABLED' + AND logs_config -> 'S3Logs' ->> 'Status' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild Projects + - CodeBuild +Title: List all AWS CodeBuild Projects \ No newline at end of file diff --git a/queries/aws_codebuild_project_5.yaml b/queries/aws_codebuild_project_5.yaml old mode 100755 new mode 100644 index bfc4d97dc..1806fa3a2 --- a/queries/aws_codebuild_project_5.yaml +++ b/queries/aws_codebuild_project_5.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive - information about each project. +Description: Allows users to query AWS CodeBuild Projects and retrieve comprehensive information about each project. ID: aws_codebuild_project_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n project_visibility\nfrom\n aws_codebuild_project\n\ - where\n project_visibility = 'PRIVATE';" + QueryToExecute: | + SELECT + name, + arn, + project_visibility + FROM + aws_codebuild_project + WHERE + project_visibility = 'PRIVATE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: List all AWS CodeBuild Projects with Private Visibility + - CodeBuild +Title: List all AWS CodeBuild Projects with Private Visibility \ No newline at end of file diff --git a/queries/aws_codebuild_source_credential_1.yaml b/queries/aws_codebuild_source_credential_1.yaml old mode 100755 new mode 100644 index 2976f70e9..549343856 --- a/queries/aws_codebuild_source_credential_1.yaml +++ b/queries/aws_codebuild_source_credential_1.yaml @@ -1,19 +1,25 @@ Description: Allows users to query AWS CodeBuild Source Credentials ID: aws_codebuild_source_credential_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n server_type,\n auth_type,\n region\nfrom\n\ - \ aws_codebuild_source_credential;" + QueryToExecute: | + SELECT + arn, + server_type, + auth_type, + region + FROM + aws_codebuild_source_credential; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find all AWS CodeBuild Source Credentials + - CodeBuild +Title: Find all AWS CodeBuild Source Credentials \ No newline at end of file diff --git a/queries/aws_codebuild_source_credential_2.yaml b/queries/aws_codebuild_source_credential_2.yaml old mode 100755 new mode 100644 index 34ae8e3a0..8ceb12ccd --- a/queries/aws_codebuild_source_credential_2.yaml +++ b/queries/aws_codebuild_source_credential_2.yaml @@ -1,24 +1,32 @@ Description: Allows users to query AWS CodeBuild Source Credentials ID: aws_codebuild_source_credential_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n p.arn as project_arn,\n p.source ->> 'Location' as source_repository,\ - \ \n p.source ->> 'Type' as source_repository_type,\n c.auth_type as authorization_type\n\ - from\n aws_codebuild_project as p\n join aws_codebuild_source_credential as\ - \ c on (p.region = c.region and p.source ->> 'Type' = c.server_type)\nwhere\n\ - \ p.source ->> 'Type' = 'GITHUB'\n and c.auth_type = 'OAUTH';" + QueryToExecute: | + SELECT + p.arn AS project_arn, + p.source ->> 'Location' AS source_repository, + p.source ->> 'Type' AS source_repository_type, + c.auth_type AS authorization_type + FROM + aws_codebuild_project AS p + JOIN aws_codebuild_source_credential AS c + ON (p.region = c.region AND p.source ->> 'Type' = c.server_type) + WHERE + p.source ->> 'Type' = 'GITHUB' + AND c.auth_type = 'OAUTH'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeBuild -Title: Find all AWS CodeBuild Source Credentials + - CodeBuild +Title: Find all AWS CodeBuild Source Credentials \ No newline at end of file diff --git a/queries/aws_codecommit_repository_1.yaml b/queries/aws_codecommit_repository_1.yaml old mode 100755 new mode 100644 index 7f5268ec9..180ad9807 --- a/queries/aws_codecommit_repository_1.yaml +++ b/queries/aws_codecommit_repository_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CodeCommit repositories and retrieve data such - as repository name, ARN, description, clone URL, last modified date, and other related - details. +Description: Allows users to query AWS CodeCommit repositories and retrieve data such as repository name, ARN, description, clone URL, last modified date, and other related details. ID: aws_codecommit_repository_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n repository_id,\n arn,\n creation_date,\n\ - \ region\nfrom\n aws_codecommit_repository;" + QueryToExecute: | + SELECT + repository_name, + repository_id, + arn, + creation_date, + region + FROM + aws_codecommit_repository; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeCommit -Title: List AWS CodeCommit Repositories with Details + - CodeCommit +Title: List AWS CodeCommit Repositories with Details \ No newline at end of file diff --git a/queries/aws_codedeploy_app_1.yaml b/queries/aws_codedeploy_app_1.yaml old mode 100755 new mode 100644 index bbb956a2e..2eacac729 --- a/queries/aws_codedeploy_app_1.yaml +++ b/queries/aws_codedeploy_app_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS CodeDeploy Applications to return detailed - information about each application, including application name, ID, and associated - deployment groups. +Description: Allows users to query AWS CodeDeploy Applications to return detailed information about each application, including application name, ID, and associated deployment groups. ID: aws_codedeploy_app_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n application_id,\n application_name\n compute_platform,\n\ - \ create_time,\n region\nfrom\n aws_codedeploy_app;" + QueryToExecute: | + SELECT + arn, + application_id, + application_name, + compute_platform, + create_time, + region + FROM + aws_codedeploy_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List AWS CodeDeploy Apps with Details + - CodeDeploy +Title: List AWS CodeDeploy Apps with Details \ No newline at end of file diff --git a/queries/aws_codedeploy_app_2.yaml b/queries/aws_codedeploy_app_2.yaml old mode 100755 new mode 100644 index 7601033fd..6a86e731f --- a/queries/aws_codedeploy_app_2.yaml +++ b/queries/aws_codedeploy_app_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS CodeDeploy Applications to return detailed - information about each application, including application name, ID, and associated - deployment groups. +Description: Allows users to query AWS CodeDeploy Applications to return detailed information about each application, including application name, ID, and associated deployment groups. ID: aws_codedeploy_app_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(arn) as application_count,\n compute_platform\n\ - from\n aws_codedeploy_app\ngroup by\n compute_platform;" + QueryToExecute: | + SELECT + COUNT(arn) AS application_count, + compute_platform + FROM + aws_codedeploy_app + GROUP BY + compute_platform; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List all AWS CodeDeploy Applications and Deployment Groups + - CodeDeploy +Title: List all AWS CodeDeploy Applications and Deployment Groups \ No newline at end of file diff --git a/queries/aws_codedeploy_app_3.yaml b/queries/aws_codedeploy_app_3.yaml old mode 100755 new mode 100644 index edd89222a..618921132 --- a/queries/aws_codedeploy_app_3.yaml +++ b/queries/aws_codedeploy_app_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS CodeDeploy Applications to return detailed - information about each application, including application name, ID, and associated - deployment groups. +Description: Allows users to query AWS CodeDeploy Applications to return detailed information about each application, including application name, ID, and associated deployment groups. ID: aws_codedeploy_app_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n application_id,\n compute_platform,\n create_time,\n\ - \ github_account_name\nfrom\n aws_codedeploy_app\nwhere\n linked_to_github;" + QueryToExecute: | + SELECT + arn, + application_id, + compute_platform, + create_time, + github_account_name + FROM + aws_codedeploy_app + WHERE + linked_to_github; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List all AWS CodeDeploy Apps Linked to GitHub + - CodeDeploy +Title: List all AWS CodeDeploy Apps Linked to GitHub \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_1.yaml b/queries/aws_codedeploy_deployment_config_1.yaml old mode 100755 new mode 100644 index 6cb786f40..da50696a3 --- a/queries/aws_codedeploy_deployment_config_1.yaml +++ b/queries/aws_codedeploy_deployment_config_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_config_id,\n deployment_config_name,\n\ - \ compute_platform,\n create_time,\n region\nfrom\n aws_codedeploy_deployment_config;" + QueryToExecute: | + SELECT + arn, + deployment_config_id, + deployment_config_name, + compute_platform, + create_time, + region + FROM + aws_codedeploy_deployment_config; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List AWS CodeDeploy Deployment Configs and Details + - CodeDeploy +Title: List AWS CodeDeploy Deployment Configs and Details \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_2.yaml b/queries/aws_codedeploy_deployment_config_2.yaml old mode 100755 new mode 100644 index 4e72705e3..fcaa4cf8f --- a/queries/aws_codedeploy_deployment_config_2.yaml +++ b/queries/aws_codedeploy_deployment_config_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(arn) as configuration_count,\n compute_platform\n\ - from\n aws_codedeploy_deployment_config\ngroup by\n compute_platform;" + QueryToExecute: | + SELECT + COUNT(arn) AS configuration_count, + compute_platform + FROM + aws_codedeploy_deployment_config + GROUP BY + compute_platform; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List all AWS CodeDeploy Deployment Configurations + - CodeDeploy +Title: List all AWS CodeDeploy Deployment Configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_3.yaml b/queries/aws_codedeploy_deployment_config_3.yaml old mode 100755 new mode 100644 index 3904e7aa2..79dffc6de --- a/queries/aws_codedeploy_deployment_config_3.yaml +++ b/queries/aws_codedeploy_deployment_config_3.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_config_id,\n deployment_config_name\n\ - \ compute_platform,\n create_time,\n region\nfrom\n aws_codedeploy_deployment_config\n\ - where\n create_time is not null;" + QueryToExecute: | + SELECT + arn, + deployment_config_id, + deployment_config_name, + compute_platform, + create_time, + region + FROM + aws_codedeploy_deployment_config + WHERE + create_time IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List AWS CodeDeploy Deployment Configurations + - CodeDeploy +Title: List AWS CodeDeploy Deployment Configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_4.yaml b/queries/aws_codedeploy_deployment_config_4.yaml old mode 100755 new mode 100644 index 0fda5bb73..5341df648 --- a/queries/aws_codedeploy_deployment_config_4.yaml +++ b/queries/aws_codedeploy_deployment_config_4.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_config_id,\n deployment_config_name\n\ - \ compute_platform,\n minimum_healthy_hosts ->> 'Type' as host_type,\n minimum_healthy_hosts\ - \ ->> 'Value' as host_value,\n region\nfrom\n aws_codedeploy_deployment_config\n\ - where\n create_time is not null;" + QueryToExecute: | + SELECT + arn, + deployment_config_id, + deployment_config_name, + compute_platform, + minimum_healthy_hosts ->> 'Type' AS host_type, + minimum_healthy_hosts ->> 'Value' AS host_value, + region + FROM + aws_codedeploy_deployment_config + WHERE + create_time IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List all AWS CodeDeploy Deployment Configurations + - CodeDeploy +Title: List all AWS CodeDeploy Deployment Configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_5.yaml b/queries/aws_codedeploy_deployment_config_5.yaml old mode 100755 new mode 100644 index 789b2008f..295a7f771 --- a/queries/aws_codedeploy_deployment_config_5.yaml +++ b/queries/aws_codedeploy_deployment_config_5.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_config_id,\n deployment_config_name,\n\ - \ traffic_routing_config -> 'TimeBasedCanary' ->> 'CanaryInterval' as canary_interval,\n\ - \ traffic_routing_config -> 'TimeBasedCanary' ->> 'CanaryPercentage' as canary_percentage\n\ - from\n aws_codedeploy_deployment_config\nwhere\n traffic_routing_config ->>\ - \ 'Type' = 'TimeBasedCanary';" + QueryToExecute: | + SELECT + arn, + deployment_config_id, + deployment_config_name, + traffic_routing_config -> 'TimeBasedCanary' ->> 'CanaryInterval' AS canary_interval, + traffic_routing_config -> 'TimeBasedCanary' ->> 'CanaryPercentage' AS canary_percentage + FROM + aws_codedeploy_deployment_config + WHERE + traffic_routing_config ->> 'Type' = 'TimeBasedCanary'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy Deployment Configurations + - CodeDeploy +Title: Find AWS CodeDeploy Deployment Configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_config_6.yaml b/queries/aws_codedeploy_deployment_config_6.yaml old mode 100755 new mode 100644 index 3996cc6bb..3e21e5672 --- a/queries/aws_codedeploy_deployment_config_6.yaml +++ b/queries/aws_codedeploy_deployment_config_6.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve - information about the deployment configurations within AWS CodeDeploy service. +Description: Allows users to query AWS CodeDeploy Deployment Configurations to retrieve information about the deployment configurations within AWS CodeDeploy service. ID: aws_codedeploy_deployment_config_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_config_id,\n deployment_config_name,\n\ - \ traffic_routing_config -> 'TimeBasedLinear' ->> 'LinearInterval' as linear_interval,\n\ - \ traffic_routing_config -> 'TimeBasedLinear' ->> 'LinearPercentage' as linear_percentage\n\ - from\n aws_codedeploy_deployment_config\nwhere\n traffic_routing_config ->>\ - \ 'Type' = 'TimeBasedLinear';" + QueryToExecute: | + SELECT + arn, + deployment_config_id, + deployment_config_name, + traffic_routing_config -> 'TimeBasedLinear' ->> 'LinearInterval' AS linear_interval, + traffic_routing_config -> 'TimeBasedLinear' ->> 'LinearPercentage' AS linear_percentage + FROM + aws_codedeploy_deployment_config + WHERE + traffic_routing_config ->> 'Type' = 'TimeBasedLinear'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy deployment configurations + - CodeDeploy +Title: Find AWS CodeDeploy deployment configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_1.yaml b/queries/aws_codedeploy_deployment_group_1.yaml old mode 100755 new mode 100644 index 2917f0d61..2bcb76967 --- a/queries/aws_codedeploy_deployment_group_1.yaml +++ b/queries/aws_codedeploy_deployment_group_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_group_id,\n deployment_group_name,\n\ - \ application_name,\n deployment_style,\n region\nfrom\n aws_codedeploy_deployment_group;" + QueryToExecute: | + SELECT + arn, + deployment_group_id, + deployment_group_name, + application_name, + deployment_style, + region + FROM + aws_codedeploy_deployment_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodeDeploy -Title: Find AWS CodeDeploy Deployment Group Details + - AWS CodeDeploy +Title: Find AWS CodeDeploy Deployment Group Details \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_2.yaml b/queries/aws_codedeploy_deployment_group_2.yaml old mode 100755 new mode 100644 index c667e0f35..f808b0b83 --- a/queries/aws_codedeploy_deployment_group_2.yaml +++ b/queries/aws_codedeploy_deployment_group_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(arn) as group_count,\n compute_platform\nfrom\n\ - \ aws_codedeploy_deployment_group\ngroup by\n compute_platform;" + QueryToExecute: | + SELECT + COUNT(arn) AS group_count, + compute_platform + FROM + aws_codedeploy_deployment_group + GROUP BY + compute_platform; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List AWS CodeDeploy Deployment Group Details and Configurations + - CodeDeploy +Title: List AWS CodeDeploy Deployment Group Details and Configurations \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_3.yaml b/queries/aws_codedeploy_deployment_group_3.yaml old mode 100755 new mode 100644 index c9828ba8a..5e75d3bd4 --- a/queries/aws_codedeploy_deployment_group_3.yaml +++ b/queries/aws_codedeploy_deployment_group_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_group_id,\n last_successful_deployment\n\ - from\n aws_codedeploy_deployment_group;" + QueryToExecute: | + SELECT + arn, + deployment_group_id, + last_successful_deployment + FROM + aws_codedeploy_deployment_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy Deployment Group Details + - CodeDeploy +Title: Find AWS CodeDeploy Deployment Group Details \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_4.yaml b/queries/aws_codedeploy_deployment_group_4.yaml old mode 100755 new mode 100644 index cc6a6a52e..220843e6f --- a/queries/aws_codedeploy_deployment_group_4.yaml +++ b/queries/aws_codedeploy_deployment_group_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(arn) as group_count,\n deployment_style\nfrom\n\ - \ aws_codedeploy_deployment_group\ngroup by\n deployment_style;" + QueryToExecute: | + SELECT + COUNT(arn) AS group_count, + deployment_style + FROM + aws_codedeploy_deployment_group + GROUP BY + deployment_style; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: List all AWS CodeDeploy Deployment Group Details + - CodeDeploy +Title: List all AWS CodeDeploy Deployment Group Details \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_5.yaml b/queries/aws_codedeploy_deployment_group_5.yaml old mode 100755 new mode 100644 index 5b90b6735..2c222c3c0 --- a/queries/aws_codedeploy_deployment_group_5.yaml +++ b/queries/aws_codedeploy_deployment_group_5.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_group_id,\n deployment_group_name,\n\ - \ auto_rollback_configuration ->> 'Enabled' as auto_rollback_configuration_enabled\n\ - from\n aws_codedeploy_deployment_group\nwhere\n auto_rollback_configuration\ - \ ->> 'Enabled' = 'true';" + QueryToExecute: | + SELECT + arn, + deployment_group_id, + deployment_group_name, + auto_rollback_configuration ->> 'Enabled' AS auto_rollback_configuration_enabled + FROM + aws_codedeploy_deployment_group + WHERE + auto_rollback_configuration ->> 'Enabled' = 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy Deployment Group Details including Alarms + - CodeDeploy +Title: Find AWS CodeDeploy Deployment Group Details including Alarms \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_6.yaml b/queries/aws_codedeploy_deployment_group_6.yaml old mode 100755 new mode 100644 index 0a5e483d4..07035afce --- a/queries/aws_codedeploy_deployment_group_6.yaml +++ b/queries/aws_codedeploy_deployment_group_6.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn as group_arn,\n deployment_group_id,\n deployment_group_name,\n\ - \ auto_scaling_groups ->> 'Hook' as auto_scaling_group_hook,\n auto_scaling_groups\ - \ ->> 'Name' as auto_scaling_group_name\nfrom\n aws_codedeploy_deployment_group\n\ - where\n application_name = 'abc'\n and deployment_group_name = 'def';" + QueryToExecute: | + SELECT + arn AS group_arn, + deployment_group_id, + deployment_group_name, + auto_scaling_groups ->> 'Hook' AS auto_scaling_group_hook, + auto_scaling_groups ->> 'Name' AS auto_scaling_group_name + FROM + aws_codedeploy_deployment_group + WHERE + application_name = 'abc' + AND deployment_group_name = 'def'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy Deployment Group Details + - CodeDeploy +Title: Find AWS CodeDeploy Deployment Group Details \ No newline at end of file diff --git a/queries/aws_codedeploy_deployment_group_7.yaml b/queries/aws_codedeploy_deployment_group_7.yaml old mode 100755 new mode 100644 index 025010bdf..da13310b0 --- a/queries/aws_codedeploy_deployment_group_7.yaml +++ b/queries/aws_codedeploy_deployment_group_7.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS CodeDeploy Deployment Group details including - deployment configurations, target revisions, and associated alarm configurations. +Description: Allows users to query AWS CodeDeploy Deployment Group details including deployment configurations, target revisions, and associated alarm configurations. ID: aws_codedeploy_deployment_group_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n deployment_group_id,\n deployment_group_name,\n\ - \ alarm_configuration ->> 'Enabled' as alarm_configuration_enabled\nfrom\n aws_codedeploy_deployment_group\n\ - where\n alarm_configuration ->> 'Enabled' = 'true';" + QueryToExecute: | + SELECT + arn, + deployment_group_id, + deployment_group_name, + alarm_configuration ->> 'Enabled' AS alarm_configuration_enabled + FROM + aws_codedeploy_deployment_group + WHERE + alarm_configuration ->> 'Enabled' = 'true'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeDeploy -Title: Find AWS CodeDeploy Deployment Groups with Alarm Configs + - CodeDeploy +Title: Find AWS CodeDeploy Deployment Groups with Alarm Configs \ No newline at end of file diff --git a/queries/aws_codepipeline_pipeline_1.yaml b/queries/aws_codepipeline_pipeline_1.yaml old mode 100755 new mode 100644 index b8c5cc711..43ed936af --- a/queries/aws_codepipeline_pipeline_1.yaml +++ b/queries/aws_codepipeline_pipeline_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS CodePipeline Pipeline data, including pipeline - names, statuses, stages, and associated metadata. +Description: Allows users to query AWS CodePipeline Pipeline data, including pipeline names, statuses, stages, and associated metadata. ID: aws_codepipeline_pipeline_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n tags_src,\n region,\n account_id\n\ - from\n aws_codepipeline_pipeline;" + QueryToExecute: | + SELECT + name, + arn, + tags_src, + region, + account_id + FROM + aws_codepipeline_pipeline; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodePipeline -Title: List all AWS CodePipeline Pipeline Data + - CodePipeline +Title: List all AWS CodePipeline Pipeline Data \ No newline at end of file diff --git a/queries/aws_codepipeline_pipeline_2.yaml b/queries/aws_codepipeline_pipeline_2.yaml old mode 100755 new mode 100644 index f9f1c5dc0..26619d84b --- a/queries/aws_codepipeline_pipeline_2.yaml +++ b/queries/aws_codepipeline_pipeline_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS CodePipeline Pipeline data, including pipeline - names, statuses, stages, and associated metadata. +Description: Allows users to query AWS CodePipeline Pipeline data, including pipeline names, statuses, stages, and associated metadata. ID: aws_codepipeline_pipeline_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n encryption_key\nfrom\n aws_codepipeline_pipeline\n\ - where\n encryption_key is null;" + QueryToExecute: | + SELECT + name, + arn, + encryption_key + FROM + aws_codepipeline_pipeline + WHERE + encryption_key IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS CodePipeline -Title: List all AWS CodePipeline Pipelines and Metadata + - AWS CodePipeline +Title: List all AWS CodePipeline Pipelines and Metadata \ No newline at end of file diff --git a/queries/aws_codestar_notification_rule_1.yaml b/queries/aws_codestar_notification_rule_1.yaml old mode 100755 new mode 100644 index 576de1644..6d8b5549d --- a/queries/aws_codestar_notification_rule_1.yaml +++ b/queries/aws_codestar_notification_rule_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query CodeStar notification rules in the AWS Developer - Tools to retrieve information about notification rules. +Description: Allows users to query CodeStar notification rules in the AWS Developer Tools to retrieve information about notification rules. ID: aws_codestar_notification_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n resource,\n detail_type,\n status\nfrom\n\ - \ aws_codestar_notification_rule;" + QueryToExecute: | + SELECT + name, + resource, + detail_type, + status + FROM + aws_codestar_notification_rule; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeStar -Title: Find all CodeStar notification rules in AWS using SQL + - CodeStar +Title: Find all CodeStar notification rules in AWS using SQL \ No newline at end of file diff --git a/queries/aws_codestar_notification_rule_2.yaml b/queries/aws_codestar_notification_rule_2.yaml old mode 100755 new mode 100644 index 73330264c..1f4ba525d --- a/queries/aws_codestar_notification_rule_2.yaml +++ b/queries/aws_codestar_notification_rule_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query CodeStar notification rules in the AWS Developer - Tools to retrieve information about notification rules. +Description: Allows users to query CodeStar notification rules in the AWS Developer Tools to retrieve information about notification rules. ID: aws_codestar_notification_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n pipeline.name as pipeline,\n notification_rule.name\ - \ notification_rule,\n notification_rule.status\nfrom\n aws_codepipeline_pipeline\ - \ as pipeline\n left join aws_codestar_notification_rule as notification_rule\ - \ on pipeline.arn = notification_rule.resource;" + QueryToExecute: | + SELECT + pipeline.name AS pipeline, + notification_rule.name AS notification_rule, + notification_rule.status + FROM + aws_codepipeline_pipeline AS pipeline + LEFT JOIN + aws_codestar_notification_rule AS notification_rule + ON + pipeline.arn = notification_rule.resource; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeStar -Title: Find AWS CodeStar notification rules using SQL + - CodeStar +Title: Find AWS CodeStar notification rules using SQL \ No newline at end of file diff --git a/queries/aws_codestar_notification_rule_3.yaml b/queries/aws_codestar_notification_rule_3.yaml old mode 100755 new mode 100644 index d25abc1e3..c5dd007d1 --- a/queries/aws_codestar_notification_rule_3.yaml +++ b/queries/aws_codestar_notification_rule_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query CodeStar notification rules in the AWS Developer - Tools to retrieve information about notification rules. +Description: Allows users to query CodeStar notification rules in the AWS Developer Tools to retrieve information about notification rules. ID: aws_codestar_notification_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name\nfrom\n aws_codestar_notification_rule\nwhere\n\ - \ jsonb_array_length(targets) = 0;" + QueryToExecute: | + SELECT + name + FROM + aws_codestar_notification_rule + WHERE + jsonb_array_length(targets) = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeStar -Title: List all AWS CodeStar notification rules with no targets + - CodeStar +Title: List all AWS CodeStar notification rules with no targets \ No newline at end of file diff --git a/queries/aws_codestar_notification_rule_4.yaml b/queries/aws_codestar_notification_rule_4.yaml old mode 100755 new mode 100644 index a6709c3d2..878f550c3 --- a/queries/aws_codestar_notification_rule_4.yaml +++ b/queries/aws_codestar_notification_rule_4.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query CodeStar notification rules in the AWS Developer - Tools to retrieve information about notification rules. +Description: Allows users to query CodeStar notification rules in the AWS Developer Tools to retrieve information about notification rules. ID: aws_codestar_notification_rule_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n notification_rule.name as notification_rule,\n target\ - \ ->> 'TargetType' as target_type,\n topic.title as target_topic\nfrom\n aws_codestar_notification_rule\ - \ as notification_rule cross\n join jsonb_array_elements(notification_rule.targets)\ - \ as target\n left join aws_sns_topic as topic on target ->> 'TargetAddress'\ - \ = topic.topic_arn;" + QueryToExecute: | + SELECT + notification_rule.name AS notification_rule, + target ->> 'TargetType' AS target_type, + topic.title AS target_topic + FROM + aws_codestar_notification_rule AS notification_rule + CROSS JOIN + jsonb_array_elements(notification_rule.targets) AS target + LEFT JOIN + aws_sns_topic AS topic + ON + target ->> 'TargetAddress' = topic.topic_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeStar -Title: List all AWS CodeStar Notification Rules with Target Details + - CodeStar +Title: List all AWS CodeStar Notification Rules with Target Details \ No newline at end of file diff --git a/queries/aws_codestar_notification_rule_5.yaml b/queries/aws_codestar_notification_rule_5.yaml old mode 100755 new mode 100644 index 9eb7b1bcb..0482198b1 --- a/queries/aws_codestar_notification_rule_5.yaml +++ b/queries/aws_codestar_notification_rule_5.yaml @@ -1,28 +1,41 @@ -Description: Allows users to query CodeStar notification rules in the AWS Developer - Tools to retrieve information about notification rules. +Description: Allows users to query CodeStar notification rules in the AWS Developer Tools to retrieve information about notification rules. ID: aws_codestar_notification_rule_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with rule_target as (\n select\n arn,\n target ->> 'TargetAddress'\ - \ as target_address,\n target ->> 'TargetStatus' as target_status,\n target\ - \ ->> 'TargetType' as target_type\n from\n aws_codestar_notification_rule\ - \ cross\n join jsonb_array_elements(targets) as target\n)\nselect\n notification_rule.name\ - \ as notification_rule,\n rule_target.target_type,\n topic.title as target_topic\n\ - from\n aws_codestar_notification_rule as notification_rule\n left join rule_target\ - \ on rule_target.arn = notification_rule.arn\n left join aws_sns_topic as topic\ - \ on rule_target.target_address = topic.topic_arn;" + QueryToExecute: | + WITH rule_target AS ( + SELECT + arn, + target ->> 'TargetAddress' AS target_address, + target ->> 'TargetStatus' AS target_status, + target ->> 'TargetType' AS target_type + FROM + aws_codestar_notification_rule + CROSS JOIN + jsonb_array_elements(targets) AS target + ) + SELECT + notification_rule.name AS notification_rule, + rule_target.target_type, + topic.title AS target_topic + FROM + aws_codestar_notification_rule AS notification_rule + LEFT JOIN + rule_target ON rule_target.arn = notification_rule.arn + LEFT JOIN + aws_sns_topic AS topic ON rule_target.target_address = topic.topic_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CodeStar -Title: List AWS CodeStar Notification Rules with Targets + - CodeStar +Title: List AWS CodeStar Notification Rules with Targets \ No newline at end of file diff --git a/queries/aws_cognito_identity_pool_1.yaml b/queries/aws_cognito_identity_pool_1.yaml old mode 100755 new mode 100644 index 030fa9d33..768c3d0f6 --- a/queries/aws_cognito_identity_pool_1.yaml +++ b/queries/aws_cognito_identity_pool_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed - information about each identity pool, including its configuration and associated - roles. +Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed information about each identity pool, including its configuration and associated roles. ID: aws_cognito_identity_pool_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity_pool_id,\n identity_pool_name,\n tags,\n \ - \ region,\n account_id\nfrom\n aws_cognito_identity_pool;" + QueryToExecute: | + SELECT + identity_pool_id, + identity_pool_name, + tags, + region, + account_id + FROM + aws_cognito_identity_pool; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito -Title: List AWS Cognito Identity Pools with Config and Roles + - Cognito +Title: List AWS Cognito Identity Pools with Config and Roles \ No newline at end of file diff --git a/queries/aws_cognito_identity_pool_2.yaml b/queries/aws_cognito_identity_pool_2.yaml old mode 100755 new mode 100644 index 5561c25ef..54c0dfb3e --- a/queries/aws_cognito_identity_pool_2.yaml +++ b/queries/aws_cognito_identity_pool_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed - information about each identity pool, including its configuration and associated - roles. +Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed information about each identity pool, including its configuration and associated roles. ID: aws_cognito_identity_pool_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity_pool_id,\n identity_pool_name,\n allow_classic_flow\n\ - from\n aws_cognito_identity_pool\nwhere\n allow_classic_flow;" + QueryToExecute: | + SELECT + identity_pool_id, + identity_pool_name, + allow_classic_flow + FROM + aws_cognito_identity_pool + WHERE + allow_classic_flow; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito -Title: List AWS Cognito Identity Pools and Their Configurations + - Cognito +Title: List AWS Cognito Identity Pools and Their Configurations \ No newline at end of file diff --git a/queries/aws_cognito_identity_pool_3.yaml b/queries/aws_cognito_identity_pool_3.yaml old mode 100755 new mode 100644 index 27df0a583..91a7a41ee --- a/queries/aws_cognito_identity_pool_3.yaml +++ b/queries/aws_cognito_identity_pool_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed - information about each identity pool, including its configuration and associated - roles. +Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed information about each identity pool, including its configuration and associated roles. ID: aws_cognito_identity_pool_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity_pool_id,\n identity_pool_name,\n allow_classic_flow\n\ - from\n aws_cognito_identity_pool\nwhere\n allow_unauthenticated_identities;" + QueryToExecute: | + SELECT + identity_pool_id, + identity_pool_name, + allow_classic_flow + FROM + aws_cognito_identity_pool + WHERE + allow_unauthenticated_identities; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito Identity Pools -Title: List AWS Cognito Identity Pools and Configurations + - Cognito Identity Pools +Title: List AWS Cognito Identity Pools and Configurations \ No newline at end of file diff --git a/queries/aws_cognito_identity_pool_4.yaml b/queries/aws_cognito_identity_pool_4.yaml old mode 100755 new mode 100644 index 961c4d38f..89648a67b --- a/queries/aws_cognito_identity_pool_4.yaml +++ b/queries/aws_cognito_identity_pool_4.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed - information about each identity pool, including its configuration and associated - roles. +Description: Allows users to query AWS Cognito Identity Pools and retrieve detailed information about each identity pool, including its configuration and associated roles. ID: aws_cognito_identity_pool_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity_pool_id,\n identity_pool_name,\n allow_classic_flow,\n\ - \ cognito_identity_providers ->> 'ClientId' as identity_provider_client_id,\n\ - \ cognito_identity_providers ->> 'ProviderName' as identity_provider_name,\n\ - \ cognito_identity_providers ->> 'ServerSideTokenCheck' as server_side_token_enabled\n\ - from\n aws_cognito_identity_pool\nwhere\n identity_pool_id = 'eu-west-3:e96205bf-1ef2-4fe6-a748-65e948673960';" + QueryToExecute: | + SELECT + identity_pool_id, + identity_pool_name, + allow_classic_flow, + cognito_identity_providers ->> 'ClientId' AS identity_provider_client_id, + cognito_identity_providers ->> 'ProviderName' AS identity_provider_name, + cognito_identity_providers ->> 'ServerSideTokenCheck' AS server_side_token_enabled + FROM + aws_cognito_identity_pool + WHERE + identity_pool_id = 'eu-west-3:e96205bf-1ef2-4fe6-a748-65e948673960'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito Identity Pools -Title: List all AWS Cognito Identity Pools with Detailed Info + - Cognito Identity Pools +Title: List all AWS Cognito Identity Pools with Detailed Info \ No newline at end of file diff --git a/queries/aws_cognito_identity_provider_1.yaml b/queries/aws_cognito_identity_provider_1.yaml old mode 100755 new mode 100644 index 578bc827c..48953e975 --- a/queries/aws_cognito_identity_provider_1.yaml +++ b/queries/aws_cognito_identity_provider_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Cognito Identity Providers, providing essential - details about the identity provider configurations within AWS Cognito User Pools. +Description: Allows users to query AWS Cognito Identity Providers, providing essential details about the identity provider configurations within AWS Cognito User Pools. ID: aws_cognito_identity_provider_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n provider_name,\n user_pool_id,\n region,\n account_id\n\ - from\n aws_cognito_identity_provider\nwhere\n user_pool_id = 'us-east-1_012345678';" + QueryToExecute: | + SELECT + provider_name, + user_pool_id, + region, + account_id + FROM + aws_cognito_identity_provider + WHERE + user_pool_id = 'us-east-1_012345678'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito -Title: Find AWS Cognito Identity Provider Configurations + - Cognito +Title: Find AWS Cognito Identity Provider Configurations \ No newline at end of file diff --git a/queries/aws_cognito_identity_provider_2.yaml b/queries/aws_cognito_identity_provider_2.yaml old mode 100755 new mode 100644 index 09c1fee2f..d8a6c0273 --- a/queries/aws_cognito_identity_provider_2.yaml +++ b/queries/aws_cognito_identity_provider_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Cognito Identity Providers, providing essential - details about the identity provider configurations within AWS Cognito User Pools. +Description: Allows users to query AWS Cognito Identity Providers, providing essential details about the identity provider configurations within AWS Cognito User Pools. ID: aws_cognito_identity_provider_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n provider_name,\n user_pool_id,\n provider_details\n\ - from\n aws_cognito_identity_provider\nwhere\n provider_type = 'Google'\n and\ - \ user_pool_id = 'us-east-1_012345678';" + QueryToExecute: | + SELECT + provider_name, + user_pool_id, + provider_details + FROM + aws_cognito_identity_provider + WHERE + provider_type = 'Google' + AND user_pool_id = 'us-east-1_012345678'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cognito -Title: Find AWS Cognito Identity Providers Using SQL + - AWS Cognito +Title: Find AWS Cognito Identity Providers Using SQL \ No newline at end of file diff --git a/queries/aws_cognito_user_pool_1.yaml b/queries/aws_cognito_user_pool_1.yaml old mode 100755 new mode 100644 index d21408555..d397fdbc9 --- a/queries/aws_cognito_user_pool_1.yaml +++ b/queries/aws_cognito_user_pool_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cognito User Pools to fetch detailed information - about each user pool, including the pool''s configuration, status, and associated - metadata. +Description: Allows users to query AWS Cognito User Pools to fetch detailed information about each user pool, including the pool's configuration, status, and associated metadata. ID: aws_cognito_user_pool_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n tags,\n region,\n account_id\n\ - from\n aws_cognito_user_pool;" + QueryToExecute: | + SELECT + id, + name, + arn, + tags, + region, + account_id + FROM + aws_cognito_user_pool; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cognito User Pools -Title: Find AWS Cognito User Pools and their configuration + - AWS Cognito User Pools +Title: Find AWS Cognito User Pools and their configuration \ No newline at end of file diff --git a/queries/aws_cognito_user_pool_2.yaml b/queries/aws_cognito_user_pool_2.yaml old mode 100755 new mode 100644 index 128c665ea..bf30f7e6b --- a/queries/aws_cognito_user_pool_2.yaml +++ b/queries/aws_cognito_user_pool_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Cognito User Pools to fetch detailed information - about each user pool, including the pool''s configuration, status, and associated - metadata. +Description: Allows users to query AWS Cognito User Pools to fetch detailed information about each user pool, including the pool's configuration, status, and associated metadata. ID: aws_cognito_user_pool_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n mfa_configuration\nfrom\n aws_cognito_user_pool\n\ - where\n mfa_configuration != 'OFF';" + QueryToExecute: | + SELECT + name, + arn, + mfa_configuration + FROM + aws_cognito_user_pool + WHERE + mfa_configuration != 'OFF'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cognito -Title: List All AWS Cognito User Pools with MFA Configuration + - Cognito +Title: List All AWS Cognito User Pools with MFA Configuration \ No newline at end of file diff --git a/queries/aws_config_aggregate_authorization_1.yaml b/queries/aws_config_aggregate_authorization_1.yaml old mode 100755 new mode 100644 index f52523307..64e3eff72 --- a/queries/aws_config_aggregate_authorization_1.yaml +++ b/queries/aws_config_aggregate_authorization_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Config Aggregate Authorizations, providing - vital information about AWS Config rules and their respective authorizations in - an aggregated form. +Description: Allows users to query AWS Config Aggregate Authorizations, providing vital information about AWS Config rules and their respective authorizations in an aggregated form. ID: aws_config_aggregate_authorization_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n authorized_account_id,\n authorized_aws_region,\n\ - \ creation_time\nfrom\n aws_config_aggregate_authorization;" + QueryToExecute: | + SELECT + arn, + authorized_account_id, + authorized_aws_region, + creation_time + FROM + aws_config_aggregate_authorization; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Aggregate Authorizations Info + - AWS Config +Title: Find AWS Config Aggregate Authorizations Info \ No newline at end of file diff --git a/queries/aws_config_configuration_recorder_1.yaml b/queries/aws_config_configuration_recorder_1.yaml old mode 100755 new mode 100644 index 5315ac742..e1938d129 --- a/queries/aws_config_configuration_recorder_1.yaml +++ b/queries/aws_config_configuration_recorder_1.yaml @@ -1,19 +1,28 @@ Description: Allows users to query AWS Config Configuration Recorder ID: aws_config_configuration_recorder_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n role_arn,\n status,\n recording_group,\n \ - \ status_recording,\n akas,\n title\nfrom\n aws_config_configuration_recorder;" + QueryToExecute: | + SELECT + name, + role_arn, + status, + recording_group, + status_recording, + akas, + title + FROM + aws_config_configuration_recorder; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Config Configuration Recorder -Title: Find AWS Config Configuration Recorder using SQL + - Config Configuration Recorder +Title: Find AWS Config Configuration Recorder using SQL \ No newline at end of file diff --git a/queries/aws_config_configuration_recorder_2.yaml b/queries/aws_config_configuration_recorder_2.yaml old mode 100755 new mode 100644 index 3a2c9da02..1349d2e9d --- a/queries/aws_config_configuration_recorder_2.yaml +++ b/queries/aws_config_configuration_recorder_2.yaml @@ -1,21 +1,29 @@ Description: Allows users to query AWS Config Configuration Recorder ID: aws_config_configuration_recorder_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n role_arn,\n status_recording,\n title\nfrom\n\ - \ aws_config_configuration_recorder\nwhere\n not status_recording;" + QueryToExecute: | + SELECT + name, + role_arn, + status_recording, + title + FROM + aws_config_configuration_recorder + WHERE + NOT status_recording; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Configuration Recorder Status + - AWS Config +Title: Find AWS Config Configuration Recorder Status \ No newline at end of file diff --git a/queries/aws_config_configuration_recorder_3.yaml b/queries/aws_config_configuration_recorder_3.yaml old mode 100755 new mode 100644 index e3e8cb667..e27536409 --- a/queries/aws_config_configuration_recorder_3.yaml +++ b/queries/aws_config_configuration_recorder_3.yaml @@ -1,22 +1,28 @@ Description: Allows users to query AWS Config Configuration Recorder ID: aws_config_configuration_recorder_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n status ->> 'LastStatus' as last_status,\n status\ - \ ->> 'LastStatusChangeTime' as last_status_change_time,\n status ->> 'LastErrorCode'\ - \ as last_error_code,\n status ->> 'LastErrorMessage' as last_error_message\n\ - from\n aws_config_configuration_recorder\nwhere\n status ->> 'LastStatus' =\ - \ 'FAILURE';" + QueryToExecute: | + SELECT + name, + status ->> 'LastStatus' AS last_status, + status ->> 'LastStatusChangeTime' AS last_status_change_time, + status ->> 'LastErrorCode' AS last_error_code, + status ->> 'LastErrorMessage' AS last_error_message + FROM + aws_config_configuration_recorder + WHERE + status ->> 'LastStatus' = 'FAILURE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find all AWS Config Configuration Recorder using SQL + - AWS Config +Title: Find all AWS Config Configuration Recorder using SQL \ No newline at end of file diff --git a/queries/aws_config_conformance_pack_1.yaml b/queries/aws_config_conformance_pack_1.yaml old mode 100755 new mode 100644 index 014bc36a1..50197afe7 --- a/queries/aws_config_conformance_pack_1.yaml +++ b/queries/aws_config_conformance_pack_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Config Conformance Packs to fetch information - about the AWS Config conformance packs deployed on an AWS account. +Description: Allows users to query AWS Config Conformance Packs to fetch information about the AWS Config conformance packs deployed on an AWS account. ID: aws_config_conformance_pack_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n conformance_pack_id,\n created_by,\n last_update_requested_time,\n\ - \ title,\n akas\nfrom\n aws_config_conformance_pack;" + QueryToExecute: | + SELECT + name, + conformance_pack_id, + created_by, + last_update_requested_time, + title, + akas + FROM + aws_config_conformance_pack; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: List all AWS Config Conformance Packs + - AWS Config +Title: List all AWS Config Conformance Packs \ No newline at end of file diff --git a/queries/aws_config_conformance_pack_2.yaml b/queries/aws_config_conformance_pack_2.yaml old mode 100755 new mode 100644 index 0374c8da5..0ae2f4c5e --- a/queries/aws_config_conformance_pack_2.yaml +++ b/queries/aws_config_conformance_pack_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Config Conformance Packs to fetch information - about the AWS Config conformance packs deployed on an AWS account. +Description: Allows users to query AWS Config Conformance Packs to fetch information about the AWS Config conformance packs deployed on an AWS account. ID: aws_config_conformance_pack_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n conformance_pack_id,\n delivery_s3_bucket,\n\ - \ delivery_s3_key_prefix\nfrom\n aws_config_conformance_pack;" + QueryToExecute: | + SELECT + name, + conformance_pack_id, + delivery_s3_bucket, + delivery_s3_key_prefix + FROM + aws_config_conformance_pack; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: List all AWS Config Conformance Packs Info + - AWS Config +Title: List all AWS Config Conformance Packs Info \ No newline at end of file diff --git a/queries/aws_config_conformance_pack_3.yaml b/queries/aws_config_conformance_pack_3.yaml old mode 100755 new mode 100644 index 79acc2664..8114f0c52 --- a/queries/aws_config_conformance_pack_3.yaml +++ b/queries/aws_config_conformance_pack_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Config Conformance Packs to fetch information - about the AWS Config conformance packs deployed on an AWS account. +Description: Allows users to query AWS Config Conformance Packs to fetch information about the AWS Config conformance packs deployed on an AWS account. ID: aws_config_conformance_pack_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n inp ->> 'ParameterName' as parameter_name,\n\ - \ inp ->> 'ParameterValue' as parameter_value,\n title,\n akas\nfrom\n aws_config_conformance_pack,\n\ - \ jsonb_array_elements(input_parameters) as inp;" + QueryToExecute: | + SELECT + name, + inp ->> 'ParameterName' AS parameter_name, + inp ->> 'ParameterValue' AS parameter_value, + title, + akas + FROM + aws_config_conformance_pack, + JSONB_ARRAY_ELEMENTS(input_parameters) AS inp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find all AWS Config Conformance Packs and Parameters + - AWS Config +Title: Find all AWS Config Conformance Packs and Parameters \ No newline at end of file diff --git a/queries/aws_config_retention_configuration_1.yaml b/queries/aws_config_retention_configuration_1.yaml old mode 100755 new mode 100644 index c073077ca..aa0376df3 --- a/queries/aws_config_retention_configuration_1.yaml +++ b/queries/aws_config_retention_configuration_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Config Retention Configuration for information - about the retention period that AWS Config uses to retain your configuration items. +Description: Allows users to query AWS Config Retention Configuration for information about the retention period that AWS Config uses to retain your configuration items. ID: aws_config_retention_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n retention_period_in_days,\n title,\n region\n\ - from\n aws_config_retention_configuration;" + QueryToExecute: | + SELECT + name, + retention_period_in_days, + title, + region + FROM + aws_config_retention_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: List AWS Config Retention Configuration Details + - AWS Config +Title: List AWS Config Retention Configuration Details \ No newline at end of file diff --git a/queries/aws_config_retention_configuration_2.yaml b/queries/aws_config_retention_configuration_2.yaml old mode 100755 new mode 100644 index b9f21ed93..bc319ff6d --- a/queries/aws_config_retention_configuration_2.yaml +++ b/queries/aws_config_retention_configuration_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Config Retention Configuration for information - about the retention period that AWS Config uses to retain your configuration items. +Description: Allows users to query AWS Config Retention Configuration for information about the retention period that AWS Config uses to retain your configuration items. ID: aws_config_retention_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n retention_period_in_days,\n title\nfrom\n \ - \ aws_config_retention_configuration\nwhere\n retention_period_in_days < 356;" + QueryToExecute: | + SELECT + name, + retention_period_in_days, + title + FROM + aws_config_retention_configuration + WHERE + retention_period_in_days < 356; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Retention Configuration Details + - AWS Config +Title: Find AWS Config Retention Configuration Details \ No newline at end of file diff --git a/queries/aws_config_retention_configuration_3.yaml b/queries/aws_config_retention_configuration_3.yaml old mode 100755 new mode 100644 index b2400423a..d09741492 --- a/queries/aws_config_retention_configuration_3.yaml +++ b/queries/aws_config_retention_configuration_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Config Retention Configuration for information - about the retention period that AWS Config uses to retain your configuration items. +Description: Allows users to query AWS Config Retention Configuration for information about the retention period that AWS Config uses to retain your configuration items. ID: aws_config_retention_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n retention_period_in_days,\n title,\n region\n\ - from\n aws_config_retention_configuration\nwhere\n region = 'us-east-1';" + QueryToExecute: | + SELECT + name, + retention_period_in_days, + title, + region + FROM + aws_config_retention_configuration + WHERE + region = 'us-east-1'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Retention Configuration Retention Period + - AWS Config +Title: Find AWS Config Retention Configuration Retention Period \ No newline at end of file diff --git a/queries/aws_config_retention_configuration_4.yaml b/queries/aws_config_retention_configuration_4.yaml old mode 100755 new mode 100644 index 61de800c2..f69a2aae8 --- a/queries/aws_config_retention_configuration_4.yaml +++ b/queries/aws_config_retention_configuration_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Config Retention Configuration for information - about the retention period that AWS Config uses to retain your configuration items. +Description: Allows users to query AWS Config Retention Configuration for information about the retention period that AWS Config uses to retain your configuration items. ID: aws_config_retention_configuration_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.title as configuration_recorder,\n r.name as retention_configuration_name,\n\ - \ r.retention_period_in_days,\n r.region\nfrom\n aws_config_retention_configuration\ - \ as r\n left join aws_config_configuration_recorder as c\non\n r.region = c.region;" + QueryToExecute: | + SELECT + c.title AS configuration_recorder, + r.name AS retention_configuration_name, + r.retention_period_in_days, + r.region + FROM + aws_config_retention_configuration AS r + LEFT JOIN aws_config_configuration_recorder AS c + ON + r.region = c.region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Retention Configuration Using SQL + - AWS Config +Title: Find AWS Config Retention Configuration Using SQL \ No newline at end of file diff --git a/queries/aws_config_rule_1.yaml b/queries/aws_config_rule_1.yaml old mode 100755 new mode 100644 index dba7082ba..cf437d338 --- a/queries/aws_config_rule_1.yaml +++ b/queries/aws_config_rule_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n arn,\n rule_state,\n created_by,\n\ - \ scope\nfrom\n aws_config_rule;" + QueryToExecute: | + SELECT + name, + rule_id, + arn, + rule_state, + created_by, + scope + FROM + aws_config_rule; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Config -Title: List all AWS Config Rules with Details + - Config +Title: List all AWS Config Rules with Details \ No newline at end of file diff --git a/queries/aws_config_rule_2.yaml b/queries/aws_config_rule_2.yaml old mode 100755 new mode 100644 index 41862a339..bacfb59a2 --- a/queries/aws_config_rule_2.yaml +++ b/queries/aws_config_rule_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n arn,\n rule_state\nfrom\n aws_config_rule\n\ - where\n rule_state <> 'ACTIVE';" + QueryToExecute: | + SELECT + name, + rule_id, + arn, + rule_state + FROM + aws_config_rule + WHERE + rule_state <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Config -Title: Find AWS Config Rules with Inactive Rule State + - Config +Title: Find AWS Config Rules with Inactive Rule State \ No newline at end of file diff --git a/queries/aws_config_rule_3.yaml b/queries/aws_config_rule_3.yaml old mode 100755 new mode 100644 index b19df57e6..91dc070c3 --- a/queries/aws_config_rule_3.yaml +++ b/queries/aws_config_rule_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n tags\nfrom\n aws_config_rule\n\ - where\n name Like '%s3-bucket%';" + QueryToExecute: | + SELECT + name, + rule_id, + tags + FROM + aws_config_rule + WHERE + name LIKE '%s3-bucket%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Rules for S3 Buckets by Name + - AWS Config +Title: Find AWS Config Rules for S3 Buckets by Name \ No newline at end of file diff --git a/queries/aws_config_rule_4.yaml b/queries/aws_config_rule_4.yaml old mode 100755 new mode 100644 index be28becc5..0868c60ef --- a/queries/aws_config_rule_4.yaml +++ b/queries/aws_config_rule_4.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(compliance_by_config_rule) as compliance_info\n\ - from\n aws_config_rule\nwhere\n name = 'approved-amis-by-id';" + QueryToExecute: | + SELECT + jsonb_pretty(compliance_by_config_rule) AS compliance_info + FROM + aws_config_rule + WHERE + name = 'approved-amis-by-id'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find AWS Config Rule Info Including Compliance Status + - AWS Config +Title: Find AWS Config Rule Info Including Compliance Status \ No newline at end of file diff --git a/queries/aws_config_rule_5.yaml b/queries/aws_config_rule_5.yaml old mode 100755 new mode 100644 index 24c28161b..b77ad4e80 --- a/queries/aws_config_rule_5.yaml +++ b/queries/aws_config_rule_5.yaml @@ -1,24 +1,26 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as config_rule_name,\n compliance_status -> 'Compliance'\ - \ -> 'ComplianceType' as compliance_type\nfrom\n aws_config_rule,\n jsonb_array_elements(compliance_by_config_rule)\ - \ as compliance_status;" + QueryToExecute: | + SELECT + name AS config_rule_name, + compliance_status -> 'Compliance' -> 'ComplianceType' AS compliance_type + FROM + aws_config_rule, + jsonb_array_elements(compliance_by_config_rule) AS compliance_status; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Config -Title: Find Config Rules in AWS with Compliance Status + - AWS Config +Title: Find Config Rules in AWS with Compliance Status \ No newline at end of file diff --git a/queries/aws_config_rule_6.yaml b/queries/aws_config_rule_6.yaml old mode 100755 new mode 100644 index d15018b06..a8540e022 --- a/queries/aws_config_rule_6.yaml +++ b/queries/aws_config_rule_6.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query Config Rules in AWS Config service. It provides - information about each Config Rule, including its name, ARN, description, scope, - and compliance status. +Description: Allows users to query Config Rules in AWS Config service. It provides information about each Config Rule, including its name, ARN, description, scope, and compliance status. ID: aws_config_rule_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as config_rule_name,\n c ->> 'Mode' as evaluation_mode\n\ - from\n aws_config_rule,\n jsonb_array_elements(evaluation_modes) as c\nwhere\n\ - \ c ->> 'Mode' = 'PROACTIVE';" + QueryToExecute: | + SELECT + name AS config_rule_name, + c ->> 'Mode' AS evaluation_mode + FROM + aws_config_rule, + jsonb_array_elements(evaluation_modes) AS c + WHERE + c ->> 'Mode' = 'PROACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Config Rules -Title: List all AWS Config Rules with Proactive Evaluation Mode + - Config Rules +Title: List all AWS Config Rules with Proactive Evaluation Mode \ No newline at end of file diff --git a/queries/aws_cost_by_account_daily_1.yaml b/queries/aws_cost_by_account_daily_1.yaml old mode 100755 new mode 100644 index 68fb9fa29..6c153e84c --- a/queries/aws_cost_by_account_daily_1.yaml +++ b/queries/aws_cost_by_account_daily_1.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query daily AWS costs by account. This table provides - an overview of AWS usage and cost data for each AWS account on a daily basis. +Description: Allows users to query daily AWS costs by account. This table provides an overview of AWS usage and cost data for each AWS account on a daily basis. ID: aws_cost_by_account_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_account_daily\norder by\n linked_account_id,\n period_start;" + QueryToExecute: | + SELECT + linked_account_id, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_account_daily + ORDER BY + linked_account_id, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find AWS Cost and Usage By Account Daily + - Cost Explorer +Title: Find AWS Cost and Usage By Account Daily \ No newline at end of file diff --git a/queries/aws_cost_by_account_daily_2.yaml b/queries/aws_cost_by_account_daily_2.yaml old mode 100755 new mode 100644 index 19cca5433..4e93dd0a2 --- a/queries/aws_cost_by_account_daily_2.yaml +++ b/queries/aws_cost_by_account_daily_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query daily AWS costs by account. This table provides - an overview of AWS usage and cost data for each AWS account on a daily basis. +Description: Allows users to query daily AWS costs by account. This table provides an overview of AWS usage and cost data for each AWS account on a daily basis. ID: aws_cost_by_account_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_account_daily\ngroup by\n linked_account_id\n\ - order by\n linked_account_id;" + QueryToExecute: | + SELECT + linked_account_id, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_account_daily + GROUP BY + linked_account_id + ORDER BY + linked_account_id; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: List AWS Daily Costs by Account Overview with SQL + - AWS Cost Explorer +Title: List AWS Daily Costs by Account Overview with SQL \ No newline at end of file diff --git a/queries/aws_cost_by_account_daily_3.yaml b/queries/aws_cost_by_account_daily_3.yaml old mode 100755 new mode 100644 index 6f5390ddd..d7551d378 --- a/queries/aws_cost_by_account_daily_3.yaml +++ b/queries/aws_cost_by_account_daily_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query daily AWS costs by account. This table provides - an overview of AWS usage and cost data for each AWS account on a daily basis. +Description: Allows users to query daily AWS costs by account. This table provides an overview of AWS usage and cost data for each AWS account on a daily basis. ID: aws_cost_by_account_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as (\n select\n linked_account_id,\n period_start,\n\ - \ unblended_cost_amount::numeric::money,\n rank() over(partition by linked_account_id\ - \ order by unblended_cost_amount desc)\n from \n aws_cost_by_account_daily\n\ - )\nselect * from ranked_costs where rank <= 10;" + QueryToExecute: | + WITH ranked_costs AS ( + SELECT + linked_account_id, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY linked_account_id ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_account_daily + ) + SELECT * + FROM ranked_costs + WHERE rank <= 10; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find Daily AWS Costs by Account + - Cost Explorer +Title: Find Daily AWS Costs by Account \ No newline at end of file diff --git a/queries/aws_cost_by_account_monthly_1.yaml b/queries/aws_cost_by_account_monthly_1.yaml old mode 100755 new mode 100644 index 8517347f7..13c7b2ae5 --- a/queries/aws_cost_by_account_monthly_1.yaml +++ b/queries/aws_cost_by_account_monthly_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query monthly AWS costs per account. It provides cost - details for each AWS account, allowing users to monitor and manage their AWS spending. +Description: Allows users to query monthly AWS costs per account. It provides cost details for each AWS account, allowing users to monitor and manage their AWS spending. ID: aws_cost_by_account_monthly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_account_monthly\norder by\n linked_account_id,\n period_start;" + QueryToExecute: | + SELECT + linked_account_id, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_account_monthly + ORDER BY + linked_account_id, + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: List AWS Monthly Costs Per Account Using AWS Cost Explorer + - AWS Cost Explorer +Title: List AWS Monthly Costs Per Account Using AWS Cost Explorer \ No newline at end of file diff --git a/queries/aws_cost_by_account_monthly_2.yaml b/queries/aws_cost_by_account_monthly_2.yaml old mode 100755 new mode 100644 index 02bd7d3a5..70d982afb --- a/queries/aws_cost_by_account_monthly_2.yaml +++ b/queries/aws_cost_by_account_monthly_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query monthly AWS costs per account. It provides cost - details for each AWS account, allowing users to monitor and manage their AWS spending. +Description: Allows users to query monthly AWS costs per account. It provides cost details for each AWS account, allowing users to monitor and manage their AWS spending. ID: aws_cost_by_account_monthly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_account_monthly\ngroup by\n linked_account_id\n\ - order by\n linked_account_id;" + QueryToExecute: | + SELECT + linked_account_id, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_account_monthly + GROUP BY + linked_account_id + ORDER BY + linked_account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find Monthly AWS Costs Per Account + - Cost Explorer +Title: Find Monthly AWS Costs Per Account \ No newline at end of file diff --git a/queries/aws_cost_by_account_monthly_3.yaml b/queries/aws_cost_by_account_monthly_3.yaml old mode 100755 new mode 100644 index b607b8078..492e08600 --- a/queries/aws_cost_by_account_monthly_3.yaml +++ b/queries/aws_cost_by_account_monthly_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query monthly AWS costs per account. It provides cost - details for each AWS account, allowing users to monitor and manage their AWS spending. +Description: Allows users to query monthly AWS costs per account. It provides cost details for each AWS account, allowing users to monitor and manage their AWS spending. ID: aws_cost_by_account_monthly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n period_start,\n unblended_cost_amount::numeric::money,\n\ - \ rank() over(partition by linked_account_id order by unblended_cost_amount desc)\n\ - from \n aws_cost_by_account_monthly;" + QueryToExecute: | + SELECT + linked_account_id, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY linked_account_id ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_account_monthly; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer Service -Title: List all Monthly AWS Costs Per Account + - Cost Explorer Service +Title: List all Monthly AWS Costs Per Account \ No newline at end of file diff --git a/queries/aws_cost_by_account_monthly_4.yaml b/queries/aws_cost_by_account_monthly_4.yaml old mode 100755 new mode 100644 index 295ea6051..daa593094 --- a/queries/aws_cost_by_account_monthly_4.yaml +++ b/queries/aws_cost_by_account_monthly_4.yaml @@ -1,27 +1,40 @@ -Description: Allows users to query monthly AWS costs per account. It provides cost - details for each AWS account, allowing users to monitor and manage their AWS spending. +Description: Allows users to query monthly AWS costs per account. It provides cost details for each AWS account, allowing users to monitor and manage their AWS spending. ID: aws_cost_by_account_monthly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with cost_data as (\n select\n linked_account_id,\n period_start,\n\ - \ unblended_cost_amount as this_month,\n lag(unblended_cost_amount,-1) over(partition\ - \ by linked_account_id order by period_start desc) as previous_month\n from \n\ - \ aws_cost_by_account_monthly\n)\nselect\n linked_account_id,\n period_start,\n\ - \ this_month::numeric::money,\n previous_month::numeric::money,\n round((100\ - \ * ( (this_month - previous_month) / previous_month))::numeric, 2) as percent_change\n\ - from\n cost_data\norder by\n linked_account_id,\n period_start;" + QueryToExecute: | + WITH cost_data AS ( + SELECT + linked_account_id, + period_start, + unblended_cost_amount AS this_month, + LAG(unblended_cost_amount, -1) OVER (PARTITION BY linked_account_id ORDER BY period_start DESC) AS previous_month + FROM + aws_cost_by_account_monthly + ) + SELECT + linked_account_id, + period_start, + this_month::numeric::money, + previous_month::numeric::money, + ROUND((100 * ((this_month - previous_month) / previous_month))::numeric, 2) AS percent_change + FROM + cost_data + ORDER BY + linked_account_id, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find AWS Monthly Cost Per Account for Management + - Cost Explorer +Title: Find AWS Monthly Cost Per Account for Management \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_daily_1.yaml b/queries/aws_cost_by_record_type_daily_1.yaml old mode 100755 new mode 100644 index 8b32615d1..34ff097b0 --- a/queries/aws_cost_by_record_type_daily_1.yaml +++ b/queries/aws_cost_by_record_type_daily_1.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query daily AWS cost data by record type. This table - provides information about AWS costs incurred per record type on a daily basis. +Description: Allows users to query daily AWS cost data by record type. This table provides information about AWS costs incurred per record type on a daily basis. ID: aws_cost_by_record_type_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n record_type,\n period_start,\n\ - \ blended_cost_amount::numeric::money,\n unblended_cost_amount::numeric::money,\n\ - \ amortized_cost_amount::numeric::money,\n net_unblended_cost_amount::numeric::money,\n\ - \ net_amortized_cost_amount::numeric::money\nfrom \n aws_cost_by_record_type_daily\n\ - order by\n linked_account_id,\n period_start;" + QueryToExecute: | + SELECT + linked_account_id, + record_type, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_record_type_daily + ORDER BY + linked_account_id, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost and Usage Report -Title: List Daily AWS Cost Data by Record Type + - AWS Cost and Usage Report +Title: List Daily AWS Cost Data by Record Type \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_daily_2.yaml b/queries/aws_cost_by_record_type_daily_2.yaml old mode 100755 new mode 100644 index 3be2b203d..4cd0b667b --- a/queries/aws_cost_by_record_type_daily_2.yaml +++ b/queries/aws_cost_by_record_type_daily_2.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query daily AWS cost data by record type. This table - provides information about AWS costs incurred per record type on a daily basis. +Description: Allows users to query daily AWS cost data by record type. This table provides information about AWS costs incurred per record type on a daily basis. ID: aws_cost_by_record_type_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n record_type,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_record_type_daily\ngroup by\n linked_account_id,\n\ - \ record_type\norder by\n linked_account_id;" + QueryToExecute: | + SELECT + linked_account_id, + record_type, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_record_type_daily + GROUP BY + linked_account_id, + record_type + ORDER BY + linked_account_id; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost and Usage Report -Title: List all AWS costs by record type on a daily basis + - Cost and Usage Report +Title: List all AWS costs by record type on a daily basis \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_daily_3.yaml b/queries/aws_cost_by_record_type_daily_3.yaml old mode 100755 new mode 100644 index 972155a5b..27a4d8ed1 --- a/queries/aws_cost_by_record_type_daily_3.yaml +++ b/queries/aws_cost_by_record_type_daily_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query daily AWS cost data by record type. This table - provides information about AWS costs incurred per record type on a daily basis. +Description: Allows users to query daily AWS cost data by record type. This table provides information about AWS costs incurred per record type on a daily basis. ID: aws_cost_by_record_type_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as (\n select\n linked_account_id,\n record_type,\n\ - \ period_start,\n unblended_cost_amount::numeric::money,\n rank() over(partition\ - \ by linked_account_id, record_type order by unblended_cost_amount desc)\n from\ - \ \n aws_cost_by_record_type_daily\n)\nselect * from ranked_costs where rank\ - \ <= 10;" + QueryToExecute: | + WITH ranked_costs AS ( + SELECT + linked_account_id, + record_type, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY linked_account_id, record_type ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_record_type_daily + ) + SELECT * + FROM ranked_costs + WHERE rank <= 10; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost and Usage Report -Title: List All Daily AWS Costs by Record Type + - Cost and Usage Report +Title: List All Daily AWS Costs by Record Type \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_monthly_1.yaml b/queries/aws_cost_by_record_type_monthly_1.yaml old mode 100755 new mode 100644 index ec36ca84d..26dd4a2d5 --- a/queries/aws_cost_by_record_type_monthly_1.yaml +++ b/queries/aws_cost_by_record_type_monthly_1.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Cost and Usage Report Records on a monthly - basis. +Description: Allows users to query AWS Cost and Usage Report Records on a monthly basis. ID: aws_cost_by_record_type_monthly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n record_type,\n period_start,\n\ - \ blended_cost_amount::numeric::money,\n unblended_cost_amount::numeric::money,\n\ - \ amortized_cost_amount::numeric::money,\n net_unblended_cost_amount::numeric::money,\n\ - \ net_amortized_cost_amount::numeric::money\nfrom \n aws_cost_by_record_type_monthly\n\ - order by\n linked_account_id,\n period_start;" + QueryToExecute: | + SELECT + linked_account_id, + record_type, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_record_type_monthly + ORDER BY + linked_account_id, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost and Usage Report -Title: Find AWS Cost and Usage Report Records Monthly + - Cost and Usage Report +Title: Find AWS Cost and Usage Report Records Monthly \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_monthly_2.yaml b/queries/aws_cost_by_record_type_monthly_2.yaml old mode 100755 new mode 100644 index 8d8fdfc24..c34d62605 --- a/queries/aws_cost_by_record_type_monthly_2.yaml +++ b/queries/aws_cost_by_record_type_monthly_2.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS Cost and Usage Report Records on a monthly - basis. +Description: Allows users to query AWS Cost and Usage Report Records on a monthly basis. ID: aws_cost_by_record_type_monthly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n record_type,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_record_type_monthly\ngroup by\n linked_account_id,\n\ - \ record_type\norder by\n linked_account_id;" + QueryToExecute: | + SELECT + linked_account_id, + record_type, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_record_type_monthly + GROUP BY + linked_account_id, + record_type + ORDER BY + linked_account_id; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost and Usage Report -Title: Find AWS Monthly Cost and Usage Report Records + - Cost and Usage Report +Title: Find AWS Monthly Cost and Usage Report Records \ No newline at end of file diff --git a/queries/aws_cost_by_record_type_monthly_3.yaml b/queries/aws_cost_by_record_type_monthly_3.yaml old mode 100755 new mode 100644 index a2e14c98b..61f57d132 --- a/queries/aws_cost_by_record_type_monthly_3.yaml +++ b/queries/aws_cost_by_record_type_monthly_3.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Cost and Usage Report Records on a monthly - basis. +Description: Allows users to query AWS Cost and Usage Report Records on a monthly basis. ID: aws_cost_by_record_type_monthly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n linked_account_id,\n record_type,\n period_start,\n\ - \ unblended_cost_amount::numeric::money,\n rank() over(partition by linked_account_id,\ - \ record_type order by unblended_cost_amount desc)\nfrom \n aws_cost_by_record_type_monthly;" + QueryToExecute: | + SELECT + linked_account_id, + record_type, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY linked_account_id, record_type ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_record_type_monthly; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost and Usage Report -Title: List AWS Cost and Usage Report Records Monthly + - Cost and Usage Report +Title: List AWS Cost and Usage Report Records Monthly \ No newline at end of file diff --git a/queries/aws_cost_by_service_daily_1.yaml b/queries/aws_cost_by_service_daily_1.yaml old mode 100755 new mode 100644 index b35b52ab6..027c869f2 --- a/queries/aws_cost_by_service_daily_1.yaml +++ b/queries/aws_cost_by_service_daily_1.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown - by AWS service. +Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown by AWS service. ID: aws_cost_by_service_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_service_daily\norder by\n service,\n period_start;" + QueryToExecute: | + SELECT + service, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_service_daily + ORDER BY + service, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List all Daily AWS Costs by Service + - Cost Explorer +Title: List all Daily AWS Costs by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_daily_2.yaml b/queries/aws_cost_by_service_daily_2.yaml old mode 100755 new mode 100644 index b14c69596..7fea4ec48 --- a/queries/aws_cost_by_service_daily_2.yaml +++ b/queries/aws_cost_by_service_daily_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown - by AWS service. +Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown by AWS service. ID: aws_cost_by_service_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_service_daily\ngroup by\n service\norder by\n\ - \ service;" + QueryToExecute: | + SELECT + service, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_daily + GROUP BY + service + ORDER BY + service; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: List AWS Cost Explorer Daily Service Cost Breakdown + - AWS Cost Explorer +Title: List AWS Cost Explorer Daily Service Cost Breakdown \ No newline at end of file diff --git a/queries/aws_cost_by_service_daily_3.yaml b/queries/aws_cost_by_service_daily_3.yaml old mode 100755 new mode 100644 index 310bd720b..bfca01a27 --- a/queries/aws_cost_by_service_daily_3.yaml +++ b/queries/aws_cost_by_service_daily_3.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown - by AWS service. +Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown by AWS service. ID: aws_cost_by_service_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_daily\n\ - group by\n service\norder by\n average desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_daily + GROUP BY + service + ORDER BY + average DESC + LIMIT 10; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: Find daily cost breakdown by AWS service + - AWS Cost Explorer +Title: Find daily cost breakdown by AWS service \ No newline at end of file diff --git a/queries/aws_cost_by_service_daily_4.yaml b/queries/aws_cost_by_service_daily_4.yaml old mode 100755 new mode 100644 index f3e60fd9e..adb2cce3b --- a/queries/aws_cost_by_service_daily_4.yaml +++ b/queries/aws_cost_by_service_daily_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown - by AWS service. +Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown by AWS service. ID: aws_cost_by_service_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_daily\n\ - group by\n service\norder by\n sum desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_daily + GROUP BY + service + ORDER BY + sum DESC + LIMIT 10; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List all AWS Cost Breakdown by Service + - Cost Explorer +Title: List all AWS Cost Breakdown by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_daily_5.yaml b/queries/aws_cost_by_service_daily_5.yaml old mode 100755 new mode 100644 index bd3bef187..ad36a420c --- a/queries/aws_cost_by_service_daily_5.yaml +++ b/queries/aws_cost_by_service_daily_5.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown - by AWS service. +Description: Allows users to query AWS Cost Explorer to retrieve daily cost breakdown by AWS service. ID: aws_cost_by_service_daily_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as (\n select\n service,\n period_start,\n\ - \ unblended_cost_amount::numeric::money,\n rank() over(partition by service\ - \ order by unblended_cost_amount desc)\n from \n aws_cost_by_service_daily\n\ - )\nselect * from ranked_costs where rank <= 10;" + QueryToExecute: | + WITH ranked_costs AS ( + SELECT + service, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER(PARTITION BY service ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_service_daily + ) + SELECT + * + FROM + ranked_costs + WHERE + rank <= 10; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find Top 10 AWS Daily Costs by Service + - Cost Explorer +Title: Find Top 10 AWS Daily Costs by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_1.yaml b/queries/aws_cost_by_service_monthly_1.yaml old mode 100755 new mode 100644 index fd1926497..1c9fbe63b --- a/queries/aws_cost_by_service_monthly_1.yaml +++ b/queries/aws_cost_by_service_monthly_1.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_service_monthly\norder by\n service,\n period_start;" + QueryToExecute: | + SELECT + service, + period_start, + blended_cost_amount::numeric::MONEY, + unblended_cost_amount::numeric::MONEY, + amortized_cost_amount::numeric::MONEY, + net_unblended_cost_amount::numeric::MONEY, + net_amortized_cost_amount::numeric::MONEY + FROM + aws_cost_by_service_monthly + ORDER BY + service, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer Service -Title: List AWS monthly cost breakdown by service + - AWS Cost Explorer Service +Title: List AWS monthly cost breakdown by service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_2.yaml b/queries/aws_cost_by_service_monthly_2.yaml old mode 100755 new mode 100644 index bac196bce..d4fbc3506 --- a/queries/aws_cost_by_service_monthly_2.yaml +++ b/queries/aws_cost_by_service_monthly_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_service_monthly\ngroup by\n service\norder\ - \ by\n service;" + QueryToExecute: | + SELECT + service, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_monthly + GROUP BY + service + ORDER BY + service; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: List AWS Monthly Cost Breakdown by Service + - AWS Cost Explorer +Title: List AWS Monthly Cost Breakdown by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_3.yaml b/queries/aws_cost_by_service_monthly_3.yaml old mode 100755 new mode 100644 index a398b78e2..615f0cf8d --- a/queries/aws_cost_by_service_monthly_3.yaml +++ b/queries/aws_cost_by_service_monthly_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_monthly\n\ - group by\n service\norder by\n average desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + SUM(unblended_cost_amount)::NUMERIC::MONEY AS sum, + AVG(unblended_cost_amount)::NUMERIC::MONEY AS average + FROM + aws_cost_by_service_monthly + GROUP BY + service + ORDER BY + average DESC + LIMIT 10; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer Service -Title: Find AWS Monthly Cost Breakdown by Service + - AWS Cost Explorer Service +Title: Find AWS Monthly Cost Breakdown by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_4.yaml b/queries/aws_cost_by_service_monthly_4.yaml old mode 100755 new mode 100644 index e6746a337..02cd4d3d2 --- a/queries/aws_cost_by_service_monthly_4.yaml +++ b/queries/aws_cost_by_service_monthly_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_monthly\n\ - group by\n service\norder by\n sum desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_monthly + GROUP BY + service + ORDER BY + sum DESC + LIMIT 10; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List all AWS monthly cost breakdown by service + - Cost Explorer +Title: List all AWS monthly cost breakdown by service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_5.yaml b/queries/aws_cost_by_service_monthly_5.yaml old mode 100755 new mode 100644 index 094ab4624..4ed59334f --- a/queries/aws_cost_by_service_monthly_5.yaml +++ b/queries/aws_cost_by_service_monthly_5.yaml @@ -1,27 +1,34 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as (\n select\n service,\n period_start,\n\ - \ unblended_cost_amount::numeric::money,\n rank() over(partition by service\ - \ order by unblended_cost_amount desc)\n from \n aws_cost_by_service_monthly\n\ - )\nselect * from ranked_costs where rank = 1;" + QueryToExecute: | + WITH ranked_costs AS ( + SELECT + service, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY service ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_service_monthly + ) + SELECT * + FROM ranked_costs + WHERE rank = 1; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List all AWS monthly cost breakdowns by service + - Cost Explorer +Title: List all AWS monthly cost breakdowns by service \ No newline at end of file diff --git a/queries/aws_cost_by_service_monthly_6.yaml b/queries/aws_cost_by_service_monthly_6.yaml old mode 100755 new mode 100644 index 0fc267a67..8f34328e0 --- a/queries/aws_cost_by_service_monthly_6.yaml +++ b/queries/aws_cost_by_service_monthly_6.yaml @@ -1,27 +1,42 @@ -Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown - by service. This table provides details such as the service name, the cost associated - with it, and the currency code. +Description: Allows users to query AWS Cost Explorer Service for monthly cost breakdown by service. This table provides details such as the service name, the cost associated with it, and the currency code. ID: aws_cost_by_service_monthly_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with cost_data as (\n select\n service,\n period_start,\n\ - \ unblended_cost_amount as this_month,\n lag(unblended_cost_amount,-1) over(partition\ - \ by service order by period_start desc) as previous_month\n from \n aws_cost_by_service_monthly\n\ - )\nselect\n service,\n period_start,\n this_month::numeric::money,\n\ - \ previous_month::numeric::money,\n case \n when previous_month = 0\ - \ and this_month = 0 then 0\n when previous_month = 0 then 999\n else\ - \ round((100 * ( (this_month - previous_month) / previous_month))::numeric, 2)\ - \ \n end as percent_change\nfrom\n cost_data\norder by\n service,\n period_start;" + QueryToExecute: | + WITH cost_data AS ( + SELECT + service, + period_start, + unblended_cost_amount AS this_month, + LAG(unblended_cost_amount,-1) OVER(PARTITION BY service ORDER BY period_start DESC) AS previous_month + FROM + aws_cost_by_service_monthly + ) + SELECT + service, + period_start, + this_month::numeric::money, + previous_month::numeric::money, + CASE + WHEN previous_month = 0 AND this_month = 0 THEN 0 + WHEN previous_month = 0 THEN 999 + ELSE ROUND((100 * ((this_month - previous_month) / previous_month))::numeric, 2) + END AS percent_change + FROM + cost_data + ORDER BY + service, + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: List AWS Monthly Cost Breakdown by Service + - AWS Cost Explorer +Title: List AWS Monthly Cost Breakdown by Service \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_daily_1.yaml b/queries/aws_cost_by_service_usage_type_daily_1.yaml old mode 100755 new mode 100644 index 6b6e49bb3..107a24e0e --- a/queries/aws_cost_by_service_usage_type_daily_1.yaml +++ b/queries/aws_cost_by_service_usage_type_daily_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch - detailed data about AWS service usage and costs. +Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch detailed data about AWS service usage and costs. ID: aws_cost_by_service_usage_type_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_service_usage_type_daily\norder by\n service,\n period_start;" + QueryToExecute: | + SELECT + service, + usage_type, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_service_usage_type_daily + ORDER BY + service, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find daily AWS Cost Explorer Service usage and costs + - Cost Explorer +Title: Find daily AWS Cost Explorer Service usage and costs \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_daily_2.yaml b/queries/aws_cost_by_service_usage_type_daily_2.yaml old mode 100755 new mode 100644 index ee7ac6e9d..08530c508 --- a/queries/aws_cost_by_service_usage_type_daily_2.yaml +++ b/queries/aws_cost_by_service_usage_type_daily_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch - detailed data about AWS service usage and costs. +Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch detailed data about AWS service usage and costs. ID: aws_cost_by_service_usage_type_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_service_usage_type_daily\ngroup by\n service,\n\ - \ usage_type\norder by\n service,\n usage_type;" + QueryToExecute: | + SELECT + service, + usage_type, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_usage_type_daily + GROUP BY + service, + usage_type + ORDER BY + service, + usage_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer Service -Title: List all AWS service usage and costs by usage type + - Cost Explorer Service +Title: List all AWS service usage and costs by usage type \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_daily_3.yaml b/queries/aws_cost_by_service_usage_type_daily_3.yaml deleted file mode 100755 index c04677838..000000000 --- a/queries/aws_cost_by_service_usage_type_daily_3.yaml +++ /dev/null @@ -1,15 +0,0 @@ -Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch - detailed data about AWS service usage and costs. -ID: aws_cost_by_service_usage_type_daily_3 -IntegrationType: -- aws_cloud_account -Query: - Engine: CloudQL-v0.0.1 - ListOfTables: [] - Parameters: [] - PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_usage_type_daily\n\ - group by\n service,\n usage_type\norder by\n average desc\nlimit 10;" -Tags: {} -Title: '' diff --git a/queries/aws_cost_by_service_usage_type_daily_4.yaml b/queries/aws_cost_by_service_usage_type_daily_4.yaml old mode 100755 new mode 100644 index d700f62ee..d0976e2b3 --- a/queries/aws_cost_by_service_usage_type_daily_4.yaml +++ b/queries/aws_cost_by_service_usage_type_daily_4.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch - detailed data about AWS service usage and costs. +Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch detailed data about AWS service usage and costs. ID: aws_cost_by_service_usage_type_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_usage_type_daily\n\ - group by\n service,\n usage_type\norder by\n sum desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + usage_type, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_usage_type_daily + GROUP BY + service, + usage_type + ORDER BY + sum DESC + LIMIT 10; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List AWS Daily Service Usage and Costs + - Cost Explorer +Title: List AWS Daily Service Usage and Costs \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_monthly_1.yaml b/queries/aws_cost_by_service_usage_type_monthly_1.yaml old mode 100755 new mode 100644 index 6b7cbc5d5..594262ed0 --- a/queries/aws_cost_by_service_usage_type_monthly_1.yaml +++ b/queries/aws_cost_by_service_usage_type_monthly_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Cost Explorer Service to get detailed cost - data per service and usage type on a monthly basis. +Description: Allows users to query AWS Cost Explorer Service to get detailed cost data per service and usage type on a monthly basis. ID: aws_cost_by_service_usage_type_monthly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from \n aws_cost_by_service_usage_type_monthly\norder by\n service,\n period_start;" + QueryToExecute: | + SELECT + service, + usage_type, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_service_usage_type_monthly + ORDER BY + service, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find AWS Monthly Cost by Service and Usage Type + - Cost Explorer +Title: Find AWS Monthly Cost by Service and Usage Type \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_monthly_2.yaml b/queries/aws_cost_by_service_usage_type_monthly_2.yaml old mode 100755 new mode 100644 index dae1b9f6b..87450f058 --- a/queries/aws_cost_by_service_usage_type_monthly_2.yaml +++ b/queries/aws_cost_by_service_usage_type_monthly_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Cost Explorer Service to get detailed cost - data per service and usage type on a monthly basis. +Description: Allows users to query AWS Cost Explorer Service to get detailed cost data per service and usage type on a monthly basis. ID: aws_cost_by_service_usage_type_monthly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom \n aws_cost_by_service_usage_type_monthly\ngroup by\n service,\n\ - \ usage_type\norder by\n service,\n usage_type;" + QueryToExecute: | + SELECT + service, + usage_type, + MIN(unblended_cost_amount)::numeric::money AS min, + MAX(unblended_cost_amount)::numeric::money AS max, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_usage_type_monthly + GROUP BY + service, + usage_type + ORDER BY + service, + usage_type; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: Query AWS Cost Explorer for Service & Usage Monthly + - AWS Cost Explorer +Title: Query AWS Cost Explorer for Service & Usage Monthly \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_monthly_3.yaml b/queries/aws_cost_by_service_usage_type_monthly_3.yaml old mode 100755 new mode 100644 index df64dc1f5..ec097d10d --- a/queries/aws_cost_by_service_usage_type_monthly_3.yaml +++ b/queries/aws_cost_by_service_usage_type_monthly_3.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query AWS Cost Explorer Service to get detailed cost - data per service and usage type on a monthly basis. +Description: Allows users to query AWS Cost Explorer Service to get detailed cost data per service and usage type on a monthly basis. ID: aws_cost_by_service_usage_type_monthly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_usage_type_monthly\n\ - group by\n service,\n usage_type\norder by\n average desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + usage_type, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_usage_type_monthly + GROUP BY + service, + usage_type + ORDER BY + average DESC + LIMIT 10; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find AWS Cost by Service and Usage Type Monthly + - Cost Explorer +Title: Find AWS Cost by Service and Usage Type Monthly \ No newline at end of file diff --git a/queries/aws_cost_by_service_usage_type_monthly_4.yaml b/queries/aws_cost_by_service_usage_type_monthly_4.yaml old mode 100755 new mode 100644 index b04249d8a..2ce9837da --- a/queries/aws_cost_by_service_usage_type_monthly_4.yaml +++ b/queries/aws_cost_by_service_usage_type_monthly_4.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS Cost Explorer Service to get detailed cost - data per service and usage type on a monthly basis. +Description: Allows users to query AWS Cost Explorer Service to get detailed cost data per service and usage type on a monthly basis. ID: aws_cost_by_service_usage_type_monthly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n usage_type,\n sum(unblended_cost_amount)::numeric::money\ - \ as sum,\n avg(unblended_cost_amount)::numeric::money as average\nfrom \n aws_cost_by_service_usage_type_monthly\n\ - group by\n service,\n usage_type\norder by\n sum desc\nlimit 10;" + QueryToExecute: | + SELECT + service, + usage_type, + SUM(unblended_cost_amount)::numeric::money AS sum, + AVG(unblended_cost_amount)::numeric::money AS average + FROM + aws_cost_by_service_usage_type_monthly + GROUP BY + service, + usage_type + ORDER BY + sum DESC + LIMIT 10; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List all AWS Cost per Service and Usage Type Monthly + - Cost Explorer +Title: List all AWS Cost per Service and Usage Type Monthly \ No newline at end of file diff --git a/queries/aws_cost_by_tag_1.yaml b/queries/aws_cost_by_tag_1.yaml old mode 100755 new mode 100644 index 547b0dac0..4db623030 --- a/queries/aws_cost_by_tag_1.yaml +++ b/queries/aws_cost_by_tag_1.yaml @@ -1,16 +1,26 @@ -Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags - and associated costs. +Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags and associated costs. ID: aws_cost_by_tag_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n tag_key_1,\n tag_value_1,\n period_start,\n blended_cost_amount::numeric::money,\n\ - \ unblended_cost_amount::numeric::money,\n amortized_cost_amount::numeric::money,\n\ - \ net_unblended_cost_amount::numeric::money,\n net_amortized_cost_amount::numeric::money\n\ - from\n aws_cost_by_tag\nwhere\n granularity = 'DAILY'\nand\n tag_key_1 = 'Name';" + QueryToExecute: | + SELECT + tag_key_1, + tag_value_1, + period_start, + blended_cost_amount::numeric::money, + unblended_cost_amount::numeric::money, + amortized_cost_amount::numeric::money, + net_unblended_cost_amount::numeric::money, + net_amortized_cost_amount::numeric::money + FROM + aws_cost_by_tag + WHERE + granularity = 'DAILY' + AND tag_key_1 = 'Name'; Tags: {} -Title: Find all AWS Cost Allocation Tags and Associated Costs +Title: Find all AWS Cost Allocation Tags and Associated Costs \ No newline at end of file diff --git a/queries/aws_cost_by_tag_2.yaml b/queries/aws_cost_by_tag_2.yaml old mode 100755 new mode 100644 index ad59c8d59..a0874177e --- a/queries/aws_cost_by_tag_2.yaml +++ b/queries/aws_cost_by_tag_2.yaml @@ -1,20 +1,30 @@ -Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags - and associated costs. +Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags and associated costs. ID: aws_cost_by_tag_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n tag_key_1,\n tag_value_1,\n min(unblended_cost_amount)::numeric::money\ - \ as min,\n max(unblended_cost_amount)::numeric::money as max,\n avg(unblended_cost_amount)::numeric::money\ - \ as average\nfrom\n aws_cost_by_tag\nwhere\n granularity = 'DAILY'\nand\n \ - \ tag_key_1 = 'Name'\ngroup by\n tag_key_1, tag_value_1;" + QueryToExecute: | + SELECT + tag_key_1, + tag_value_1, + MIN(unblended_cost_amount)::NUMERIC::MONEY AS min, + MAX(unblended_cost_amount)::NUMERIC::MONEY AS max, + AVG(unblended_cost_amount)::NUMERIC::MONEY AS average + FROM + aws_cost_by_tag + WHERE + granularity = 'DAILY' + AND + tag_key_1 = 'Name' + GROUP BY + tag_key_1, tag_value_1; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws -Title: Find AWS Cost Explorer Tag Allocations and Costs + - aws +Title: Find AWS Cost Explorer Tag Allocations and Costs \ No newline at end of file diff --git a/queries/aws_cost_by_tag_3.yaml b/queries/aws_cost_by_tag_3.yaml old mode 100755 new mode 100644 index 741b4641c..58bd6c4c9 --- a/queries/aws_cost_by_tag_3.yaml +++ b/queries/aws_cost_by_tag_3.yaml @@ -1,25 +1,41 @@ -Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags - and associated costs. +Description: Allows users to query AWS Cost Explorer to obtain cost allocation tags and associated costs. ID: aws_cost_by_tag_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as\n(\n select\n tag_key_1,\n tag_value_1,\n\ - \ period_start,\n unblended_cost_amount::numeric::money,\n rank() over(partition\ - \ by tag_key_1\n order by\n unblended_cost_amount desc)\n from\n aws_cost_by_tag\n\ - \ where\n granularity = 'DAILY'\n and tag_key_1 = 'Name'\n)\nselect\n \ - \ *\nfrom\n ranked_costs\nwhere\n rank <= 10;" + QueryToExecute: | + WITH ranked_costs AS + ( + SELECT + tag_key_1, + tag_value_1, + period_start, + unblended_cost_amount::numeric::money, + RANK() OVER (PARTITION BY tag_key_1 + ORDER BY unblended_cost_amount DESC) + FROM + aws_cost_by_tag + WHERE + granularity = 'DAILY' + AND tag_key_1 = 'Name' + ) + SELECT + * + FROM + ranked_costs + WHERE + rank <= 10; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List Top 10 AWS Costs by Tag Using SQL + - Cost Explorer +Title: List Top 10 AWS Costs by Tag Using SQL \ No newline at end of file diff --git a/queries/aws_cost_forecast_daily_1.yaml b/queries/aws_cost_forecast_daily_1.yaml old mode 100755 new mode 100644 index 95a13c33d..e6c249c4f --- a/queries/aws_cost_forecast_daily_1.yaml +++ b/queries/aws_cost_forecast_daily_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Cost Explorer''s daily cost forecast data, - providing insights into projected daily costs based on historical data. +Description: Allows users to query AWS Cost Explorer's daily cost forecast data, providing insights into projected daily costs based on historical data. ID: aws_cost_forecast_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n period_start,\n period_end,\n mean_value::numeric::money\ - \ \nfrom \n aws_cost_forecast_daily\norder by\n period_start;" + QueryToExecute: | + SELECT + period_start, + period_end, + mean_value::numeric::money + FROM + aws_cost_forecast_daily + ORDER BY + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: Find Daily Cost Forecast Insights with AWS Cost Explorer + - AWS Cost Explorer +Title: Find Daily Cost Forecast Insights with AWS Cost Explorer \ No newline at end of file diff --git a/queries/aws_cost_forecast_monthly_1.yaml b/queries/aws_cost_forecast_monthly_1.yaml old mode 100755 new mode 100644 index ca367e8be..9d9df6486 --- a/queries/aws_cost_forecast_monthly_1.yaml +++ b/queries/aws_cost_forecast_monthly_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Cost Forecasts in AWS Cost Explorer for monthly - cost predictions. +Description: Allows users to query Cost Forecasts in AWS Cost Explorer for monthly cost predictions. ID: aws_cost_forecast_monthly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n period_start,\n period_end,\n mean_value::numeric::money\ - \ \nfrom \n aws_cost_forecast_monthly\norder by\n period_start;" + QueryToExecute: | + SELECT + period_start, + period_end, + mean_value::numeric::money + FROM + aws_cost_forecast_monthly + ORDER BY + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: Find Cost Forecasts in AWS Cost Explorer for Monthly Costs + - Cost Explorer +Title: Find Cost Forecasts in AWS Cost Explorer for Monthly Costs \ No newline at end of file diff --git a/queries/aws_cost_forecast_monthly_2.yaml b/queries/aws_cost_forecast_monthly_2.yaml old mode 100755 new mode 100644 index 1515b6663..b2e7481a9 --- a/queries/aws_cost_forecast_monthly_2.yaml +++ b/queries/aws_cost_forecast_monthly_2.yaml @@ -1,27 +1,41 @@ -Description: Allows users to query Cost Forecasts in AWS Cost Explorer for monthly - cost predictions. +Description: Allows users to query Cost Forecasts in AWS Cost Explorer for monthly cost predictions. ID: aws_cost_forecast_monthly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with cost_data as (\n select\n period_start,\n mean_value\ - \ as this_month,\n lag(mean_value,-1) over(order by period_start desc) as previous_month\n\ - \ from \n aws_cost_forecast_monthly\n)\nselect\n period_start,\n this_month::numeric::money,\n\ - \ previous_month::numeric::money,\n case \n when previous_month = 0\ - \ and this_month = 0 then 0\n when previous_month = 0 then 999\n else\ - \ round((100 * ( (this_month - previous_month) / previous_month))::numeric, 2)\ - \ \n end as percent_change\nfrom\n cost_data\norder by\n period_start;" + QueryToExecute: | + WITH cost_data AS ( + SELECT + period_start, + mean_value AS this_month, + LAG(mean_value, -1) OVER(ORDER BY period_start DESC) AS previous_month + FROM + aws_cost_forecast_monthly + ) + SELECT + period_start, + this_month::numeric::money, + previous_month::numeric::money, + CASE + WHEN previous_month = 0 AND this_month = 0 THEN 0 + WHEN previous_month = 0 THEN 999 + ELSE ROUND((100 * ((this_month - previous_month) / previous_month))::numeric, 2) + END AS percent_change + FROM + cost_data + ORDER BY + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List AWS Monthly Cost Forecasts using SQL + - Cost Explorer +Title: List AWS Monthly Cost Forecasts using SQL \ No newline at end of file diff --git a/queries/aws_cost_usage_1.yaml b/queries/aws_cost_usage_1.yaml old mode 100755 new mode 100644 index 176d01991..0da1712ad --- a/queries/aws_cost_usage_1.yaml +++ b/queries/aws_cost_usage_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service - to monitor, track, and manage AWS costs and usage over time. +Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service to monitor, track, and manage AWS costs and usage over time. ID: aws_cost_usage_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n period_start,\n dimension_1 as account_id,\n dimension_2\ - \ as service_name,\n net_unblended_cost_amount::numeric::money\nfrom\n aws_cost_usage\n\ - where\n granularity = 'MONTHLY'\n and dimension_type_1 = 'LINKED_ACCOUNT'\n\ - \ and dimension_type_2 = 'SERVICE'\norder by\n dimension_1,\n period_start;" + QueryToExecute: | + SELECT + period_start, + dimension_1 AS account_id, + dimension_2 AS service_name, + net_unblended_cost_amount::numeric::money + FROM + aws_cost_usage + WHERE + granularity = 'MONTHLY' + AND dimension_type_1 = 'LINKED_ACCOUNT' + AND dimension_type_2 = 'SERVICE' + ORDER BY + dimension_1, + period_start; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer Service -Title: Find AWS Cost Explorer Service Cost and Usage Data + - Cost Explorer Service +Title: Find AWS Cost Explorer Service Cost and Usage Data \ No newline at end of file diff --git a/queries/aws_cost_usage_2.yaml b/queries/aws_cost_usage_2.yaml old mode 100755 new mode 100644 index 5b5631fab..a56740089 --- a/queries/aws_cost_usage_2.yaml +++ b/queries/aws_cost_usage_2.yaml @@ -1,29 +1,42 @@ -Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service - to monitor, track, and manage AWS costs and usage over time. +Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service to monitor, track, and manage AWS costs and usage over time. ID: aws_cost_usage_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with ranked_costs as (\n select\n dimension_1 as account_id,\n\ - \ dimension_2 as service_name,\n sum(net_unblended_cost_amount)::numeric::money\ - \ as net_unblended_cost,\n rank() over(partition by dimension_1 order by sum(net_unblended_cost_amount)\ - \ desc)\n from\n aws_cost_usage\n where\n granularity = 'MONTHLY'\n \ - \ and dimension_type_1 = 'LINKED_ACCOUNT'\n and dimension_type_2 = 'SERVICE'\n\ - \ group by\n dimension_1,\n dimension_2\n order by\n dimension_1,\n\ - \ net_unblended_cost desc\n)\nselect * from ranked_costs where rank <=5" + QueryToExecute: | + WITH ranked_costs AS ( + SELECT + dimension_1 AS account_id, + dimension_2 AS service_name, + SUM(net_unblended_cost_amount)::numeric::money AS net_unblended_cost, + RANK() OVER(PARTITION BY dimension_1 ORDER BY SUM(net_unblended_cost_amount) DESC) + FROM + aws_cost_usage + WHERE + granularity = 'MONTHLY' + AND dimension_type_1 = 'LINKED_ACCOUNT' + AND dimension_type_2 = 'SERVICE' + GROUP BY + dimension_1, + dimension_2 + ORDER BY + dimension_1, + net_unblended_cost DESC + ) + SELECT * FROM ranked_costs WHERE rank <= 5 Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer -Title: List Top 5 AWS Cost and Usage Data + - Cost Explorer +Title: List Top 5 AWS Cost and Usage Data \ No newline at end of file diff --git a/queries/aws_cost_usage_3.yaml b/queries/aws_cost_usage_3.yaml old mode 100755 new mode 100644 index 9f7faef7e..b7e8ba872 --- a/queries/aws_cost_usage_3.yaml +++ b/queries/aws_cost_usage_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service - to monitor, track, and manage AWS costs and usage over time. +Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service to monitor, track, and manage AWS costs and usage over time. ID: aws_cost_usage_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n period_start,\n dimension_1 as account_id,\n dimension_2\ - \ as record_type,\n net_unblended_cost_amount::numeric::money\nfrom\n aws_cost_usage\n\ - where\n granularity = 'MONTHLY'\n and dimension_type_1 = 'LINKED_ACCOUNT'\n\ - \ and dimension_type_2 = 'RECORD_TYPE'\norder by\n dimension_1,\n period_start;" + QueryToExecute: | + SELECT + period_start, + dimension_1 AS account_id, + dimension_2 AS record_type, + net_unblended_cost_amount::NUMERIC::MONEY + FROM + aws_cost_usage + WHERE + granularity = 'MONTHLY' + AND dimension_type_1 = 'LINKED_ACCOUNT' + AND dimension_type_2 = 'RECORD_TYPE' + ORDER BY + dimension_1, + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cost Explorer -Title: Find All AWS Monthly Cost and Usage Data + - AWS Cost Explorer +Title: Find All AWS Monthly Cost and Usage Data \ No newline at end of file diff --git a/queries/aws_cost_usage_4.yaml b/queries/aws_cost_usage_4.yaml old mode 100755 new mode 100644 index 0aed86912..feaae6c86 --- a/queries/aws_cost_usage_4.yaml +++ b/queries/aws_cost_usage_4.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service - to monitor, track, and manage AWS costs and usage over time. +Description: Allows users to query Cost and Usage data from AWS Cost Explorer Service to monitor, track, and manage AWS costs and usage over time. ID: aws_cost_usage_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n period_start,\n dimension_1 as account_id,\n dimension_2\ - \ as record_type,\n net_unblended_cost_amount::numeric::money\nfrom\n aws_cost_usage\n\ - where\n granularity = 'MONTHLY'\n and dimension_type_1 = 'LINKED_ACCOUNT'\n\ - \ and dimension_type_2 = 'RECORD_TYPE'\n and dimension_2 in ('DiscountedUsage',\ - \ 'Credit')\norder by\n dimension_1,\n period_start;" + QueryToExecute: | + SELECT + period_start, + dimension_1 AS account_id, + dimension_2 AS record_type, + net_unblended_cost_amount::numeric::money + FROM + aws_cost_usage + WHERE + granularity = 'MONTHLY' + AND dimension_type_1 = 'LINKED_ACCOUNT' + AND dimension_type_2 = 'RECORD_TYPE' + AND dimension_2 IN ('DiscountedUsage', 'Credit') + ORDER BY + dimension_1, + period_start; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cost Explorer Service -Title: List all AWS Cost and Usage Data from Cost Explorer Service + - Cost Explorer Service +Title: List all AWS Cost and Usage Data from Cost Explorer Service \ No newline at end of file diff --git a/queries/aws_dax_cluster_1.yaml b/queries/aws_dax_cluster_1.yaml old mode 100755 new mode 100644 index 8c26d5a1f..374a92234 --- a/queries/aws_dax_cluster_1.yaml +++ b/queries/aws_dax_cluster_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, - status, nodes, and other associated metadata. +Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, status, nodes, and other associated metadata. ID: aws_dax_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n description,\n active_nodes,\n iam_role_arn,\n\ - \ status,\n region\nfrom\n aws_dax_cluster;" + QueryToExecute: | + SELECT + cluster_name, + description, + active_nodes, + iam_role_arn, + status, + region + FROM + aws_dax_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: List all AWS DAX Clusters with Configuration Details + - DAX +Title: List all AWS DAX Clusters with Configuration Details \ No newline at end of file diff --git a/queries/aws_dax_cluster_2.yaml b/queries/aws_dax_cluster_2.yaml old mode 100755 new mode 100644 index 1a70ebfe6..9e907249f --- a/queries/aws_dax_cluster_2.yaml +++ b/queries/aws_dax_cluster_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, - status, nodes, and other associated metadata. +Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, status, nodes, and other associated metadata. ID: aws_dax_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n description,\n sse_description ->>\ - \ 'Status' as sse_status\nfrom\n aws_dax_cluster\nwhere\n sse_description ->>\ - \ 'Status' = 'DISABLED';" + QueryToExecute: | + SELECT + cluster_name, + description, + sse_description ->> 'Status' AS sse_status + FROM + aws_dax_cluster + WHERE + sse_description ->> 'Status' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: List all AWS DAX Clusters and Their Configurations + - DAX +Title: List all AWS DAX Clusters and Their Configurations \ No newline at end of file diff --git a/queries/aws_dax_cluster_3.yaml b/queries/aws_dax_cluster_3.yaml old mode 100755 new mode 100644 index c55fe178a..47254549c --- a/queries/aws_dax_cluster_3.yaml +++ b/queries/aws_dax_cluster_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, - status, nodes, and other associated metadata. +Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, status, nodes, and other associated metadata. ID: aws_dax_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n node_type,\n count(*) as count\nfrom\n\ - \ aws_dax_cluster\nwhere\n node_type not in ('cache.m5.large', 'cache.m4.4xlarge')\n\ - group by\n cluster_name, node_type;" + QueryToExecute: | + SELECT + cluster_name, + node_type, + COUNT(*) AS count + FROM + aws_dax_cluster + WHERE + node_type NOT IN ('cache.m5.large', 'cache.m4.4xlarge') + GROUP BY + cluster_name, + node_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: List all AWS DAX Clusters with Configuration and Status + - DAX +Title: List all AWS DAX Clusters with Configuration and Status \ No newline at end of file diff --git a/queries/aws_dax_cluster_4.yaml b/queries/aws_dax_cluster_4.yaml old mode 100755 new mode 100644 index baf43d55b..e77620562 --- a/queries/aws_dax_cluster_4.yaml +++ b/queries/aws_dax_cluster_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, - status, nodes, and other associated metadata. +Description: Allows users to query AWS DAX Clusters to fetch details about their configurations, status, nodes, and other associated metadata. ID: aws_dax_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n subnet_group,\n sg ->> 'SecurityGroupIdentifier'\ - \ as sg_id,\n n ->> 'AvailabilityZone' as az_name,\n cluster_discovery_endpoint\ - \ ->> 'Address' as cluster_discovery_endpoint_address,\n cluster_discovery_endpoint\ - \ ->> 'Port' as cluster_discovery_endpoint_port\nfrom\n aws_dax_cluster,\n jsonb_array_elements(security_groups)\ - \ as sg,\n jsonb_array_elements(nodes) as n;" + QueryToExecute: | + SELECT + cluster_name, + subnet_group, + sg ->> 'SecurityGroupIdentifier' AS sg_id, + n ->> 'AvailabilityZone' AS az_name, + cluster_discovery_endpoint ->> 'Address' AS cluster_discovery_endpoint_address, + cluster_discovery_endpoint ->> 'Port' AS cluster_discovery_endpoint_port + FROM + aws_dax_cluster, + jsonb_array_elements(security_groups) AS sg, + jsonb_array_elements(nodes) AS n; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: Find AWS DAX Cluster Configurations and Status + - DAX +Title: Find AWS DAX Cluster Configurations and Status \ No newline at end of file diff --git a/queries/aws_dax_parameter_1.yaml b/queries/aws_dax_parameter_1.yaml old mode 100755 new mode 100644 index 29a6e3f9c..3a16c096e --- a/queries/aws_dax_parameter_1.yaml +++ b/queries/aws_dax_parameter_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS DAX Parameter Groups to retrieve information - about their configuration settings. +Description: Allows users to query AWS DAX Parameter Groups to retrieve information about their configuration settings. ID: aws_dax_parameter_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n parameter_name,\n parameter_group_name,\n parameter_value,\n\ - \ data_type,\n parameter_type\nfrom\n aws_dax_parameter;" + QueryToExecute: | + SELECT + parameter_name, + parameter_group_name, + parameter_value, + data_type, + parameter_type + FROM + aws_dax_parameter; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: Find AWS DAX Parameter Groups Configuration Settings + - DAX +Title: Find AWS DAX Parameter Groups Configuration Settings \ No newline at end of file diff --git a/queries/aws_dax_parameter_2.yaml b/queries/aws_dax_parameter_2.yaml old mode 100755 new mode 100644 index 8192802be..f02a84662 --- a/queries/aws_dax_parameter_2.yaml +++ b/queries/aws_dax_parameter_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS DAX Parameter Groups to retrieve information - about their configuration settings. +Description: Allows users to query AWS DAX Parameter Groups to retrieve information about their configuration settings. ID: aws_dax_parameter_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n parameter_group_name,\n region,\n count(parameter_name)\ - \ as number_of_parameters\nfrom\n aws_dax_parameter\ngroup by\n parameter_group_name,\ - \ \n region;" + QueryToExecute: | + SELECT + parameter_group_name, + region, + COUNT(parameter_name) AS number_of_parameters + FROM + aws_dax_parameter + GROUP BY + parameter_group_name, + region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: List AWS DAX Parameter Groups and Their Settings + - DAX +Title: List AWS DAX Parameter Groups and Their Settings \ No newline at end of file diff --git a/queries/aws_dax_parameter_3.yaml b/queries/aws_dax_parameter_3.yaml old mode 100755 new mode 100644 index b1be2e63d..f2cbdada7 --- a/queries/aws_dax_parameter_3.yaml +++ b/queries/aws_dax_parameter_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS DAX Parameter Groups to retrieve information - about their configuration settings. +Description: Allows users to query AWS DAX Parameter Groups to retrieve information about their configuration settings. ID: aws_dax_parameter_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n parameter_name,\n parameter_group_name,\n parameter_value,\n\ - \ data_type,\n parameter_type,\n is_modifiable\nfrom\n aws_dax_parameter\n\ - where\n is_modifiable = 'TRUE';" + QueryToExecute: | + SELECT + parameter_name, + parameter_group_name, + parameter_value, + data_type, + parameter_type, + is_modifiable + FROM + aws_dax_parameter + WHERE + is_modifiable = 'TRUE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: List All DAX Parameter Groups and Configurations in AWS + - DAX +Title: List All DAX Parameter Groups and Configurations in AWS \ No newline at end of file diff --git a/queries/aws_dax_parameter_group_1.yaml b/queries/aws_dax_parameter_group_1.yaml old mode 100755 new mode 100644 index 239b8b472..836fb3970 --- a/queries/aws_dax_parameter_group_1.yaml +++ b/queries/aws_dax_parameter_group_1.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS DynamoDB Accelerator (DAX) Parameter Groups, - providing details such as parameter group name, ARN, description, and parameter - settings. +Description: Allows users to query AWS DynamoDB Accelerator (DAX) Parameter Groups, providing details such as parameter group name, ARN, description, and parameter settings. ID: aws_dax_parameter_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n parameter_group_name,\n description,\n region\nfrom\n\ - \ aws_dax_parameter_group;" + QueryToExecute: | + SELECT + parameter_group_name, + description, + region + FROM + aws_dax_parameter_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB Accelerator (DAX) -Title: List AWS DAX Parameter Groups and Details + - DynamoDB Accelerator (DAX) +Title: List AWS DAX Parameter Groups and Details \ No newline at end of file diff --git a/queries/aws_dax_parameter_group_2.yaml b/queries/aws_dax_parameter_group_2.yaml old mode 100755 new mode 100644 index f3a616c68..f9d5c33ed --- a/queries/aws_dax_parameter_group_2.yaml +++ b/queries/aws_dax_parameter_group_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS DynamoDB Accelerator (DAX) Parameter Groups, - providing details such as parameter group name, ARN, description, and parameter - settings. +Description: Allows users to query AWS DynamoDB Accelerator (DAX) Parameter Groups, providing details such as parameter group name, ARN, description, and parameter settings. ID: aws_dax_parameter_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n p.parameter_group_name,\n c.cluster_name,\n c.node_type,\n\ - \ c.status\nfrom\n aws_dax_parameter_group as p,\n aws_dax_cluster as c\nwhere\n\ - \ c.parameter_group ->> 'ParameterGroupName' = p.parameter_group_name;" + QueryToExecute: | + SELECT + p.parameter_group_name, + c.cluster_name, + c.node_type, + c.status + FROM + aws_dax_parameter_group AS p, + aws_dax_cluster AS c + WHERE + c.parameter_group ->> 'ParameterGroupName' = p.parameter_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB Accelerator -Title: Find all AWS DAX Parameter Groups and their Settings + - DynamoDB Accelerator +Title: Find all AWS DAX Parameter Groups and their Settings \ No newline at end of file diff --git a/queries/aws_dax_subnet_group_1.yaml b/queries/aws_dax_subnet_group_1.yaml old mode 100755 new mode 100644 index 9d18fdb0b..993c7415e --- a/queries/aws_dax_subnet_group_1.yaml +++ b/queries/aws_dax_subnet_group_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS DAX Subnet Group details, such as the subnet - group name, description, VPC ID, and the subnets in the group. +Description: Allows users to query AWS DAX Subnet Group details, such as the subnet group name, description, VPC ID, and the subnets in the group. ID: aws_dax_subnet_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subnet_group_name,\n description,\n vpc_id,\n subnets,\n\ - \ region\nfrom\n aws_dax_subnet_group;" + QueryToExecute: | + SELECT + subnet_group_name, + description, + vpc_id, + subnets, + region + FROM + aws_dax_subnet_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DAX -Title: List AWS DAX Subnet Group Details + - AWS DAX +Title: List AWS DAX Subnet Group Details \ No newline at end of file diff --git a/queries/aws_dax_subnet_group_2.yaml b/queries/aws_dax_subnet_group_2.yaml old mode 100755 new mode 100644 index 9dfb0c180..ac2dd77a5 --- a/queries/aws_dax_subnet_group_2.yaml +++ b/queries/aws_dax_subnet_group_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS DAX Subnet Group details, such as the subnet - group name, description, VPC ID, and the subnets in the group. +Description: Allows users to query AWS DAX Subnet Group details, such as the subnet group name, description, VPC ID, and the subnets in the group. ID: aws_dax_subnet_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subnet_group_name,\n v.vpc_id,\n v.arn as vpc_arn,\n\ - \ v.cidr_block as vpc_cidr_block,\n v.state as vpc_state,\n v.is_default as\ - \ is_default_vpc,\n v.region\nfrom\n aws_dax_subnet_group g\njoin aws_vpc v\n\ - \ on v.vpc_id = g.vpc_id;" + QueryToExecute: | + SELECT + subnet_group_name, + v.vpc_id, + v.arn AS vpc_arn, + v.cidr_block AS vpc_cidr_block, + v.state AS vpc_state, + v.is_default AS is_default_vpc, + v.region + FROM + aws_dax_subnet_group g + JOIN aws_vpc v + ON v.vpc_id = g.vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX -Title: Find AWS DAX Subnet Group details including VPC info + - DAX +Title: Find AWS DAX Subnet Group details including VPC info \ No newline at end of file diff --git a/queries/aws_dax_subnet_group_3.yaml b/queries/aws_dax_subnet_group_3.yaml old mode 100755 new mode 100644 index bb3db7244..eb4b27b19 --- a/queries/aws_dax_subnet_group_3.yaml +++ b/queries/aws_dax_subnet_group_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS DAX Subnet Group details, such as the subnet - group name, description, VPC ID, and the subnets in the group. +Description: Allows users to query AWS DAX Subnet Group details, such as the subnet group name, description, VPC ID, and the subnets in the group. ID: aws_dax_subnet_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subnet_group_name,\n g.vpc_id,\n vs.subnet_arn,\n \ - \ vs.cidr_block as subnet_cidr_block,\n vs.state as subnet_state,\n vs.availability_zone\ - \ as subnet_availability_zone,\n vs.region\nfrom\n aws_dax_subnet_group g,\n\ - \ jsonb_array_elements(subnets) s\njoin aws_vpc_subnet vs\n on vs.subnet_id\ - \ = s ->> 'SubnetIdentifier';" + QueryToExecute: | + SELECT + subnet_group_name, + g.vpc_id, + vs.subnet_arn, + vs.cidr_block AS subnet_cidr_block, + vs.state AS subnet_state, + vs.availability_zone AS subnet_availability_zone, + vs.region + FROM + aws_dax_subnet_group g, + jsonb_array_elements(subnets) s + JOIN aws_vpc_subnet vs + ON vs.subnet_id = s ->> 'SubnetIdentifier'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DAX Subnet Group -Title: List all AWS DAX Subnet Group details + - DAX Subnet Group +Title: List all AWS DAX Subnet Group details \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_1.yaml b/queries/aws_directory_service_certificate_1.yaml old mode 100755 new mode 100644 index d6e56ab14..fb42267a2 --- a/queries/aws_directory_service_certificate_1.yaml +++ b/queries/aws_directory_service_certificate_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n directory_id,\n certificate_id,\n common_name,\n type,\n\ - \ state,\n expiry_date_time\nfrom\n aws_directory_service_certificate;" + QueryToExecute: | + SELECT + directory_id, + certificate_id, + common_name, + type, + state, + expiry_date_time + FROM + aws_directory_service_certificate; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: Find AWS Directory Service Certificates and Details + - Directory Service +Title: Find AWS Directory Service Certificates and Details \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_2.yaml b/queries/aws_directory_service_certificate_2.yaml old mode 100755 new mode 100644 index 0cd2b4d59..06c35dd1f --- a/queries/aws_directory_service_certificate_2.yaml +++ b/queries/aws_directory_service_certificate_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.certificate_id,\n c.common_name,\n c.directory_id,\n\ - \ c.type as certificate_type,\n d.name as directory_name,\n d.type as directory_type\n\ - from\n aws_directory_service_certificate c,\n aws_directory_service_directory\ - \ d\nwhere\n d.type = 'MicrosoftAD';" + QueryToExecute: | + SELECT + c.certificate_id, + c.common_name, + c.directory_id, + c.type AS certificate_type, + d.name AS directory_name, + d.type AS directory_type + FROM + aws_directory_service_certificate c, + aws_directory_service_directory d + WHERE + d.type = 'MicrosoftAD'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: List all AWS Directory Service Certificates + - AWS Directory Service +Title: List all AWS Directory Service Certificates \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_3.yaml b/queries/aws_directory_service_certificate_3.yaml old mode 100755 new mode 100644 index c6633fc49..f8768c248 --- a/queries/aws_directory_service_certificate_3.yaml +++ b/queries/aws_directory_service_certificate_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n common_name,\n directory_id,\n type,\n state\nfrom\n\ - \ aws_directory_service_certificate\nwhere\n state = 'Deregistered';" + QueryToExecute: | + SELECT + common_name, + directory_id, + type, + state + FROM + aws_directory_service_certificate + WHERE + state = 'Deregistered'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: Find AWS Directory Service Certificates with Specific States + - AWS Directory Service +Title: Find AWS Directory Service Certificates with Specific States \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_4.yaml b/queries/aws_directory_service_certificate_4.yaml old mode 100755 new mode 100644 index 1d17b303e..7abd36bb7 --- a/queries/aws_directory_service_certificate_4.yaml +++ b/queries/aws_directory_service_certificate_4.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n directory_id,\n certificate_id,\n common_name,\n type,\n\ - \ state,\n expiry_date_time\nfrom\n aws_directory_service_certificate\nwhere\n\ - \ expiry_date_time >= now() + interval '7' day;" + QueryToExecute: | + SELECT + directory_id, + certificate_id, + common_name, + type, + state, + expiry_date_time + FROM + aws_directory_service_certificate + WHERE + expiry_date_time >= NOW() + INTERVAL '7' DAY; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: Find AWS Directory Service Certificates with SQL Query + - Directory Service +Title: Find AWS Directory Service Certificates with SQL Query \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_5.yaml b/queries/aws_directory_service_certificate_5.yaml old mode 100755 new mode 100644 index 22b9ce722..b81d1e58a --- a/queries/aws_directory_service_certificate_5.yaml +++ b/queries/aws_directory_service_certificate_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n directory_id,\n certificate_id,\n common_name,\n client_cert_auth_settings\ - \ -> 'OCSPUrl' as ocsp_url\nfrom\n aws_directory_service_certificate;" + QueryToExecute: | + SELECT + directory_id, + certificate_id, + common_name, + client_cert_auth_settings -> 'OCSPUrl' AS ocsp_url + FROM + aws_directory_service_certificate; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: List all AWS Directory Service Certificates' Information + - Directory Service +Title: List all AWS Directory Service Certificates' Information \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_6.yaml b/queries/aws_directory_service_certificate_6.yaml old mode 100755 new mode 100644 index c7977c4dc..18765b0ae --- a/queries/aws_directory_service_certificate_6.yaml +++ b/queries/aws_directory_service_certificate_6.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n directory_id,\n count(*) as certificate_count\nfrom\n\ - \ aws_directory_service_certificate\ngroup by\n directory_id;" + QueryToExecute: | + SELECT + directory_id, + COUNT(*) AS certificate_count + FROM + aws_directory_service_certificate + GROUP BY + directory_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: List all Directory Service Certificates in AWS + - Directory Service +Title: List all Directory Service Certificates in AWS \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_7.yaml b/queries/aws_directory_service_certificate_7.yaml old mode 100755 new mode 100644 index bf0412147..20ae83f43 --- a/queries/aws_directory_service_certificate_7.yaml +++ b/queries/aws_directory_service_certificate_7.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n common_name,\n directory_id,\n type,\n state\nfrom\n\ - \ aws_directory_service_certificate\nwhere\n registered_date_time <= now() -\ - \ interval '1 year'\n and state not like 'Deregister%';" + QueryToExecute: | + SELECT + common_name, + directory_id, + type, + state + FROM + aws_directory_service_certificate + WHERE + registered_date_time <= NOW() - INTERVAL '1 year' + AND state NOT LIKE 'Deregister%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: Find AWS Directory Service Certificates older than 1 year + - AWS Directory Service +Title: Find AWS Directory Service Certificates older than 1 year \ No newline at end of file diff --git a/queries/aws_directory_service_certificate_8.yaml b/queries/aws_directory_service_certificate_8.yaml old mode 100755 new mode 100644 index 33d23ed8f..5f30d0f60 --- a/queries/aws_directory_service_certificate_8.yaml +++ b/queries/aws_directory_service_certificate_8.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Directory Service Certificates to gather information - about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. +Description: Allows users to query AWS Directory Service Certificates to gather information about the certificates associated with AWS Managed Microsoft AD and Simple AD directories. ID: aws_directory_service_certificate_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct partition,\n registered_date_time\nfrom\n \ - \ aws_directory_service_certificate\norder by\n partition,\n registered_date_time\ - \ desc;" + QueryToExecute: | + SELECT + DISTINCT partition, + registered_date_time + FROM + aws_directory_service_certificate + ORDER BY + partition, + registered_date_time DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: Find AWS Directory Service Certificates Details + - Directory Service +Title: Find AWS Directory Service Certificates Details \ No newline at end of file diff --git a/queries/aws_directory_service_directory_1.yaml b/queries/aws_directory_service_directory_1.yaml old mode 100755 new mode 100644 index 6222601fd..5ff0f9244 --- a/queries/aws_directory_service_directory_1.yaml +++ b/queries/aws_directory_service_directory_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Directory Service Directories for information - about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. +Description: Allows users to query AWS Directory Service Directories for information about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. ID: aws_directory_service_directory_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n directory_id\nfrom\n aws_directory_service_directory;" + QueryToExecute: | + SELECT + name, + arn, + directory_id + FROM + aws_directory_service_directory; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: Query AWS Directory Service Directories for Information + - Directory Service +Title: Query AWS Directory Service Directories for Information \ No newline at end of file diff --git a/queries/aws_directory_service_directory_2.yaml b/queries/aws_directory_service_directory_2.yaml old mode 100755 new mode 100644 index dfaa094fa..f5529492d --- a/queries/aws_directory_service_directory_2.yaml +++ b/queries/aws_directory_service_directory_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Directory Service Directories for information - about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. +Description: Allows users to query AWS Directory Service Directories for information about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. ID: aws_directory_service_directory_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n directory_id,\n type\nfrom\n aws_directory_service_directory\n\ - where\n type = 'MicrosoftAD';" + QueryToExecute: | + SELECT + name, + arn, + directory_id, + type + FROM + aws_directory_service_directory + WHERE + type = 'MicrosoftAD'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: Find AWS Managed and Simple AD Directory Details + - AWS Directory Service +Title: Find AWS Managed and Simple AD Directory Details \ No newline at end of file diff --git a/queries/aws_directory_service_directory_3.yaml b/queries/aws_directory_service_directory_3.yaml old mode 100755 new mode 100644 index 4a088de70..7cf53d104 --- a/queries/aws_directory_service_directory_3.yaml +++ b/queries/aws_directory_service_directory_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Directory Service Directories for information - about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. +Description: Allows users to query AWS Directory Service Directories for information about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. ID: aws_directory_service_directory_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n sd ->> 'ShareMethod' share_method,\n\ - \ sd ->> 'ShareStatus' share_status,\n sd ->> 'SharedAccountId' shared_account_id,\n\ - \ sd ->> 'SharedDirectoryId' shared_directory_id\nfrom\n aws_directory_service_directory,\n\ - \ jsonb_array_elements(shared_directories) sd;" + QueryToExecute: | + SELECT + name, + directory_id, + sd ->> 'ShareMethod' AS share_method, + sd ->> 'ShareStatus' AS share_status, + sd ->> 'SharedAccountId' AS shared_account_id, + sd ->> 'SharedDirectoryId' AS shared_directory_id + FROM + aws_directory_service_directory, + JSONB_ARRAY_ELEMENTS(shared_directories) sd; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: List all AWS Managed and Simple AD Directory Info + - AWS Directory Service +Title: List all AWS Managed and Simple AD Directory Info \ No newline at end of file diff --git a/queries/aws_directory_service_directory_4.yaml b/queries/aws_directory_service_directory_4.yaml old mode 100755 new mode 100644 index 350929ba1..832dcdc0d --- a/queries/aws_directory_service_directory_4.yaml +++ b/queries/aws_directory_service_directory_4.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Directory Service Directories for information - about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. +Description: Allows users to query AWS Directory Service Directories for information about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. ID: aws_directory_service_directory_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n snapshot_limit ->> 'ManualSnapshotsCurrentCount'\ - \ as manual_snapshots_current_count,\n snapshot_limit ->> 'ManualSnapshotsLimit'\ - \ as manual_snapshots_limit,\n snapshot_limit ->> 'ManualSnapshotsLimitReached'\ - \ as manual_snapshots_limit_reached\nfrom\n aws_directory_service_directory;" + QueryToExecute: | + SELECT + name, + directory_id, + snapshot_limit ->> 'ManualSnapshotsCurrentCount' AS manual_snapshots_current_count, + snapshot_limit ->> 'ManualSnapshotsLimit' AS manual_snapshots_limit, + snapshot_limit ->> 'ManualSnapshotsLimitReached' AS manual_snapshots_limit_reached + FROM + aws_directory_service_directory; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: List all AWS Directory Service Directories + - Directory Service +Title: List all AWS Directory Service Directories \ No newline at end of file diff --git a/queries/aws_directory_service_directory_5.yaml b/queries/aws_directory_service_directory_5.yaml old mode 100755 new mode 100644 index deb6155d4..4d9fed263 --- a/queries/aws_directory_service_directory_5.yaml +++ b/queries/aws_directory_service_directory_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Directory Service Directories for information - about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. +Description: Allows users to query AWS Directory Service Directories for information about AWS Managed Microsoft AD, AWS Managed AD, and Simple AD directories. ID: aws_directory_service_directory_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n e ->> 'CreatedDateTime' as\ - \ topic_created_date_time,\n e ->> 'Status' as topic_status,\n e ->> 'TopicArn'\ - \ as topic_arn,\n e ->> 'TopicName' as topic_name\nfrom\n aws_directory_service_directory,\n\ - \ jsonb_array_elements(event_topics) as e;" + QueryToExecute: | + SELECT + name, + directory_id, + e ->> 'CreatedDateTime' AS topic_created_date_time, + e ->> 'Status' AS topic_status, + e ->> 'TopicArn' AS topic_arn, + e ->> 'TopicName' AS topic_name + FROM + aws_directory_service_directory, + jsonb_array_elements(event_topics) AS e; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: List All AWS Directory Service Directory Information + - Directory Service +Title: List All AWS Directory Service Directory Information \ No newline at end of file diff --git a/queries/aws_directory_servicelog_subscription_1.yaml b/queries/aws_directory_servicelog_subscription_1.yaml old mode 100755 new mode 100644 index 8ccd68c4a..8f6d277a4 --- a/queries/aws_directory_servicelog_subscription_1.yaml +++ b/queries/aws_directory_servicelog_subscription_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Directory Service Log Subscription to obtain - detailed information about each log subscription associated with the AWS Directory - Service. +Description: Allows users to query AWS Directory Service Log Subscription to obtain detailed information about each log subscription associated with the AWS Directory Service. ID: aws_directory_servicelog_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n partition,\n subscription_created_date_time,\n\ - \ directory_id,\n title\nfrom\n aws_directory_service_log_subscription;" + QueryToExecute: | + SELECT + log_group_name, + partition, + subscription_created_date_time, + directory_id, + title + FROM + aws_directory_service_log_subscription; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Directory Service -Title: List all AWS Directory Service Log Subscriptions + - AWS Directory Service +Title: List all AWS Directory Service Log Subscriptions \ No newline at end of file diff --git a/queries/aws_directory_servicelog_subscription_2.yaml b/queries/aws_directory_servicelog_subscription_2.yaml old mode 100755 new mode 100644 index 81782aa70..d0ab04848 --- a/queries/aws_directory_servicelog_subscription_2.yaml +++ b/queries/aws_directory_servicelog_subscription_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Directory Service Log Subscription to obtain - detailed information about each log subscription associated with the AWS Directory - Service. +Description: Allows users to query AWS Directory Service Log Subscription to obtain detailed information about each log subscription associated with the AWS Directory Service. ID: aws_directory_servicelog_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.log_group_name,\n d.name as directory_name,\n d.arn\ - \ as directory_arn,\n d.directory_id,\n d.type as directory_type\nfrom\n aws_directory_service_log_subscription\ - \ as s\n left join aws_directory_service_directory as d on s.directory_id = d.directory_id;" + QueryToExecute: | + SELECT + s.log_group_name, + d.name AS directory_name, + d.arn AS directory_arn, + d.directory_id, + d.type AS directory_type + FROM + aws_directory_service_log_subscription AS s + LEFT JOIN + aws_directory_service_directory AS d + ON + s.directory_id = d.directory_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Directory Service -Title: List AWS Directory Service Log Subscriptions with Details + - Directory Service +Title: List AWS Directory Service Log Subscriptions with Details \ No newline at end of file diff --git a/queries/aws_dlm_lifecycle_policy_1.yaml b/queries/aws_dlm_lifecycle_policy_1.yaml old mode 100755 new mode 100644 index 54c8d18b6..ddad694d8 --- a/queries/aws_dlm_lifecycle_policy_1.yaml +++ b/queries/aws_dlm_lifecycle_policy_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed - information about each policy, including its configuration, status, and tags. +Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed information about each policy, including its configuration, status, and tags. ID: aws_dlm_lifecycle_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_id,\n arn,\n date_created\nfrom\n aws_dlm_lifecycle_policy;" + QueryToExecute: | + SELECT + policy_id, + arn, + date_created + FROM + aws_dlm_lifecycle_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DLM -Title: List AWS DLM Lifecycle Policies and Details + - AWS DLM +Title: List AWS DLM Lifecycle Policies and Details \ No newline at end of file diff --git a/queries/aws_dlm_lifecycle_policy_2.yaml b/queries/aws_dlm_lifecycle_policy_2.yaml old mode 100755 new mode 100644 index 2c5276686..294ccc3ce --- a/queries/aws_dlm_lifecycle_policy_2.yaml +++ b/queries/aws_dlm_lifecycle_policy_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed - information about each policy, including its configuration, status, and tags. +Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed information about each policy, including its configuration, status, and tags. ID: aws_dlm_lifecycle_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_id,\n arn,\n date_created,\n policy_type,\n\ - \ s ->> 'ShareRules' as share_rules\nfrom\n aws_dlm_lifecycle_policy,\n jsonb_array_elements(policy_details\ - \ -> 'Schedules') s\nwhere \n s ->> 'ShareRules' is not null;" + QueryToExecute: | + SELECT + policy_id, + arn, + date_created, + policy_type, + s ->> 'ShareRules' AS share_rules + FROM + aws_dlm_lifecycle_policy, + jsonb_array_elements(policy_details -> 'Schedules') s + WHERE + s ->> 'ShareRules' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DLM Lifecycle Policy -Title: List All AWS DLM Lifecycle Policies and Details + - DLM Lifecycle Policy +Title: List All AWS DLM Lifecycle Policies and Details \ No newline at end of file diff --git a/queries/aws_dlm_lifecycle_policy_3.yaml b/queries/aws_dlm_lifecycle_policy_3.yaml old mode 100755 new mode 100644 index dcb487c9d..463aca1fd --- a/queries/aws_dlm_lifecycle_policy_3.yaml +++ b/queries/aws_dlm_lifecycle_policy_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed - information about each policy, including its configuration, status, and tags. +Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed information about each policy, including its configuration, status, and tags. ID: aws_dlm_lifecycle_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_id,\n arn,\n date_created,\n policy_type,\n\ - \ s ->> 'CrossRegionCopyRules' as cross_region_copy_rules\nfrom\n aws_dlm_lifecycle_policy,\n\ - \ jsonb_array_elements(policy_details -> 'Schedules') s\nwhere \n s ->> 'CrossRegionCopyRules'\ - \ is not null;" + QueryToExecute: | + SELECT + policy_id, + arn, + date_created, + policy_type, + s ->> 'CrossRegionCopyRules' AS cross_region_copy_rules + FROM + aws_dlm_lifecycle_policy, + jsonb_array_elements(policy_details -> 'Schedules') s + WHERE + s ->> 'CrossRegionCopyRules' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DLM -Title: List all AWS DLM Lifecycle Policies with Configuration + - DLM +Title: List all AWS DLM Lifecycle Policies with Configuration \ No newline at end of file diff --git a/queries/aws_dlm_lifecycle_policy_4.yaml b/queries/aws_dlm_lifecycle_policy_4.yaml old mode 100755 new mode 100644 index fd08319c7..501e94dfd --- a/queries/aws_dlm_lifecycle_policy_4.yaml +++ b/queries/aws_dlm_lifecycle_policy_4.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed - information about each policy, including its configuration, status, and tags. +Description: Allows users to query AWS DLM Lifecycle Policies to retrieve detailed information about each policy, including its configuration, status, and tags. ID: aws_dlm_lifecycle_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_id,\n arn,\n date_created,\n policy_type,\n\ - \ s -> 'RetainRule' ->> 'Count' as retain_count\nfrom\n aws_dlm_lifecycle_policy,\n\ - \ jsonb_array_elements(policy_details -> 'Schedules') s\nwhere \n s -> 'RetainRule'\ - \ is not null;" + QueryToExecute: | + SELECT + policy_id, + arn, + date_created, + policy_type, + s -> 'RetainRule' ->> 'Count' AS retain_count + FROM + aws_dlm_lifecycle_policy, + jsonb_array_elements(policy_details -> 'Schedules') s + WHERE + s -> 'RetainRule' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DLM -Title: List AWS DLM Lifecycle Policies with Configuration and Status + - AWS DLM +Title: List AWS DLM Lifecycle Policies with Configuration and Status \ No newline at end of file diff --git a/queries/aws_dms_certificate_1.yaml b/queries/aws_dms_certificate_1.yaml old mode 100755 new mode 100644 index d36619637..1a7eb8d87 --- a/queries/aws_dms_certificate_1.yaml +++ b/queries/aws_dms_certificate_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS DMS (Database Migration Service) Certificates. - This table provides information about SSL/TLS certificates used in AWS DMS for encrypting - data during database migration tasks. Certificates play a crucial role in ensuring - the security and integrity of data transferred between source and target databases. +Description: Allows users to query AWS DMS (Database Migration Service) Certificates. This table provides information about SSL/TLS certificates used in AWS DMS for encrypting data during database migration tasks. Certificates play a crucial role in ensuring the security and integrity of data transferred between source and target databases. ID: aws_dms_certificate_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_identifier,\n arn,\n certificate_creation_date,\n\ - \ signing_algorithm,\n valid_to_date,\n region\nfrom\n aws_dms_certificate;" + QueryToExecute: | + SELECT + certificate_identifier, + arn, + certificate_creation_date, + signing_algorithm, + valid_to_date, + region + FROM + aws_dms_certificate; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find all AWS DMS Certificates and Their Details + - Database Migration Service +Title: Find all AWS DMS Certificates and Their Details \ No newline at end of file diff --git a/queries/aws_dms_certificate_2.yaml b/queries/aws_dms_certificate_2.yaml old mode 100755 new mode 100644 index c94f32acf..867f4ebfb --- a/queries/aws_dms_certificate_2.yaml +++ b/queries/aws_dms_certificate_2.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS DMS (Database Migration Service) Certificates. - This table provides information about SSL/TLS certificates used in AWS DMS for encrypting - data during database migration tasks. Certificates play a crucial role in ensuring - the security and integrity of data transferred between source and target databases. +Description: Allows users to query AWS DMS (Database Migration Service) Certificates. This table provides information about SSL/TLS certificates used in AWS DMS for encrypting data during database migration tasks. Certificates play a crucial role in ensuring the security and integrity of data transferred between source and target databases. ID: aws_dms_certificate_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_identifier,\n arn,\n key_length,\n signing_algorithm,\n\ - \ valid_to_date\nfrom\n aws_dms_certificate\nwhere\n valid_to_date <= current_date\ - \ + interval '10' day;" + QueryToExecute: | + SELECT + certificate_identifier, + arn, + key_length, + signing_algorithm, + valid_to_date + FROM + aws_dms_certificate + WHERE + valid_to_date <= CURRENT_DATE + INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find all AWS DMS Certificates Expiring in 10 Days + - Database Migration Service +Title: Find all AWS DMS Certificates Expiring in 10 Days \ No newline at end of file diff --git a/queries/aws_dms_certificate_3.yaml b/queries/aws_dms_certificate_3.yaml old mode 100755 new mode 100644 index e0f85749d..2662cd503 --- a/queries/aws_dms_certificate_3.yaml +++ b/queries/aws_dms_certificate_3.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS DMS (Database Migration Service) Certificates. - This table provides information about SSL/TLS certificates used in AWS DMS for encrypting - data during database migration tasks. Certificates play a crucial role in ensuring - the security and integrity of data transferred between source and target databases. +Description: Allows users to query AWS DMS (Database Migration Service) Certificates. This table provides information about SSL/TLS certificates used in AWS DMS for encrypting data during database migration tasks. Certificates play a crucial role in ensuring the security and integrity of data transferred between source and target databases. ID: aws_dms_certificate_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_identifier,\n arn,\n signing_algorithm,\n\ - \ key_length,\n certificate_owner\nfrom\n aws_dms_certificate\nwhere\n signing_algorithm\ - \ = 'SHA256withRSA';" + QueryToExecute: | + SELECT + certificate_identifier, + arn, + signing_algorithm, + key_length, + certificate_owner + FROM + aws_dms_certificate + WHERE + signing_algorithm = 'SHA256withRSA'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: List all AWS DMS Certificates and Details + - DMS +Title: List all AWS DMS Certificates and Details \ No newline at end of file diff --git a/queries/aws_dms_certificate_4.yaml b/queries/aws_dms_certificate_4.yaml old mode 100755 new mode 100644 index 6ade1fe41..97bd3d43f --- a/queries/aws_dms_certificate_4.yaml +++ b/queries/aws_dms_certificate_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS DMS (Database Migration Service) Certificates. - This table provides information about SSL/TLS certificates used in AWS DMS for encrypting - data during database migration tasks. Certificates play a crucial role in ensuring - the security and integrity of data transferred between source and target databases. +Description: Allows users to query AWS DMS (Database Migration Service) Certificates. This table provides information about SSL/TLS certificates used in AWS DMS for encrypting data during database migration tasks. Certificates play a crucial role in ensuring the security and integrity of data transferred between source and target databases. ID: aws_dms_certificate_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_identifier,\n arn,\n certificate_owner,\n\ - \ account_id\nfrom\n aws_dms_certificate\nwhere\n certificate_owner <> account_id;" + QueryToExecute: | + SELECT + certificate_identifier, + arn, + certificate_owner, + account_id + FROM + aws_dms_certificate + WHERE + certificate_owner <> account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find AWS DMS Certificates for Data Migration Security + - Database Migration Service +Title: Find AWS DMS Certificates for Data Migration Security \ No newline at end of file diff --git a/queries/aws_dms_certificate_5.yaml b/queries/aws_dms_certificate_5.yaml old mode 100755 new mode 100644 index c09bc852a..58914a9a0 --- a/queries/aws_dms_certificate_5.yaml +++ b/queries/aws_dms_certificate_5.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS DMS (Database Migration Service) Certificates. - This table provides information about SSL/TLS certificates used in AWS DMS for encrypting - data during database migration tasks. Certificates play a crucial role in ensuring - the security and integrity of data transferred between source and target databases. +Description: Allows users to query AWS DMS (Database Migration Service) Certificates. This table provides information about SSL/TLS certificates used in AWS DMS for encrypting data during database migration tasks. Certificates play a crucial role in ensuring the security and integrity of data transferred between source and target databases. ID: aws_dms_certificate_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n certificate_identifier,\n arn,\n certificate_owner,\n\ - \ (valid_to_date - current_date) as days_left,\n region\nfrom\n aws_dms_certificate;" + QueryToExecute: | + SELECT + certificate_identifier, + arn, + certificate_owner, + (valid_to_date - current_date) AS days_left, + region + FROM + aws_dms_certificate; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find all AWS DMS Certificates with Details + - Database Migration Service +Title: Find all AWS DMS Certificates with Details \ No newline at end of file diff --git a/queries/aws_dms_endpoint_1.yaml b/queries/aws_dms_endpoint_1.yaml old mode 100755 new mode 100644 index db220a7f3..7e014a2b8 --- a/queries/aws_dms_endpoint_1.yaml +++ b/queries/aws_dms_endpoint_1.yaml @@ -1,20 +1,28 @@ -Description: Query AWS DMS Endpoints to retrieve connection information for source - or target databases in database migration activities. +Description: Query AWS DMS Endpoints to retrieve connection information for source or target databases in database migration activities. ID: aws_dms_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_identifier,\n arn,\n certificate_arn,\n database_name,\n\ - \ endpoint_type,\n engine_display_name,\n engine_name\nfrom\n aws_dms_endpoint;" + QueryToExecute: | + SELECT + endpoint_identifier, + arn, + certificate_arn, + database_name, + endpoint_type, + engine_display_name, + engine_name + FROM + aws_dms_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find AWS DMS Endpoints Connection Info for Databases + - Database Migration Service +Title: Find AWS DMS Endpoints Connection Info for Databases \ No newline at end of file diff --git a/queries/aws_dms_endpoint_2.yaml b/queries/aws_dms_endpoint_2.yaml old mode 100755 new mode 100644 index b6831860c..63f1bef80 --- a/queries/aws_dms_endpoint_2.yaml +++ b/queries/aws_dms_endpoint_2.yaml @@ -1,21 +1,28 @@ -Description: Query AWS DMS Endpoints to retrieve connection information for source - or target databases in database migration activities. +Description: Query AWS DMS Endpoints to retrieve connection information for source or target databases in database migration activities. ID: aws_dms_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_identifier,\n arn,\n engine_display_name,\n\ - \ endpoint_type,\n engine_name\nfrom\n aws_dms_endpoint\nwhere\n endpoint_type\ - \ = 'SOURCE';" + QueryToExecute: | + SELECT + endpoint_identifier, + arn, + engine_display_name, + endpoint_type, + engine_name + FROM + aws_dms_endpoint + WHERE + endpoint_type = 'SOURCE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: Find AWS DMS Endpoints Connection Info for Migration + - DMS +Title: Find AWS DMS Endpoints Connection Info for Migration \ No newline at end of file diff --git a/queries/aws_dms_endpoint_3.yaml b/queries/aws_dms_endpoint_3.yaml old mode 100755 new mode 100644 index 9a6822553..a5e3b9931 --- a/queries/aws_dms_endpoint_3.yaml +++ b/queries/aws_dms_endpoint_3.yaml @@ -1,22 +1,30 @@ -Description: Query AWS DMS Endpoints to retrieve connection information for source - or target databases in database migration activities. +Description: Query AWS DMS Endpoints to retrieve connection information for source or target databases in database migration activities. ID: aws_dms_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_identifier,\n arn,\n engine_name,\n instance_create_time,\n\ - \ my_sql_settings\nfrom\n aws_dms_endpoint\nwhere\n engine_name = 'mysql';" + QueryToExecute: | + SELECT + endpoint_identifier, + arn, + engine_name, + instance_create_time, + my_sql_settings + FROM + aws_dms_endpoint + WHERE + engine_name = 'mysql'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: List all AWS DMS Endpoints for connection details + - DMS +Title: List all AWS DMS Endpoints for connection details \ No newline at end of file diff --git a/queries/aws_dms_endpoint_4.yaml b/queries/aws_dms_endpoint_4.yaml old mode 100755 new mode 100644 index 2e37d92be..99b025eda --- a/queries/aws_dms_endpoint_4.yaml +++ b/queries/aws_dms_endpoint_4.yaml @@ -1,25 +1,32 @@ -Description: Query AWS DMS Endpoints to retrieve connection information for source - or target databases in database migration activities. +Description: Query AWS DMS Endpoints to retrieve connection information for source or target databases in database migration activities. ID: aws_dms_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_identifier,\n kms_key_id,\n server_name,\n\ - \ service_access_role_arn,\n ssl_mode\nfrom\n aws_dms_endpoint\nwhere\n ssl_mode\ - \ <> 'none';" + QueryToExecute: | + SELECT + endpoint_identifier, + kms_key_id, + server_name, + service_access_role_arn, + ssl_mode + FROM + aws_dms_endpoint + WHERE + ssl_mode <> 'none'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List All AWS DMS Endpoints for Database Migrations + - Database Migration Service +Title: List All AWS DMS Endpoints for Database Migrations \ No newline at end of file diff --git a/queries/aws_dms_endpoint_5.yaml b/queries/aws_dms_endpoint_5.yaml old mode 100755 new mode 100644 index f1a4a3130..44d4ef9a3 --- a/queries/aws_dms_endpoint_5.yaml +++ b/queries/aws_dms_endpoint_5.yaml @@ -1,32 +1,40 @@ -Description: Query AWS DMS Endpoints to retrieve connection information for source - or target databases in database migration activities. +Description: Query AWS DMS Endpoints to retrieve connection information for source or target databases in database migration activities. ID: aws_dms_endpoint_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_identifier,\n arn,\n my_sql_settings ->> 'AfterConnectScript'\ - \ as after_connect_script,\n (my_sql_settings ->> 'CleanSourceMetadataOnMismatch')::boolean\ - \ as clean_source_metadata_on_mismatch,\n my_sql_settings ->> 'DatabaseName'\ - \ as database_name,\n (my_sql_settings ->> 'EventsPollInterval')::integer as\ - \ events_poll_interval,\n (my_sql_settings ->> 'ExecuteTimeout')::integer as\ - \ execute_timeout,\n (my_sql_settings ->> 'MaxFileSize')::integer as max_file_size,\n\ - \ (my_sql_settings ->> 'ParallelLoadThreads')::integer as parallel_load_threads,\n\ - \ my_sql_settings ->> 'Password' as password,\n (my_sql_settings ->> 'Port')::integer\ - \ as port,\n my_sql_settings ->> 'SecretsManagerAccessRoleArn' as secrets_manager_access_role_arn,\n\ - \ my_sql_settings ->> 'SecretsManagerSecretId' as secrets_manager_secret_id,\n\ - \ my_sql_settings ->> 'ServerName' as server_name,\n my_sql_settings ->> 'ServerTimezone'\ - \ as server_timezone,\n my_sql_settings ->> 'TargetDbType' as target_db_type,\n\ - \ my_sql_settings ->> 'Username' as username\nfrom\n aws_dms_endpoint\nwhere\n\ - \ engine_name = 'mysql';" + QueryToExecute: | + SELECT + endpoint_identifier, + arn, + my_sql_settings ->> 'AfterConnectScript' AS after_connect_script, + (my_sql_settings ->> 'CleanSourceMetadataOnMismatch')::boolean AS clean_source_metadata_on_mismatch, + my_sql_settings ->> 'DatabaseName' AS database_name, + (my_sql_settings ->> 'EventsPollInterval')::integer AS events_poll_interval, + (my_sql_settings ->> 'ExecuteTimeout')::integer AS execute_timeout, + (my_sql_settings ->> 'MaxFileSize')::integer AS max_file_size, + (my_sql_settings ->> 'ParallelLoadThreads')::integer AS parallel_load_threads, + my_sql_settings ->> 'Password' AS password, + (my_sql_settings ->> 'Port')::integer AS port, + my_sql_settings ->> 'SecretsManagerAccessRoleArn' AS secrets_manager_access_role_arn, + my_sql_settings ->> 'SecretsManagerSecretId' AS secrets_manager_secret_id, + my_sql_settings ->> 'ServerName' AS server_name, + my_sql_settings ->> 'ServerTimezone' AS server_timezone, + my_sql_settings ->> 'TargetDbType' AS target_db_type, + my_sql_settings ->> 'Username' AS username + FROM + aws_dms_endpoint + WHERE + engine_name = 'mysql'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DMS Endpoints -Title: Find AWS DMS Endpoints and Retrieve Connection Information + - AWS DMS Endpoints +Title: Find AWS DMS Endpoints and Retrieve Connection Information \ No newline at end of file diff --git a/queries/aws_dms_replication_instance_1.yaml b/queries/aws_dms_replication_instance_1.yaml old mode 100755 new mode 100644 index 3ea6c1f2e..09b3eb6bb --- a/queries/aws_dms_replication_instance_1.yaml +++ b/queries/aws_dms_replication_instance_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Database Migration Service Replication Instances - and provides information about each replication instance in an AWS DMS (Database - Migration Service). +Description: Allows users to query AWS Database Migration Service Replication Instances and provides information about each replication instance in an AWS DMS (Database Migration Service). ID: aws_dms_replication_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_instance_identifier,\n arn,\n engine_version,\n\ - \ instance_create_time,\n kms_key_id,\n publicly_accessible,\n region\nfrom\n\ - \ aws_dms_replication_instance;" + QueryToExecute: | + SELECT + replication_instance_identifier, + arn, + engine_version, + instance_create_time, + kms_key_id, + publicly_accessible, + region + FROM + aws_dms_replication_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS DMS Replication Instances + - Database Migration Service +Title: List all AWS DMS Replication Instances \ No newline at end of file diff --git a/queries/aws_dms_replication_instance_2.yaml b/queries/aws_dms_replication_instance_2.yaml old mode 100755 new mode 100644 index 409f80565..516d971ef --- a/queries/aws_dms_replication_instance_2.yaml +++ b/queries/aws_dms_replication_instance_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Database Migration Service Replication Instances - and provides information about each replication instance in an AWS DMS (Database - Migration Service). +Description: Allows users to query AWS Database Migration Service Replication Instances and provides information about each replication instance in an AWS DMS (Database Migration Service). ID: aws_dms_replication_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_instance_identifier,\n arn,\n engine_version,\n\ - \ instance_create_time,\n auto_minor_version_upgrade,\n region\nfrom\n aws_dms_replication_instance\n\ - where\n not auto_minor_version_upgrade;" + QueryToExecute: | + SELECT + replication_instance_identifier, + arn, + engine_version, + instance_create_time, + auto_minor_version_upgrade, + region + FROM + aws_dms_replication_instance + WHERE + NOT auto_minor_version_upgrade; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS DMS Replication Instances for Asset Management + - Database Migration Service +Title: List all AWS DMS Replication Instances for Asset Management \ No newline at end of file diff --git a/queries/aws_dms_replication_instance_3.yaml b/queries/aws_dms_replication_instance_3.yaml old mode 100755 new mode 100644 index b4509c8d9..43806120e --- a/queries/aws_dms_replication_instance_3.yaml +++ b/queries/aws_dms_replication_instance_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Database Migration Service Replication Instances - and provides information about each replication instance in an AWS DMS (Database - Migration Service). +Description: Allows users to query AWS Database Migration Service Replication Instances and provides information about each replication instance in an AWS DMS (Database Migration Service). ID: aws_dms_replication_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_instance_identifier,\n arn,\n engine_version,\n\ - \ instance_create_time,\n replication_instance_class,\n region\nfrom\n aws_dms_replication_instance\n\ - where\n replication_instance_class not in ('dms.r5.16xlarge', 'dms.r5.24xlarge');" + QueryToExecute: | + SELECT + replication_instance_identifier, + arn, + engine_version, + instance_create_time, + replication_instance_class, + region + FROM + aws_dms_replication_instance + WHERE + replication_instance_class NOT IN ('dms.r5.16xlarge', 'dms.r5.24xlarge'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find AWS Database Migration Service Replication Instances + - Database Migration Service +Title: Find AWS Database Migration Service Replication Instances \ No newline at end of file diff --git a/queries/aws_dms_replication_instance_4.yaml b/queries/aws_dms_replication_instance_4.yaml old mode 100755 new mode 100644 index 5563132a3..0e414ac83 --- a/queries/aws_dms_replication_instance_4.yaml +++ b/queries/aws_dms_replication_instance_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Database Migration Service Replication Instances - and provides information about each replication instance in an AWS DMS (Database - Migration Service). +Description: Allows users to query AWS Database Migration Service Replication Instances and provides information about each replication instance in an AWS DMS (Database Migration Service). ID: aws_dms_replication_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_instance_identifier,\n arn,\n publicly_accessible,\n\ - \ region\nfrom\n aws_dms_replication_instance\nwhere\n publicly_accessible;" + QueryToExecute: | + SELECT + replication_instance_identifier, + arn, + publicly_accessible, + region + FROM + aws_dms_replication_instance + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS Database Migration Service Replication Instances + - Database Migration Service +Title: List all AWS Database Migration Service Replication Instances \ No newline at end of file diff --git a/queries/aws_dms_replication_instance_5.yaml b/queries/aws_dms_replication_instance_5.yaml old mode 100755 new mode 100644 index d2e362257..b7343602a --- a/queries/aws_dms_replication_instance_5.yaml +++ b/queries/aws_dms_replication_instance_5.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Database Migration Service Replication Instances - and provides information about each replication instance in an AWS DMS (Database - Migration Service). +Description: Allows users to query AWS Database Migration Service Replication Instances and provides information about each replication instance in an AWS DMS (Database Migration Service). ID: aws_dms_replication_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_instance_identifier,\n arn,\n publicly_accessible,\n\ - \ multi_az,\n region\nfrom\n aws_dms_replication_instance\nwhere\n not multi_az;" + QueryToExecute: | + SELECT + replication_instance_identifier, + arn, + publicly_accessible, + multi_az, + region + FROM + aws_dms_replication_instance + WHERE + NOT multi_az; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find AWS Database Migration Service Replication Instances + - Database Migration Service +Title: Find AWS Database Migration Service Replication Instances \ No newline at end of file diff --git a/queries/aws_dms_replication_task_1.yaml b/queries/aws_dms_replication_task_1.yaml old mode 100755 new mode 100644 index ab5e15d53..65b256ad0 --- a/queries/aws_dms_replication_task_1.yaml +++ b/queries/aws_dms_replication_task_1.yaml @@ -1,24 +1,30 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_task_identifier,\n arn,\n migration_type,\n\ - \ status,\n replication_task_creation_date\nfrom\n aws_dms_replication_task;" + QueryToExecute: | + SELECT + replication_task_identifier, + arn, + migration_type, + status, + replication_task_creation_date + FROM + aws_dms_replication_task; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DMS Replication Tasks -Title: List AWS DMS Replication Task Information + - AWS DMS Replication Tasks +Title: List AWS DMS Replication Task Information \ No newline at end of file diff --git a/queries/aws_dms_replication_task_2.yaml b/queries/aws_dms_replication_task_2.yaml old mode 100755 new mode 100644 index 3f28427ed..8d11c96f4 --- a/queries/aws_dms_replication_task_2.yaml +++ b/queries/aws_dms_replication_task_2.yaml @@ -1,22 +1,28 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_task_identifier,\n migration_type,\n status\n\ - from\n aws_dms_replication_task\nwhere\n migration_type = 'full-load';" + QueryToExecute: | + SELECT + replication_task_identifier, + migration_type, + status + FROM + aws_dms_replication_task + WHERE + migration_type = 'full-load'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: List AWS DMS Replication Tasks for Data Migration + - DMS +Title: List AWS DMS Replication Tasks for Data Migration \ No newline at end of file diff --git a/queries/aws_dms_replication_task_3.yaml b/queries/aws_dms_replication_task_3.yaml old mode 100755 new mode 100644 index d8888bd63..e5ad8d07c --- a/queries/aws_dms_replication_task_3.yaml +++ b/queries/aws_dms_replication_task_3.yaml @@ -1,22 +1,28 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_task_identifier,\n status,\n last_failure_message\n\ - from\n aws_dms_replication_task\nwhere\n status = 'failed';" + QueryToExecute: | + SELECT + replication_task_identifier, + status, + last_failure_message + FROM + aws_dms_replication_task + WHERE + status = 'failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: Find AWS DMS Tasks with Failed Status Using SQL + - DMS +Title: Find AWS DMS Tasks with Failed Status Using SQL \ No newline at end of file diff --git a/queries/aws_dms_replication_task_4.yaml b/queries/aws_dms_replication_task_4.yaml old mode 100755 new mode 100644 index 15f1493b3..91869f0d1 --- a/queries/aws_dms_replication_task_4.yaml +++ b/queries/aws_dms_replication_task_4.yaml @@ -1,28 +1,34 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_task_identifier,\n status,\n replication_task_stats\ - \ -> 'ElapsedTimeMillis' as elapsed_time_millis,\n replication_task_stats ->\ - \ 'FreshStartDate' as fresh_start_date,\n replication_task_stats -> 'FullLoadFinishDate'\ - \ as full_load_finish_date,\n replication_task_stats -> 'FullLoadProgressPercent'\ - \ as full_load_progress_percent,\n replication_task_stats -> 'FullLoadStartDate'\ - \ as full_load_start_date,\n replication_task_stats -> 'StartDate' as start_date,\n\ - \ replication_task_stats -> 'StopDate' as stop_date,\n replication_task_stats\ - \ -> 'TablesErrored' as tables_errored,\n replication_task_stats -> 'TablesLoaded'\ - \ as tables_loaded,\n replication_task_stats -> 'TablesLoading' as tables_loading,\n\ - \ replication_task_stats -> 'TablesQueued' as tables_queued\nfrom\n aws_dms_replication_task;" + QueryToExecute: | + SELECT + replication_task_identifier, + status, + replication_task_stats -> 'ElapsedTimeMillis' AS elapsed_time_millis, + replication_task_stats -> 'FreshStartDate' AS fresh_start_date, + replication_task_stats -> 'FullLoadFinishDate' AS full_load_finish_date, + replication_task_stats -> 'FullLoadProgressPercent' AS full_load_progress_percent, + replication_task_stats -> 'FullLoadStartDate' AS full_load_start_date, + replication_task_stats -> 'StartDate' AS start_date, + replication_task_stats -> 'StopDate' AS stop_date, + replication_task_stats -> 'TablesErrored' AS tables_errored, + replication_task_stats -> 'TablesLoaded' AS tables_loaded, + replication_task_stats -> 'TablesLoading' AS tables_loading, + replication_task_stats -> 'TablesQueued' AS tables_queued + FROM + aws_dms_replication_task; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: Find AWS DMS Replication Task Details for Data Migration + - DMS +Title: Find AWS DMS Replication Task Details for Data Migration \ No newline at end of file diff --git a/queries/aws_dms_replication_task_5.yaml b/queries/aws_dms_replication_task_5.yaml old mode 100755 new mode 100644 index 8a5855970..60688f20f --- a/queries/aws_dms_replication_task_5.yaml +++ b/queries/aws_dms_replication_task_5.yaml @@ -1,24 +1,33 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n t.replication_task_identifier,\n t.arn as task_arn,\n\ - \ i.replication_instance_class,\n i.engine_version,\n i.publicly_accessible,\n\ - \ i.dns_name_servers\nfrom\n aws_dms_replication_task t\njoin aws_dms_replication_instance\ - \ i on t.replication_instance_arn = i.arn;" + QueryToExecute: | + SELECT + t.replication_task_identifier, + t.arn AS task_arn, + i.replication_instance_class, + i.engine_version, + i.publicly_accessible, + i.dns_name_servers + FROM + aws_dms_replication_task t + JOIN + aws_dms_replication_instance i + ON + t.replication_instance_arn = i.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS DMS -Title: List all AWS DMS Replication Tasks with Details + - AWS DMS +Title: List all AWS DMS Replication Tasks with Details \ No newline at end of file diff --git a/queries/aws_dms_replication_task_6.yaml b/queries/aws_dms_replication_task_6.yaml old mode 100755 new mode 100644 index fb9c65305..cffe0e4b5 --- a/queries/aws_dms_replication_task_6.yaml +++ b/queries/aws_dms_replication_task_6.yaml @@ -1,22 +1,28 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_task_identifier,\n source_endpoint_arn,\n\ - \ status\nfrom\n aws_dms_replication_task\nwhere\n endpoint_type = 'source';" + QueryToExecute: | + SELECT + replication_task_identifier, + source_endpoint_arn, + status + FROM + aws_dms_replication_task + WHERE + endpoint_type = 'source'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: Find AWS DMS Replication Tasks for Data Migration + - DMS +Title: Find AWS DMS Replication Tasks for Data Migration \ No newline at end of file diff --git a/queries/aws_dms_replication_task_7.yaml b/queries/aws_dms_replication_task_7.yaml old mode 100755 new mode 100644 index f47bc0cc5..6575c59f6 --- a/queries/aws_dms_replication_task_7.yaml +++ b/queries/aws_dms_replication_task_7.yaml @@ -1,24 +1,29 @@ -Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed - information on data migration activities between source and target databases. +Description: Enables users to query AWS DMS Replication Tasks to retrieve detailed information on data migration activities between source and target databases. ID: aws_dms_replication_task_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_type,\n count(*) as task_count\nfrom\n aws_dms_replication_task\n\ - group by\n endpoint_type;" + QueryToExecute: | + SELECT + endpoint_type, + COUNT(*) AS task_count + FROM + aws_dms_replication_task + GROUP BY + endpoint_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DMS -Title: List all AWS DMS Replication Task Details + - DMS +Title: List all AWS DMS Replication Task Details \ No newline at end of file diff --git a/queries/aws_docdb_cluster_1.yaml b/queries/aws_docdb_cluster_1.yaml old mode 100755 new mode 100644 index 10aef1070..1e590761c --- a/queries/aws_docdb_cluster_1.yaml +++ b/queries/aws_docdb_cluster_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n db_cluster_identifier,\n deletion_protection,\n\ - \ engine,\n status,\n region\nfrom\n aws_docdb_cluster;" + QueryToExecute: | + SELECT + arn, + db_cluster_identifier, + deletion_protection, + engine, + status, + region + FROM + aws_docdb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find Amazon DocumentDB Cluster Configuration and Status + - Amazon DocumentDB +Title: Find Amazon DocumentDB Cluster Configuration and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_2.yaml b/queries/aws_docdb_cluster_2.yaml old mode 100755 new mode 100644 index 4e6d9c394..71f530728 --- a/queries/aws_docdb_cluster_2.yaml +++ b/queries/aws_docdb_cluster_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n status,\n cluster_create_time,\n\ - \ kms_key_id,\n storage_encrypted\nfrom\n aws_docdb_cluster\nwhere\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_cluster_identifier, + status, + cluster_create_time, + kms_key_id, + storage_encrypted + FROM + aws_docdb_cluster + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find Amazon DocumentDB Cluster Configuration and Status + - Amazon DocumentDB +Title: Find Amazon DocumentDB Cluster Configuration and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_3.yaml b/queries/aws_docdb_cluster_3.yaml old mode 100755 new mode 100644 index 0dc5bd495..fe3104c21 --- a/queries/aws_docdb_cluster_3.yaml +++ b/queries/aws_docdb_cluster_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n backup_retention_period\nfrom\n\ - \ aws_docdb_cluster\nwhere\n backup_retention_period > 7;" + QueryToExecute: | + SELECT + db_cluster_identifier, + backup_retention_period + FROM + aws_docdb_cluster + WHERE + backup_retention_period > 7; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DocumentDB -Title: Find Amazon DocumentDB Cluster Config and Status + - DocumentDB +Title: Find Amazon DocumentDB Cluster Config and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_4.yaml b/queries/aws_docdb_cluster_4.yaml old mode 100755 new mode 100644 index f8a8c833d..6039588a1 --- a/queries/aws_docdb_cluster_4.yaml +++ b/queries/aws_docdb_cluster_4.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n jsonb_array_length(availability_zones)\ - \ as availability_zones_count\nfrom\n aws_docdb_cluster;" + QueryToExecute: | + SELECT + db_cluster_identifier, + JSONB_ARRAY_LENGTH(availability_zones) AS availability_zones_count + FROM + aws_docdb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List all Amazon DocumentDB Cluster Configuration and Status + - Amazon DocumentDB +Title: List all Amazon DocumentDB Cluster Configuration and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_5.yaml b/queries/aws_docdb_cluster_5.yaml old mode 100755 new mode 100644 index d0150969f..15db49958 --- a/queries/aws_docdb_cluster_5.yaml +++ b/queries/aws_docdb_cluster_5.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n status,\n cluster_create_time,\n\ - \ deletion_protection\nfrom\n aws_docdb_cluster\nwhere\n not deletion_protection;" + QueryToExecute: | + SELECT + db_cluster_identifier, + status, + cluster_create_time, + deletion_protection + FROM + aws_docdb_cluster + WHERE + NOT deletion_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DocumentDB -Title: List Amazon DocumentDB Clusters and Their Status + - DocumentDB +Title: List Amazon DocumentDB Clusters and Their Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_6.yaml b/queries/aws_docdb_cluster_6.yaml old mode 100755 new mode 100644 index 0ae555ffd..f40bcbb73 --- a/queries/aws_docdb_cluster_6.yaml +++ b/queries/aws_docdb_cluster_6.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n member ->> 'DBClusterParameterGroupStatus'\ - \ as db_cluster_parameter_group_status,\n member ->> 'DBInstanceIdentifier' as\ - \ db_instance_identifier,\n member ->> 'IsClusterWriter' as is_cluster_writer,\n\ - \ member ->> 'PromotionTier' as promotion_tier\nfrom\n aws_docdb_cluster\n \ - \ cross join jsonb_array_elements(members) as member;" + QueryToExecute: | + SELECT + db_cluster_identifier, + member ->> 'DBClusterParameterGroupStatus' AS db_cluster_parameter_group_status, + member ->> 'DBInstanceIdentifier' AS db_instance_identifier, + member ->> 'IsClusterWriter' AS is_cluster_writer, + member ->> 'PromotionTier' AS promotion_tier + FROM + aws_docdb_cluster + CROSS JOIN + jsonb_array_elements(members) AS member; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DocumentDB -Title: List all Amazon DocumentDB Clusters for Configuration and Status + - DocumentDB +Title: List all Amazon DocumentDB Clusters for Configuration and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_7.yaml b/queries/aws_docdb_cluster_7.yaml old mode 100755 new mode 100644 index 0b7ba9d9e..c81bfab00 --- a/queries/aws_docdb_cluster_7.yaml +++ b/queries/aws_docdb_cluster_7.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query Amazon DocumentDB Clusters for detailed information - about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Clusters for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n status,\n cluster_create_time,\n\ - \ deletion_protection\nfrom\n aws_docdb_cluster\nwhere\n not deletion_protection;" + QueryToExecute: | + SELECT + db_cluster_identifier, + status, + cluster_create_time, + deletion_protection + FROM + aws_docdb_cluster + WHERE + NOT deletion_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find Amazon DocumentDB Clusters and Configuration Status + - Amazon DocumentDB +Title: Find Amazon DocumentDB Clusters and Configuration Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_1.yaml b/queries/aws_docdb_cluster_instance_1.yaml old mode 100755 new mode 100644 index 9cff5bbd6..6378ffb2a --- a/queries/aws_docdb_cluster_instance_1.yaml +++ b/queries/aws_docdb_cluster_instance_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n db_cluster_identifier,\n \ - \ engine,\n engine_version,\n db_instance_class,\n availability_zone\nfrom\n\ - \ aws_docdb_cluster_instance;" + QueryToExecute: | + SELECT + db_instance_identifier, + db_cluster_identifier, + engine, + engine_version, + db_instance_class, + availability_zone + FROM + aws_docdb_cluster_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List Amazon DocumentDB Cluster Instances + - Amazon DocumentDB +Title: List Amazon DocumentDB Cluster Instances \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_2.yaml b/queries/aws_docdb_cluster_instance_2.yaml old mode 100755 new mode 100644 index 5fb4eb493..5e172aef1 --- a/queries/aws_docdb_cluster_instance_2.yaml +++ b/queries/aws_docdb_cluster_instance_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n db_cluster_identifier,\n \ - \ engine,\n engine_version,\n db_instance_class,\n availability_zone\nfrom\n\ - \ aws_docdb_cluster_instance\nwhere\n publicly_accessible;" + QueryToExecute: | + SELECT + db_instance_identifier, + db_cluster_identifier, + engine, + engine_version, + db_instance_class, + availability_zone + FROM + aws_docdb_cluster_instance + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DocumentDB -Title: List all Amazon DocumentDB Cluster Instances + - DocumentDB +Title: List all Amazon DocumentDB Cluster Instances \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_3.yaml b/queries/aws_docdb_cluster_instance_3.yaml old mode 100755 new mode 100644 index 779407e7b..461b0b0e9 --- a/queries/aws_docdb_cluster_instance_3.yaml +++ b/queries/aws_docdb_cluster_instance_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_subnet_group_arn,\n db_subnet_group_name,\n db_subnet_group_description,\n\ - \ db_subnet_group_status\nfrom\n aws_docdb_cluster_instance;" + QueryToExecute: | + SELECT + db_subnet_group_arn, + db_subnet_group_name, + db_subnet_group_description, + db_subnet_group_status + FROM + aws_docdb_cluster_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find all Amazon DocumentDB Cluster Instances with Details + - Amazon DocumentDB +Title: Find all Amazon DocumentDB Cluster Instances with Details \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_4.yaml b/queries/aws_docdb_cluster_instance_4.yaml old mode 100755 new mode 100644 index 96151cefc..51dff0bd5 --- a/queries/aws_docdb_cluster_instance_4.yaml +++ b/queries/aws_docdb_cluster_instance_4.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier as attached_vpc,\n vsg ->> 'VpcSecurityGroupId'\ - \ as vpc_security_group_id,\n vsg ->> 'Status' as status,\n sub -> 'SubnetAvailabilityZone'\ - \ ->> 'Name' as subnet_availability_zone,\n sub ->> 'SubnetIdentifier' as subnet_identifier,\n\ - \ sub -> 'SubnetOutpost' ->> 'Arn' as subnet_outpost,\n sub ->> 'SubnetStatus'\ - \ as subnet_status\nfrom\n aws_docdb_cluster_instance\n cross join jsonb_array_elements(vpc_security_groups)\ - \ as vsg\n cross join jsonb_array_elements(subnets) as sub;" + QueryToExecute: | + SELECT + db_instance_identifier AS attached_vpc, + vsg ->> 'VpcSecurityGroupId' AS vpc_security_group_id, + vsg ->> 'Status' AS status, + sub -> 'SubnetAvailabilityZone' ->> 'Name' AS subnet_availability_zone, + sub ->> 'SubnetIdentifier' AS subnet_identifier, + sub -> 'SubnetOutpost' ->> 'Arn' AS subnet_outpost, + sub ->> 'SubnetStatus' AS subnet_status + FROM + aws_docdb_cluster_instance + CROSS JOIN + jsonb_array_elements(vpc_security_groups) AS vsg + CROSS JOIN + jsonb_array_elements(subnets) AS sub; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List all Information of Amazon DocumentDB Clusters + - Amazon DocumentDB +Title: List all Information of Amazon DocumentDB Clusters \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_5.yaml b/queries/aws_docdb_cluster_instance_5.yaml old mode 100755 new mode 100644 index cf1108355..1e8c0d94b --- a/queries/aws_docdb_cluster_instance_5.yaml +++ b/queries/aws_docdb_cluster_instance_5.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n db_cluster_identifier,\n \ - \ db_instance_class\nfrom\n aws_docdb_cluster_instance\nwhere\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_instance_identifier, + db_cluster_identifier, + db_instance_class + FROM + aws_docdb_cluster_instance + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find all Amazon DocumentDB Cluster Instances using SQL + - Amazon DocumentDB +Title: Find all Amazon DocumentDB Cluster Instances using SQL \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_6.yaml b/queries/aws_docdb_cluster_instance_6.yaml old mode 100755 new mode 100644 index 8df8e8f1b..a30bd6ea8 --- a/queries/aws_docdb_cluster_instance_6.yaml +++ b/queries/aws_docdb_cluster_instance_6.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n db_cluster_identifier,\n \ - \ db_instance_class\nfrom\n aws_docdb_cluster_instance\nwhere\n enabled_cloudwatch_logs_exports\ - \ is null;" + QueryToExecute: | + SELECT + db_instance_identifier, + db_cluster_identifier, + db_instance_class + FROM + aws_docdb_cluster_instance + WHERE + enabled_cloudwatch_logs_exports IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List Amazon DocumentDB Cluster Instances with SQL + - Amazon DocumentDB +Title: List Amazon DocumentDB Cluster Instances with SQL \ No newline at end of file diff --git a/queries/aws_docdb_cluster_instance_7.yaml b/queries/aws_docdb_cluster_instance_7.yaml old mode 100755 new mode 100644 index 8375ac697..7209ddce3 --- a/queries/aws_docdb_cluster_instance_7.yaml +++ b/queries/aws_docdb_cluster_instance_7.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed - information such as instance identifier, cluster identifier, instance class, availability - zone, engine version, and more. +Description: Allows users to query Amazon DocumentDB Cluster Instances to gather detailed information such as instance identifier, cluster identifier, instance class, availability zone, engine version, and more. ID: aws_docdb_cluster_instance_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n endpoint_address,\n endpoint_hosted_zone_id,\n\ - \ endpoint_port\nfrom\n aws_docdb_cluster_instance;" + QueryToExecute: | + SELECT + db_instance_identifier, + endpoint_address, + endpoint_hosted_zone_id, + endpoint_port + FROM + aws_docdb_cluster_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List all Amazon DocumentDB Cluster Instances and Details + - Amazon DocumentDB +Title: List all Amazon DocumentDB Cluster Instances and Details \ No newline at end of file diff --git a/queries/aws_docdb_cluster_snapshot_1.yaml b/queries/aws_docdb_cluster_snapshot_1.yaml old mode 100755 new mode 100644 index 25073e7e6..b58c7b85c --- a/queries/aws_docdb_cluster_snapshot_1.yaml +++ b/queries/aws_docdb_cluster_snapshot_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed - information about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n snapshot_type,\n \ - \ not storage_encrypted as storage_not_encrypted,\n split_part(kms_key_id, '/',\ - \ 1) as kms_key_id\nfrom\n aws_docdb_cluster_snapshot\nwhere\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + snapshot_type, + NOT storage_encrypted AS storage_not_encrypted, + SPLIT_PART(kms_key_id, '/', 1) AS kms_key_id + FROM + aws_docdb_cluster_snapshot + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find Amazon DocumentDB Cluster Snapshots Configuration and Status + - Amazon DocumentDB +Title: Find Amazon DocumentDB Cluster Snapshots Configuration and Status \ No newline at end of file diff --git a/queries/aws_docdb_cluster_snapshot_2.yaml b/queries/aws_docdb_cluster_snapshot_2.yaml old mode 100755 new mode 100644 index 5695d70e7..2e33eebd1 --- a/queries/aws_docdb_cluster_snapshot_2.yaml +++ b/queries/aws_docdb_cluster_snapshot_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed - information about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n cluster_create_time,\n\ - \ engine,\n engine_version\nfrom\n aws_docdb_cluster_snapshot;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + cluster_create_time, + engine, + engine_version + FROM + aws_docdb_cluster_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DocumentDB -Title: Find Amazon DocumentDB Cluster Snapshot Details + - DocumentDB +Title: Find Amazon DocumentDB Cluster Snapshot Details \ No newline at end of file diff --git a/queries/aws_docdb_cluster_snapshot_3.yaml b/queries/aws_docdb_cluster_snapshot_3.yaml old mode 100755 new mode 100644 index bcc9c6850..c1ce52abe --- a/queries/aws_docdb_cluster_snapshot_3.yaml +++ b/queries/aws_docdb_cluster_snapshot_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed - information about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n count(db_cluster_snapshot_identifier)\ - \ as snapshot_count\nfrom\n aws_docdb_cluster_snapshot\ngroup by\n db_cluster_identifier;" + QueryToExecute: | + SELECT + db_cluster_identifier, + COUNT(db_cluster_snapshot_identifier) AS snapshot_count + FROM + aws_docdb_cluster_snapshot + GROUP BY + db_cluster_identifier; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: List Amazon DocumentDB Cluster Snapshots and their Details + - Amazon DocumentDB +Title: List Amazon DocumentDB Cluster Snapshots and their Details \ No newline at end of file diff --git a/queries/aws_docdb_cluster_snapshot_4.yaml b/queries/aws_docdb_cluster_snapshot_4.yaml old mode 100755 new mode 100644 index 99db060d0..7295258ae --- a/queries/aws_docdb_cluster_snapshot_4.yaml +++ b/queries/aws_docdb_cluster_snapshot_4.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed - information about their configuration, status, and associated metadata. +Description: Allows users to query Amazon DocumentDB Cluster Snapshots for detailed information about their configuration, status, and associated metadata. ID: aws_docdb_cluster_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n engine,\n snapshot_type\n\ - from\n aws_docdb_cluster_snapshot\nwhere\n snapshot_type = 'manual';" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + engine, + snapshot_type + FROM + aws_docdb_cluster_snapshot + WHERE + snapshot_type = 'manual'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon DocumentDB -Title: Find Amazon DocumentDB Cluster Snapshot details + - Amazon DocumentDB +Title: Find Amazon DocumentDB Cluster Snapshot details \ No newline at end of file diff --git a/queries/aws_drs_job_1.yaml b/queries/aws_drs_job_1.yaml old mode 100755 new mode 100644 index de94205c4..071f858e9 --- a/queries/aws_drs_job_1.yaml +++ b/queries/aws_drs_job_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Data Replication Service Jobs and retrieve - key job details such as job ID, job status, creation time, and more. +Description: Allows users to query AWS Data Replication Service Jobs and retrieve key job details such as job ID, job status, creation time, and more. ID: aws_drs_job_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n status,\n initiated_by\nfrom\n aws_drs_job;" + QueryToExecute: | + SELECT + title, + arn, + status, + initiated_by + FROM + aws_drs_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Data Replication Service -Title: List all AWS Data Replication Service Jobs Details + - Data Replication Service +Title: List all AWS Data Replication Service Jobs Details \ No newline at end of file diff --git a/queries/aws_drs_job_2.yaml b/queries/aws_drs_job_2.yaml old mode 100755 new mode 100644 index 5b01a9775..4e2a9d81b --- a/queries/aws_drs_job_2.yaml +++ b/queries/aws_drs_job_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Data Replication Service Jobs and retrieve - key job details such as job ID, job status, creation time, and more. +Description: Allows users to query AWS Data Replication Service Jobs and retrieve key job details such as job ID, job status, creation time, and more. ID: aws_drs_job_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n status,\n initiated_by,\n creation_date_time\n\ - from\n aws_drs_job\nwhere\n status = 'PENDING';" + QueryToExecute: | + SELECT + title, + arn, + status, + initiated_by, + creation_date_time + FROM + aws_drs_job + WHERE + status = 'PENDING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Data Replication Service -Title: Find AWS Data Replication Service Job Details + - Data Replication Service +Title: Find AWS Data Replication Service Job Details \ No newline at end of file diff --git a/queries/aws_drs_job_3.yaml b/queries/aws_drs_job_3.yaml old mode 100755 new mode 100644 index c36b372be..9248a53ff --- a/queries/aws_drs_job_3.yaml +++ b/queries/aws_drs_job_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Data Replication Service Jobs and retrieve - key job details such as job ID, job status, creation time, and more. +Description: Allows users to query AWS Data Replication Service Jobs and retrieve key job details such as job ID, job status, creation time, and more. ID: aws_drs_job_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n status,\n initiated_by,\n type,\n\ - \ creation_date_time,\n end_date_time\nfrom\n aws_drs_job\nwhere\n creation_date_time\ - \ >= now() - interval '30' day;" + QueryToExecute: | + SELECT + title, + arn, + status, + initiated_by, + type, + creation_date_time, + end_date_time + FROM + aws_drs_job + WHERE + creation_date_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Data Replication Service -Title: List AWS Data Replication Service Job Details + - Data Replication Service +Title: List AWS Data Replication Service Job Details \ No newline at end of file diff --git a/queries/aws_drs_recovery_instance_1.yaml b/queries/aws_drs_recovery_instance_1.yaml old mode 100755 new mode 100644 index f9bd64876..ddb22df41 --- a/queries/aws_drs_recovery_instance_1.yaml +++ b/queries/aws_drs_recovery_instance_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Disaster Recovery Service Recovery Instances - to retrieve information about recovery instances, including instance type, recovery - instance ARN, and associated tags. +Description: Allows users to query AWS Disaster Recovery Service Recovery Instances to retrieve information about recovery instances, including instance type, recovery instance ARN, and associated tags. ID: aws_drs_recovery_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recovery_instance_id,\n arn,\n source_server_id,\n\ - \ ec2_instance_id,\n ec2_instance_state\nfrom\n aws_drs_recovery_instance;" + QueryToExecute: | + SELECT + recovery_instance_id, + arn, + source_server_id, + ec2_instance_id, + ec2_instance_state + FROM + aws_drs_recovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List AWS Disaster Recovery Service Recovery Instances + - Disaster Recovery Service +Title: List AWS Disaster Recovery Service Recovery Instances \ No newline at end of file diff --git a/queries/aws_drs_recovery_instance_2.yaml b/queries/aws_drs_recovery_instance_2.yaml old mode 100755 new mode 100644 index e33588069..66a5677ec --- a/queries/aws_drs_recovery_instance_2.yaml +++ b/queries/aws_drs_recovery_instance_2.yaml @@ -1,29 +1,32 @@ -Description: Allows users to query AWS Disaster Recovery Service Recovery Instances - to retrieve information about recovery instances, including instance type, recovery - instance ARN, and associated tags. +Description: Allows users to query AWS Disaster Recovery Service Recovery Instances to retrieve information about recovery instances, including instance type, recovery instance ARN, and associated tags. ID: aws_drs_recovery_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recovery_instance_id\n arn,\n recovery_instance_properties\ - \ ->> 'Cpus' as recovery_instance_cpus,\n recovery_instance_properties ->> 'Disks'\ - \ as recovery_instance_disks,\n recovery_instance_properties ->> 'IdentificationHints'\ - \ as recovery_instance_identification_hints,\n recovery_instance_properties ->>\ - \ 'LastUpdatedDateTime' as recovery_instance_last_updated_date_time,\n recovery_instance_properties\ - \ ->> 'NetworkInterfaces' as recovery_instance_network_interfaces,\n recovery_instance_properties\ - \ ->> 'Os' as recovery_instance_os,\n recovery_instance_properties ->> 'RamBytes'\ - \ as recovery_instance_ram_bytes\nfrom\n aws_drs_recovery_instance;" + QueryToExecute: | + SELECT + recovery_instance_id, + arn, + recovery_instance_properties ->> 'Cpus' AS recovery_instance_cpus, + recovery_instance_properties ->> 'Disks' AS recovery_instance_disks, + recovery_instance_properties ->> 'IdentificationHints' AS recovery_instance_identification_hints, + recovery_instance_properties ->> 'LastUpdatedDateTime' AS recovery_instance_last_updated_date_time, + recovery_instance_properties ->> 'NetworkInterfaces' AS recovery_instance_network_interfaces, + recovery_instance_properties ->> 'Os' AS recovery_instance_os, + recovery_instance_properties ->> 'RamBytes' AS recovery_instance_ram_bytes + FROM + aws_drs_recovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: Query AWS DRS Recovery Instances for Detailed Information + - Disaster Recovery Service +Title: Query AWS DRS Recovery Instances for Detailed Information \ No newline at end of file diff --git a/queries/aws_drs_recovery_instance_3.yaml b/queries/aws_drs_recovery_instance_3.yaml old mode 100755 new mode 100644 index 039e1dc9f..b02f87370 --- a/queries/aws_drs_recovery_instance_3.yaml +++ b/queries/aws_drs_recovery_instance_3.yaml @@ -1,30 +1,37 @@ -Description: Allows users to query AWS Disaster Recovery Service Recovery Instances - to retrieve information about recovery instances, including instance type, recovery - instance ARN, and associated tags. +Description: Allows users to query AWS Disaster Recovery Service Recovery Instances to retrieve information about recovery instances, including instance type, recovery instance ARN, and associated tags. ID: aws_drs_recovery_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recovery_instance_id,\n arn,\n source_server_id,\n\ - \ ec2_instance_id,\n failback ->> 'AgentLastSeenByServiceDateTime' as agent_last_seen_by_service_date_time,\n\ - \ failback ->> 'ElapsedReplicationDuration' as elapsed_replication_duration,\n\ - \ failback ->> 'FailbackClientID' as failback_client_id,\n failback ->> 'FailbackClientLastSeenByServiceDateTime'\ - \ as failback_client_last_seen_by_service_date_time,\n failback ->> 'FailbackInitiationTime'\ - \ as failback_initiation_time,\n failback -> 'FailbackJobID' as failback_job_id,\n\ - \ failback -> 'FailbackLaunchType' as failback_launch_type,\n failback -> 'FailbackToOriginalServer'\ - \ as failback_to_original_server,\n failback -> 'FirstByteDateTime' as failback_first_byte_date_time,\n\ - \ failback -> 'State' as failback_state\nfrom\n aws_drs_recovery_instance;" + QueryToExecute: | + SELECT + recovery_instance_id, + arn, + source_server_id, + ec2_instance_id, + failback ->> 'AgentLastSeenByServiceDateTime' AS agent_last_seen_by_service_date_time, + failback ->> 'ElapsedReplicationDuration' AS elapsed_replication_duration, + failback ->> 'FailbackClientID' AS failback_client_id, + failback ->> 'FailbackClientLastSeenByServiceDateTime' AS failback_client_last_seen_by_service_date_time, + failback ->> 'FailbackInitiationTime' AS failback_initiation_time, + failback -> 'FailbackJobID' AS failback_job_id, + failback -> 'FailbackLaunchType' AS failback_launch_type, + failback -> 'FailbackToOriginalServer' AS failback_to_original_server, + failback -> 'FirstByteDateTime' AS failback_first_byte_date_time, + failback -> 'State' AS failback_state + FROM + aws_drs_recovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List all AWS Disaster Recovery Recovery Instances + - Disaster Recovery Service +Title: List all AWS Disaster Recovery Recovery Instances \ No newline at end of file diff --git a/queries/aws_drs_recovery_instance_4.yaml b/queries/aws_drs_recovery_instance_4.yaml old mode 100755 new mode 100644 index 6e94c6563..776ebc858 --- a/queries/aws_drs_recovery_instance_4.yaml +++ b/queries/aws_drs_recovery_instance_4.yaml @@ -1,26 +1,28 @@ -Description: Allows users to query AWS Disaster Recovery Service Recovery Instances - to retrieve information about recovery instances, including instance type, recovery - instance ARN, and associated tags. +Description: Allows users to query AWS Disaster Recovery Service Recovery Instances to retrieve information about recovery instances, including instance type, recovery instance ARN, and associated tags. ID: aws_drs_recovery_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recovery_instance_id,\n arn,\n data_replication_info\ - \ -> 'DataReplicationInitiation' ->> 'StartDateTime' as data_replication_start_date_time,\n\ - \ data_replication_info -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime'\ - \ as data_replication_next_attempt_date_time,\n data_replication_info ->> 'DataReplicationError'\ - \ as data_replication_error,\n data_replication_info ->> 'DataReplicationState'\ - \ as data_replication_state,\n data_replication_info ->> 'ReplicatedDisks' as\ - \ data_replication_replicated_disks\nfrom\n aws_drs_recovery_instance;" + QueryToExecute: | + SELECT + recovery_instance_id, + arn, + data_replication_info -> 'DataReplicationInitiation' ->> 'StartDateTime' AS data_replication_start_date_time, + data_replication_info -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime' AS data_replication_next_attempt_date_time, + data_replication_info ->> 'DataReplicationError' AS data_replication_error, + data_replication_info ->> 'DataReplicationState' AS data_replication_state, + data_replication_info ->> 'ReplicatedDisks' AS data_replication_replicated_disks + FROM + aws_drs_recovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List All AWS Disaster Recovery Service Recovery Instances + - Disaster Recovery Service +Title: List All AWS Disaster Recovery Service Recovery Instances \ No newline at end of file diff --git a/queries/aws_drs_recovery_instance_5.yaml b/queries/aws_drs_recovery_instance_5.yaml old mode 100755 new mode 100644 index 592dc54f7..9d230b2e0 --- a/queries/aws_drs_recovery_instance_5.yaml +++ b/queries/aws_drs_recovery_instance_5.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Disaster Recovery Service Recovery Instances - to retrieve information about recovery instances, including instance type, recovery - instance ARN, and associated tags. +Description: Allows users to query AWS Disaster Recovery Service Recovery Instances to retrieve information about recovery instances, including instance type, recovery instance ARN, and associated tags. ID: aws_drs_recovery_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recovery_instance_id,\n arn,\n source_server_id,\n\ - \ ec2_instance_id,\n ec2_instance_state,\n is_drill,\n job_id\nfrom\n aws_drs_recovery_instance\n\ - where\n not is_drill;" + QueryToExecute: | + SELECT + recovery_instance_id, + arn, + source_server_id, + ec2_instance_id, + ec2_instance_state, + is_drill, + job_id + FROM + aws_drs_recovery_instance + WHERE + NOT is_drill; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List all AWS Disaster Recovery Service Recovery Instances + - Disaster Recovery Service +Title: List all AWS Disaster Recovery Service Recovery Instances \ No newline at end of file diff --git a/queries/aws_drs_recovery_snapshot_1.yaml b/queries/aws_drs_recovery_snapshot_1.yaml old mode 100755 new mode 100644 index 77e5fcda6..b3348df52 --- a/queries/aws_drs_recovery_snapshot_1.yaml +++ b/queries/aws_drs_recovery_snapshot_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides - information about recovery snapshots within AWS Disaster Recovery Service (DRS). - This table can be used to gather insights on recovery snapshots, including their - details, associated metadata, and more. +Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides information about recovery snapshots within AWS Disaster Recovery Service (DRS). This table can be used to gather insights on recovery snapshots, including their details, associated metadata, and more. ID: aws_drs_recovery_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n source_server_id,\n expected_timestamp,\n\ - \ timestamp,\n title\nfrom\n aws_drs_recovery_snapshot;" + QueryToExecute: | + SELECT + snapshot_id, + source_server_id, + expected_timestamp, + timestamp, + title + FROM + aws_drs_recovery_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List AWS DRS Recovery Snapshot Data with Details + - Disaster Recovery Service +Title: List AWS DRS Recovery Snapshot Data with Details \ No newline at end of file diff --git a/queries/aws_drs_recovery_snapshot_2.yaml b/queries/aws_drs_recovery_snapshot_2.yaml old mode 100755 new mode 100644 index 7145377c9..eefb8d567 --- a/queries/aws_drs_recovery_snapshot_2.yaml +++ b/queries/aws_drs_recovery_snapshot_2.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides - information about recovery snapshots within AWS Disaster Recovery Service (DRS). - This table can be used to gather insights on recovery snapshots, including their - details, associated metadata, and more. +Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides information about recovery snapshots within AWS Disaster Recovery Service (DRS). This table can be used to gather insights on recovery snapshots, including their details, associated metadata, and more. ID: aws_drs_recovery_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.snapshot_id,\n r.source_server_id,\n s.arn as source_server_arn,\n\ - \ s.recovery_instance_id,\n s.replication_direction\nfrom\n aws_drs_recovery_snapshot\ - \ r,\n aws_drs_source_server as s\nwhere\n r.source_server_id = s.source_server_id;" + QueryToExecute: | + SELECT + r.snapshot_id, + r.source_server_id, + s.arn AS source_server_arn, + s.recovery_instance_id, + s.replication_direction + FROM + aws_drs_recovery_snapshot r, + aws_drs_source_server AS s + WHERE + r.source_server_id = s.source_server_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List AWS DRS Recovery Snapshot Details and Metadata + - Disaster Recovery Service +Title: List AWS DRS Recovery Snapshot Details and Metadata \ No newline at end of file diff --git a/queries/aws_drs_recovery_snapshot_3.yaml b/queries/aws_drs_recovery_snapshot_3.yaml old mode 100755 new mode 100644 index 7fc515414..3fbc8e146 --- a/queries/aws_drs_recovery_snapshot_3.yaml +++ b/queries/aws_drs_recovery_snapshot_3.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides - information about recovery snapshots within AWS Disaster Recovery Service (DRS). - This table can be used to gather insights on recovery snapshots, including their - details, associated metadata, and more. +Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides information about recovery snapshots within AWS Disaster Recovery Service (DRS). This table can be used to gather insights on recovery snapshots, including their details, associated metadata, and more. ID: aws_drs_recovery_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_server_id,\n count(snapshot_id) as recovery_snapshot_count\n\ - from\n aws_drs_recovery_snapshot\ngroup by\n source_server_id;" + QueryToExecute: | + SELECT + source_server_id, + COUNT(snapshot_id) AS recovery_snapshot_count + FROM + aws_drs_recovery_snapshot + GROUP BY + source_server_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List all Recovery Snapshot Data in AWS DRS + - Disaster Recovery Service +Title: List all Recovery Snapshot Data in AWS DRS \ No newline at end of file diff --git a/queries/aws_drs_recovery_snapshot_4.yaml b/queries/aws_drs_recovery_snapshot_4.yaml old mode 100755 new mode 100644 index b97d40022..c11367e41 --- a/queries/aws_drs_recovery_snapshot_4.yaml +++ b/queries/aws_drs_recovery_snapshot_4.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides - information about recovery snapshots within AWS Disaster Recovery Service (DRS). - This table can be used to gather insights on recovery snapshots, including their - details, associated metadata, and more. +Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides information about recovery snapshots within AWS Disaster Recovery Service (DRS). This table can be used to gather insights on recovery snapshots, including their details, associated metadata, and more. ID: aws_drs_recovery_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n source_server_id,\n expected_timestamp,\n\ - \ timestamp\nfrom\n aws_drs_recovery_snapshot\nwhere\n timestamp <= now() -\ - \ interval '30' day;" + QueryToExecute: | + SELECT + snapshot_id, + source_server_id, + expected_timestamp, + timestamp + FROM + aws_drs_recovery_snapshot + WHERE + timestamp <= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List AWS DRS Recovery Snapshots with Metadata Details + - Disaster Recovery Service +Title: List AWS DRS Recovery Snapshots with Metadata Details \ No newline at end of file diff --git a/queries/aws_drs_recovery_snapshot_5.yaml b/queries/aws_drs_recovery_snapshot_5.yaml old mode 100755 new mode 100644 index 0e3e928f0..20b4cbda9 --- a/queries/aws_drs_recovery_snapshot_5.yaml +++ b/queries/aws_drs_recovery_snapshot_5.yaml @@ -1,27 +1,38 @@ -Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides - information about recovery snapshots within AWS Disaster Recovery Service (DRS). - This table can be used to gather insights on recovery snapshots, including their - details, associated metadata, and more. +Description: Allows users to query DRS Recovery Snapshot data in AWS. It provides information about recovery snapshots within AWS Disaster Recovery Service (DRS). This table can be used to gather insights on recovery snapshots, including their details, associated metadata, and more. ID: aws_drs_recovery_snapshot_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.snapshot_id,\n r.source_server_id,\n s as ebs_snapshot_id,\n\ - \ e.state as snapshot_state,\n e.volume_size,\n e.volume_id,\n e.encrypted,\n\ - \ e.kms_key_id,\n e.data_encryption_key_id\nfrom\n aws_drs_recovery_snapshot\ - \ as r,\n jsonb_array_elements_text(ebs_snapshots) as s,\n aws_ebs_snapshot\ - \ as e\nwhere\n r.snapshot_id = 'pit-3367d3f930778a9c3'\nand\n s = e.snapshot_id;" + QueryToExecute: | + SELECT + r.snapshot_id, + r.source_server_id, + s AS ebs_snapshot_id, + e.state AS snapshot_state, + e.volume_size, + e.volume_id, + e.encrypted, + e.kms_key_id, + e.data_encryption_key_id + FROM + aws_drs_recovery_snapshot AS r, + jsonb_array_elements_text(ebs_snapshots) AS s, + aws_ebs_snapshot AS e + WHERE + r.snapshot_id = 'pit-3367d3f930778a9c3' + AND + s = e.snapshot_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Disaster Recovery Service -Title: List all AWS DRS Recovery Snapshot Data + - Disaster Recovery Service +Title: List all AWS DRS Recovery Snapshot Data \ No newline at end of file diff --git a/queries/aws_drs_source_server_1.yaml b/queries/aws_drs_source_server_1.yaml old mode 100755 new mode 100644 index ba55d8b94..8000b2081 --- a/queries/aws_drs_source_server_1.yaml +++ b/queries/aws_drs_source_server_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n last_launch_result,\n source_server_id,\n title\n\ - from\n aws_drs_source_server;" + QueryToExecute: | + SELECT + arn, + last_launch_result, + source_server_id, + title + FROM + aws_drs_source_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS Database Migration Service Source Servers + - Database Migration Service +Title: List all AWS Database Migration Service Source Servers \ No newline at end of file diff --git a/queries/aws_drs_source_server_2.yaml b/queries/aws_drs_source_server_2.yaml old mode 100755 new mode 100644 index d1c9b72aa..d4f99eff9 --- a/queries/aws_drs_source_server_2.yaml +++ b/queries/aws_drs_source_server_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n title,\n source_cloud_properties ->> 'OriginAccountID'\ - \ as source_cloud_origin_account_id,\n source_cloud_properties ->> 'OriginAvailabilityZone'\ - \ as source_cloud_origin_availability_zone,\n source_cloud_properties ->> 'OriginRegion'\ - \ as source_cloud_origin_region\nfrom\n aws_drs_source_server;" + QueryToExecute: | + SELECT + arn, + title, + source_cloud_properties ->> 'OriginAccountID' AS source_cloud_origin_account_id, + source_cloud_properties ->> 'OriginAvailabilityZone' AS source_cloud_origin_availability_zone, + source_cloud_properties ->> 'OriginRegion' AS source_cloud_origin_region + FROM + aws_drs_source_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS DMS Source Servers for Detailed Info + - Database Migration Service +Title: List all AWS DMS Source Servers for Detailed Info \ No newline at end of file diff --git a/queries/aws_drs_source_server_3.yaml b/queries/aws_drs_source_server_3.yaml old mode 100755 new mode 100644 index fa044ef6b..eced65de2 --- a/queries/aws_drs_source_server_3.yaml +++ b/queries/aws_drs_source_server_3.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n title,\n source_properties ->> 'Cpus' as source_cpus,\n\ - \ source_properties ->> 'Disks' as source_disks,\n source_properties -> 'IdentificationHints'\ - \ ->> 'Hostname' as source_hostname,\n source_properties ->> 'NetworkInterfaces'\ - \ as source_network_interfaces,\n source_properties -> 'Os' ->> 'FullString'\ - \ as source_os,\n source_properties -> 'RamBytes' as source_ram_bytes,\n source_properties\ - \ -> 'RecommendedInstanceType' as source_recommended_instance_type,\n source_properties\ - \ -> 'LastUpdatedDateTime' as source_last_updated_date_time\nfrom\n aws_drs_source_server;" + QueryToExecute: | + SELECT + arn, + title, + source_properties ->> 'Cpus' AS source_cpus, + source_properties ->> 'Disks' AS source_disks, + source_properties -> 'IdentificationHints' ->> 'Hostname' AS source_hostname, + source_properties ->> 'NetworkInterfaces' AS source_network_interfaces, + source_properties -> 'Os' ->> 'FullString' AS source_os, + source_properties -> 'RamBytes' AS source_ram_bytes, + source_properties -> 'RecommendedInstanceType' AS source_recommended_instance_type, + source_properties -> 'LastUpdatedDateTime' AS source_last_updated_date_time + FROM + aws_drs_source_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Query AWS DMS Source Servers for Replication Details + - Database Migration Service +Title: Query AWS DMS Source Servers for Replication Details \ No newline at end of file diff --git a/queries/aws_drs_source_server_4.yaml b/queries/aws_drs_source_server_4.yaml old mode 100755 new mode 100644 index a3908e4d2..8083c98bf --- a/queries/aws_drs_source_server_4.yaml +++ b/queries/aws_drs_source_server_4.yaml @@ -1,27 +1,30 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n title,\n data_replication_info -> 'DataReplicationInitiation'\ - \ ->> 'StartDateTime' as data_replication_start_date_time,\n data_replication_info\ - \ -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime' as data_replication_next_attempt_date_time,\n\ - \ data_replication_info ->> 'DataReplicationError' as data_replication_error,\n\ - \ data_replication_info ->> 'DataReplicationState' as data_replication_state,\n\ - \ data_replication_info ->> 'ReplicatedDisks' as data_replication_replicated_disks\n\ - from\n aws_drs_source_server;" + QueryToExecute: | + SELECT + arn, + title, + data_replication_info -> 'DataReplicationInitiation' ->> 'StartDateTime' AS data_replication_start_date_time, + data_replication_info -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime' AS data_replication_next_attempt_date_time, + data_replication_info ->> 'DataReplicationError' AS data_replication_error, + data_replication_info ->> 'DataReplicationState' AS data_replication_state, + data_replication_info ->> 'ReplicatedDisks' AS data_replication_replicated_disks + FROM + aws_drs_source_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List all AWS DMS Source Servers with Replication Info + - Database Migration Service +Title: List all AWS DMS Source Servers with Replication Info \ No newline at end of file diff --git a/queries/aws_drs_source_server_5.yaml b/queries/aws_drs_source_server_5.yaml old mode 100755 new mode 100644 index 715760f7d..f79a62fb3 --- a/queries/aws_drs_source_server_5.yaml +++ b/queries/aws_drs_source_server_5.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n title,\n launch_configuration ->> 'Name' as\ - \ launch_configuration_name,\n launch_configuration ->> 'CopyPrivateIp' as launch_configuration_copy_private_ip,\n\ - \ launch_configuration ->> 'CopyTags' as launch_configuration_copy_tags,\n launch_configuration\ - \ ->> 'Ec2LaunchTemplateID' as launch_configuration_ec2_launch_template_id,\n\ - \ launch_configuration ->> 'LaunchDisposition' as launch_configuration_disposition,\n\ - \ launch_configuration ->> 'TargetInstanceTypeRightSizingMethod' as launch_configuration_target_instance_type_right_sizing_method,\n\ - \ launch_configuration -> 'Licensing' as launch_configuration_licensing,\n launch_configuration\ - \ -> 'ResultMetadata' as launch_configuration_result_metadata\nfrom\n aws_drs_source_server;" + QueryToExecute: | + SELECT + arn, + title, + launch_configuration ->> 'Name' AS launch_configuration_name, + launch_configuration ->> 'CopyPrivateIp' AS launch_configuration_copy_private_ip, + launch_configuration ->> 'CopyTags' AS launch_configuration_copy_tags, + launch_configuration ->> 'Ec2LaunchTemplateID' AS launch_configuration_ec2_launch_template_id, + launch_configuration ->> 'LaunchDisposition' AS launch_configuration_disposition, + launch_configuration ->> 'TargetInstanceTypeRightSizingMethod' AS launch_configuration_target_instance_type_right_sizing_method, + launch_configuration -> 'Licensing' AS launch_configuration_licensing, + launch_configuration -> 'ResultMetadata' AS launch_configuration_result_metadata + FROM + aws_drs_source_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: List AWS DMS Source Servers with Detailed Information + - Database Migration Service +Title: List AWS DMS Source Servers with Detailed Information \ No newline at end of file diff --git a/queries/aws_drs_source_server_6.yaml b/queries/aws_drs_source_server_6.yaml old mode 100755 new mode 100644 index 347a0127c..26f625abb --- a/queries/aws_drs_source_server_6.yaml +++ b/queries/aws_drs_source_server_6.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n last_launch_result,\n source_server_id\n\ - from\n aws_drs_source_server\nwhere\n last_launch_result = 'FAILED';" + QueryToExecute: | + SELECT + title, + arn, + last_launch_result, + source_server_id + FROM + aws_drs_source_server + WHERE + last_launch_result = 'FAILED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find Failed AWS Database Migration Source Servers + - Database Migration Service +Title: Find Failed AWS Database Migration Source Servers \ No newline at end of file diff --git a/queries/aws_drs_source_server_7.yaml b/queries/aws_drs_source_server_7.yaml old mode 100755 new mode 100644 index c55378f0a..6f71c352d --- a/queries/aws_drs_source_server_7.yaml +++ b/queries/aws_drs_source_server_7.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS Database Migration Service Source Servers for - detailed information about the replication servers used in database migrations. +Description: Allows users to query AWS Database Migration Service Source Servers for detailed information about the replication servers used in database migrations. ID: aws_drs_source_server_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n data_replication_info ->> 'DataReplicationState'\ - \ as data_replication_state,\n data_replication_info ->> 'DataReplicationError'\ - \ as data_replication_error,\n data_replication_info -> 'DataReplicationInitiation'\ - \ ->> 'StartDateTime' as data_replication_start_date_time,\n data_replication_info\ - \ -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime' as data_replication_next_attempt_date_time\n\ - from\n aws_drs_source_server\nwhere\n data_replication_info ->> 'DataReplicationState'\ - \ = 'DISCONNECTED';" + QueryToExecute: | + SELECT + title, + arn, + data_replication_info ->> 'DataReplicationState' AS data_replication_state, + data_replication_info ->> 'DataReplicationError' AS data_replication_error, + data_replication_info -> 'DataReplicationInitiation' ->> 'StartDateTime' AS data_replication_start_date_time, + data_replication_info -> 'DataReplicationInitiation' ->> 'NextAttemptDateTime' AS data_replication_next_attempt_date_time + FROM + aws_drs_source_server + WHERE + data_replication_info ->> 'DataReplicationState' = 'DISCONNECTED'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Database Migration Service -Title: Find AWS DMS Source Server Data Replication Details + - Database Migration Service +Title: Find AWS DMS Source Server Data Replication Details \ No newline at end of file diff --git a/queries/aws_dynamodb_backup_1.yaml b/queries/aws_dynamodb_backup_1.yaml old mode 100755 new mode 100644 index 938981c23..efba4a404 --- a/queries/aws_dynamodb_backup_1.yaml +++ b/queries/aws_dynamodb_backup_1.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query DynamoDB Backup details such as backup ARN, backup - creation date, backup size, backup status, and more. +Description: Allows users to query DynamoDB Backup details such as backup ARN, backup creation date, backup size, backup status, and more. ID: aws_dynamodb_backup_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n table_name,\n table_id\nfrom\n aws_dynamodb_backup;" + QueryToExecute: | + SELECT + name, + table_name, + table_id + FROM + aws_dynamodb_backup; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all DynamoDB Backup details with SQL query + - DynamoDB +Title: List all DynamoDB Backup details with SQL query \ No newline at end of file diff --git a/queries/aws_dynamodb_backup_2.yaml b/queries/aws_dynamodb_backup_2.yaml old mode 100755 new mode 100644 index c20801c53..53a305294 --- a/queries/aws_dynamodb_backup_2.yaml +++ b/queries/aws_dynamodb_backup_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query DynamoDB Backup details such as backup ARN, backup - creation date, backup size, backup status, and more. +Description: Allows users to query DynamoDB Backup details such as backup ARN, backup creation date, backup size, backup status, and more. ID: aws_dynamodb_backup_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n backup_status,\n backup_type,\n backup_expiry_datetime,\n\ - \ backup_size_bytes\nfrom\n aws_dynamodb_backup;" + QueryToExecute: | + SELECT + name, + backup_status, + backup_type, + backup_expiry_datetime, + backup_size_bytes + FROM + aws_dynamodb_backup; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Backup Details + - DynamoDB +Title: List all AWS DynamoDB Backup Details \ No newline at end of file diff --git a/queries/aws_dynamodb_global_table_1.yaml b/queries/aws_dynamodb_global_table_1.yaml old mode 100755 new mode 100644 index afc3672ba..aa671903f --- a/queries/aws_dynamodb_global_table_1.yaml +++ b/queries/aws_dynamodb_global_table_1.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS DynamoDB Global Tables to gather information - about the global tables, including the table name, creation time, status, and other - related details. +Description: Allows users to query AWS DynamoDB Global Tables to gather information about the global tables, including the table name, creation time, status, and other related details. ID: aws_dynamodb_global_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n global_table_name,\n rg -> 'RegionName' as region_name\n\ - from\n aws_dynamodb_global_table\n cross join jsonb_array_elements(replication_group)\ - \ as rg;" + QueryToExecute: | + SELECT + global_table_name, + rg -> 'RegionName' AS region_name + FROM + aws_dynamodb_global_table + CROSS JOIN + jsonb_array_elements(replication_group) AS rg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB Global Table -Title: List all AWS DynamoDB Global Tables and their Regions + - DynamoDB Global Table +Title: List all AWS DynamoDB Global Tables and their Regions \ No newline at end of file diff --git a/queries/aws_dynamodb_global_table_2.yaml b/queries/aws_dynamodb_global_table_2.yaml old mode 100755 new mode 100644 index 32bc86bb9..79786b60f --- a/queries/aws_dynamodb_global_table_2.yaml +++ b/queries/aws_dynamodb_global_table_2.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS DynamoDB Global Tables to gather information - about the global tables, including the table name, creation time, status, and other - related details. +Description: Allows users to query AWS DynamoDB Global Tables to gather information about the global tables, including the table name, creation time, status, and other related details. ID: aws_dynamodb_global_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n global_table_name,\n global_table_status,\n rg -> 'GlobalSecondaryIndexes'\ - \ as global_secondary_indexes,\n rg -> 'RegionName' as region_name,\n rg ->\ - \ 'ReplicaInaccessibleDateTime' as replica_inaccessible_date_time,\n rg -> 'ReplicaStatus'\ - \ as replica_status,\n rg -> 'ReplicaStatusDescription' as replica_status_description,\n\ - \ rg -> 'ReplicaStatusPercentProgress' as replica_status_percent_progress\nfrom\n\ - \ aws_dynamodb_global_table\n cross join jsonb_array_elements(replication_group)\ - \ as rg;" + QueryToExecute: | + SELECT + global_table_name, + global_table_status, + rg -> 'GlobalSecondaryIndexes' AS global_secondary_indexes, + rg -> 'RegionName' AS region_name, + rg -> 'ReplicaInaccessibleDateTime' AS replica_inaccessible_date_time, + rg -> 'ReplicaStatus' AS replica_status, + rg -> 'ReplicaStatusDescription' AS replica_status_description, + rg -> 'ReplicaStatusPercentProgress' AS replica_status_percent_progress + FROM + aws_dynamodb_global_table + CROSS JOIN + jsonb_array_elements(replication_group) AS rg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Global Tables with Details + - DynamoDB +Title: List all AWS DynamoDB Global Tables with Details \ No newline at end of file diff --git a/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_1.yaml b/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_1.yaml old mode 100755 new mode 100644 index 188671d50..faeaafb36 --- a/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_1.yaml +++ b/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query DynamoDB Metrics on account provisioned read capacity - utilization. +Description: Allows users to query DynamoDB Metrics on account provisioned read capacity utilization. ID: aws_dynamodb_metric_account_provisioned_read_capacity_util_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_id,\n timestamp,\n minimum,\n maximum,\n \ - \ average,\n sum,\n sample_count\nfrom\n aws_dynamodb_metric_account_provisioned_read_capacity_util\n\ - order by\n timestamp;" + QueryToExecute: | + SELECT + account_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_dynamodb_metric_account_provisioned_read_capacity_util + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List AWS DynamoDB Metrics on Read Capacity Utilization + - DynamoDB +Title: List AWS DynamoDB Metrics on Read Capacity Utilization \ No newline at end of file diff --git a/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_2.yaml b/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_2.yaml old mode 100755 new mode 100644 index 59ef23fae..ea3e073f5 --- a/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_2.yaml +++ b/queries/aws_dynamodb_metric_account_provisioned_read_capacity_util_2.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query DynamoDB Metrics on account provisioned read capacity - utilization. +Description: Allows users to query DynamoDB Metrics on account provisioned read capacity utilization. ID: aws_dynamodb_metric_account_provisioned_read_capacity_util_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_id,\n timestamp,\n minimum,\n maximum,\n \ - \ average,\n sum,\n sample_count\nfrom\n aws_dynamodb_metric_account_provisioned_read_capacity_util\n\ - where\n maximum > 80\norder by\n timestamp;" + QueryToExecute: | + SELECT + account_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_dynamodb_metric_account_provisioned_read_capacity_util + WHERE + maximum > 80 + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Metrics on Read Capacity Utilization + - DynamoDB +Title: List all AWS DynamoDB Metrics on Read Capacity Utilization \ No newline at end of file diff --git a/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_1.yaml b/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_1.yaml old mode 100755 new mode 100644 index 39ee8d78d..d2b1c3ca8 --- a/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_1.yaml +++ b/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS DynamoDB Metrics for account provisioned write - capacity utilization. +Description: Allows users to query AWS DynamoDB Metrics for account provisioned write capacity utilization. ID: aws_dynamodb_metric_account_provisioned_write_capacity_util_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_id,\n timestamp,\n minimum,\n maximum,\n \ - \ average,\n sum,\n sample_count\nfrom\n aws_dynamodb_metric_account_provisioned_write_capacity_util\n\ - order by\n timestamp;" + QueryToExecute: | + SELECT + account_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_dynamodb_metric_account_provisioned_write_capacity_util + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List AWS DynamoDB Metrics for Write Capacity Utilization + - DynamoDB +Title: List AWS DynamoDB Metrics for Write Capacity Utilization \ No newline at end of file diff --git a/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_2.yaml b/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_2.yaml old mode 100755 new mode 100644 index 2a145200f..0cbaa9a9b --- a/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_2.yaml +++ b/queries/aws_dynamodb_metric_account_provisioned_write_capacity_util_2.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query AWS DynamoDB Metrics for account provisioned write - capacity utilization. +Description: Allows users to query AWS DynamoDB Metrics for account provisioned write capacity utilization. ID: aws_dynamodb_metric_account_provisioned_write_capacity_util_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_id,\n timestamp,\n minimum,\n maximum,\n \ - \ average,\n sum,\n sample_count\nfrom\n aws_dynamodb_metric_account_provisioned_write_capacity_util\n\ - where\n maximum > 80\norder by\n timestamp;" + QueryToExecute: | + SELECT + account_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_dynamodb_metric_account_provisioned_write_capacity_util + WHERE + maximum > 80 + ORDER BY + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List AWS DynamoDB Account Write Capacity Utilization Metrics + - DynamoDB +Title: List AWS DynamoDB Account Write Capacity Utilization Metrics \ No newline at end of file diff --git a/queries/aws_dynamodb_table_1.yaml b/queries/aws_dynamodb_table_1.yaml old mode 100755 new mode 100644 index 3b0744979..6ae19d035 --- a/queries/aws_dynamodb_table_1.yaml +++ b/queries/aws_dynamodb_table_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information - about their configuration, status, and associated attributes. +Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information about their configuration, status, and associated attributes. ID: aws_dynamodb_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n sse_description\nfrom\n aws_dynamodb_table\n\ - where\n sse_description is null;" + QueryToExecute: | + SELECT + name, + sse_description + FROM + aws_dynamodb_table + WHERE + sse_description IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: Find AWS DynamoDB Tables with Missing SSE Description + - DynamoDB +Title: Find AWS DynamoDB Tables with Missing SSE Description \ No newline at end of file diff --git a/queries/aws_dynamodb_table_2.yaml b/queries/aws_dynamodb_table_2.yaml old mode 100755 new mode 100644 index e767ec61c..3d4fafeb9 --- a/queries/aws_dynamodb_table_2.yaml +++ b/queries/aws_dynamodb_table_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information - about their configuration, status, and associated attributes. +Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information about their configuration, status, and associated attributes. ID: aws_dynamodb_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n continuous_backups_status\nfrom\n aws_dynamodb_table\n\ - where\n continuous_backups_status = 'DISABLED';" + QueryToExecute: | + SELECT + name, + continuous_backups_status + FROM + aws_dynamodb_table + WHERE + continuous_backups_status = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Tables with Disabled Backups + - DynamoDB +Title: List all AWS DynamoDB Tables with Disabled Backups \ No newline at end of file diff --git a/queries/aws_dynamodb_table_3.yaml b/queries/aws_dynamodb_table_3.yaml old mode 100755 new mode 100644 index a5e80b190..f6372261d --- a/queries/aws_dynamodb_table_3.yaml +++ b/queries/aws_dynamodb_table_3.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information - about their configuration, status, and associated attributes. +Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information about their configuration, status, and associated attributes. ID: aws_dynamodb_table_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n point_in_time_recovery_description ->> 'EarliestRestorableDateTime'\ - \ as earliest_restorable_date_time,\n point_in_time_recovery_description ->>\ - \ 'LatestRestorableDateTime' as latest_restorable_date_time,\n point_in_time_recovery_description\ - \ ->> 'PointInTimeRecoveryStatus' as point_in_time_recovery_status\nfrom\n aws_dynamodb_table;" + QueryToExecute: | + SELECT + name, + point_in_time_recovery_description ->> 'EarliestRestorableDateTime' AS earliest_restorable_date_time, + point_in_time_recovery_description ->> 'LatestRestorableDateTime' AS latest_restorable_date_time, + point_in_time_recovery_description ->> 'PointInTimeRecoveryStatus' AS point_in_time_recovery_status + FROM + aws_dynamodb_table; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Tables and retrieve their status + - DynamoDB +Title: List all AWS DynamoDB Tables and retrieve their status \ No newline at end of file diff --git a/queries/aws_dynamodb_table_4.yaml b/queries/aws_dynamodb_table_4.yaml old mode 100755 new mode 100644 index c53fc3f11..cb6d27a3b --- a/queries/aws_dynamodb_table_4.yaml +++ b/queries/aws_dynamodb_table_4.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information - about their configuration, status, and associated attributes. +Description: Allows users to query AWS DynamoDB Tables and retrieve detailed information about their configuration, status, and associated attributes. ID: aws_dynamodb_table_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n d ->> 'StreamArn' as kinesis_stream_arn,\n \ - \ d ->> 'DestinationStatus' as stream_status\nfrom\n aws_dynamodb_table,\n jsonb_array_elements(streaming_destination\ - \ -> 'KinesisDataStreamDestinations') as d" + QueryToExecute: | + SELECT + name, + d ->> 'StreamArn' AS kinesis_stream_arn, + d ->> 'DestinationStatus' AS stream_status + FROM + aws_dynamodb_table, + jsonb_array_elements(streaming_destination -> 'KinesisDataStreamDestinations') AS d Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB table configurations and status + - DynamoDB +Title: List all AWS DynamoDB table configurations and status \ No newline at end of file diff --git a/queries/aws_dynamodb_table_export_1.yaml b/queries/aws_dynamodb_table_export_1.yaml old mode 100755 new mode 100644 index 1687da106..a3e94e253 --- a/queries/aws_dynamodb_table_export_1.yaml +++ b/queries/aws_dynamodb_table_export_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS DynamoDB Table Exports, providing detailed - information on the exports of DynamoDB tables including the export time, status, - and the exported data format. +Description: Allows users to query AWS DynamoDB Table Exports, providing detailed information on the exports of DynamoDB tables including the export time, status, and the exported data format. ID: aws_dynamodb_table_export_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n end_time,\n export_format,\n export_status,\n\ - \ s3_bucket\nfrom\n aws_dynamodb_table_export;" + QueryToExecute: | + SELECT + arn, + end_time, + export_format, + export_status, + s3_bucket + FROM + aws_dynamodb_table_export; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all details of AWS DynamoDB Table Exports + - DynamoDB +Title: List all details of AWS DynamoDB Table Exports \ No newline at end of file diff --git a/queries/aws_dynamodb_table_export_2.yaml b/queries/aws_dynamodb_table_export_2.yaml old mode 100755 new mode 100644 index 367992ea1..0e7d239d4 --- a/queries/aws_dynamodb_table_export_2.yaml +++ b/queries/aws_dynamodb_table_export_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS DynamoDB Table Exports, providing detailed - information on the exports of DynamoDB tables including the export time, status, - and the exported data format. +Description: Allows users to query AWS DynamoDB Table Exports, providing detailed information on the exports of DynamoDB tables including the export time, status, and the exported data format. ID: aws_dynamodb_table_export_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n end_time,\n export_format,\n export_status,\n\ - \ s3_bucket\nfrom\n aws_dynamodb_table_export\nwhere\n export_status <> 'COMPLETED';" + QueryToExecute: | + SELECT + arn, + end_time, + export_format, + export_status, + s3_bucket + FROM + aws_dynamodb_table_export + WHERE + export_status <> 'COMPLETED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: List all AWS DynamoDB Table Exports with Details + - DynamoDB +Title: List all AWS DynamoDB Table Exports with Details \ No newline at end of file diff --git a/queries/aws_dynamodb_table_export_3.yaml b/queries/aws_dynamodb_table_export_3.yaml old mode 100755 new mode 100644 index 308bfccd3..f9fea9e37 --- a/queries/aws_dynamodb_table_export_3.yaml +++ b/queries/aws_dynamodb_table_export_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS DynamoDB Table Exports, providing detailed - information on the exports of DynamoDB tables including the export time, status, - and the exported data format. +Description: Allows users to query AWS DynamoDB Table Exports, providing detailed information on the exports of DynamoDB tables including the export time, status, and the exported data format. ID: aws_dynamodb_table_export_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n end_time,\n export_format,\n export_status,\n\ - \ export_time,\n s3_bucket\nfrom\n aws_dynamodb_table_export\nwhere\n export_time\ - \ >= now() - interval '10' day;" + QueryToExecute: | + SELECT + arn, + end_time, + export_format, + export_status, + export_time, + s3_bucket + FROM + aws_dynamodb_table_export + WHERE + export_time >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DynamoDB -Title: Find AWS DynamoDB Table Exports with Detailed Info + - DynamoDB +Title: Find AWS DynamoDB Table Exports with Detailed Info \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_1.yaml b/queries/aws_ebs_snapshot_1.yaml old mode 100755 new mode 100644 index 4b3b03046..a2d41a7fd --- a/queries/aws_ebs_snapshot_1.yaml +++ b/queries/aws_ebs_snapshot_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n arn,\n encrypted\nfrom\n aws_ebs_snapshot\n\ - where\n not encrypted;" + QueryToExecute: | + SELECT + snapshot_id, + arn, + encrypted + FROM + aws_ebs_snapshot + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store (EBS) -Title: Find Detailed Information About AWS EBS Snapshots + - Elastic Block Store (EBS) +Title: Find Detailed Information About AWS EBS Snapshots \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_2.yaml b/queries/aws_ebs_snapshot_2.yaml old mode 100755 new mode 100644 index 9222c4842..fda1c84d5 --- a/queries/aws_ebs_snapshot_2.yaml +++ b/queries/aws_ebs_snapshot_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n arn,\n volume_id,\n perm ->> 'UserId'\ - \ as userid,\n perm ->> 'Group' as group\nfrom\n aws_ebs_snapshot\n cross join\ - \ jsonb_array_elements(create_volume_permissions) as perm\nwhere\n perm ->> 'Group'\ - \ = 'all';" + QueryToExecute: | + SELECT + snapshot_id, + arn, + volume_id, + perm ->> 'UserId' AS userid, + perm ->> 'Group' AS group + FROM + aws_ebs_snapshot + CROSS JOIN + jsonb_array_elements(create_volume_permissions) AS perm + WHERE + perm ->> 'Group' = 'all'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find AWS EBS Snapshots with User and Group Details + - Elastic Block Store +Title: Find AWS EBS Snapshots with User and Group Details \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_3.yaml b/queries/aws_ebs_snapshot_3.yaml old mode 100755 new mode 100644 index 417f0a5af..0c817b26e --- a/queries/aws_ebs_snapshot_3.yaml +++ b/queries/aws_ebs_snapshot_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n volume_id,\n perm ->> 'UserId' as account_ids\n\ - from\n aws_ebs_snapshot\n cross join jsonb_array_elements(create_volume_permissions)\ - \ as perm;" + QueryToExecute: | + SELECT + snapshot_id, + volume_id, + perm ->> 'UserId' AS account_ids + FROM + aws_ebs_snapshot + CROSS JOIN + jsonb_array_elements(create_volume_permissions) AS perm; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List all AWS EBS snapshots with details + - Elastic Block Store +Title: List all AWS EBS snapshots with details \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_4.yaml b/queries/aws_ebs_snapshot_4.yaml old mode 100755 new mode 100644 index ef5a53034..7f730c6ad --- a/queries/aws_ebs_snapshot_4.yaml +++ b/queries/aws_ebs_snapshot_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n count(snapshot_id) as snapshot_id\nfrom\n\ - \ aws_ebs_snapshot\ngroup by\n volume_id;" + QueryToExecute: | + SELECT + volume_id, + COUNT(snapshot_id) AS snapshot_id + FROM + aws_ebs_snapshot + GROUP BY + volume_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store (EBS) -Title: List all AWS EBS snapshots with configuration details + - Elastic Block Store (EBS) +Title: List all AWS EBS snapshots with configuration details \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_5.yaml b/queries/aws_ebs_snapshot_5.yaml old mode 100755 new mode 100644 index e61f36c78..480e27187 --- a/queries/aws_ebs_snapshot_5.yaml +++ b/queries/aws_ebs_snapshot_5.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n arn,\n encrypted,\n owner_id\nfrom\n\ - \ aws_ebs_snapshot\nwhere\n owner_id = '859788737657';" + QueryToExecute: | + SELECT + snapshot_id, + arn, + encrypted, + owner_id + FROM + aws_ebs_snapshot + WHERE + owner_id = '859788737657'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find details of AWS EBS snapshot configurations + - Elastic Block Store +Title: Find details of AWS EBS snapshot configurations \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_6.yaml b/queries/aws_ebs_snapshot_6.yaml old mode 100755 new mode 100644 index e69258784..a69058241 --- a/queries/aws_ebs_snapshot_6.yaml +++ b/queries/aws_ebs_snapshot_6.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n arn,\n encrypted,\n owner_id\nfrom\n\ - \ aws_ebs_snapshot\nwhere\n snapshot_id = 'snap-07bf4f91353ad71ae';" + QueryToExecute: | + SELECT + snapshot_id, + arn, + encrypted, + owner_id + FROM + aws_ebs_snapshot + WHERE + snapshot_id = 'snap-07bf4f91353ad71ae'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find EBS Snapshots Configuration and Metadata in AWS + - Elastic Block Store +Title: Find EBS Snapshots Configuration and Metadata in AWS \ No newline at end of file diff --git a/queries/aws_ebs_snapshot_7.yaml b/queries/aws_ebs_snapshot_7.yaml old mode 100755 new mode 100644 index e7eb8e809..f2ebe7fa6 --- a/queries/aws_ebs_snapshot_7.yaml +++ b/queries/aws_ebs_snapshot_7.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EBS snapshots, providing detailed information - about each snapshot''s configuration, status, and associated metadata. +Description: Allows users to query AWS EBS snapshots, providing detailed information about each snapshot's configuration, status, and associated metadata. ID: aws_ebs_snapshot_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_id,\n arn,\n encrypted,\n owner_id\nfrom\n\ - \ aws_ebs_snapshot\nwhere\n owner_alias = 'amazon'" + QueryToExecute: | + SELECT + snapshot_id, + arn, + encrypted, + owner_id + FROM + aws_ebs_snapshot + WHERE + owner_alias = 'amazon' Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List all AWS EBS Snapshot Configurations and Status + - Elastic Block Store +Title: List all AWS EBS Snapshot Configurations and Status \ No newline at end of file diff --git a/queries/aws_ebs_volume_1.yaml b/queries/aws_ebs_volume_1.yaml old mode 100755 new mode 100644 index 65d3d27b7..de33913a2 --- a/queries/aws_ebs_volume_1.yaml +++ b/queries/aws_ebs_volume_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n encrypted\nfrom\n aws_ebs_volume\nwhere\n\ - \ not encrypted;" + QueryToExecute: | + SELECT + volume_id, + encrypted + FROM + aws_ebs_volume + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find All Unencrypted EBS Volumes in AWS + - Elastic Block Store +Title: Find All Unencrypted EBS Volumes in AWS \ No newline at end of file diff --git a/queries/aws_ebs_volume_2.yaml b/queries/aws_ebs_volume_2.yaml old mode 100755 new mode 100644 index ef90b45b2..a7fe8b11f --- a/queries/aws_ebs_volume_2.yaml +++ b/queries/aws_ebs_volume_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n volume_type\nfrom\n aws_ebs_volume\nwhere\n\ - \ jsonb_array_length(attachments) = 0;" + QueryToExecute: | + SELECT + volume_id, + volume_type + FROM + aws_ebs_volume + WHERE + jsonb_array_length(attachments) = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store (EBS) -Title: List all AWS EBS volumes with no attachments + - Elastic Block Store (EBS) +Title: List all AWS EBS volumes with no attachments \ No newline at end of file diff --git a/queries/aws_ebs_volume_3.yaml b/queries/aws_ebs_volume_3.yaml old mode 100755 new mode 100644 index fea7edfed..4174116cf --- a/queries/aws_ebs_volume_3.yaml +++ b/queries/aws_ebs_volume_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n volume_type\nfrom\n aws_ebs_volume\nwhere\n\ - \ volume_type = 'io1';" + QueryToExecute: | + SELECT + volume_id, + volume_type + FROM + aws_ebs_volume + WHERE + volume_type = 'io1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store (EBS) -Title: List all AWS EBS Volumes and Their Details + - Elastic Block Store (EBS) +Title: List all AWS EBS Volumes and Their Details \ No newline at end of file diff --git a/queries/aws_ebs_volume_4.yaml b/queries/aws_ebs_volume_4.yaml old mode 100755 new mode 100644 index f00240e1e..f56786a50 --- a/queries/aws_ebs_volume_4.yaml +++ b/queries/aws_ebs_volume_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n size\nfrom\n aws_ebs_volume\nwhere\n \ - \ size > '100';" + QueryToExecute: | + SELECT + volume_id, + size + FROM + aws_ebs_volume + WHERE + size > '100'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List all AWS EBS volumes with configuration and status details + - Elastic Block Store +Title: List all AWS EBS volumes with configuration and status details \ No newline at end of file diff --git a/queries/aws_ebs_volume_5.yaml b/queries/aws_ebs_volume_5.yaml old mode 100755 new mode 100644 index 3913f9bf3..f55b68126 --- a/queries/aws_ebs_volume_5.yaml +++ b/queries/aws_ebs_volume_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_type,\n count(volume_type) as count\nfrom\n \ - \ aws_ebs_volume\ngroup by\n volume_type;" + QueryToExecute: | + SELECT + volume_type, + COUNT(volume_type) AS count + FROM + aws_ebs_volume + GROUP BY + volume_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List all AWS EBS Volumes and Configuration Details + - Elastic Block Store +Title: List all AWS EBS Volumes and Configuration Details \ No newline at end of file diff --git a/queries/aws_ebs_volume_6.yaml b/queries/aws_ebs_volume_6.yaml old mode 100755 new mode 100644 index dd93c998b..479883989 --- a/queries/aws_ebs_volume_6.yaml +++ b/queries/aws_ebs_volume_6.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n size,\n att ->> 'InstanceId' as instance_id\n\ - from\n aws_ebs_volume\n cross join jsonb_array_elements(attachments) as att\n\ - \ join aws_ec2_instance as i on i.instance_id = att ->> 'InstanceId'\nwhere\n\ - \ instance_state = 'stopped';" + QueryToExecute: | + SELECT + volume_id, + size, + att ->> 'InstanceId' AS instance_id + FROM + aws_ebs_volume + CROSS JOIN jsonb_array_elements(attachments) AS att + JOIN aws_ec2_instance AS i ON i.instance_id = att ->> 'InstanceId' + WHERE + instance_state = 'stopped'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store (EBS) -Title: List all AWS EBS volumes and their stopped instances + - Elastic Block Store (EBS) +Title: List all AWS EBS volumes and their stopped instances \ No newline at end of file diff --git a/queries/aws_ebs_volume_7.yaml b/queries/aws_ebs_volume_7.yaml old mode 100755 new mode 100644 index 06b03252d..cc4fbcbc0 --- a/queries/aws_ebs_volume_7.yaml +++ b/queries/aws_ebs_volume_7.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed - information about their configuration, status, and associated tags. +Description: Allows users to query AWS Elastic Block Store (EBS) volumes for detailed information about their configuration, status, and associated tags. ID: aws_ebs_volume_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n volume_type\nfrom\n aws_ebs_volume\nwhere\n\ - \ volume_type = 'io1';" + QueryToExecute: | + SELECT + volume_id, + volume_type + FROM + aws_ebs_volume + WHERE + volume_type = 'io1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List AWS EBS Volumes for Configuration and Status + - Elastic Block Store +Title: List AWS EBS Volumes for Configuration and Status \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_1.yaml b/queries/aws_ebs_volume_metric_read_ops_1.yaml old mode 100755 new mode 100644 index 3ac73e1e7..0ffb4122b --- a/queries/aws_ebs_volume_metric_read_ops_1.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_1.yaml @@ -1,22 +1,33 @@ Description: Allows users to query AWS EBS Volume read operations metrics. ID: aws_ebs_volume_metric_read_ops_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops\norder by\n volume_id,\n\ - \ timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS Volume -Title: List all AWS EBS Volume read operations metrics + - EBS Volume +Title: List all AWS EBS Volume read operations metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_2.yaml b/queries/aws_ebs_volume_metric_read_ops_2.yaml old mode 100755 new mode 100644 index 074609131..ae3c3bdce --- a/queries/aws_ebs_volume_metric_read_ops_2.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_2.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS EBS Volume read operations metrics. ID: aws_ebs_volume_metric_read_ops_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops\nwhere\n average\ - \ > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find Read Ops Metrics of AWS EBS Volumes with SQL + - EBS +Title: Find Read Ops Metrics of AWS EBS Volumes with SQL \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_3.yaml b/queries/aws_ebs_volume_metric_read_ops_3.yaml old mode 100755 new mode 100644 index 3a7eecd4a..de082c94e --- a/queries/aws_ebs_volume_metric_read_ops_3.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_3.yaml @@ -1,22 +1,35 @@ Description: Allows users to query AWS EBS Volume read operations metrics. ID: aws_ebs_volume_metric_read_ops_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops\nwhere\n maximum\ - \ > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: List all AWS EBS Volume read operations metrics + - EBS +Title: List all AWS EBS Volume read operations metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_4.yaml b/queries/aws_ebs_volume_metric_read_ops_4.yaml old mode 100755 new mode 100644 index e55f7a9de..936bfb3ee --- a/queries/aws_ebs_volume_metric_read_ops_4.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_4.yaml @@ -1,25 +1,39 @@ Description: Allows users to query AWS EBS Volume read operations metrics. ID: aws_ebs_volume_metric_read_ops_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops as r,\n aws_ebs_volume_metric_write_ops\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops AS r, + aws_ebs_volume_metric_write_ops AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: List All AWS EBS Volume Read Operations Metrics + - EBS +Title: List All AWS EBS Volume Read Operations Metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_daily_1.yaml b/queries/aws_ebs_volume_metric_read_ops_daily_1.yaml old mode 100755 new mode 100644 index 99ee6e4bb..bb6b6327a --- a/queries/aws_ebs_volume_metric_read_ops_daily_1.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_daily_1.yaml @@ -1,20 +1,31 @@ Description: Allows users to query AWS EBS Volume metrics for daily read operations. ID: aws_ebs_volume_metric_read_ops_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_daily\norder by\n\ - \ volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_daily + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: List AWS EBS Volume Metrics for Daily Read Ops + - EBS +Title: List AWS EBS Volume Metrics for Daily Read Ops \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_daily_2.yaml b/queries/aws_ebs_volume_metric_read_ops_daily_2.yaml old mode 100755 new mode 100644 index 21670a431..aa54d8a8a --- a/queries/aws_ebs_volume_metric_read_ops_daily_2.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_daily_2.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS EBS Volume metrics for daily read operations. ID: aws_ebs_volume_metric_read_ops_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_daily\nwhere\n\ - \ average > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_daily + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find Daily AWS EBS Volume Read Ops Metrics using SQL + - EBS +Title: Find Daily AWS EBS Volume Read Ops Metrics using SQL \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_daily_3.yaml b/queries/aws_ebs_volume_metric_read_ops_daily_3.yaml old mode 100755 new mode 100644 index 75153cfc0..82c5bd7cf --- a/queries/aws_ebs_volume_metric_read_ops_daily_3.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_daily_3.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS EBS Volume metrics for daily read operations. ID: aws_ebs_volume_metric_read_ops_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_daily\nwhere\n\ - \ maximum > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_daily + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find all AWS EBS Volume daily read operations metrics + - EBS +Title: Find all AWS EBS Volume daily read operations metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_daily_4.yaml b/queries/aws_ebs_volume_metric_read_ops_daily_4.yaml old mode 100755 new mode 100644 index 2e87dd6bb..7e56f5ba9 --- a/queries/aws_ebs_volume_metric_read_ops_daily_4.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_daily_4.yaml @@ -1,27 +1,41 @@ Description: Allows users to query AWS EBS Volume metrics for daily read operations. ID: aws_ebs_volume_metric_read_ops_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops_daily as r,\n aws_ebs_volume_metric_write_ops_daily\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops_daily AS r, + aws_ebs_volume_metric_write_ops_daily AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find AWS EBS Volume Metrics for Daily Read Operations + - EBS +Title: Find AWS EBS Volume Metrics for Daily Read Operations \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_hourly_1.yaml b/queries/aws_ebs_volume_metric_read_ops_hourly_1.yaml old mode 100755 new mode 100644 index 8c3744504..7001deb95 --- a/queries/aws_ebs_volume_metric_read_ops_hourly_1.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_hourly_1.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on - an hourly basis. +Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on an hourly basis. ID: aws_ebs_volume_metric_read_ops_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_hourly\norder\ - \ by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_hourly + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 EBS -Title: Find Amazon EC2 EBS Volume Read Operations Metrics Hourly + - Amazon EC2 EBS +Title: Find Amazon EC2 EBS Volume Read Operations Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_hourly_2.yaml b/queries/aws_ebs_volume_metric_read_ops_hourly_2.yaml old mode 100755 new mode 100644 index 13ffde87d..f076db583 --- a/queries/aws_ebs_volume_metric_read_ops_hourly_2.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_hourly_2.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on - an hourly basis. +Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on an hourly basis. ID: aws_ebs_volume_metric_read_ops_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_hourly\nwhere\n\ - \ average > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_hourly + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 -Title: List all Amazon EC2 EBS Volume Read Ops metrics hourly + - Amazon EC2 +Title: List all Amazon EC2 EBS Volume Read Ops metrics hourly \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_hourly_3.yaml b/queries/aws_ebs_volume_metric_read_ops_hourly_3.yaml old mode 100755 new mode 100644 index cab0b1c79..88632a6bd --- a/queries/aws_ebs_volume_metric_read_ops_hourly_3.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_hourly_3.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on - an hourly basis. +Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on an hourly basis. ID: aws_ebs_volume_metric_read_ops_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_read_ops_hourly\nwhere\n\ - \ maximum > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_read_ops_hourly + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 -Title: Find Amazon EC2 EBS Volume Read Ops Metrics Hourly + - Amazon EC2 +Title: Find Amazon EC2 EBS Volume Read Ops Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_hourly_4.yaml b/queries/aws_ebs_volume_metric_read_ops_hourly_4.yaml old mode 100755 new mode 100644 index 55cd679bf..50fff92a7 --- a/queries/aws_ebs_volume_metric_read_ops_hourly_4.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_hourly_4.yaml @@ -1,25 +1,37 @@ -Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on - an hourly basis. +Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on an hourly basis. ID: aws_ebs_volume_metric_read_ops_hourly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n v.iops as provisioned_iops,\n\ - \ round(r.average) +round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n\ - \ round(w.average) as write_ops_avg\nfrom \n aws_ebs_volume_metric_read_ops_hourly\ - \ as r,\n aws_ebs_volume_metric_write_ops_hourly as w,\n aws_ebs_volume as v\n\ - where \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n and v.volume_id\ - \ = r.volume_id \n and r.average + w.average > v.iops\norder by\n r.volume_id,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + v.iops AS provisioned_iops, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg + FROM + aws_ebs_volume_metric_read_ops_hourly AS r, + aws_ebs_volume_metric_write_ops_hourly AS w, + aws_ebs_volume AS v + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + AND v.volume_id = r.volume_id + AND r.average + w.average > v.iops + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 -Title: List all Amazon EC2 EBS Volume Read Ops Metrics Hourly + - Amazon EC2 +Title: List all Amazon EC2 EBS Volume Read Ops Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_read_ops_hourly_5.yaml b/queries/aws_ebs_volume_metric_read_ops_hourly_5.yaml old mode 100755 new mode 100644 index 2be1bb032..d3cd0c2cf --- a/queries/aws_ebs_volume_metric_read_ops_hourly_5.yaml +++ b/queries/aws_ebs_volume_metric_read_ops_hourly_5.yaml @@ -1,26 +1,39 @@ -Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on - an hourly basis. +Description: Allows users to query Amazon EC2 EBS Volume Read Operations metrics on an hourly basis. ID: aws_ebs_volume_metric_read_ops_hourly_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops_hourly as r,\n aws_ebs_volume_metric_write_ops_hourly\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops_hourly AS r, + aws_ebs_volume_metric_write_ops_hourly AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 EBS -Title: Find AWS EC2 EBS Volume Read Ops Metrics Hourly + - Amazon EC2 EBS +Title: Find AWS EC2 EBS Volume Read Ops Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_1.yaml b/queries/aws_ebs_volume_metric_write_ops_1.yaml old mode 100755 new mode 100644 index b5c42d289..0008289c6 --- a/queries/aws_ebs_volume_metric_write_ops_1.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_1.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations - metrics. +Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations metrics. ID: aws_ebs_volume_metric_write_ops_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops\norder by\n \ - \ volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find AWS EBS Volume Write Operations Metrics + - Elastic Block Store +Title: Find AWS EBS Volume Write Operations Metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_2.yaml b/queries/aws_ebs_volume_metric_write_ops_2.yaml old mode 100755 new mode 100644 index da20f54f6..7bacdc778 --- a/queries/aws_ebs_volume_metric_write_ops_2.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_2.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations - metrics. +Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations metrics. ID: aws_ebs_volume_metric_write_ops_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops\nwhere\n average\ - \ > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List AWS EBS Volume Write Ops Metrics via SQL + - Elastic Block Store +Title: List AWS EBS Volume Write Ops Metrics via SQL \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_3.yaml b/queries/aws_ebs_volume_metric_write_ops_3.yaml old mode 100755 new mode 100644 index 8125a346a..d37f22f55 --- a/queries/aws_ebs_volume_metric_write_ops_3.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_3.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations - metrics. +Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations metrics. ID: aws_ebs_volume_metric_write_ops_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops\nwhere\n maximum\ - \ > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: Find AWS EBS volume write ops metrics + - Elastic Block Store +Title: Find AWS EBS volume write ops metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_4.yaml b/queries/aws_ebs_volume_metric_write_ops_4.yaml old mode 100755 new mode 100644 index 6759745ae..2c666e234 --- a/queries/aws_ebs_volume_metric_write_ops_4.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_4.yaml @@ -1,28 +1,41 @@ -Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations - metrics. +Description: Allows users to query AWS Elastic Block Store (EBS) volume write operations metrics. ID: aws_ebs_volume_metric_write_ops_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops as r,\n aws_ebs_volume_metric_write_ops\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops AS r, + aws_ebs_volume_metric_write_ops AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Block Store -Title: List EBS Volume Write Ops Metrics using SQL + - Elastic Block Store +Title: List EBS Volume Write Ops Metrics using SQL \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_daily_1.yaml b/queries/aws_ebs_volume_metric_write_ops_daily_1.yaml old mode 100755 new mode 100644 index 30a667319..329d152e3 --- a/queries/aws_ebs_volume_metric_write_ops_daily_1.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_daily_1.yaml @@ -1,22 +1,33 @@ Description: Allows users to query AWS EBS Volume Metrics for daily write operations. ID: aws_ebs_volume_metric_write_ops_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_daily\norder\ - \ by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_daily + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: List all AWS EBS Volume Metrics for daily write operations + - EBS +Title: List all AWS EBS Volume Metrics for daily write operations \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_daily_2.yaml b/queries/aws_ebs_volume_metric_write_ops_daily_2.yaml old mode 100755 new mode 100644 index 19cb7b1ff..9669dd5af --- a/queries/aws_ebs_volume_metric_write_ops_daily_2.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_daily_2.yaml @@ -1,22 +1,35 @@ Description: Allows users to query AWS EBS Volume Metrics for daily write operations. ID: aws_ebs_volume_metric_write_ops_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_daily\nwhere\n\ - \ average > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_daily + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EBS -Title: Find daily AWS EBS Volume Metrics for write operations + - Amazon EBS +Title: Find daily AWS EBS Volume Metrics for write operations \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_daily_3.yaml b/queries/aws_ebs_volume_metric_write_ops_daily_3.yaml old mode 100755 new mode 100644 index a68eb2e66..5852637a1 --- a/queries/aws_ebs_volume_metric_write_ops_daily_3.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_daily_3.yaml @@ -1,22 +1,35 @@ Description: Allows users to query AWS EBS Volume Metrics for daily write operations. ID: aws_ebs_volume_metric_write_ops_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_daily\nwhere\n\ - \ maximum > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_daily + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find AWS EBS Volume Write Ops Metrics Daily + - EBS +Title: Find AWS EBS Volume Write Ops Metrics Daily \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_daily_4.yaml b/queries/aws_ebs_volume_metric_write_ops_daily_4.yaml old mode 100755 new mode 100644 index 009fa8526..326de95e4 --- a/queries/aws_ebs_volume_metric_write_ops_daily_4.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_daily_4.yaml @@ -1,25 +1,39 @@ Description: Allows users to query AWS EBS Volume Metrics for daily write operations. ID: aws_ebs_volume_metric_write_ops_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops_daily as r,\n aws_ebs_volume_metric_write_ops_daily\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops_daily AS r, + aws_ebs_volume_metric_write_ops_daily AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Query Daily AWS EBS Volume Write Ops Metrics + - EBS +Title: Query Daily AWS EBS Volume Write Ops Metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_hourly_1.yaml b/queries/aws_ebs_volume_metric_write_ops_hourly_1.yaml old mode 100755 new mode 100644 index e1be39076..182e9cf10 --- a/queries/aws_ebs_volume_metric_write_ops_hourly_1.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_hourly_1.yaml @@ -1,20 +1,31 @@ Description: Allows users to query AWS EBS Volume Metrics on hourly write operations. ID: aws_ebs_volume_metric_write_ops_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_hourly\norder\ - \ by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_hourly + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find AWS EBS Volume Metrics on Hourly Write Operations + - EBS +Title: Find AWS EBS Volume Metrics on Hourly Write Operations \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_hourly_2.yaml b/queries/aws_ebs_volume_metric_write_ops_hourly_2.yaml old mode 100755 new mode 100644 index 50b44c855..1e3a305c1 --- a/queries/aws_ebs_volume_metric_write_ops_hourly_2.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_hourly_2.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS EBS Volume Metrics on hourly write operations. ID: aws_ebs_volume_metric_write_ops_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_hourly\nwhere\n\ - \ average > 1000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_hourly + WHERE + average > 1000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Query AWS EBS Volume Hourly Write Operations Metrics + - EBS +Title: Query AWS EBS Volume Hourly Write Operations Metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_hourly_3.yaml b/queries/aws_ebs_volume_metric_write_ops_hourly_3.yaml old mode 100755 new mode 100644 index 0792ac380..5281856bd --- a/queries/aws_ebs_volume_metric_write_ops_hourly_3.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_hourly_3.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS EBS Volume Metrics on hourly write operations. ID: aws_ebs_volume_metric_write_ops_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n volume_id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sum,\n sample_count\nfrom\n aws_ebs_volume_metric_write_ops_hourly\nwhere\n\ - \ maximum > 8000\norder by\n volume_id,\n timestamp;" + QueryToExecute: | + SELECT + volume_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_ebs_volume_metric_write_ops_hourly + WHERE + maximum > 8000 + ORDER BY + volume_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS EBS -Title: List all AWS EBS Volume Metrics on Hourly Write Ops + - AWS EBS +Title: List all AWS EBS Volume Metrics on Hourly Write Ops \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_hourly_4.yaml b/queries/aws_ebs_volume_metric_write_ops_hourly_4.yaml old mode 100755 new mode 100644 index c85cf7faa..7070f1def --- a/queries/aws_ebs_volume_metric_write_ops_hourly_4.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_hourly_4.yaml @@ -1,26 +1,39 @@ Description: Allows users to query AWS EBS Volume Metrics on hourly write operations. ID: aws_ebs_volume_metric_write_ops_hourly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n v.iops as provisioned_iops,\n\ - \ round(r.average) +round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n\ - \ round(w.average) as write_ops_avg\nfrom \n aws_ebs_volume_metric_read_ops_hourly\ - \ as r,\n aws_ebs_volume_metric_write_ops_hourly as w,\n aws_ebs_volume as v\n\ - where \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n and v.volume_id\ - \ = r.volume_id \n and r.average + w.average > v.iops\norder by\n r.volume_id,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + v.iops AS provisioned_iops, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg + FROM + aws_ebs_volume_metric_read_ops_hourly AS r, + aws_ebs_volume_metric_write_ops_hourly AS w, + aws_ebs_volume AS v + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + AND v.volume_id = r.volume_id + AND r.average + w.average > v.iops + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find AWS EBS Volume Hourly Write Operation Metrics + - EBS +Title: Find AWS EBS Volume Hourly Write Operation Metrics \ No newline at end of file diff --git a/queries/aws_ebs_volume_metric_write_ops_hourly_5.yaml b/queries/aws_ebs_volume_metric_write_ops_hourly_5.yaml old mode 100755 new mode 100644 index e91835618..e982cc1b6 --- a/queries/aws_ebs_volume_metric_write_ops_hourly_5.yaml +++ b/queries/aws_ebs_volume_metric_write_ops_hourly_5.yaml @@ -1,27 +1,41 @@ Description: Allows users to query AWS EBS Volume Metrics on hourly write operations. ID: aws_ebs_volume_metric_write_ops_hourly_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.volume_id,\n r.timestamp,\n round(r.average) + round(w.average)\ - \ as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average) as write_ops_avg,\n\ - \ round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum) as read_ops_max,\n\ - \ round(w.maximum) as write_ops_max,\n round(r.minimum) + round(w.minimum) as\ - \ iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum) as write_ops_min\n\ - from \n aws_ebs_volume_metric_read_ops_hourly as r,\n aws_ebs_volume_metric_write_ops_hourly\ - \ as w\nwhere \n r.volume_id = w.volume_id\n and r.timestamp = w.timestamp\n\ - order by\n r.volume_id,\n r.timestamp;" + QueryToExecute: | + SELECT + r.volume_id, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_ebs_volume_metric_read_ops_hourly AS r, + aws_ebs_volume_metric_write_ops_hourly AS w + WHERE + r.volume_id = w.volume_id + AND r.timestamp = w.timestamp + ORDER BY + r.volume_id, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EBS -Title: Find AWS EBS Volume Metrics on Hourly Write Ops + - EBS +Title: Find AWS EBS Volume Metrics on Hourly Write Ops \ No newline at end of file diff --git a/queries/aws_ec2_ami_1.yaml b/queries/aws_ec2_ami_1.yaml old mode 100755 new mode 100644 index c6016fd58..feaee8186 --- a/queries/aws_ec2_ami_1.yaml +++ b/queries/aws_ec2_ami_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve - detailed information about each AMI available in the AWS account. +Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve detailed information about each AMI available in the AWS account. ID: aws_ec2_ami_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n state,\n image_location,\n creation_date,\n\ - \ public,\n root_device_name\nfrom\n aws_ec2_ami;" + QueryToExecute: | + SELECT + name, + image_id, + state, + image_location, + creation_date, + public, + root_device_name + FROM + aws_ec2_ami; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 AMIs with Details via SQL + - EC2 +Title: List all AWS EC2 AMIs with Details via SQL \ No newline at end of file diff --git a/queries/aws_ec2_ami_2.yaml b/queries/aws_ec2_ami_2.yaml old mode 100755 new mode 100644 index b61af6d24..230f9b857 --- a/queries/aws_ec2_ami_2.yaml +++ b/queries/aws_ec2_ami_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve - detailed information about each AMI available in the AWS account. +Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve detailed information about each AMI available in the AWS account. ID: aws_ec2_ami_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n public\nfrom\n aws_ec2_ami\nwhere\n\ - \ public;" + QueryToExecute: | + SELECT + name, + image_id, + public + FROM + aws_ec2_ami + WHERE + public; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 AMIs to Retrieve Detailed Information + - EC2 +Title: List all AWS EC2 AMIs to Retrieve Detailed Information \ No newline at end of file diff --git a/queries/aws_ec2_ami_3.yaml b/queries/aws_ec2_ami_3.yaml old mode 100755 new mode 100644 index 8a530a4ca..62357fa90 --- a/queries/aws_ec2_ami_3.yaml +++ b/queries/aws_ec2_ami_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve - detailed information about each AMI available in the AWS account. +Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve detailed information about each AMI available in the AWS account. ID: aws_ec2_ami_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n public,\n state\nfrom\n aws_ec2_ami\n\ - where\n state = 'failed';" + QueryToExecute: | + SELECT + name, + image_id, + public, + state + FROM + aws_ec2_ami + WHERE + state = 'failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 AMI Details with Failed State + - EC2 +Title: List all AWS EC2 AMI Details with Failed State \ No newline at end of file diff --git a/queries/aws_ec2_ami_4.yaml b/queries/aws_ec2_ami_4.yaml old mode 100755 new mode 100644 index adfa28f36..836e32d53 --- a/queries/aws_ec2_ami_4.yaml +++ b/queries/aws_ec2_ami_4.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve - detailed information about each AMI available in the AWS account. +Description: Allows users to query AWS EC2 AMIs (Amazon Machine Images) to retrieve detailed information about each AMI available in the AWS account. ID: aws_ec2_ami_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n mapping -> 'Ebs' ->> 'VolumeSize'\ - \ as volume_size,\n mapping -> 'Ebs' ->> 'VolumeType' as volume_type,\n mapping\ - \ -> 'Ebs' ->> 'Encrypted' as encryption_status,\n mapping -> 'Ebs' ->> 'KmsKeyId'\ - \ as kms_key,\n mapping -> 'Ebs' ->> 'DeleteOnTermination' as delete_on_termination\n\ - from\n aws_ec2_ami\n cross join jsonb_array_elements(block_device_mappings)\ - \ as mapping;" + QueryToExecute: | + SELECT + name, + image_id, + mapping -> 'Ebs' ->> 'VolumeSize' AS volume_size, + mapping -> 'Ebs' ->> 'VolumeType' AS volume_type, + mapping -> 'Ebs' ->> 'Encrypted' AS encryption_status, + mapping -> 'Ebs' ->> 'KmsKeyId' AS kms_key, + mapping -> 'Ebs' ->> 'DeleteOnTermination' AS delete_on_termination + FROM + aws_ec2_ami + CROSS JOIN + jsonb_array_elements(block_device_mappings) AS mapping; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 AMI -Title: List all AWS EC2 AMIs with Detailed Information + - EC2 AMI +Title: List all AWS EC2 AMIs with Detailed Information \ No newline at end of file diff --git a/queries/aws_ec2_ami_shared_1.yaml b/queries/aws_ec2_ami_shared_1.yaml old mode 100755 new mode 100644 index 843710ba3..e1ff460c8 --- a/queries/aws_ec2_ami_shared_1.yaml +++ b/queries/aws_ec2_ami_shared_1.yaml @@ -1,22 +1,32 @@ Description: Allows users to query shared Amazon Machine Images (AMIs) in AWS EC2 ID: aws_ec2_ami_shared_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n state,\n image_location,\n creation_date,\n\ - \ public,\n root_device_name\nfrom\n aws_ec2_ami_shared\nwhere\n owner_id\ - \ = '137112412989';" + QueryToExecute: | + SELECT + name, + image_id, + state, + image_location, + creation_date, + public, + root_device_name + FROM + aws_ec2_ami_shared + WHERE + owner_id = '137112412989'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find shared Amazon Machine Images (AMIs) in AWS EC2 + - EC2 +Title: Find shared Amazon Machine Images (AMIs) in AWS EC2 \ No newline at end of file diff --git a/queries/aws_ec2_ami_shared_2.yaml b/queries/aws_ec2_ami_shared_2.yaml old mode 100755 new mode 100644 index fd2c6fccf..ff6ee4a42 --- a/queries/aws_ec2_ami_shared_2.yaml +++ b/queries/aws_ec2_ami_shared_2.yaml @@ -1,22 +1,33 @@ Description: Allows users to query shared Amazon Machine Images (AMIs) in AWS EC2 ID: aws_ec2_ami_shared_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n image_id,\n state,\n image_location,\n creation_date,\n\ - \ public,\n root_device_name\nfrom\n aws_ec2_ami_shared\nwhere\n owner_id\ - \ = '137112412989'\n and architecture = 'arm64';" + QueryToExecute: | + SELECT + name, + image_id, + state, + image_location, + creation_date, + public, + root_device_name + FROM + aws_ec2_ami_shared + WHERE + owner_id = '137112412989' + AND architecture = 'arm64'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find Shared Amazon Machine Images (AMIs) in AWS EC2 + - EC2 +Title: Find Shared Amazon Machine Images (AMIs) in AWS EC2 \ No newline at end of file diff --git a/queries/aws_ec2_ami_shared_3.yaml b/queries/aws_ec2_ami_shared_3.yaml old mode 100755 new mode 100644 index 139d4b1f1..d039e7e6c --- a/queries/aws_ec2_ami_shared_3.yaml +++ b/queries/aws_ec2_ami_shared_3.yaml @@ -1,21 +1,33 @@ Description: Allows users to query shared Amazon Machine Images (AMIs) in AWS EC2 ID: aws_ec2_ami_shared_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.title,\n i.instance_id,\n i.image_id,\n ami.name,\n\ - \ ami.description,\n ami.platform_details\nfrom\n aws_ec2_instance as i\n join\ - \ aws_ec2_ami_shared as ami on i.image_id = ami.image_id\nwhere\n ami.owner_id\ - \ = '137112412989';" + QueryToExecute: | + SELECT + i.title, + i.instance_id, + i.image_id, + ami.name, + ami.description, + ami.platform_details + FROM + aws_ec2_instance AS i + JOIN + aws_ec2_ami_shared AS ami + ON + i.image_id = ami.image_id + WHERE + ami.owner_id = '137112412989'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all shared Amazon Machine Images (AMIs) in AWS EC2 + - EC2 +Title: List all shared Amazon Machine Images (AMIs) in AWS EC2 \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_1.yaml b/queries/aws_ec2_application_load_balancer_1.yaml old mode 100755 new mode 100644 index ce489f4ab..75167bb30 --- a/queries/aws_ec2_application_load_balancer_1.yaml +++ b/queries/aws_ec2_application_load_balancer_1.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed - information about each load balancer within an AWS account. This includes its current - state, availability zones, security groups, and other important attributes. +Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed information about each load balancer within an AWS account. This includes its current state, availability zones, security groups, and other important attributes. ID: aws_ec2_application_load_balancer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_elements_text(security_groups) as\ - \ attached_security_group\nfrom\n aws_ec2_application_load_balancer;" + QueryToExecute: | + SELECT + name, + JSONB_ARRAY_ELEMENTS_TEXT(security_groups) AS attached_security_group + FROM + aws_ec2_application_load_balancer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: Find AWS EC2 Load Balancers with Security Groups + - EC2 Application Load Balancer +Title: Find AWS EC2 Load Balancers with Security Groups \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_2.yaml b/queries/aws_ec2_application_load_balancer_2.yaml old mode 100755 new mode 100644 index 465a89ae8..a6e8fb601 --- a/queries/aws_ec2_application_load_balancer_2.yaml +++ b/queries/aws_ec2_application_load_balancer_2.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed - information about each load balancer within an AWS account. This includes its current - state, availability zones, security groups, and other important attributes. +Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed information about each load balancer within an AWS account. This includes its current state, availability zones, security groups, and other important attributes. ID: aws_ec2_application_load_balancer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n az ->> 'LoadBalancerAddresses' as load_balancer_addresses,\n\ - \ az ->> 'OutpostId' as outpost_id,\n az ->> 'SubnetId' as subnet_id,\n az\ - \ ->> 'ZoneName' as zone_name\nfrom\n aws_ec2_application_load_balancer\n cross\ - \ join jsonb_array_elements(availability_zones) as az;" + QueryToExecute: | + SELECT + name, + az ->> 'LoadBalancerAddresses' AS load_balancer_addresses, + az ->> 'OutpostId' AS outpost_id, + az ->> 'SubnetId' AS subnet_id, + az ->> 'ZoneName' AS zone_name + FROM + aws_ec2_application_load_balancer + CROSS JOIN jsonb_array_elements(availability_zones) AS az; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List All AWS EC2 Application Load Balancers with Details + - EC2 Application Load Balancer +Title: List All AWS EC2 Application Load Balancers with Details \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_3.yaml b/queries/aws_ec2_application_load_balancer_3.yaml old mode 100755 new mode 100644 index a0ad510e2..29f991b73 --- a/queries/aws_ec2_application_load_balancer_3.yaml +++ b/queries/aws_ec2_application_load_balancer_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed - information about each load balancer within an AWS account. This includes its current - state, availability zones, security groups, and other important attributes. +Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed information about each load balancer within an AWS account. This includes its current state, availability zones, security groups, and other important attributes. ID: aws_ec2_application_load_balancer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n count(az ->> 'ZoneName') < 2 as zone_count_1\n\ - from\n aws_ec2_application_load_balancer\n cross join jsonb_array_elements(availability_zones)\ - \ as az\ngroup by\n name;" + QueryToExecute: | + SELECT + name, + COUNT(az ->> 'ZoneName') < 2 AS zone_count_1 + FROM + aws_ec2_application_load_balancer + CROSS JOIN JSONB_ARRAY_ELEMENTS(availability_zones) AS az + GROUP BY + name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List All AWS EC2 ALBs with Detailed Information + - EC2 Application Load Balancer +Title: List All AWS EC2 ALBs with Detailed Information \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_4.yaml b/queries/aws_ec2_application_load_balancer_4.yaml old mode 100755 new mode 100644 index a8fbecf05..ff909c639 --- a/queries/aws_ec2_application_load_balancer_4.yaml +++ b/queries/aws_ec2_application_load_balancer_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed - information about each load balancer within an AWS account. This includes its current - state, availability zones, security groups, and other important attributes. +Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed information about each load balancer within an AWS account. This includes its current state, availability zones, security groups, and other important attributes. ID: aws_ec2_application_load_balancer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as logging_key,\n lb ->> 'Value'\ - \ as logging_value\nfrom\n aws_ec2_application_load_balancer\n cross join jsonb_array_elements(load_balancer_attributes)\ - \ as lb\nwhere\n lb ->> 'Key' = 'access_logs.s3.enabled'\n and lb ->> 'Value'\ - \ = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS logging_key, + lb ->> 'Value' AS logging_value + FROM + aws_ec2_application_load_balancer + CROSS JOIN + jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'access_logs.s3.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List all AWS EC2 Application Load Balancers and Attributes + - EC2 Application Load Balancer +Title: List all AWS EC2 Application Load Balancers and Attributes \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_5.yaml b/queries/aws_ec2_application_load_balancer_5.yaml old mode 100755 new mode 100644 index 14e023b7c..2e63cf49b --- a/queries/aws_ec2_application_load_balancer_5.yaml +++ b/queries/aws_ec2_application_load_balancer_5.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed - information about each load balancer within an AWS account. This includes its current - state, availability zones, security groups, and other important attributes. +Description: Allows users to query AWS EC2 Application Load Balancer, providing detailed information about each load balancer within an AWS account. This includes its current state, availability zones, security groups, and other important attributes. ID: aws_ec2_application_load_balancer_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as deletion_protection_key,\n \ - \ lb ->> 'Value' as deletion_protection_value\nfrom\n aws_ec2_application_load_balancer\n\ - \ cross join jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb\ - \ ->> 'Key' = 'deletion_protection.enabled'\n and lb ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS deletion_protection_key, + lb ->> 'Value' AS deletion_protection_value + FROM + aws_ec2_application_load_balancer + CROSS JOIN jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'deletion_protection.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List all AWS EC2 Application Load Balancer Details + - EC2 Application Load Balancer +Title: List all AWS EC2 Application Load Balancer Details \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_metric_request_count_1.yaml b/queries/aws_ec2_application_load_balancer_metric_request_count_1.yaml old mode 100755 new mode 100644 index 7a1a21a74..d901da19e --- a/queries/aws_ec2_application_load_balancer_metric_request_count_1.yaml +++ b/queries/aws_ec2_application_load_balancer_metric_request_count_1.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query AWS EC2 Application Load Balancer Metrics, specifically - the request count. +Description: Allows users to query AWS EC2 Application Load Balancer Metrics, specifically the request count. ID: aws_ec2_application_load_balancer_metric_request_count_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n average,\n maximum,\n\ - \ minimum,\n sample_count,\n timestamp\nfrom\n aws_ec2_application_load_balancer_metric_request_count\n\ - order by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + average, + maximum, + minimum, + sample_count, + timestamp + FROM + aws_ec2_application_load_balancer_metric_request_count + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: Query AWS EC2 Application Load Balancer Request Count + - EC2 Application Load Balancer +Title: Query AWS EC2 Application Load Balancer Request Count \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_metric_request_count_2.yaml b/queries/aws_ec2_application_load_balancer_metric_request_count_2.yaml old mode 100755 new mode 100644 index 83411e7ce..c784501db --- a/queries/aws_ec2_application_load_balancer_metric_request_count_2.yaml +++ b/queries/aws_ec2_application_load_balancer_metric_request_count_2.yaml @@ -1,23 +1,36 @@ -Description: Allows users to query AWS EC2 Application Load Balancer Metrics, specifically - the request count. +Description: Allows users to query AWS EC2 Application Load Balancer Metrics, specifically the request count. ID: aws_ec2_application_load_balancer_metric_request_count_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ average\n sample_count,\n timestamp\nfrom\n aws_ec2_application_load_balancer_metric_request_count\n\ - where\n average < 100\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + average, + sample_count, + timestamp + FROM + aws_ec2_application_load_balancer_metric_request_count + WHERE + average < 100 + ORDER BY + name, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List AWS EC2 Application Load Balancer Request Counts + - EC2 Application Load Balancer +Title: List AWS EC2 Application Load Balancer Request Counts \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_metric_request_count_daily_1.yaml b/queries/aws_ec2_application_load_balancer_metric_request_count_daily_1.yaml old mode 100755 new mode 100644 index 75e86019f..7998b45b4 --- a/queries/aws_ec2_application_load_balancer_metric_request_count_daily_1.yaml +++ b/queries/aws_ec2_application_load_balancer_metric_request_count_daily_1.yaml @@ -1,23 +1,34 @@ -Description: Allows users to query daily request count metrics of the AWS EC2 Application - Load Balancer. +Description: Allows users to query daily request count metrics of the AWS EC2 Application Load Balancer. ID: aws_ec2_application_load_balancer_metric_request_count_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n average,\n maximum,\n\ - \ minimum,\n sample_count,\n timestamp\nfrom\n aws_ec2_application_load_balancer_metric_request_count_daily\n\ - order by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + average, + maximum, + minimum, + sample_count, + timestamp + FROM + aws_ec2_application_load_balancer_metric_request_count_daily + ORDER BY + name, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: Find daily request count metrics of AWS EC2 ALB + - EC2 Application Load Balancer +Title: Find daily request count metrics of AWS EC2 ALB \ No newline at end of file diff --git a/queries/aws_ec2_application_load_balancer_metric_request_count_daily_2.yaml b/queries/aws_ec2_application_load_balancer_metric_request_count_daily_2.yaml old mode 100755 new mode 100644 index 777355d53..1f3550885 --- a/queries/aws_ec2_application_load_balancer_metric_request_count_daily_2.yaml +++ b/queries/aws_ec2_application_load_balancer_metric_request_count_daily_2.yaml @@ -1,21 +1,34 @@ -Description: Allows users to query daily request count metrics of the AWS EC2 Application - Load Balancer. +Description: Allows users to query daily request count metrics of the AWS EC2 Application Load Balancer. ID: aws_ec2_application_load_balancer_metric_request_count_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ average\n sample_count,\n timestamp\nfrom\n aws_ec2_application_load_balancer_metric_request_count_daily\n\ - where\n average < 100\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + average, + sample_count, + timestamp + FROM + aws_ec2_application_load_balancer_metric_request_count_daily + WHERE + average < 100 + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Application Load Balancer -Title: List all daily request count metrics for AWS EC2 Application Load Balancer + - EC2 Application Load Balancer +Title: List all daily request count metrics for AWS EC2 Application Load Balancer \ No newline at end of file diff --git a/queries/aws_ec2_autoscaling_group_1.yaml b/queries/aws_ec2_autoscaling_group_1.yaml old mode 100755 new mode 100644 index e3b0206d8..1a83c5d40 --- a/queries/aws_ec2_autoscaling_group_1.yaml +++ b/queries/aws_ec2_autoscaling_group_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed - information about each group''s configuration, instances, policies, and more. +Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed information about each group's configuration, instances, policies, and more. ID: aws_ec2_autoscaling_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n load_balancer_names,\n availability_zones,\n\ - \ service_linked_role_arn,\n default_cooldown,\n max_size,\n min_size,\n \ - \ new_instances_protected_from_scale_in\nfrom\n aws_ec2_autoscaling_group;" + QueryToExecute: | + SELECT + name, + load_balancer_names, + availability_zones, + service_linked_role_arn, + default_cooldown, + max_size, + min_size, + new_instances_protected_from_scale_in + FROM + aws_ec2_autoscaling_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Auto Scaling -Title: List all AWS EC2 Auto Scaling Groups with Details + - EC2 Auto Scaling +Title: List all AWS EC2 Auto Scaling Groups with Details \ No newline at end of file diff --git a/queries/aws_ec2_autoscaling_group_2.yaml b/queries/aws_ec2_autoscaling_group_2.yaml old mode 100755 new mode 100644 index 363415f10..160f1cefb --- a/queries/aws_ec2_autoscaling_group_2.yaml +++ b/queries/aws_ec2_autoscaling_group_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed - information about each group''s configuration, instances, policies, and more. +Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed information about each group's configuration, instances, policies, and more. ID: aws_ec2_autoscaling_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_length(availability_zones) as az_count\n\ - from\n aws_ec2_autoscaling_group\nwhere\n jsonb_array_length(availability_zones)\ - \ < 2;" + QueryToExecute: | + SELECT + name, + JSONB_ARRAY_LENGTH(availability_zones) AS az_count + FROM + aws_ec2_autoscaling_group + WHERE + JSONB_ARRAY_LENGTH(availability_zones) < 2; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Auto Scaling -Title: Find AWS EC2 Auto Scaling Groups with Less than 2 AZs + - EC2 Auto Scaling +Title: Find AWS EC2 Auto Scaling Groups with Less than 2 AZs \ No newline at end of file diff --git a/queries/aws_ec2_autoscaling_group_3.yaml b/queries/aws_ec2_autoscaling_group_3.yaml old mode 100755 new mode 100644 index 0366e6c3e..00f9b56b4 --- a/queries/aws_ec2_autoscaling_group_3.yaml +++ b/queries/aws_ec2_autoscaling_group_3.yaml @@ -1,28 +1,33 @@ -Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed - information about each group''s configuration, instances, policies, and more. +Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed information about each group's configuration, instances, policies, and more. ID: aws_ec2_autoscaling_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as autoscaling_group_name,\n ins_detail ->> 'InstanceId'\ - \ as instance_id,\n ins_detail ->> 'InstanceType' as instance_type,\n ins_detail\ - \ ->> 'AvailabilityZone' as az,\n ins_detail ->> 'HealthStatus' as health_status,\n\ - \ ins_detail ->> 'LaunchConfigurationName' as launch_configuration_name,\n ins_detail\ - \ -> 'LaunchTemplate' ->> 'LaunchTemplateName' as launch_template_name,\n ins_detail\ - \ -> 'LaunchTemplate' ->> 'Version' as launch_template_version,\n ins_detail\ - \ ->> 'ProtectedFromScaleIn' as protected_from_scale_in\nfrom\n aws_ec2_autoscaling_group,\n\ - \ jsonb_array_elements(instances) as ins_detail;" + QueryToExecute: | + SELECT + name AS autoscaling_group_name, + ins_detail ->> 'InstanceId' AS instance_id, + ins_detail ->> 'InstanceType' AS instance_type, + ins_detail ->> 'AvailabilityZone' AS az, + ins_detail ->> 'HealthStatus' AS health_status, + ins_detail ->> 'LaunchConfigurationName' AS launch_configuration_name, + ins_detail -> 'LaunchTemplate' ->> 'LaunchTemplateName' AS launch_template_name, + ins_detail -> 'LaunchTemplate' ->> 'Version' AS launch_template_version, + ins_detail ->> 'ProtectedFromScaleIn' AS protected_from_scale_in + FROM + aws_ec2_autoscaling_group, + jsonb_array_elements(instances) AS ins_detail; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Auto Scaling -Title: List all AWS EC2 Auto Scaling Groups and Details + - EC2 Auto Scaling +Title: List all AWS EC2 Auto Scaling Groups and Details \ No newline at end of file diff --git a/queries/aws_ec2_autoscaling_group_4.yaml b/queries/aws_ec2_autoscaling_group_4.yaml old mode 100755 new mode 100644 index 2274fd6c5..fc09e4277 --- a/queries/aws_ec2_autoscaling_group_4.yaml +++ b/queries/aws_ec2_autoscaling_group_4.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed - information about each group''s configuration, instances, policies, and more. +Description: Allows users to query AWS EC2 Auto Scaling Groups and access detailed information about each group's configuration, instances, policies, and more. ID: aws_ec2_autoscaling_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n health_check_type,\n health_check_grace_period\n\ - from\n aws_ec2_autoscaling_group;" + QueryToExecute: | + SELECT + name, + health_check_type, + health_check_grace_period + FROM + aws_ec2_autoscaling_group; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Auto Scaling -Title: List AWS EC2 Auto Scaling Groups and Their Configurations + - EC2 Auto Scaling +Title: List AWS EC2 Auto Scaling Groups and Their Configurations \ No newline at end of file diff --git a/queries/aws_ec2_capacity_reservation_1.yaml b/queries/aws_ec2_capacity_reservation_1.yaml old mode 100755 new mode 100644 index 6620962bc..5a964f2c2 --- a/queries/aws_ec2_capacity_reservation_1.yaml +++ b/queries/aws_ec2_capacity_reservation_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Capacity Reservations to provide information - about the reservations within AWS Elastic Compute Cloud (EC2). +Description: Allows users to query AWS EC2 Capacity Reservations to provide information about the reservations within AWS Elastic Compute Cloud (EC2). ID: aws_ec2_capacity_reservation_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n capacity_reservation_id,\n capacity_reservation_arn,\n\ - \ instance_type,\n state\nfrom\n aws_ec2_capacity_reservation;" + QueryToExecute: | + SELECT + capacity_reservation_id, + capacity_reservation_arn, + instance_type, + state + FROM + aws_ec2_capacity_reservation; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Compute Cloud (EC2) -Title: Find All AWS EC2 Capacity Reservations via SQL + - Elastic Compute Cloud (EC2) +Title: Find All AWS EC2 Capacity Reservations via SQL \ No newline at end of file diff --git a/queries/aws_ec2_capacity_reservation_2.yaml b/queries/aws_ec2_capacity_reservation_2.yaml old mode 100755 new mode 100644 index 4c5e41114..4a35433dc --- a/queries/aws_ec2_capacity_reservation_2.yaml +++ b/queries/aws_ec2_capacity_reservation_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Capacity Reservations to provide information - about the reservations within AWS Elastic Compute Cloud (EC2). +Description: Allows users to query AWS EC2 Capacity Reservations to provide information about the reservations within AWS Elastic Compute Cloud (EC2). ID: aws_ec2_capacity_reservation_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n capacity_reservation_id,\n capacity_reservation_arn,\n\ - \ instance_type,\n state\nfrom\n aws_ec2_capacity_reservation\nwhere\n state\ - \ = 'expired';" + QueryToExecute: | + SELECT + capacity_reservation_id, + capacity_reservation_arn, + instance_type, + state + FROM + aws_ec2_capacity_reservation + WHERE + state = 'expired'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Capacity Reservations with SQL Query + - EC2 +Title: Find AWS EC2 Capacity Reservations with SQL Query \ No newline at end of file diff --git a/queries/aws_ec2_capacity_reservation_3.yaml b/queries/aws_ec2_capacity_reservation_3.yaml old mode 100755 new mode 100644 index 44b79f235..2bb4ae14e --- a/queries/aws_ec2_capacity_reservation_3.yaml +++ b/queries/aws_ec2_capacity_reservation_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Capacity Reservations to provide information - about the reservations within AWS Elastic Compute Cloud (EC2). +Description: Allows users to query AWS EC2 Capacity Reservations to provide information about the reservations within AWS Elastic Compute Cloud (EC2). ID: aws_ec2_capacity_reservation_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n capacity_reservation_id,\n capacity_reservation_arn,\n\ - \ instance_type,\n state\nfrom\n aws_ec2_capacity_reservation\nwhere\n capacity_reservation_id\ - \ = 'cr-0b30935e9fc2da81e';" + QueryToExecute: | + SELECT + capacity_reservation_id, + capacity_reservation_arn, + instance_type, + state + FROM + aws_ec2_capacity_reservation + WHERE + capacity_reservation_id = 'cr-0b30935e9fc2da81e'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Compute Cloud (EC2) -Title: List AWS EC2 Capacity Reservations Details + - Elastic Compute Cloud (EC2) +Title: List AWS EC2 Capacity Reservations Details \ No newline at end of file diff --git a/queries/aws_ec2_classic_load_balancer_1.yaml b/queries/aws_ec2_classic_load_balancer_1.yaml old mode 100755 new mode 100644 index a2997085f..185e45eea --- a/queries/aws_ec2_classic_load_balancer_1.yaml +++ b/queries/aws_ec2_classic_load_balancer_1.yaml @@ -1,20 +1,25 @@ Description: Allows users to query Classic Load Balancers within Amazon EC2. ID: aws_ec2_classic_load_balancer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n instances\nfrom\n aws_ec2_classic_load_balancer;" + QueryToExecute: | + SELECT + name, + instances + FROM + aws_ec2_classic_load_balancer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 -Title: List all AWS EC2 Classic Load Balancers with Instances + - Amazon EC2 +Title: List all AWS EC2 Classic Load Balancers with Instances \ No newline at end of file diff --git a/queries/aws_ec2_classic_load_balancer_2.yaml b/queries/aws_ec2_classic_load_balancer_2.yaml old mode 100755 new mode 100644 index 5e8dcf1f3..23fe38148 --- a/queries/aws_ec2_classic_load_balancer_2.yaml +++ b/queries/aws_ec2_classic_load_balancer_2.yaml @@ -1,19 +1,25 @@ Description: Allows users to query Classic Load Balancers within Amazon EC2. ID: aws_ec2_classic_load_balancer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_log_enabled\nfrom\n aws_ec2_classic_load_balancer\n\ - where\n access_log_enabled = 'false';" + QueryToExecute: | + SELECT + name, + access_log_enabled + FROM + aws_ec2_classic_load_balancer + WHERE + access_log_enabled = 'false'; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Classic Load Balancer -Title: List all disabled access logs on EC2 Classic Load Balancers + - EC2 Classic Load Balancer +Title: List all disabled access logs on EC2 Classic Load Balancers \ No newline at end of file diff --git a/queries/aws_ec2_classic_load_balancer_3.yaml b/queries/aws_ec2_classic_load_balancer_3.yaml old mode 100755 new mode 100644 index 92e329e26..d8fb048b0 --- a/queries/aws_ec2_classic_load_balancer_3.yaml +++ b/queries/aws_ec2_classic_load_balancer_3.yaml @@ -1,21 +1,25 @@ Description: Allows users to query Classic Load Balancers within Amazon EC2. ID: aws_ec2_classic_load_balancer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_elements_text(security_groups) as\ - \ sg\nfrom\n aws_ec2_classic_load_balancer;" + QueryToExecute: | + SELECT + name, + jsonb_array_elements_text(security_groups) AS sg + FROM + aws_ec2_classic_load_balancer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all Classic Load Balancers within Amazon EC2 + - EC2 +Title: List all Classic Load Balancers within Amazon EC2 \ No newline at end of file diff --git a/queries/aws_ec2_classic_load_balancer_4.yaml b/queries/aws_ec2_classic_load_balancer_4.yaml old mode 100755 new mode 100644 index 0fc614857..6ada49c7d --- a/queries/aws_ec2_classic_load_balancer_4.yaml +++ b/queries/aws_ec2_classic_load_balancer_4.yaml @@ -1,25 +1,29 @@ Description: Allows users to query Classic Load Balancers within Amazon EC2. ID: aws_ec2_classic_load_balancer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n listener_description -> 'Listener' ->> 'InstancePort'\ - \ as instance_port,\n listener_description -> 'Listener' ->> 'InstanceProtocol'\ - \ as instance_protocol,\n listener_description -> 'Listener' ->> 'LoadBalancerPort'\ - \ as load_balancer_port,\n listener_description -> 'Listener' ->> 'Protocol'\ - \ as load_balancer_protocol,\n listener_description -> 'SSLCertificateId' ->>\ - \ 'SSLCertificateId' as ssl_certificate,\n listener_description -> 'Listener'\ - \ ->> 'PolicyNames' as policy_names\nfrom\n aws_ec2_classic_load_balancer\n \ - \ cross join jsonb_array_elements(listener_descriptions) as listener_description;" + QueryToExecute: | + SELECT + name, + listener_description -> 'Listener' ->> 'InstancePort' AS instance_port, + listener_description -> 'Listener' ->> 'InstanceProtocol' AS instance_protocol, + listener_description -> 'Listener' ->> 'LoadBalancerPort' AS load_balancer_port, + listener_description -> 'Listener' ->> 'Protocol' AS load_balancer_protocol, + listener_description -> 'SSLCertificateId' ->> 'SSLCertificateId' AS ssl_certificate, + listener_description -> 'Listener' ->> 'PolicyNames' AS policy_names + FROM + aws_ec2_classic_load_balancer + CROSS JOIN jsonb_array_elements(listener_descriptions) AS listener_description; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all Load Balancers in AWS EC2 Classic + - EC2 +Title: Find all Load Balancers in AWS EC2 Classic \ No newline at end of file diff --git a/queries/aws_ec2_classic_load_balancer_5.yaml b/queries/aws_ec2_classic_load_balancer_5.yaml old mode 100755 new mode 100644 index 244458f91..45761fed7 --- a/queries/aws_ec2_classic_load_balancer_5.yaml +++ b/queries/aws_ec2_classic_load_balancer_5.yaml @@ -1,20 +1,27 @@ Description: Allows users to query Classic Load Balancers within Amazon EC2. ID: aws_ec2_classic_load_balancer_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n healthy_threshold,\n health_check_interval,\n\ - \ health_check_target,\n health_check_timeout,\n unhealthy_threshold\nfrom\n\ - \ aws_ec2_classic_load_balancer;" + QueryToExecute: | + SELECT + name, + healthy_threshold, + health_check_interval, + health_check_target, + health_check_timeout, + unhealthy_threshold + FROM + aws_ec2_classic_load_balancer; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all EC2 Classic Load Balancers and Health Configs + - EC2 +Title: List all EC2 Classic Load Balancers and Health Configs \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_1.yaml b/queries/aws_ec2_client_vpn_endpoint_1.yaml old mode 100755 new mode 100644 index 00d202273..fbdbe7088 --- a/queries/aws_ec2_client_vpn_endpoint_1.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n description,\n status,\n client_vpn_endpoint_id,\n\ - \ transport_protocol,\n creation_time,\n tags\nfrom\n aws_ec2_client_vpn_endpoint;" + QueryToExecute: | + SELECT + title, + description, + status, + client_vpn_endpoint_id, + transport_protocol, + creation_time, + tags + FROM + aws_ec2_client_vpn_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Client VPN -Title: Find AWS EC2 Client VPN Endpoints Configuration and Status + - EC2 Client VPN +Title: Find AWS EC2 Client VPN Endpoints Configuration and Status \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_2.yaml b/queries/aws_ec2_client_vpn_endpoint_2.yaml old mode 100755 new mode 100644 index 514c894ed..31c3dad34 --- a/queries/aws_ec2_client_vpn_endpoint_2.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status,\n client_vpn_endpoint_id,\n transport_protocol,\n\ - \ tags\nfrom\n aws_ec2_client_vpn_endpoint\nwhere\n status ->> 'Code' <> 'available';" + QueryToExecute: | + SELECT + title, + status, + client_vpn_endpoint_id, + transport_protocol, + tags + FROM + aws_ec2_client_vpn_endpoint + WHERE + status ->> 'Code' <> 'available'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Client VPN -Title: Find AWS EC2 Client VPN Endpoint Network Details + - EC2 Client VPN +Title: Find AWS EC2 Client VPN Endpoint Network Details \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_3.yaml b/queries/aws_ec2_client_vpn_endpoint_3.yaml old mode 100755 new mode 100644 index 4d457b6a0..9d16d2400 --- a/queries/aws_ec2_client_vpn_endpoint_3.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status ->> 'Code' as status,\n client_vpn_endpoint_id,\n\ - \ transport_protocol,\n tags\nfrom\n aws_ec2_client_vpn_endpoint\nwhere\n \ - \ creation_time >= now() - interval '30' day;" + QueryToExecute: | + SELECT + title, + status ->> 'Code' AS status, + client_vpn_endpoint_id, + transport_protocol, + tags + FROM + aws_ec2_client_vpn_endpoint + WHERE + creation_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Client VPN -Title: List all AWS EC2 Client VPN Endpoint Details + - EC2 Client VPN +Title: List all AWS EC2 Client VPN Endpoint Details \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_4.yaml b/queries/aws_ec2_client_vpn_endpoint_4.yaml old mode 100755 new mode 100644 index a53dd632f..dc25fd75b --- a/queries/aws_ec2_client_vpn_endpoint_4.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_4.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status ->> 'Code' as status,\n client_vpn_endpoint_id,\n\ - \ security_group_ids,\n vpc_id,\n vpn_port,\n vpn_protocol,\n transport_protocol,\n\ - \ tags\nfrom\n aws_ec2_client_vpn_endpoint\nwhere\n creation_time >= now()\ - \ - interval '30' day;" + QueryToExecute: | + SELECT + title, + status ->> 'Code' AS status, + client_vpn_endpoint_id, + security_group_ids, + vpc_id, + vpn_port, + vpn_protocol, + transport_protocol, + tags + FROM + aws_ec2_client_vpn_endpoint + WHERE + creation_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Client VPN -Title: Find Configuration and Status of AWS EC2 Client VPN Endpoints + - EC2 Client VPN +Title: Find Configuration and Status of AWS EC2 Client VPN Endpoints \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_5.yaml b/queries/aws_ec2_client_vpn_endpoint_5.yaml old mode 100755 new mode 100644 index cfc557680..328a19993 --- a/queries/aws_ec2_client_vpn_endpoint_5.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_5.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status ->> 'Code' as status,\n client_vpn_endpoint_id,\n\ - \ security_group_ids,\n vpc_id,\n vpn_port,\n vpn_protocol,\n transport_protocol,\n\ - \ tags\nfrom\n aws_ec2_client_vpn_endpoint;" + QueryToExecute: | + SELECT + title, + status ->> 'Code' AS status, + client_vpn_endpoint_id, + security_group_ids, + vpc_id, + vpn_port, + vpn_protocol, + transport_protocol, + tags + FROM + aws_ec2_client_vpn_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Client VPN Endpoints Configuration Details + - EC2 +Title: Find AWS EC2 Client VPN Endpoints Configuration Details \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_6.yaml b/queries/aws_ec2_client_vpn_endpoint_6.yaml old mode 100755 new mode 100644 index 758caa5b0..ed851bb10 --- a/queries/aws_ec2_client_vpn_endpoint_6.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_6.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status ->> 'Code' as status,\n client_vpn_endpoint_id,\n\ - \ connection_log_options ->> 'Enabled' as connection_log_options_enabled,\n \ - \ connection_log_options ->> 'CloudwatchLogGroup' as connection_log_options_cloudwatch_log_group,\n\ - \ connection_log_options ->> 'CloudwatchLogStream' as connection_log_options_cloudwatch_log_stream,\n\ - \ tags\nfrom\n aws_ec2_client_vpn_endpoint;" + QueryToExecute: | + SELECT + title, + status ->> 'Code' AS status, + client_vpn_endpoint_id, + connection_log_options ->> 'Enabled' AS connection_log_options_enabled, + connection_log_options ->> 'CloudwatchLogGroup' AS connection_log_options_cloudwatch_log_group, + connection_log_options ->> 'CloudwatchLogStream' AS connection_log_options_cloudwatch_log_stream, + tags + FROM + aws_ec2_client_vpn_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Client VPN -Title: List all AWS EC2 Client VPN Endpoints with Details + - EC2 Client VPN +Title: List all AWS EC2 Client VPN Endpoints with Details \ No newline at end of file diff --git a/queries/aws_ec2_client_vpn_endpoint_7.yaml b/queries/aws_ec2_client_vpn_endpoint_7.yaml old mode 100755 new mode 100644 index a5844e834..cb9242b77 --- a/queries/aws_ec2_client_vpn_endpoint_7.yaml +++ b/queries/aws_ec2_client_vpn_endpoint_7.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed - information about the configuration, status, and associated network details of each - endpoint. +Description: Allows users to query AWS EC2 Client VPN Endpoints to retrieve detailed information about the configuration, status, and associated network details of each endpoint. ID: aws_ec2_client_vpn_endpoint_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n status ->> 'Code' as status,\n client_vpn_endpoint_id,\n\ - \ autentication ->> 'Type' as authentication_options_type,\n autentication ->\ - \ 'MutualAuthentication' ->> 'ClientRootCertificateChain' as authentication_client_root_certificate_chain,\n\ - \ authentication_options,\n tags\nfrom\n aws_ec2_client_vpn_endpoint,\n jsonb_array_elements(authentication_options)\ - \ as autentication;" + QueryToExecute: | + SELECT + title, + status ->> 'Code' AS status, + client_vpn_endpoint_id, + autentication ->> 'Type' AS authentication_options_type, + autentication -> 'MutualAuthentication' ->> 'ClientRootCertificateChain' AS authentication_client_root_certificate_chain, + authentication_options, + tags + FROM + aws_ec2_client_vpn_endpoint, + jsonb_array_elements(authentication_options) AS autentication; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all Configuration and Status of EC2 Client VPN Endpoints + - EC2 +Title: List all Configuration and Status of EC2 Client VPN Endpoints \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_1.yaml b/queries/aws_ec2_gateway_load_balancer_1.yaml old mode 100755 new mode 100644 index cffa51bd1..abf743e7e --- a/queries/aws_ec2_gateway_load_balancer_1.yaml +++ b/queries/aws_ec2_gateway_load_balancer_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n type,\n state_code,\n vpc_id,\n availability_zones\n\ - from\n aws_ec2_gateway_load_balancer;" + QueryToExecute: | + SELECT + name, + arn, + type, + state_code, + vpc_id, + availability_zones + FROM + aws_ec2_gateway_load_balancer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer details, config & state + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer details, config & state \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_2.yaml b/queries/aws_ec2_gateway_load_balancer_2.yaml old mode 100755 new mode 100644 index 8f2841db4..cff57e43d --- a/queries/aws_ec2_gateway_load_balancer_2.yaml +++ b/queries/aws_ec2_gateway_load_balancer_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n az ->> 'LoadBalancerAddresses' as load_balancer_addresses,\n\ - \ az ->> 'OutpostId' as outpost_id,\n az ->> 'SubnetId' as subnet_id,\n az\ - \ ->> 'ZoneName' as zone_name\nfrom\n aws_ec2_gateway_load_balancer,\n jsonb_array_elements(availability_zones)\ - \ as az;" + QueryToExecute: | + SELECT + name, + az ->> 'LoadBalancerAddresses' AS load_balancer_addresses, + az ->> 'OutpostId' AS outpost_id, + az ->> 'SubnetId' AS subnet_id, + az ->> 'ZoneName' AS zone_name + FROM + aws_ec2_gateway_load_balancer, + jsonb_array_elements(availability_zones) AS az; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: List all AWS EC2 Gateway Load Balancer Details + - EC2 Gateway Load Balancer +Title: List all AWS EC2 Gateway Load Balancer Details \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_3.yaml b/queries/aws_ec2_gateway_load_balancer_3.yaml old mode 100755 new mode 100644 index b94cd2b38..40fd0ffdb --- a/queries/aws_ec2_gateway_load_balancer_3.yaml +++ b/queries/aws_ec2_gateway_load_balancer_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n count(az ->> 'ZoneName') as zone_count\nfrom\n\ - \ aws_ec2_gateway_load_balancer,\n jsonb_array_elements(availability_zones)\ - \ as az\ngroup by\n name\nhaving\n count(az ->> 'ZoneName') < 2;" + QueryToExecute: | + SELECT + name, + COUNT(az ->> 'ZoneName') AS zone_count + FROM + aws_ec2_gateway_load_balancer, + jsonb_array_elements(availability_zones) AS az + GROUP BY + name + HAVING + COUNT(az ->> 'ZoneName') < 2; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer Details and Configuration + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer Details and Configuration \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_4.yaml b/queries/aws_ec2_gateway_load_balancer_4.yaml old mode 100755 new mode 100644 index cb8b56a9d..8e199d9b4 --- a/queries/aws_ec2_gateway_load_balancer_4.yaml +++ b/queries/aws_ec2_gateway_load_balancer_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as deletion_protection_key,\n \ - \ lb ->> 'Value' as deletion_protection_value\nfrom\n aws_ec2_gateway_load_balancer,\n\ - \ jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb ->> 'Key'\ - \ = 'deletion_protection.enabled'\n and lb ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS deletion_protection_key, + lb ->> 'Value' AS deletion_protection_value + FROM + aws_ec2_gateway_load_balancer, + jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'deletion_protection.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer with deletion protection + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer with deletion protection \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_5.yaml b/queries/aws_ec2_gateway_load_balancer_5.yaml old mode 100755 new mode 100644 index b25f60698..31d95561b --- a/queries/aws_ec2_gateway_load_balancer_5.yaml +++ b/queries/aws_ec2_gateway_load_balancer_5.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as load_balancing_cross_zone_key,\n\ - \ lb ->> 'Value' as load_balancing_cross_zone_value\nfrom\n aws_ec2_gateway_load_balancer,\n\ - \ jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb ->> 'Key'\ - \ = 'load_balancing.cross_zone.enabled'\n and lb ->> 'Value' = 'true';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS load_balancing_cross_zone_key, + lb ->> 'Value' AS load_balancing_cross_zone_value + FROM + aws_ec2_gateway_load_balancer, + jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'load_balancing.cross_zone.enabled' + AND lb ->> 'Value' = 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer Configuration Details + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer Configuration Details \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_6.yaml b/queries/aws_ec2_gateway_load_balancer_6.yaml old mode 100755 new mode 100644 index b42d5437a..e323755b3 --- a/queries/aws_ec2_gateway_load_balancer_6.yaml +++ b/queries/aws_ec2_gateway_load_balancer_6.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_elements_text(security_groups) as\ - \ attached_security_group\nfrom\n aws_ec2_gateway_load_balancer;" + QueryToExecute: | + SELECT + name, + JSONB_ARRAY_ELEMENTS_TEXT(security_groups) AS attached_security_group + FROM + aws_ec2_gateway_load_balancer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer Details + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer Details \ No newline at end of file diff --git a/queries/aws_ec2_gateway_load_balancer_7.yaml b/queries/aws_ec2_gateway_load_balancer_7.yaml old mode 100755 new mode 100644 index d617c2616..6c0578772 --- a/queries/aws_ec2_gateway_load_balancer_7.yaml +++ b/queries/aws_ec2_gateway_load_balancer_7.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Gateway Load Balancer details, including - its configuration, state, type, and associated tags. +Description: Allows users to query AWS EC2 Gateway Load Balancer details, including its configuration, state, type, and associated tags. ID: aws_ec2_gateway_load_balancer_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state_code\nfrom\n aws_ec2_gateway_load_balancer\n\ - where\n state_code <> 'active';" + QueryToExecute: | + SELECT + name, + state_code + FROM + aws_ec2_gateway_load_balancer + WHERE + state_code <> 'active'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Gateway Load Balancer -Title: Find AWS EC2 Gateway Load Balancer details, state, type + - EC2 Gateway Load Balancer +Title: Find AWS EC2 Gateway Load Balancer details, state, type \ No newline at end of file diff --git a/queries/aws_ec2_instance_1.yaml b/queries/aws_ec2_instance_1.yaml old mode 100755 new mode 100644 index 3ce360e9b..fae916876 --- a/queries/aws_ec2_instance_1.yaml +++ b/queries/aws_ec2_instance_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n placement_availability_zone as az,\n instance_type,\n\ - \ count(*)\nfrom\n aws_ec2_instance\ngroup by\n placement_availability_zone,\n\ - \ instance_type;" + QueryToExecute: | + SELECT + placement_availability_zone AS az, + instance_type, + COUNT(*) + FROM + aws_ec2_instance + GROUP BY + placement_availability_zone, + instance_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Type and State Info + - EC2 +Title: List all AWS EC2 Instances with Type and State Info \ No newline at end of file diff --git a/queries/aws_ec2_instance_10.yaml b/queries/aws_ec2_instance_10.yaml old mode 100755 new mode 100644 index c3350ccda..361a70517 --- a/queries/aws_ec2_instance_10.yaml +++ b/queries/aws_ec2_instance_10.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n disable_api_termination\nfrom\n aws_ec2_instance\n\ - where\n not disable_api_termination;" + QueryToExecute: | + SELECT + instance_id, + disable_api_termination + FROM + aws_ec2_instance + WHERE + NOT disable_api_termination; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all AWS EC2 Instances with API Termination Enabled + - EC2 +Title: Find all AWS EC2 Instances with API Termination Enabled \ No newline at end of file diff --git a/queries/aws_ec2_instance_11.yaml b/queries/aws_ec2_instance_11.yaml old mode 100755 new mode 100644 index f63379741..58090c8f4 --- a/queries/aws_ec2_instance_11.yaml +++ b/queries/aws_ec2_instance_11.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n sg ->> 'GroupId' as group_id,\n sg ->>\ - \ 'GroupName' as group_name\nfrom\n aws_ec2_instance\n cross join jsonb_array_elements(security_groups)\ - \ as sg\nwhere\n sg ->> 'GroupName' = 'default';" + QueryToExecute: | + SELECT + instance_id, + sg ->> 'GroupId' AS group_id, + sg ->> 'GroupName' AS group_name + FROM + aws_ec2_instance + CROSS JOIN + jsonb_array_elements(security_groups) AS sg + WHERE + sg ->> 'GroupName' = 'default'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Group Details + - EC2 +Title: List all AWS EC2 Instances with Group Details \ No newline at end of file diff --git a/queries/aws_ec2_instance_12.yaml b/queries/aws_ec2_instance_12.yaml old mode 100755 new mode 100644 index 459492787..32b9cbf91 --- a/queries/aws_ec2_instance_12.yaml +++ b/queries/aws_ec2_instance_12.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.instance_id,\n vols -> 'Ebs' ->> 'VolumeId' as vol_id,\n\ - \ vol.encrypted\nfrom\n aws_ec2_instance as i\n cross join jsonb_array_elements(block_device_mappings)\ - \ as vols\n join aws_ebs_volume as vol on vol.volume_id = vols -> 'Ebs' ->> 'VolumeId'\n\ - where\n not vol.encrypted;" + QueryToExecute: | + SELECT + i.instance_id, + vols -> 'Ebs' ->> 'VolumeId' AS vol_id, + vol.encrypted + FROM + aws_ec2_instance AS i + CROSS JOIN jsonb_array_elements(block_device_mappings) AS vols + JOIN aws_ebs_volume AS vol ON vol.volume_id = vols -> 'Ebs' ->> 'VolumeId' + WHERE + NOT vol.encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances and Volume Encryption Status + - EC2 +Title: List all AWS EC2 Instances and Volume Encryption Status \ No newline at end of file diff --git a/queries/aws_ec2_instance_13.yaml b/queries/aws_ec2_instance_13.yaml old mode 100755 new mode 100644 index d3604fa7d..330c6e9be --- a/queries/aws_ec2_instance_13.yaml +++ b/queries/aws_ec2_instance_13.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_13 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n user_data\nfrom\n aws_ec2_instance\n\ - where\n user_data like any (array ['%pass%', '%secret%','%token%','%key%'])\n\ - \ or user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]';" + QueryToExecute: | + SELECT + instance_id, + user_data + FROM + aws_ec2_instance + WHERE + user_data LIKE ANY (ARRAY ['%pass%', '%secret%', '%token%', '%key%']) + OR user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]'; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find EC2 Instances with Sensitive Data in User Data + - EC2 +Title: Find EC2 Instances with Sensitive Data in User Data \ No newline at end of file diff --git a/queries/aws_ec2_instance_14.yaml b/queries/aws_ec2_instance_14.yaml old mode 100755 new mode 100644 index 1288e6e4b..0f0a3135f --- a/queries/aws_ec2_instance_14.yaml +++ b/queries/aws_ec2_instance_14.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_14 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n launch_template_data -> 'ImageId' as\ - \ image_id,\n launch_template_data -> 'Placement' as placement,\n launch_template_data\ - \ -> 'DisableApiStop' as disable_api_stop,\n launch_template_data -> 'MetadataOptions'\ - \ as metadata_options,\n launch_template_data -> 'NetworkInterfaces' as network_interfaces,\n\ - \ launch_template_data -> 'BlockDeviceMappings' as block_device_mappings,\n \ - \ launch_template_data -> 'CapacityReservationSpecification' as capacity_reservation_specification\n\ - from\n aws_ec2_instance;" + QueryToExecute: | + SELECT + instance_id, + launch_template_data -> 'ImageId' AS image_id, + launch_template_data -> 'Placement' AS placement, + launch_template_data -> 'DisableApiStop' AS disable_api_stop, + launch_template_data -> 'MetadataOptions' AS metadata_options, + launch_template_data -> 'NetworkInterfaces' AS network_interfaces, + launch_template_data -> 'BlockDeviceMappings' AS block_device_mappings, + launch_template_data -> 'CapacityReservationSpecification' AS capacity_reservation_specification + FROM + aws_ec2_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List All AWS EC2 Instances with Detailed Information + - EC2 +Title: List All AWS EC2 Instances with Detailed Information \ No newline at end of file diff --git a/queries/aws_ec2_instance_15.yaml b/queries/aws_ec2_instance_15.yaml old mode 100755 new mode 100644 index 1debfd03f..63df670e9 --- a/queries/aws_ec2_instance_15.yaml +++ b/queries/aws_ec2_instance_15.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_15 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n i.instance_id, \n i.vpc_id, \n i.subnet_id, \n s.tags\ - \ ->> 'Name' as subnet_name\nfrom \n aws_ec2_instance as i, \n aws_vpc_subnet\ - \ as s \nwhere \n i.subnet_id = s.subnet_id;" + QueryToExecute: | + SELECT + i.instance_id, + i.vpc_id, + i.subnet_id, + s.tags ->> 'Name' AS subnet_name + FROM + aws_ec2_instance AS i, + aws_vpc_subnet AS s + WHERE + i.subnet_id = s.subnet_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Comprehensive Data + - EC2 +Title: List all AWS EC2 Instances with Comprehensive Data \ No newline at end of file diff --git a/queries/aws_ec2_instance_2.yaml b/queries/aws_ec2_instance_2.yaml old mode 100755 new mode 100644 index 72ae3f8b8..2e58d7854 --- a/queries/aws_ec2_instance_2.yaml +++ b/queries/aws_ec2_instance_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n monitoring_state\nfrom\n aws_ec2_instance\n\ - where\n monitoring_state = 'disabled';" + QueryToExecute: | + SELECT + instance_id, + monitoring_state + FROM + aws_ec2_instance + WHERE + monitoring_state = 'disabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances and Their States + - EC2 +Title: List all AWS EC2 Instances and Their States \ No newline at end of file diff --git a/queries/aws_ec2_instance_3.yaml b/queries/aws_ec2_instance_3.yaml old mode 100755 new mode 100644 index a80fdc681..9381cee28 --- a/queries/aws_ec2_instance_3.yaml +++ b/queries/aws_ec2_instance_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n count(instance_type) as count\nfrom\n\ - \ aws_ec2_instance\ngroup by\n instance_type;" + QueryToExecute: | + SELECT + instance_type, + COUNT(instance_type) AS count + FROM + aws_ec2_instance + GROUP BY + instance_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Types and Counts + - EC2 +Title: List all AWS EC2 Instances with Types and Counts \ No newline at end of file diff --git a/queries/aws_ec2_instance_4.yaml b/queries/aws_ec2_instance_4.yaml old mode 100755 new mode 100644 index df5d5292b..668a3d8a3 --- a/queries/aws_ec2_instance_4.yaml +++ b/queries/aws_ec2_instance_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n instance_state,\n launch_time,\n state_transition_time\n\ - from\n aws_ec2_instance\nwhere\n instance_state = 'stopped'\n and state_transition_time\ - \ <= (current_date - interval '30' day);" + QueryToExecute: | + SELECT + instance_id, + instance_state, + launch_time, + state_transition_time + FROM + aws_ec2_instance + WHERE + instance_state = 'stopped' + AND state_transition_time <= (CURRENT_DATE - INTERVAL '30' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Instances Stopped Over 30 days Ago + - EC2 +Title: Find AWS EC2 Instances Stopped Over 30 days Ago \ No newline at end of file diff --git a/queries/aws_ec2_instance_5.yaml b/queries/aws_ec2_instance_5.yaml old mode 100755 new mode 100644 index 4567520a8..f199220bc --- a/queries/aws_ec2_instance_5.yaml +++ b/queries/aws_ec2_instance_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n tags\nfrom\n aws_ec2_instance\nwhere\n\ - \ not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + instance_id, + tags + FROM + aws_ec2_instance + WHERE + NOT tags :: JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Comprehensive Data + - EC2 +Title: List all AWS EC2 Instances with Comprehensive Data \ No newline at end of file diff --git a/queries/aws_ec2_instance_6.yaml b/queries/aws_ec2_instance_6.yaml old mode 100755 new mode 100644 index 057162e8f..f63c9e438 --- a/queries/aws_ec2_instance_6.yaml +++ b/queries/aws_ec2_instance_6.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n instance_state,\n launch_time,\n maintenance_options\ - \ ->> 'AutoRecovery' as auto_recovery\nfrom\n aws_ec2_instance;" + QueryToExecute: | + SELECT + instance_id, + instance_state, + launch_time, + maintenance_options ->> 'AutoRecovery' AS auto_recovery + FROM + aws_ec2_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all EC2 Instances with Detailed Information + - EC2 +Title: Find all EC2 Instances with Detailed Information \ No newline at end of file diff --git a/queries/aws_ec2_instance_7.yaml b/queries/aws_ec2_instance_7.yaml old mode 100755 new mode 100644 index 6f26e74fb..7497f423f --- a/queries/aws_ec2_instance_7.yaml +++ b/queries/aws_ec2_instance_7.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n instance_type,\n instance_state,\n \ - \ l ->> 'LicenseConfigurationArn' as license_configuration_arn\nfrom\n aws_ec2_instance,\n\ - \ jsonb_array_elements(licenses) as l;" + QueryToExecute: | + SELECT + instance_id, + instance_type, + instance_state, + l ->> 'LicenseConfigurationArn' AS license_configuration_arn + FROM + aws_ec2_instance, + jsonb_array_elements(licenses) AS l; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 instances including detailed data + - EC2 +Title: List all AWS EC2 instances including detailed data \ No newline at end of file diff --git a/queries/aws_ec2_instance_8.yaml b/queries/aws_ec2_instance_8.yaml old mode 100755 new mode 100644 index 9aef23305..671d5d69b --- a/queries/aws_ec2_instance_8.yaml +++ b/queries/aws_ec2_instance_8.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n instance_state,\n placement_affinity,\n\ - \ placement_group_id,\n placement_group_name,\n placement_availability_zone,\n\ - \ placement_host_id,\n placement_host_resource_group_arn,\n placement_partition_number,\n\ - \ placement_tenancy\nfrom\n aws_ec2_instance;" + QueryToExecute: | + SELECT + instance_id, + instance_state, + placement_affinity, + placement_group_id, + placement_group_name, + placement_availability_zone, + placement_host_id, + placement_host_resource_group_arn, + placement_partition_number, + placement_tenancy + FROM + aws_ec2_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Detailed Attributes + - EC2 +Title: List all AWS EC2 Instances with Detailed Attributes \ No newline at end of file diff --git a/queries/aws_ec2_instance_9.yaml b/queries/aws_ec2_instance_9.yaml old mode 100755 new mode 100644 index 42d59e07d..eaaab2d8a --- a/queries/aws_ec2_instance_9.yaml +++ b/queries/aws_ec2_instance_9.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EC2 Instances for comprehensive data on each - instance, including instance type, state, tags, and more. +Description: Allows users to query AWS EC2 Instances for comprehensive data on each instance, including instance type, state, tags, and more. ID: aws_ec2_instance_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n count(*) as count\nfrom\n aws_ec2_instance\n\ - where\n instance_type not in ('t2.large', 'm3.medium')\ngroup by\n instance_type;" + QueryToExecute: | + SELECT + instance_type, + COUNT(*) AS count + FROM + aws_ec2_instance + WHERE + instance_type NOT IN ('t2.large', 'm3.medium') + GROUP BY + instance_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instances with Instance Type Count + - EC2 +Title: List all AWS EC2 Instances with Instance Type Count \ No newline at end of file diff --git a/queries/aws_ec2_instance_availability_1.yaml b/queries/aws_ec2_instance_availability_1.yaml old mode 100755 new mode 100644 index 554be7213..73ba5d45c --- a/queries/aws_ec2_instance_availability_1.yaml +++ b/queries/aws_ec2_instance_availability_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instance Availability and retrieve detailed - information about the availability of EC2 instances in each AWS region. +Description: Allows users to query AWS EC2 Instance Availability and retrieve detailed information about the availability of EC2 instances in each AWS region. ID: aws_ec2_instance_availability_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n location\nfrom\n aws_ec2_instance_availability\n\ - where\n location = 'us-east-1';" + QueryToExecute: | + SELECT + instance_type, + location + FROM + aws_ec2_instance_availability + WHERE + location = 'us-east-1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instance Availability by Region + - EC2 +Title: List all AWS EC2 Instance Availability by Region \ No newline at end of file diff --git a/queries/aws_ec2_instance_availability_2.yaml b/queries/aws_ec2_instance_availability_2.yaml old mode 100755 new mode 100644 index 30275e44f..4ad618975 --- a/queries/aws_ec2_instance_availability_2.yaml +++ b/queries/aws_ec2_instance_availability_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EC2 Instance Availability and retrieve detailed - information about the availability of EC2 instances in each AWS region. +Description: Allows users to query AWS EC2 Instance Availability and retrieve detailed information about the availability of EC2 instances in each AWS region. ID: aws_ec2_instance_availability_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n location\nfrom\n aws_ec2_instance_availability\n\ - where\n location = 'af-south'\n and instance_type = 'r5.12xlarge';" + QueryToExecute: | + SELECT + instance_type, + location + FROM + aws_ec2_instance_availability + WHERE + location = 'af-south' + AND instance_type = 'r5.12xlarge'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS EC2 -Title: List all AWS EC2 Instance Availability by Region + - AWS EC2 +Title: List all AWS EC2 Instance Availability by Region \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_1.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_1.yaml old mode 100755 new mode 100644 index b402ef005..7524b047d --- a/queries/aws_ec2_instance_metric_cpu_utilization_1.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_1.yaml @@ -1,20 +1,30 @@ Description: Allows users to query EC2 Instance CPU Utilization metrics from AWS CloudWatch. ID: aws_ec2_instance_metric_cpu_utilization_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization\n\ - order by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization + ORDER BY + instance_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Instance CPU Utilization Metrics + - EC2 +Title: Find AWS EC2 Instance CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_2.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_2.yaml old mode 100755 new mode 100644 index d20c38711..748426d05 --- a/queries/aws_ec2_instance_metric_cpu_utilization_2.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_2.yaml @@ -1,21 +1,32 @@ Description: Allows users to query EC2 Instance CPU Utilization metrics from AWS CloudWatch. ID: aws_ec2_instance_metric_cpu_utilization_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization\n\ - where average > 80\norder by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + ROUND(minimum::NUMERIC, 2) AS min_cpu, + ROUND(maximum::NUMERIC, 2) AS max_cpu, + ROUND(average::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization + WHERE + average > 80 + ORDER BY + instance_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Instances with High CPU Utilization + - EC2 +Title: Find AWS EC2 Instances with High CPU Utilization \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_daily_1.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_daily_1.yaml old mode 100755 new mode 100644 index 16218444f..3552e7b4d --- a/queries/aws_ec2_instance_metric_cpu_utilization_daily_1.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_daily_1.yaml @@ -1,20 +1,30 @@ Description: Allows users to query daily CPU utilization metrics of AWS EC2 instances. ID: aws_ec2_instance_metric_cpu_utilization_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_daily\n\ - order by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_daily + ORDER BY + instance_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Instances Daily CPU Utilization Metrics + - EC2 +Title: List AWS EC2 Instances Daily CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_daily_2.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_daily_2.yaml old mode 100755 new mode 100644 index 43faa9264..2b72ad2ee --- a/queries/aws_ec2_instance_metric_cpu_utilization_daily_2.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_daily_2.yaml @@ -1,25 +1,36 @@ Description: Allows users to query daily CPU utilization metrics of AWS EC2 instances. ID: aws_ec2_instance_metric_cpu_utilization_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_daily\n\ - where average > 80\norder by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_daily + WHERE + AVERAGE > 80 + ORDER BY + instance_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Instances with High Daily CPU Utilization + - EC2 +Title: Find AWS EC2 Instances with High Daily CPU Utilization \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_daily_3.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_daily_3.yaml old mode 100755 new mode 100644 index 738556bb3..fed9c89d9 --- a/queries/aws_ec2_instance_metric_cpu_utilization_daily_3.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_daily_3.yaml @@ -1,21 +1,32 @@ Description: Allows users to query daily CPU utilization metrics of AWS EC2 instances. ID: aws_ec2_instance_metric_cpu_utilization_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_daily\n\ - where average < 1\norder by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_daily + WHERE + AVERAGE < 1 + ORDER BY + instance_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find Daily CPU Utilization Metrics of AWS EC2 Instances + - EC2 +Title: Find Daily CPU Utilization Metrics of AWS EC2 Instances \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_1.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_1.yaml old mode 100755 new mode 100644 index 163557e20..92510e50a --- a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_1.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an - hourly basis. +Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an hourly basis. ID: aws_ec2_instance_metric_cpu_utilization_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_hourly\n\ - order by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_hourly + ORDER BY + instance_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Instance -Title: Query AWS EC2 Instance CPU Utilization Metrics Hourly + - EC2 Instance +Title: Query AWS EC2 Instance CPU Utilization Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_2.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_2.yaml old mode 100755 new mode 100644 index ab57de746..674ef9d19 --- a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_2.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an - hourly basis. +Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an hourly basis. ID: aws_ec2_instance_metric_cpu_utilization_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_hourly\n\ - where average > 80\norder by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + ROUND(minimum::NUMERIC, 2) AS min_cpu, + ROUND(maximum::NUMERIC, 2) AS max_cpu, + ROUND(average::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_hourly + WHERE + average > 80 + ORDER BY + instance_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all AWS EC2 Instance CPU Utilization hourly metrics + - EC2 +Title: Find all AWS EC2 Instance CPU Utilization hourly metrics \ No newline at end of file diff --git a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_3.yaml b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_3.yaml old mode 100755 new mode 100644 index 7dd66417f..39a9f90a6 --- a/queries/aws_ec2_instance_metric_cpu_utilization_hourly_3.yaml +++ b/queries/aws_ec2_instance_metric_cpu_utilization_hourly_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an - hourly basis. +Description: Allows users to query AWS EC2 Instance CPU Utilization metrics on an hourly basis. ID: aws_ec2_instance_metric_cpu_utilization_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ec2_instance_metric_cpu_utilization_hourly\n\ - where average < 1\norder by\n instance_id,\n timestamp;" + QueryToExecute: | + SELECT + instance_id, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ec2_instance_metric_cpu_utilization_hourly + WHERE + AVERAGE < 1 + ORDER BY + instance_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find EC2 Instance Hourly CPU Utilization Metrics in AWS + - EC2 +Title: Find EC2 Instance Hourly CPU Utilization Metrics in AWS \ No newline at end of file diff --git a/queries/aws_ec2_instance_type_1.yaml b/queries/aws_ec2_instance_type_1.yaml old mode 100755 new mode 100644 index a2e306c81..e94bef052 --- a/queries/aws_ec2_instance_type_1.yaml +++ b/queries/aws_ec2_instance_type_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instance Type data, including details about - instance type name, current generation, vCPU, memory, storage, and network performance. +Description: Allows users to query AWS EC2 Instance Type data, including details about instance type name, current generation, vCPU, memory, storage, and network performance. ID: aws_ec2_instance_type_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n dedicated_hosts_supported\nfrom\n \ - \ aws_ec2_instance_type\nwhere\n dedicated_hosts_supported;" + QueryToExecute: | + SELECT + instance_type, + dedicated_hosts_supported + FROM + aws_ec2_instance_type + WHERE + dedicated_hosts_supported; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Instance Type -Title: List all AWS EC2 Instance Type Data and Details + - EC2 Instance Type +Title: List all AWS EC2 Instance Type Data and Details \ No newline at end of file diff --git a/queries/aws_ec2_instance_type_2.yaml b/queries/aws_ec2_instance_type_2.yaml old mode 100755 new mode 100644 index 01165de9c..a4d2a75ec --- a/queries/aws_ec2_instance_type_2.yaml +++ b/queries/aws_ec2_instance_type_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Instance Type data, including details about - instance type name, current generation, vCPU, memory, storage, and network performance. +Description: Allows users to query AWS EC2 Instance Type data, including details about instance type name, current generation, vCPU, memory, storage, and network performance. ID: aws_ec2_instance_type_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n auto_recovery_supported\nfrom\n aws_ec2_instance_type\n\ - where\n not auto_recovery_supported;" + QueryToExecute: | + SELECT + instance_type, + auto_recovery_supported + FROM + aws_ec2_instance_type + WHERE + NOT auto_recovery_supported; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Instance Type -Title: Find All AWS EC2 Instance Types and Recovery Support + - EC2 Instance Type +Title: Find All AWS EC2 Instance Types and Recovery Support \ No newline at end of file diff --git a/queries/aws_ec2_instance_type_3.yaml b/queries/aws_ec2_instance_type_3.yaml old mode 100755 new mode 100644 index 17d48250a..8b8ad4f94 --- a/queries/aws_ec2_instance_type_3.yaml +++ b/queries/aws_ec2_instance_type_3.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS EC2 Instance Type data, including details about - instance type name, current generation, vCPU, memory, storage, and network performance. +Description: Allows users to query AWS EC2 Instance Type data, including details about instance type name, current generation, vCPU, memory, storage, and network performance. ID: aws_ec2_instance_type_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n dedicated_hosts_supported,\n v_cpu_info\ - \ -> 'DefaultCores' as default_cores,\n v_cpu_info -> 'DefaultThreadsPerCore'\ - \ as default_threads_per_core,\n v_cpu_info -> 'DefaultVCpus' as default_vcpus,\n\ - \ v_cpu_info -> 'ValidCores' as valid_cores,\n v_cpu_info -> 'ValidThreadsPerCore'\ - \ as valid_threads_per_core\nfrom\n aws_ec2_instance_type\nwhere\n v_cpu_info\ - \ ->> 'DefaultCores' > '24';" + QueryToExecute: | + SELECT + instance_type, + dedicated_hosts_supported, + v_cpu_info -> 'DefaultCores' AS default_cores, + v_cpu_info -> 'DefaultThreadsPerCore' AS default_threads_per_core, + v_cpu_info -> 'DefaultVCpus' AS default_vcpus, + v_cpu_info -> 'ValidCores' AS valid_cores, + v_cpu_info -> 'ValidThreadsPerCore' AS valid_threads_per_core + FROM + aws_ec2_instance_type + WHERE + v_cpu_info ->> 'DefaultCores' > '24'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Instance Types with Detailed Specs + - EC2 +Title: Find AWS EC2 Instance Types with Detailed Specs \ No newline at end of file diff --git a/queries/aws_ec2_instance_type_4.yaml b/queries/aws_ec2_instance_type_4.yaml old mode 100755 new mode 100644 index 9181ff20d..6897f2708 --- a/queries/aws_ec2_instance_type_4.yaml +++ b/queries/aws_ec2_instance_type_4.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS EC2 Instance Type data, including details about - instance type name, current generation, vCPU, memory, storage, and network performance. +Description: Allows users to query AWS EC2 Instance Type data, including details about instance type name, current generation, vCPU, memory, storage, and network performance. ID: aws_ec2_instance_type_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n ebs_info ->> 'EncryptionSupport' as\ - \ encryption_support\nfrom\n aws_ec2_instance_type\nwhere\n ebs_info ->> 'EncryptionSupport'\ - \ = 'unsupported';" + QueryToExecute: | + SELECT + instance_type, + ebs_info ->> 'EncryptionSupport' AS encryption_support + FROM + aws_ec2_instance_type + WHERE + ebs_info ->> 'EncryptionSupport' = 'unsupported'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all AWS EC2 Instance Types with Unsupported Encryption + - EC2 +Title: Find all AWS EC2 Instance Types with Unsupported Encryption \ No newline at end of file diff --git a/queries/aws_ec2_instance_type_5.yaml b/queries/aws_ec2_instance_type_5.yaml old mode 100755 new mode 100644 index 2d1672153..63b929ac9 --- a/queries/aws_ec2_instance_type_5.yaml +++ b/queries/aws_ec2_instance_type_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Instance Type data, including details about - instance type name, current generation, vCPU, memory, storage, and network performance. +Description: Allows users to query AWS EC2 Instance Type data, including details about instance type name, current generation, vCPU, memory, storage, and network performance. ID: aws_ec2_instance_type_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n free_tier_eligible\nfrom\n aws_ec2_instance_type\n\ - where\n free_tier_eligible;" + QueryToExecute: | + SELECT + instance_type, + free_tier_eligible + FROM + aws_ec2_instance_type + WHERE + free_tier_eligible; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Instance Types with Free Tier Eligibility + - EC2 +Title: List all AWS EC2 Instance Types with Free Tier Eligibility \ No newline at end of file diff --git a/queries/aws_ec2_key_pair_1.yaml b/queries/aws_ec2_key_pair_1.yaml old mode 100755 new mode 100644 index d06a38c84..83a0ac314 --- a/queries/aws_ec2_key_pair_1.yaml +++ b/queries/aws_ec2_key_pair_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS EC2 Key Pairs, providing information about - key pairs which are used to securely log into EC2 instances. +Description: Allows users to query AWS EC2 Key Pairs, providing information about key pairs which are used to securely log into EC2 instances. ID: aws_ec2_key_pair_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key_name,\n key_pair_id,\n region\nfrom\n aws_ec2_key_pair;" + QueryToExecute: | + SELECT + key_name, + key_pair_id, + region + FROM + aws_ec2_key_pair; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Key Pairs with Name and ID + - EC2 +Title: List all AWS EC2 Key Pairs with Name and ID \ No newline at end of file diff --git a/queries/aws_ec2_key_pair_2.yaml b/queries/aws_ec2_key_pair_2.yaml old mode 100755 new mode 100644 index 576ab9acf..fc54ec452 --- a/queries/aws_ec2_key_pair_2.yaml +++ b/queries/aws_ec2_key_pair_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Key Pairs, providing information about - key pairs which are used to securely log into EC2 instances. +Description: Allows users to query AWS EC2 Key Pairs, providing information about key pairs which are used to securely log into EC2 instances. ID: aws_ec2_key_pair_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key_name,\n tags\nfrom\n aws_ec2_key_pair\nwhere\n\ - \ not tags :: JSONB ? 'owner';" + QueryToExecute: | + SELECT + key_name, + tags + FROM + aws_ec2_key_pair + WHERE + NOT tags :: JSONB ? 'owner'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Key Pairs -Title: List all AWS EC2 Key Pairs to Securely Log Into EC2 Instances + - EC2 Key Pairs +Title: List all AWS EC2 Key Pairs to Securely Log Into EC2 Instances \ No newline at end of file diff --git a/queries/aws_ec2_launch_configuration_1.yaml b/queries/aws_ec2_launch_configuration_1.yaml old mode 100755 new mode 100644 index 44657d8cf..5ec01bb23 --- a/queries/aws_ec2_launch_configuration_1.yaml +++ b/queries/aws_ec2_launch_configuration_1.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS EC2 Launch Configurations to gain insights - into their configurations, metadata, and associated instances. +Description: Allows users to query AWS EC2 Launch Configurations to gain insights into their configurations, metadata, and associated instances. ID: aws_ec2_launch_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n associate_public_ip_address,\n\ - \ ebs_optimized,\n image_id,\n instance_monitoring_enabled,\n instance_type,\n\ - \ key_name\nfrom\n aws_ec2_launch_configuration;" + QueryToExecute: | + SELECT + name, + created_time, + associate_public_ip_address, + ebs_optimized, + image_id, + instance_monitoring_enabled, + instance_type, + key_name + FROM + aws_ec2_launch_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Configurations and Metadata + - EC2 +Title: List all AWS EC2 Launch Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_ec2_launch_configuration_2.yaml b/queries/aws_ec2_launch_configuration_2.yaml old mode 100755 new mode 100644 index c8adaf64e..21d9e1bc9 --- a/queries/aws_ec2_launch_configuration_2.yaml +++ b/queries/aws_ec2_launch_configuration_2.yaml @@ -1,19 +1,23 @@ -Description: Allows users to query AWS EC2 Launch Configurations to gain insights - into their configurations, metadata, and associated instances. +Description: Allows users to query AWS EC2 Launch Configurations to gain insights into their configurations, metadata, and associated instances. ID: aws_ec2_launch_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n iam_instance_profile\nfrom\n aws_ec2_launch_configuration;" + QueryToExecute: | + SELECT + name, + iam_instance_profile + FROM + aws_ec2_launch_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Configurations and Metadata + - EC2 +Title: List all AWS EC2 Launch Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_ec2_launch_configuration_3.yaml b/queries/aws_ec2_launch_configuration_3.yaml old mode 100755 new mode 100644 index 4f3797c37..35b2e2f25 --- a/queries/aws_ec2_launch_configuration_3.yaml +++ b/queries/aws_ec2_launch_configuration_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Launch Configurations to gain insights - into their configurations, metadata, and associated instances. +Description: Allows users to query AWS EC2 Launch Configurations to gain insights into their configurations, metadata, and associated instances. ID: aws_ec2_launch_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n associate_public_ip_address\nfrom\n aws_ec2_launch_configuration\n\ - where\n associate_public_ip_address;" + QueryToExecute: | + SELECT + name, + associate_public_ip_address + FROM + aws_ec2_launch_configuration + WHERE + associate_public_ip_address; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Launch Configurations and Metadata + - EC2 +Title: Find AWS EC2 Launch Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_ec2_launch_configuration_4.yaml b/queries/aws_ec2_launch_configuration_4.yaml old mode 100755 new mode 100644 index 75d2e489a..0bab9c9dd --- a/queries/aws_ec2_launch_configuration_4.yaml +++ b/queries/aws_ec2_launch_configuration_4.yaml @@ -1,20 +1,23 @@ -Description: Allows users to query AWS EC2 Launch Configurations to gain insights - into their configurations, metadata, and associated instances. +Description: Allows users to query AWS EC2 Launch Configurations to gain insights into their configurations, metadata, and associated instances. ID: aws_ec2_launch_configuration_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_array_elements_text(security_groups) as\ - \ security_groups\nfrom\n aws_ec2_launch_configuration;" + QueryToExecute: | + SELECT + name, + JSONB_ARRAY_ELEMENTS_TEXT(security_groups) AS security_groups + FROM + aws_ec2_launch_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Launch Configurations and Security Groups + - EC2 +Title: Find AWS EC2 Launch Configurations and Security Groups \ No newline at end of file diff --git a/queries/aws_ec2_launch_configuration_5.yaml b/queries/aws_ec2_launch_configuration_5.yaml old mode 100755 new mode 100644 index ebde3c88c..3566e0ebd --- a/queries/aws_ec2_launch_configuration_5.yaml +++ b/queries/aws_ec2_launch_configuration_5.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EC2 Launch Configurations to gain insights - into their configurations, metadata, and associated instances. +Description: Allows users to query AWS EC2 Launch Configurations to gain insights into their configurations, metadata, and associated instances. ID: aws_ec2_launch_configuration_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n user_data\nfrom\n aws_ec2_launch_configuration\n\ - where\n user_data like any (array ['%pass%', '%secret%','%token%','%key%'])\n\ - \ or user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]';" + QueryToExecute: | + SELECT + name, + user_data + FROM + aws_ec2_launch_configuration + WHERE + user_data LIKE ANY (ARRAY ['%pass%', '%secret%', '%token%', '%key%']) + OR user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Launch Configurations With Sensitive Data + - EC2 +Title: Find AWS EC2 Launch Configurations With Sensitive Data \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_1.yaml b/queries/aws_ec2_launch_template_1.yaml old mode 100755 new mode 100644 index 36a798230..83144648c --- a/queries/aws_ec2_launch_template_1.yaml +++ b/queries/aws_ec2_launch_template_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, - including the associated AMI, instance type, key pair, security groups, and user - data. +Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, including the associated AMI, instance type, key pair, security groups, and user data. ID: aws_ec2_launch_template_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n created_time,\n\ - \ created_by,\n default_version_number,\n latest_version_number\nfrom\n aws_ec2_launch_template;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + created_time, + created_by, + default_version_number, + latest_version_number + FROM + aws_ec2_launch_template; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Templates and Details + - EC2 +Title: List all AWS EC2 Launch Templates and Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_2.yaml b/queries/aws_ec2_launch_template_2.yaml old mode 100755 new mode 100644 index 396569e0a..2314506e9 --- a/queries/aws_ec2_launch_template_2.yaml +++ b/queries/aws_ec2_launch_template_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, - including the associated AMI, instance type, key pair, security groups, and user - data. +Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, including the associated AMI, instance type, key pair, security groups, and user data. ID: aws_ec2_launch_template_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n create_time,\n\ - \ created_by\nfrom\n aws_ec2_launch_template\nwhere\n created_by like '%turbot';" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + create_time, + created_by + FROM + aws_ec2_launch_template + WHERE + created_by LIKE '%turbot'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Launch Templates -Title: Find AWS EC2 Launch Templates with detailed information + - EC2 Launch Templates +Title: Find AWS EC2 Launch Templates with detailed information \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_3.yaml b/queries/aws_ec2_launch_template_3.yaml old mode 100755 new mode 100644 index 831ad17e3..b5dfe047d --- a/queries/aws_ec2_launch_template_3.yaml +++ b/queries/aws_ec2_launch_template_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, - including the associated AMI, instance type, key pair, security groups, and user - data. +Description: Allows users to query AWS EC2 Launch Templates to retrieve detailed information, including the associated AMI, instance type, key pair, security groups, and user data. ID: aws_ec2_launch_template_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n create_time\n\ - from\n aws_ec2_launch_template\nwhere\n create_time >= now() - interval '30'\ - \ day;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + create_time + FROM + aws_ec2_launch_template + WHERE + create_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Templates with Details + - EC2 +Title: List all AWS EC2 Launch Templates with Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_1.yaml b/queries/aws_ec2_launch_template_version_1.yaml old mode 100755 new mode 100644 index fbbeb3397..c8ec0bf0a --- a/queries/aws_ec2_launch_template_version_1.yaml +++ b/queries/aws_ec2_launch_template_version_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n created_by,\n\ - \ default_version,\n version_description,\n version_number\nfrom\n aws_ec2_launch_template_version;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + created_by, + default_version, + version_description, + version_number + FROM + aws_ec2_launch_template_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Template Versions and their Details + - EC2 +Title: List all AWS EC2 Launch Template Versions and their Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_2.yaml b/queries/aws_ec2_launch_template_version_2.yaml old mode 100755 new mode 100644 index 05ee8611c..cf6efc5c9 --- a/queries/aws_ec2_launch_template_version_2.yaml +++ b/queries/aws_ec2_launch_template_version_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n create_time,\n\ - \ created_by,\n version_description,\n version_number\nfrom\n aws_ec2_launch_template_version\n\ - where\n created_by like '%turbot';" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + create_time, + created_by, + version_description, + version_number + FROM + aws_ec2_launch_template_version + WHERE + created_by LIKE '%turbot'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Launch Template Version Details + - EC2 +Title: List AWS EC2 Launch Template Version Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_3.yaml b/queries/aws_ec2_launch_template_version_3.yaml old mode 100755 new mode 100644 index fc2b6e8c3..bf9ba3eee --- a/queries/aws_ec2_launch_template_version_3.yaml +++ b/queries/aws_ec2_launch_template_version_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n create_time,\n\ - \ default_version,\n version_number\nfrom\n aws_ec2_launch_template_version\n\ - where\n create_time >= now() - interval '30' day;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + create_time, + default_version, + version_number + FROM + aws_ec2_launch_template_version + WHERE + create_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Launch Template Versions Details + - EC2 +Title: Find AWS EC2 Launch Template Versions Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_4.yaml b/queries/aws_ec2_launch_template_version_4.yaml old mode 100755 new mode 100644 index 1377c3642..f2a805d5f --- a/queries/aws_ec2_launch_template_version_4.yaml +++ b/queries/aws_ec2_launch_template_version_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n create_time,\n\ - \ default_version,\n version_number\nfrom\n aws_ec2_launch_template_version\n\ - where\n default_version;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + create_time, + default_version, + version_number + FROM + aws_ec2_launch_template_version + WHERE + default_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EC2 -Title: List all AWS EC2 Launch Template Versions + - Amazon EC2 +Title: List all AWS EC2 Launch Template Versions \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_5.yaml b/queries/aws_ec2_launch_template_version_5.yaml old mode 100755 new mode 100644 index a5c1d147f..a4c6c4cb6 --- a/queries/aws_ec2_launch_template_version_5.yaml +++ b/queries/aws_ec2_launch_template_version_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_id,\n count(version_number) as number_of_versions\n\ - from\n aws_ec2_launch_template_version\ngroup by\n launch_template_id;" + QueryToExecute: | + SELECT + launch_template_id, + COUNT(version_number) AS number_of_versions + FROM + aws_ec2_launch_template_version + GROUP BY + launch_template_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Template Versions + - EC2 +Title: List all AWS EC2 Launch Template Versions \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_6.yaml b/queries/aws_ec2_launch_template_version_6.yaml old mode 100755 new mode 100644 index 9e4b8c6d5..77b766ff8 --- a/queries/aws_ec2_launch_template_version_6.yaml +++ b/queries/aws_ec2_launch_template_version_6.yaml @@ -1,42 +1,51 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n version_number,\n\ - \ launch_template_data -> 'BlockDeviceMappings' as block_device_mappings,\n \ - \ launch_template_data -> 'CapacityReservationSpecification' as capacity_reservation_specification,\n\ - \ launch_template_data -> 'CpuOptions' as cpu_options,\n launch_template_data\ - \ -> 'CreditSpecification' as credit_specification,\n launch_template_data ->\ - \ 'DisableApiStop' as disable_api_stop,\n launch_template_data -> 'DisableApiTermination'\ - \ as disable_api_termination,\n launch_template_data -> 'EbsOptimized' as ebs_optimized,\n\ - \ launch_template_data -> 'ElasticGpuSpecifications' as elastic_gpu_specifications,\n\ - \ launch_template_data -> 'ElasticInferenceAccelerators' as elastic_inference_accelerators,\n\ - \ launch_template_data -> 'EnclaveOptions' as enclave_options,\n launch_template_data\ - \ -> 'IamInstanceProfile' as iam_instance_profile,\n launch_template_data ->\ - \ 'ImageId' as image_id,\n launch_template_data -> 'InstanceInitiatedShutdownBehavior'\ - \ as instance_initiated_shutdown_behavior,\n launch_template_data -> 'InstanceRequirements'\ - \ as instance_requirements,\n launch_template_data -> 'InstanceType' as instance_type,\n\ - \ launch_template_data -> 'KernelId' as kernel_id,\n launch_template_data ->\ - \ 'LicenseSpecifications' as license_specifications,\n launch_template_data ->\ - \ 'MaintenanceOptions' as maintenance_options,\n launch_template_data -> 'MetadataOptions'\ - \ as metadata_options,\n launch_template_data -> 'Monitoring' as monitoring,\n\ - \ launch_template_data -> 'NetworkInterfaces' as network_interfaces,\n launch_template_data\ - \ -> 'PrivateDnsNameOptions' as private_dns_name_options,\n launch_template_data\ - \ -> 'RamDiskId' as ram_disk_id,\n launch_template_data -> 'SecurityGroupIds'\ - \ as security_group_ids,\n launch_template_data -> 'SecurityGroups' as security_groups,\n\ - \ launch_template_data -> 'TagSpecifications' as tag_specifications,\n launch_template_data\ - \ -> 'UserData' as user_data\nfrom\n aws_ec2_launch_template_version;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + version_number, + launch_template_data -> 'BlockDeviceMappings' AS block_device_mappings, + launch_template_data -> 'CapacityReservationSpecification' AS capacity_reservation_specification, + launch_template_data -> 'CpuOptions' AS cpu_options, + launch_template_data -> 'CreditSpecification' AS credit_specification, + launch_template_data -> 'DisableApiStop' AS disable_api_stop, + launch_template_data -> 'DisableApiTermination' AS disable_api_termination, + launch_template_data -> 'EbsOptimized' AS ebs_optimized, + launch_template_data -> 'ElasticGpuSpecifications' AS elastic_gpu_specifications, + launch_template_data -> 'ElasticInferenceAccelerators' AS elastic_inference_accelerators, + launch_template_data -> 'EnclaveOptions' AS enclave_options, + launch_template_data -> 'IamInstanceProfile' AS iam_instance_profile, + launch_template_data -> 'ImageId' AS image_id, + launch_template_data -> 'InstanceInitiatedShutdownBehavior' AS instance_initiated_shutdown_behavior, + launch_template_data -> 'InstanceRequirements' AS instance_requirements, + launch_template_data -> 'InstanceType' AS instance_type, + launch_template_data -> 'KernelId' AS kernel_id, + launch_template_data -> 'LicenseSpecifications' AS license_specifications, + launch_template_data -> 'MaintenanceOptions' AS maintenance_options, + launch_template_data -> 'MetadataOptions' AS metadata_options, + launch_template_data -> 'Monitoring' AS monitoring, + launch_template_data -> 'NetworkInterfaces' AS network_interfaces, + launch_template_data -> 'PrivateDnsNameOptions' AS private_dns_name_options, + launch_template_data -> 'RamDiskId' AS ram_disk_id, + launch_template_data -> 'SecurityGroupIds' AS security_group_ids, + launch_template_data -> 'SecurityGroups' AS security_groups, + launch_template_data -> 'TagSpecifications' AS tag_specifications, + launch_template_data -> 'UserData' AS user_data + FROM + aws_ec2_launch_template_version; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Launch Template Versions with Details + - EC2 +Title: List AWS EC2 Launch Template Versions with Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_7.yaml b/queries/aws_ec2_launch_template_version_7.yaml old mode 100755 new mode 100644 index d524fa677..053f16ad1 --- a/queries/aws_ec2_launch_template_version_7.yaml +++ b/queries/aws_ec2_launch_template_version_7.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n version_number,\n\ - \ version_description,\n ebs_optimized\nfrom\n aws_ec2_launch_template_version\n\ - where\n ebs_optimized;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + version_number, + version_description, + ebs_optimized + FROM + aws_ec2_launch_template_version + WHERE + ebs_optimized; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Template Versions and Details + - EC2 +Title: List all AWS EC2 Launch Template Versions and Details \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_8.yaml b/queries/aws_ec2_launch_template_version_8.yaml old mode 100755 new mode 100644 index 04b16050b..b4fb681d8 --- a/queries/aws_ec2_launch_template_version_8.yaml +++ b/queries/aws_ec2_launch_template_version_8.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n version_number,\n\ - \ version_description,\n disable_api_termination\nfrom\n aws_ec2_launch_template_version\n\ - where\n disable_api_termination;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + version_number, + version_description, + disable_api_termination + FROM + aws_ec2_launch_template_version + WHERE + disable_api_termination; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Launch Template Versions + - EC2 +Title: List all AWS EC2 Launch Template Versions \ No newline at end of file diff --git a/queries/aws_ec2_launch_template_version_9.yaml b/queries/aws_ec2_launch_template_version_9.yaml old mode 100755 new mode 100644 index cd5275e4c..4bc23d9a2 --- a/queries/aws_ec2_launch_template_version_9.yaml +++ b/queries/aws_ec2_launch_template_version_9.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS EC2 Launch Template Versions, providing details - about each version of an Amazon EC2 launch template. +Description: Allows users to query AWS EC2 Launch Template Versions, providing details about each version of an Amazon EC2 launch template. ID: aws_ec2_launch_template_version_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n launch_template_name,\n launch_template_id,\n version_number,\n\ - \ disable_api_stop\nfrom\n aws_ec2_launch_template_version\nwhere\n disable_api_stop;" + QueryToExecute: | + SELECT + launch_template_name, + launch_template_id, + version_number, + disable_api_stop + FROM + aws_ec2_launch_template_version + WHERE + disable_api_stop; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Launch Template Versions and Details + - EC2 +Title: Find AWS EC2 Launch Template Versions and Details \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_1.yaml b/queries/aws_ec2_load_balancer_listener_1.yaml old mode 100755 new mode 100644 index 314286c29..fc2d2b63d --- a/queries/aws_ec2_load_balancer_listener_1.yaml +++ b/queries/aws_ec2_load_balancer_listener_1.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides - information about listeners for an Application Load Balancer or Network Load Balancer. +Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides information about listeners for an Application Load Balancer or Network Load Balancer. ID: aws_ec2_load_balancer_listener_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n port,\n protocol\nfrom\n aws_ec2_load_balancer_listener;" + QueryToExecute: | + SELECT + title, + arn, + port, + protocol + FROM + aws_ec2_load_balancer_listener; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: Find AWS EC2 Load Balancer Listeners + - EC2 Load Balancer +Title: Find AWS EC2 Load Balancer Listeners \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_2.yaml b/queries/aws_ec2_load_balancer_listener_2.yaml old mode 100755 new mode 100644 index 8a5cb0fa2..5a97f094d --- a/queries/aws_ec2_load_balancer_listener_2.yaml +++ b/queries/aws_ec2_load_balancer_listener_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides - information about listeners for an Application Load Balancer or Network Load Balancer. +Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides information about listeners for an Application Load Balancer or Network Load Balancer. ID: aws_ec2_load_balancer_listener_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n action ->> 'AuthenticateCognitoConfig'\ - \ as authenticate_cognito_config,\n action ->> 'AuthenticateOidcConfig' as authenticate_Oidc_config,\n\ - \ action ->> 'FixedResponseConfig' as fixed_response_config,\n action -> 'ForwardConfig'\ - \ -> 'TargetGroupStickinessConfig' ->> 'DurationSeconds' as duration_seconds,\n\ - \ action -> 'ForwardConfig' -> 'TargetGroupStickinessConfig' ->> 'Enabled' as\ - \ target_group_stickiness_config_enabled\nfrom\n aws_ec2_load_balancer_listener\n\ - \ cross join jsonb_array_elements(default_actions) as action;" + QueryToExecute: | + SELECT + title, + arn, + action ->> 'AuthenticateCognitoConfig' AS authenticate_cognito_config, + action ->> 'AuthenticateOidcConfig' AS authenticate_oidc_config, + action ->> 'FixedResponseConfig' AS fixed_response_config, + action -> 'ForwardConfig' -> 'TargetGroupStickinessConfig' ->> 'DurationSeconds' AS duration_seconds, + action -> 'ForwardConfig' -> 'TargetGroupStickinessConfig' ->> 'Enabled' AS target_group_stickiness_config_enabled + FROM + aws_ec2_load_balancer_listener + CROSS JOIN + jsonb_array_elements(default_actions) AS action; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Load Balancer Listeners + - EC2 +Title: List all AWS EC2 Load Balancer Listeners \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_3.yaml b/queries/aws_ec2_load_balancer_listener_3.yaml old mode 100755 new mode 100644 index a0b662dde..e62b8932d --- a/queries/aws_ec2_load_balancer_listener_3.yaml +++ b/queries/aws_ec2_load_balancer_listener_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides - information about listeners for an Application Load Balancer or Network Load Balancer. +Description: Allows users to query AWS EC2 Load Balancer Listener data, which provides information about listeners for an Application Load Balancer or Network Load Balancer. ID: aws_ec2_load_balancer_listener_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n port,\n protocol\nfrom\n aws_ec2_load_balancer_listener\n\ - where\n protocol = 'HTTP';" + QueryToExecute: | + SELECT + title, + arn, + port, + protocol + FROM + aws_ec2_load_balancer_listener + WHERE + protocol = 'HTTP'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: Find AWS EC2 Load Balancer Listeners by Protocol + - EC2 Load Balancer +Title: Find AWS EC2 Load Balancer Listeners by Protocol \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_1.yaml b/queries/aws_ec2_load_balancer_listener_rule_1.yaml old mode 100755 new mode 100644 index a4e68ff35..bedb59b32 --- a/queries/aws_ec2_load_balancer_listener_rule_1.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n listener_arn,\n priority,\n is_default,\n \ - \ region\nfrom\n aws_ec2_load_balancer_listener_rule\nwhere\n arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789098:listener-rule/app/test53333/f7cc8cdc44ff910b/c9418b57592205f0/a8fe6d8842838dfa';" + QueryToExecute: | + SELECT + arn, + listener_arn, + priority, + is_default, + region + FROM + aws_ec2_load_balancer_listener_rule + WHERE + arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789098:listener-rule/app/test53333/f7cc8cdc44ff910b/c9418b57592205f0/a8fe6d8842838dfa'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: Find AWS EC2 Load Balancer Listener Rules Details + - EC2 Load Balancer +Title: Find AWS EC2 Load Balancer Listener Rules Details \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_2.yaml b/queries/aws_ec2_load_balancer_listener_rule_2.yaml old mode 100755 new mode 100644 index 2a2d976f4..92cd294df --- a/queries/aws_ec2_load_balancer_listener_rule_2.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n priority,\n is_default,\n actions,\n conditions\n\ - from\n aws_ec2_load_balancer_listener_rule\nwhere\n listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272';" + QueryToExecute: | + SELECT + arn, + priority, + is_default, + actions, + conditions + FROM + aws_ec2_load_balancer_listener_rule + WHERE + listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: 'Find AWS EC2 Load Balancer Listener Rules: Actions & Conditions' + - EC2 Load Balancer +Title: 'Find AWS EC2 Load Balancer Listener Rules: Actions & Conditions' \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_3.yaml b/queries/aws_ec2_load_balancer_listener_rule_3.yaml old mode 100755 new mode 100644 index 65a4ee53f..0d2a5cca8 --- a/queries/aws_ec2_load_balancer_listener_rule_3.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_3.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n a ->> 'Type' as action_type,\n a ->> 'Order'\ - \ as action_order,\n a ->> 'TargetGroupArn' as target_group_arn,\n a -> 'RedirectConfig'\ - \ as redirect_config,\n a -> 'ForwardConfig' as forward_config,\n a -> 'FixedResponseConfig'\ - \ as fixed_response_config,\n a -> 'AuthenticateOidcConfig' as authenticate_oidc_config,\n\ - \ a -> 'AuthenticateCognitoConfig' as authenticate_cognito_config\nfrom\n aws_ec2_load_balancer_listener_rule,\n\ - \ jsonb_array_elements(actions) as a\nwhere\n listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272';" + QueryToExecute: | + SELECT + arn, + a ->> 'Type' AS action_type, + a ->> 'Order' AS action_order, + a ->> 'TargetGroupArn' AS target_group_arn, + a -> 'RedirectConfig' AS redirect_config, + a -> 'ForwardConfig' AS forward_config, + a -> 'FixedResponseConfig' AS fixed_response_config, + a -> 'AuthenticateOidcConfig' AS authenticate_oidc_config, + a -> 'AuthenticateCognitoConfig' AS authenticate_cognito_config + FROM + aws_ec2_load_balancer_listener_rule, + jsonb_array_elements(actions) AS a + WHERE + listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: Find All AWS EC2 Load Balancer Listener Rules Details + - EC2 Load Balancer +Title: Find All AWS EC2 Load Balancer Listener Rules Details \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_4.yaml b/queries/aws_ec2_load_balancer_listener_rule_4.yaml old mode 100755 new mode 100644 index c711697dd..a152365b1 --- a/queries/aws_ec2_load_balancer_listener_rule_4.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n listener_arn,\n priority\nfrom\n aws_ec2_load_balancer_listener_rule\n\ - where\n listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272'\n\ - \ and is_default = true;" + QueryToExecute: | + SELECT + arn, + listener_arn, + priority + FROM + aws_ec2_load_balancer_listener_rule + WHERE + listener_arn = 'arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/70d7923f8398b272' + AND is_default = TRUE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Load Balancer -Title: List all AWS EC2 Load Balancer Listener Rules + - EC2 Load Balancer +Title: List all AWS EC2 Load Balancer Listener Rules \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_5.yaml b/queries/aws_ec2_load_balancer_listener_rule_5.yaml old mode 100755 new mode 100644 index 89a693f46..bef6784d0 --- a/queries/aws_ec2_load_balancer_listener_rule_5.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_5.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.arn,\n r.listener_arn,\n l.load_balancer_arn,\n \ - \ l.protocol as listener_protocol,\n l.ssl_policy,\n r.priority,\n r.is_default,\n\ - \ r.actions,\n r.conditions\nfrom\n aws_ec2_load_balancer_listener_rule as\ - \ r\n join aws_ec2_load_balancer_listener as l on r.listener_arn = l.arn;" + QueryToExecute: | + SELECT + r.arn, + r.listener_arn, + l.load_balancer_arn, + l.protocol AS listener_protocol, + l.ssl_policy, + r.priority, + r.is_default, + r.actions, + r.conditions + FROM + aws_ec2_load_balancer_listener_rule AS r + JOIN + aws_ec2_load_balancer_listener AS l + ON r.listener_arn = l.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Load Balancer Listener Rules + - EC2 +Title: List all AWS EC2 Load Balancer Listener Rules \ No newline at end of file diff --git a/queries/aws_ec2_load_balancer_listener_rule_6.yaml b/queries/aws_ec2_load_balancer_listener_rule_6.yaml old mode 100755 new mode 100644 index d36c4e118..18d0c6b01 --- a/queries/aws_ec2_load_balancer_listener_rule_6.yaml +++ b/queries/aws_ec2_load_balancer_listener_rule_6.yaml @@ -1,24 +1,37 @@ -Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing - detailed information on rule actions, conditions, and priority. +Description: Allows users to query AWS EC2 Load Balancer Listener Rules, providing detailed information on rule actions, conditions, and priority. ID: aws_ec2_load_balancer_listener_rule_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.arn,\n r.listener_arn,\n l.load_balancer_arn,\n \ - \ l.protocol as listener_protocol,\n l.ssl_policy,\n a.canonical_hosted_zone_id,\n\ - \ a.dns_name,\n a.ip_address_type,\n r.priority,\n r.is_default,\n r.actions,\n\ - \ r.conditions\nfrom\n aws_ec2_load_balancer_listener_rule as r\n join aws_ec2_load_balancer_listener\ - \ as l on r.listener_arn = l.arn\n join aws_ec2_application_load_balancer as\ - \ a on l.load_balancer_arn = a.arn;" + QueryToExecute: | + SELECT + r.arn, + r.listener_arn, + l.load_balancer_arn, + l.protocol AS listener_protocol, + l.ssl_policy, + a.canonical_hosted_zone_id, + a.dns_name, + a.ip_address_type, + r.priority, + r.is_default, + r.actions, + r.conditions + FROM + aws_ec2_load_balancer_listener_rule AS r + JOIN aws_ec2_load_balancer_listener AS l + ON r.listener_arn = l.arn + JOIN aws_ec2_application_load_balancer AS a + ON l.load_balancer_arn = a.arn; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Load Balancer Listener Rules with Conditions & Actions + - EC2 +Title: List AWS EC2 Load Balancer Listener Rules with Conditions & Actions \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_1.yaml b/queries/aws_ec2_managed_prefix_list_1.yaml old mode 100755 new mode 100644 index e73b70315..64fb9864b --- a/queries/aws_ec2_managed_prefix_list_1.yaml +++ b/queries/aws_ec2_managed_prefix_list_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n state,\n owner_id\nfrom\n aws_ec2_managed_prefix_list;" + QueryToExecute: | + SELECT + name, + id, + arn, + state, + owner_id + FROM + aws_ec2_managed_prefix_list; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Managed Prefix Lists and Metadata + - EC2 +Title: List AWS EC2 Managed Prefix Lists and Metadata \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_2.yaml b/queries/aws_ec2_managed_prefix_list_2.yaml old mode 100755 new mode 100644 index 96be44711..d4c2c21e2 --- a/queries/aws_ec2_managed_prefix_list_2.yaml +++ b/queries/aws_ec2_managed_prefix_list_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n state,\n owner_id\nfrom\n aws_ec2_managed_prefix_list\n\ - where\n owner_id <> 'AWS';" + QueryToExecute: | + SELECT + name, + id, + arn, + state, + owner_id + FROM + aws_ec2_managed_prefix_list + WHERE + owner_id <> 'AWS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Managed Prefix Lists with SQL + - EC2 +Title: List all AWS EC2 Managed Prefix Lists with SQL \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_3.yaml b/queries/aws_ec2_managed_prefix_list_3.yaml old mode 100755 new mode 100644 index f6da64777..a8accba3b --- a/queries/aws_ec2_managed_prefix_list_3.yaml +++ b/queries/aws_ec2_managed_prefix_list_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n address_family\nfrom\n aws_ec2_managed_prefix_list\n\ - where\n address_family = 'IPv6';" + QueryToExecute: | + SELECT + name, + id, + address_family + FROM + aws_ec2_managed_prefix_list + WHERE + address_family = 'IPv6'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Managed Prefix Lists by IP Address Family + - EC2 +Title: Find AWS EC2 Managed Prefix Lists by IP Address Family \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_4.yaml b/queries/aws_ec2_managed_prefix_list_4.yaml old mode 100755 new mode 100644 index 3b5457cb2..cd918a62f --- a/queries/aws_ec2_managed_prefix_list_4.yaml +++ b/queries/aws_ec2_managed_prefix_list_4.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n state,\n owner_id\nfrom\n aws_ec2_managed_prefix_list\n\ - where\n id in ('pl-03a3e735e3467c0c4', 'pl-4ca54025');" + QueryToExecute: | + SELECT + name, + id, + arn, + state, + owner_id + FROM + aws_ec2_managed_prefix_list + WHERE + id IN ('pl-03a3e735e3467c0c4', 'pl-4ca54025'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Managed Prefix List Details + - EC2 +Title: List AWS EC2 Managed Prefix List Details \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_5.yaml b/queries/aws_ec2_managed_prefix_list_5.yaml old mode 100755 new mode 100644 index 383ad7f05..fc5a5017b --- a/queries/aws_ec2_managed_prefix_list_5.yaml +++ b/queries/aws_ec2_managed_prefix_list_5.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n state,\n owner_id\nfrom\n aws_ec2_managed_prefix_list\n\ - where\n name in ('testPrefix', 'com.amazonaws.us-east-2.dynamodb');" + QueryToExecute: | + SELECT + name, + id, + arn, + state, + owner_id + FROM + aws_ec2_managed_prefix_list + WHERE + name IN ('testPrefix', 'com.amazonaws.us-east-2.dynamodb'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Managed Prefix Lists with details + - EC2 +Title: List all AWS EC2 Managed Prefix Lists with details \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_6.yaml b/queries/aws_ec2_managed_prefix_list_6.yaml old mode 100755 new mode 100644 index de8eaea89..fc689b55d --- a/queries/aws_ec2_managed_prefix_list_6.yaml +++ b/queries/aws_ec2_managed_prefix_list_6.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information - about IP address ranges (CIDRs), permissions, and associated metadata. +Description: Allows users to query AWS EC2 Managed Prefix Lists, providing information about IP address ranges (CIDRs), permissions, and associated metadata. ID: aws_ec2_managed_prefix_list_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n state,\n owner_id\nfrom\n aws_ec2_managed_prefix_list\n\ - where\n owner_id = '632901234528';" + QueryToExecute: | + SELECT + name, + id, + arn, + state, + owner_id + FROM + aws_ec2_managed_prefix_list + WHERE + owner_id = '632901234528'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Managed Prefix Lists with permissions + - EC2 +Title: Find AWS EC2 Managed Prefix Lists with permissions \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_entry_1.yaml b/queries/aws_ec2_managed_prefix_list_entry_1.yaml old mode 100755 new mode 100644 index 2182de38e..985bc0d78 --- a/queries/aws_ec2_managed_prefix_list_entry_1.yaml +++ b/queries/aws_ec2_managed_prefix_list_entry_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing - details such as the CIDR block, description, and the prefix list ID. This table - is useful for understanding the IP address ranges included in a managed prefix list. +Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing details such as the CIDR block, description, and the prefix list ID. This table is useful for understanding the IP address ranges included in a managed prefix list. ID: aws_ec2_managed_prefix_list_entry_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n prefix_list_id,\n cidr,\n description\nfrom\n aws_ec2_managed_prefix_list_entry;" + QueryToExecute: | + SELECT + prefix_list_id, + cidr, + description + FROM + aws_ec2_managed_prefix_list_entry; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Managed Prefix List Entry Details + - EC2 +Title: List AWS EC2 Managed Prefix List Entry Details \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_entry_2.yaml b/queries/aws_ec2_managed_prefix_list_entry_2.yaml old mode 100755 new mode 100644 index 1b94e8938..7b66a4835 --- a/queries/aws_ec2_managed_prefix_list_entry_2.yaml +++ b/queries/aws_ec2_managed_prefix_list_entry_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing - details such as the CIDR block, description, and the prefix list ID. This table - is useful for understanding the IP address ranges included in a managed prefix list. +Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing details such as the CIDR block, description, and the prefix list ID. This table is useful for understanding the IP address ranges included in a managed prefix list. ID: aws_ec2_managed_prefix_list_entry_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n l.name,\n l.id,\n e.cidr,\n e.description,\n l.state,\n\ - \ l.owner_id\nfrom\n aws_ec2_managed_prefix_list_entry as e,\n aws_ec2_managed_prefix_list\ - \ as l\nwhere\n l.owner_id <> 'AWS';" + QueryToExecute: | + SELECT + l.name, + l.id, + e.cidr, + e.description, + l.state, + l.owner_id + FROM + aws_ec2_managed_prefix_list_entry AS e, + aws_ec2_managed_prefix_list AS l + WHERE + l.owner_id <> 'AWS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Managed Prefix List Entries with Details + - EC2 +Title: Find AWS EC2 Managed Prefix List Entries with Details \ No newline at end of file diff --git a/queries/aws_ec2_managed_prefix_list_entry_3.yaml b/queries/aws_ec2_managed_prefix_list_entry_3.yaml old mode 100755 new mode 100644 index 337bdae73..1614e866c --- a/queries/aws_ec2_managed_prefix_list_entry_3.yaml +++ b/queries/aws_ec2_managed_prefix_list_entry_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing - details such as the CIDR block, description, and the prefix list ID. This table - is useful for understanding the IP address ranges included in a managed prefix list. +Description: Allows users to query AWS EC2 Managed Prefix List Entries, providing details such as the CIDR block, description, and the prefix list ID. This table is useful for understanding the IP address ranges included in a managed prefix list. ID: aws_ec2_managed_prefix_list_entry_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n prefix_list_id,\n count(cidr) as numbers_of_entries\n\ - from\n aws_ec2_managed_prefix_list_entry\ngroup by\n prefix_list_id;" + QueryToExecute: | + SELECT + prefix_list_id, + COUNT(cidr) AS numbers_of_entries + FROM + aws_ec2_managed_prefix_list_entry + GROUP BY + prefix_list_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Managed Prefix List Entries with Details + - EC2 +Title: List AWS EC2 Managed Prefix List Entries with Details \ No newline at end of file diff --git a/queries/aws_ec2_network_interface_1.yaml b/queries/aws_ec2_network_interface_1.yaml old mode 100755 new mode 100644 index df4bc210e..2a1aec671 --- a/queries/aws_ec2_network_interface_1.yaml +++ b/queries/aws_ec2_network_interface_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive - details about each interface, including its associated instances, security groups, - and subnet information. +Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive details about each interface, including its associated instances, security groups, and subnet information. ID: aws_ec2_network_interface_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_interface_id,\n interface_type,\n description,\n\ - \ private_ip_address,\n association_public_ip,\n mac_address\nfrom\n aws_ec2_network_interface;" + QueryToExecute: | + SELECT + network_interface_id, + interface_type, + description, + private_ip_address, + association_public_ip, + mac_address + FROM + aws_ec2_network_interface; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all AWS EC2 Network Interfaces & Associated Details + - EC2 +Title: Find all AWS EC2 Network Interfaces & Associated Details \ No newline at end of file diff --git a/queries/aws_ec2_network_interface_2.yaml b/queries/aws_ec2_network_interface_2.yaml old mode 100755 new mode 100644 index 78a9fc1a5..d3644d725 --- a/queries/aws_ec2_network_interface_2.yaml +++ b/queries/aws_ec2_network_interface_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive - details about each interface, including its associated instances, security groups, - and subnet information. +Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive details about each interface, including its associated instances, security groups, and subnet information. ID: aws_ec2_network_interface_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_interface_id,\n interface_type,\n description,\n\ - \ private_ip_address,\n association_public_ip,\n mac_address\nfrom\n aws_ec2_network_interface\n\ - where\n private_ip_address :: cidr <<= '10.66.0.0/16';" + QueryToExecute: | + SELECT + network_interface_id, + interface_type, + description, + private_ip_address, + association_public_ip, + mac_address + FROM + aws_ec2_network_interface + WHERE + private_ip_address :: cidr <<= '10.66.0.0/16'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Network Interfaces and Details + - EC2 +Title: Find AWS EC2 Network Interfaces and Details \ No newline at end of file diff --git a/queries/aws_ec2_network_interface_3.yaml b/queries/aws_ec2_network_interface_3.yaml old mode 100755 new mode 100644 index 68c173e71..96da95885 --- a/queries/aws_ec2_network_interface_3.yaml +++ b/queries/aws_ec2_network_interface_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive - details about each interface, including its associated instances, security groups, - and subnet information. +Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive details about each interface, including its associated instances, security groups, and subnet information. ID: aws_ec2_network_interface_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n interface_type,\n count(interface_type) as count\nfrom\n\ - \ aws_ec2_network_interface\ngroup by\n interface_type\norder by\n count desc;" + QueryToExecute: | + SELECT + interface_type, + COUNT(interface_type) AS count + FROM + aws_ec2_network_interface + GROUP BY + interface_type + ORDER BY + count DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find Details of AWS EC2 Network Interfaces + - EC2 +Title: Find Details of AWS EC2 Network Interfaces \ No newline at end of file diff --git a/queries/aws_ec2_network_interface_4.yaml b/queries/aws_ec2_network_interface_4.yaml old mode 100755 new mode 100644 index 808bedd56..10b08ef13 --- a/queries/aws_ec2_network_interface_4.yaml +++ b/queries/aws_ec2_network_interface_4.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive - details about each interface, including its associated instances, security groups, - and subnet information. +Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive details about each interface, including its associated instances, security groups, and subnet information. ID: aws_ec2_network_interface_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_interface_id as eni,\n sg ->> 'GroupId' as \"\ - security group id\",\n sg ->> 'GroupName' as \"security group name\"\nfrom\n\ - \ aws_ec2_network_interface\n cross join jsonb_array_elements(groups) as sg\n\ - order by\n eni;" + QueryToExecute: | + SELECT + network_interface_id AS eni, + sg ->> 'GroupId' AS "security group id", + sg ->> 'GroupName' AS "security group name" + FROM + aws_ec2_network_interface + CROSS JOIN + jsonb_array_elements(groups) AS sg + ORDER BY + eni; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Network Interfaces and Associated Details + - EC2 +Title: List all AWS EC2 Network Interfaces and Associated Details \ No newline at end of file diff --git a/queries/aws_ec2_network_interface_5.yaml b/queries/aws_ec2_network_interface_5.yaml old mode 100755 new mode 100644 index cbcca2b76..7664a6e23 --- a/queries/aws_ec2_network_interface_5.yaml +++ b/queries/aws_ec2_network_interface_5.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive - details about each interface, including its associated instances, security groups, - and subnet information. +Description: Allows users to query AWS EC2 Network Interfaces and provides comprehensive details about each interface, including its associated instances, security groups, and subnet information. ID: aws_ec2_network_interface_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.network_interface_id,\n v.vpc_id,\n v.is_default,\n\ - \ v.cidr_block,\n v.state,\n v.account_id,\n v.region\nfrom\n aws_ec2_network_interface\ - \ e,\n aws_vpc v\nwhere \n e.vpc_id = v.vpc_id;" + QueryToExecute: | + SELECT + e.network_interface_id, + v.vpc_id, + v.is_default, + v.cidr_block, + v.state, + v.account_id, + v.region + FROM + aws_ec2_network_interface e, + aws_vpc v + WHERE + e.vpc_id = v.vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Network Interfaces and Details + - EC2 +Title: Find AWS EC2 Network Interfaces and Details \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_1.yaml b/queries/aws_ec2_network_load_balancer_1.yaml old mode 100755 new mode 100644 index bb95f6340..3d251addf --- a/queries/aws_ec2_network_load_balancer_1.yaml +++ b/queries/aws_ec2_network_load_balancer_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, - status, and other related information. +Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, status, and other related information. ID: aws_ec2_network_load_balancer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n count(az ->> 'ZoneName') as zone_count\nfrom\n\ - \ aws_ec2_network_load_balancer\n cross join jsonb_array_elements(availability_zones)\ - \ as az\ngroup by\n name;" + QueryToExecute: | + SELECT + name, + COUNT(az ->> 'ZoneName') AS zone_count + FROM + aws_ec2_network_load_balancer + CROSS JOIN + jsonb_array_elements(availability_zones) AS az + GROUP BY + name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: List all AWS EC2 Network Load Balancer Configurations + - EC2 Network Load Balancer +Title: List all AWS EC2 Network Load Balancer Configurations \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_2.yaml b/queries/aws_ec2_network_load_balancer_2.yaml old mode 100755 new mode 100644 index f60636a08..19b617f8d --- a/queries/aws_ec2_network_load_balancer_2.yaml +++ b/queries/aws_ec2_network_load_balancer_2.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, - status, and other related information. +Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, status, and other related information. ID: aws_ec2_network_load_balancer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as cross_zone,\n lb ->> 'Value'\ - \ as cross_zone_value\nfrom\n aws_ec2_network_load_balancer\n cross join jsonb_array_elements(load_balancer_attributes)\ - \ as lb\nwhere\n lb ->> 'Key' = 'load_balancing.cross_zone.enabled'\n and lb\ - \ ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS cross_zone, + lb ->> 'Value' AS cross_zone_value + FROM + aws_ec2_network_load_balancer + CROSS JOIN jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'load_balancing.cross_zone.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: Find AWS EC2 Network Load Balancer Configuration and Status + - EC2 Network Load Balancer +Title: Find AWS EC2 Network Load Balancer Configuration and Status \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_3.yaml b/queries/aws_ec2_network_load_balancer_3.yaml old mode 100755 new mode 100644 index 600061ae2..7a97d1ff4 --- a/queries/aws_ec2_network_load_balancer_3.yaml +++ b/queries/aws_ec2_network_load_balancer_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, - status, and other related information. +Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, status, and other related information. ID: aws_ec2_network_load_balancer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as logging_key,\n lb ->> 'Value'\ - \ as logging_value\nfrom\n aws_ec2_network_load_balancer\n cross join jsonb_array_elements(load_balancer_attributes)\ - \ as lb\nwhere\n lb ->> 'Key' = 'access_logs.s3.enabled'\n and lb ->> 'Value'\ - \ = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS logging_key, + lb ->> 'Value' AS logging_value + FROM + aws_ec2_network_load_balancer + CROSS JOIN jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'access_logs.s3.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: Find AWS EC2 NLB with Access Logs Disabled + - EC2 Network Load Balancer +Title: Find AWS EC2 NLB with Access Logs Disabled \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_4.yaml b/queries/aws_ec2_network_load_balancer_4.yaml old mode 100755 new mode 100644 index 04071c350..d48d3c799 --- a/queries/aws_ec2_network_load_balancer_4.yaml +++ b/queries/aws_ec2_network_load_balancer_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, - status, and other related information. +Description: Allows users to query AWS EC2 Network Load Balancer data including configuration, status, and other related information. ID: aws_ec2_network_load_balancer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n lb ->> 'Key' as deletion_protection_key,\n \ - \ lb ->> 'Value' as deletion_protection_value\nfrom\n aws_ec2_network_load_balancer\n\ - \ cross join jsonb_array_elements(load_balancer_attributes) as lb\nwhere\n lb\ - \ ->> 'Key' = 'deletion_protection.enabled'\n and lb ->> 'Value' = 'false';" + QueryToExecute: | + SELECT + name, + lb ->> 'Key' AS deletion_protection_key, + lb ->> 'Value' AS deletion_protection_value + FROM + aws_ec2_network_load_balancer + CROSS JOIN jsonb_array_elements(load_balancer_attributes) AS lb + WHERE + lb ->> 'Key' = 'deletion_protection.enabled' + AND lb ->> 'Value' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: List all AWS EC2 Network Load Balancer Deletion Protection + - EC2 Network Load Balancer +Title: List all AWS EC2 Network Load Balancer Deletion Protection \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_1.yaml b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_1.yaml old mode 100755 new mode 100644 index 9851feeda..a2cae93cc --- a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_1.yaml +++ b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_1.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS EC2 Network Load Balancer Metrics for net flow - count data. This includes information such as the number of new or terminated flows - per minute from a network load balancer. +Description: Allows users to query AWS EC2 Network Load Balancer Metrics for net flow count data. This includes information such as the number of new or terminated flows per minute from a network load balancer. ID: aws_ec2_network_load_balancer_metric_net_flow_count_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ sample_count,\n timestamp\nfrom\n aws_ec2_network_load_balancer_metric_net_flow_count\n\ - order by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + sample_count, + timestamp + FROM + aws_ec2_network_load_balancer_metric_net_flow_count + ORDER BY + name, + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: Query AWS EC2 Network Load Balancer Net Flow Counts + - EC2 Network Load Balancer +Title: Query AWS EC2 Network Load Balancer Net Flow Counts \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_2.yaml b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_2.yaml old mode 100755 new mode 100644 index 7c3624450..91ddd001f --- a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_2.yaml +++ b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_2.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query AWS EC2 Network Load Balancer Metrics for net flow - count data. This includes information such as the number of new or terminated flows - per minute from a network load balancer. +Description: Allows users to query AWS EC2 Network Load Balancer Metrics for net flow count data. This includes information such as the number of new or terminated flows per minute from a network load balancer. ID: aws_ec2_network_load_balancer_metric_net_flow_count_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ average,\n sample_count,\n timestamp\nfrom\n aws_ec2_network_load_balancer_metric_net_flow_count\n\ - where\n average < 100\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + average, + sample_count, + timestamp + FROM + aws_ec2_network_load_balancer_metric_net_flow_count + WHERE + average < 100 + ORDER BY + name, + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: Find AWS EC2 Network Load Balancer Net Flow Counts + - EC2 Network Load Balancer +Title: Find AWS EC2 Network Load Balancer Net Flow Counts \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_1.yaml b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_1.yaml old mode 100755 new mode 100644 index 2c1813d3b..79be43400 --- a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_1.yaml +++ b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_1.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query Network Load Balancer Metrics in EC2, specifically - the daily net flow count, providing insights into network traffic patterns and potential - anomalies. +Description: Allows users to query Network Load Balancer Metrics in EC2, specifically the daily net flow count, providing insights into network traffic patterns and potential anomalies. ID: aws_ec2_network_load_balancer_metric_net_flow_count_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ sample_count,\n timestamp\nfrom\n aws_ec2_network_load_balancer_metric_net_flow_count_daily\n\ - order by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + sample_count, + timestamp + FROM + aws_ec2_network_load_balancer_metric_net_flow_count_daily + ORDER BY + name, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: Find Network Load Balancer Metrics and Traffic Patterns + - EC2 Network Load Balancer +Title: Find Network Load Balancer Metrics and Traffic Patterns \ No newline at end of file diff --git a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_2.yaml b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_2.yaml old mode 100755 new mode 100644 index 69036e731..e4364d182 --- a/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_2.yaml +++ b/queries/aws_ec2_network_load_balancer_metric_net_flow_count_daily_2.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query Network Load Balancer Metrics in EC2, specifically - the daily net flow count, providing insights into network traffic patterns and potential - anomalies. +Description: Allows users to query Network Load Balancer Metrics in EC2, specifically the daily net flow count, providing insights into network traffic patterns and potential anomalies. ID: aws_ec2_network_load_balancer_metric_net_flow_count_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n metric_name,\n namespace,\n maximum,\n minimum,\n\ - \ average,\n sample_count,\n timestamp\nfrom\n aws_ec2_network_load_balancer_metric_net_flow_count_daily\n\ - where\n average < 100\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + metric_name, + namespace, + maximum, + minimum, + average, + sample_count, + timestamp + FROM + aws_ec2_network_load_balancer_metric_net_flow_count_daily + WHERE + average < 100 + ORDER BY + name, + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Network Load Balancer -Title: List Network Load Balancer Metrics in EC2 Daily + - EC2 Network Load Balancer +Title: List Network Load Balancer Metrics in EC2 Daily \ No newline at end of file diff --git a/queries/aws_ec2_regional_settings_1.yaml b/queries/aws_ec2_regional_settings_1.yaml old mode 100755 new mode 100644 index 988421799..711b9a9f7 --- a/queries/aws_ec2_regional_settings_1.yaml +++ b/queries/aws_ec2_regional_settings_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 regional settings, including default EBS - encryption and default EBS encryption KMS key. +Description: Allows users to query AWS EC2 regional settings, including default EBS encryption and default EBS encryption KMS key. ID: aws_ec2_regional_settings_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n default_ebs_encryption_enabled,\n default_ebs_encryption_key,\n\ - \ title,\n region\nfrom\n aws_ec2_regional_settings;" + QueryToExecute: | + SELECT + default_ebs_encryption_enabled, + default_ebs_encryption_key, + title, + region + FROM + aws_ec2_regional_settings; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List AWS EC2 Regional Settings including EBS Encryption + - EC2 +Title: List AWS EC2 Regional Settings including EBS Encryption \ No newline at end of file diff --git a/queries/aws_ec2_regional_settings_2.yaml b/queries/aws_ec2_regional_settings_2.yaml old mode 100755 new mode 100644 index 1efd8e699..91980544e --- a/queries/aws_ec2_regional_settings_2.yaml +++ b/queries/aws_ec2_regional_settings_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS EC2 regional settings, including default EBS - encryption and default EBS encryption KMS key. +Description: Allows users to query AWS EC2 regional settings, including default EBS encryption and default EBS encryption KMS key. ID: aws_ec2_regional_settings_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n default_ebs_encryption_enabled,\n default_ebs_encryption_key,\n\ - \ title,\n region\nfrom\n aws_ec2_regional_settings\nwhere\n region = 'ap-south-1';" + QueryToExecute: | + SELECT + default_ebs_encryption_enabled, + default_ebs_encryption_key, + title, + region + FROM + aws_ec2_regional_settings + WHERE + region = 'ap-south-1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Regional Settings including EBS encryption + - EC2 +Title: List all AWS EC2 Regional Settings including EBS encryption \ No newline at end of file diff --git a/queries/aws_ec2_regional_settings_3.yaml b/queries/aws_ec2_regional_settings_3.yaml old mode 100755 new mode 100644 index 82d460f91..678ed5a88 --- a/queries/aws_ec2_regional_settings_3.yaml +++ b/queries/aws_ec2_regional_settings_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS EC2 regional settings, including default EBS - encryption and default EBS encryption KMS key. +Description: Allows users to query AWS EC2 regional settings, including default EBS encryption and default EBS encryption KMS key. ID: aws_ec2_regional_settings_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n region,\n default_ebs_encryption_enabled,\n default_ebs_encryption_key\n\ - from\n aws_ec2_regional_settings\nwhere\n default_ebs_encryption_enabled;" + QueryToExecute: | + SELECT + region, + default_ebs_encryption_enabled, + default_ebs_encryption_key + FROM + aws_ec2_regional_settings + WHERE + default_ebs_encryption_enabled; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List All AWS EC2 Regions With Encryption Settings + - EC2 +Title: List All AWS EC2 Regions With Encryption Settings \ No newline at end of file diff --git a/queries/aws_ec2_reserved_instance_1.yaml b/queries/aws_ec2_reserved_instance_1.yaml old mode 100755 new mode 100644 index d1e51a7fe..29d240741 --- a/queries/aws_ec2_reserved_instance_1.yaml +++ b/queries/aws_ec2_reserved_instance_1.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive - insights on the reserved instances, such as their configurations, state, and associated - tags. +Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive insights on the reserved instances, such as their configurations, state, and associated tags. ID: aws_ec2_reserved_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_instance_id,\n arn,\n instance_type,\n instance_state,\n\ - \ currency_code,\n CAST(fixed_price AS varchar),\n offering_class, scope,\n\ - \ CAST(usage_price AS varchar)\nfrom\n aws_ec2_reserved_instance;" + QueryToExecute: | + SELECT + reserved_instance_id, + arn, + instance_type, + instance_state, + currency_code, + CAST(fixed_price AS VARCHAR), + offering_class, + scope, + CAST(usage_price AS VARCHAR) + FROM + aws_ec2_reserved_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: 'Find AWS EC2 Reserved Instances: Configurations and State' + - EC2 +Title: 'Find AWS EC2 Reserved Instances: Configurations and State' \ No newline at end of file diff --git a/queries/aws_ec2_reserved_instance_2.yaml b/queries/aws_ec2_reserved_instance_2.yaml old mode 100755 new mode 100644 index e3db2251c..2c5e8b94b --- a/queries/aws_ec2_reserved_instance_2.yaml +++ b/queries/aws_ec2_reserved_instance_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive - insights on the reserved instances, such as their configurations, state, and associated - tags. +Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive insights on the reserved instances, such as their configurations, state, and associated tags. ID: aws_ec2_reserved_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n count(instance_count) as count\nfrom\n\ - \ aws_ec2_reserved_instance\ngroup by\n instance_type;" + QueryToExecute: | + SELECT + instance_type, + COUNT(instance_count) AS count + FROM + aws_ec2_reserved_instance + GROUP BY + instance_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Reserved Instances by Type + - EC2 +Title: Find AWS EC2 Reserved Instances by Type \ No newline at end of file diff --git a/queries/aws_ec2_reserved_instance_3.yaml b/queries/aws_ec2_reserved_instance_3.yaml old mode 100755 new mode 100644 index 5179891b9..b2c10a337 --- a/queries/aws_ec2_reserved_instance_3.yaml +++ b/queries/aws_ec2_reserved_instance_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive - insights on the reserved instances, such as their configurations, state, and associated - tags. +Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive insights on the reserved instances, such as their configurations, state, and associated tags. ID: aws_ec2_reserved_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_type,\n count(*) as count\nfrom\n aws_ec2_reserved_instance\n\ - where\n instance_type not in ('t2.large', 'm3.medium')\ngroup by\n instance_type;" + QueryToExecute: | + SELECT + instance_type, + COUNT(*) AS count + FROM + aws_ec2_reserved_instance + WHERE + instance_type NOT IN ('t2.large', 'm3.medium') + GROUP BY + instance_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Reserved Instances -Title: List all AWS EC2 Reserved Instances and their configurations + - EC2 Reserved Instances +Title: List all AWS EC2 Reserved Instances and their configurations \ No newline at end of file diff --git a/queries/aws_ec2_reserved_instance_4.yaml b/queries/aws_ec2_reserved_instance_4.yaml old mode 100755 new mode 100644 index 6db740355..1bea307d3 --- a/queries/aws_ec2_reserved_instance_4.yaml +++ b/queries/aws_ec2_reserved_instance_4.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive - insights on the reserved instances, such as their configurations, state, and associated - tags. +Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive insights on the reserved instances, such as their configurations, state, and associated tags. ID: aws_ec2_reserved_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_instance_id,\n instance_type,\n offering_class\n\ - from\n aws_ec2_reserved_instance\nwhere\n offering_class = 'standard';" + QueryToExecute: | + SELECT + reserved_instance_id, + instance_type, + offering_class + FROM + aws_ec2_reserved_instance + WHERE + offering_class = 'standard'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Reserved Instances and configurations + - EC2 +Title: List all AWS EC2 Reserved Instances and configurations \ No newline at end of file diff --git a/queries/aws_ec2_reserved_instance_5.yaml b/queries/aws_ec2_reserved_instance_5.yaml old mode 100755 new mode 100644 index d3bfb8ef9..f00bad7e6 --- a/queries/aws_ec2_reserved_instance_5.yaml +++ b/queries/aws_ec2_reserved_instance_5.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive - insights on the reserved instances, such as their configurations, state, and associated - tags. +Description: Allows users to query AWS EC2 Reserved Instances to gather comprehensive insights on the reserved instances, such as their configurations, state, and associated tags. ID: aws_ec2_reserved_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_instance_id,\n instance_type,\n instance_state\n\ - from\n aws_ec2_reserved_instance\nwhere\n instance_state = 'active';" + QueryToExecute: | + SELECT + reserved_instance_id, + instance_type, + instance_state + FROM + aws_ec2_reserved_instance + WHERE + instance_state = 'active'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Reserved Instances and Their Configurations + - EC2 +Title: Find AWS EC2 Reserved Instances and Their Configurations \ No newline at end of file diff --git a/queries/aws_ec2_spot_price_1.yaml b/queries/aws_ec2_spot_price_1.yaml old mode 100755 new mode 100644 index 943dc1908..fbd668ef8 --- a/queries/aws_ec2_spot_price_1.yaml +++ b/queries/aws_ec2_spot_price_1.yaml @@ -1,26 +1,39 @@ -Description: Allows users to query AWS EC2 Spot Price data, including information - about the instance type, product description, spot price, and the date and time - the price was set. +Description: Allows users to query AWS EC2 Spot Price data, including information about the instance type, product description, spot price, and the date and time the price was set. ID: aws_ec2_spot_price_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n availability_zone,\n instance_type,\n product_description,\n\ - \ spot_price::numeric as spot_price,\n create_timestamp as start_time,\n lead(create_timestamp,\ - \ 1, now()) over (partition by instance_type, availability_zone, product_description\ - \ order by create_timestamp) as stop_time\nfrom\n aws_ec2_spot_price\nwhere\n\ - \ instance_type = 'm5.4xlarge'\n and product_description = 'Linux/UNIX'\n and\ - \ availability_zone in\n (\n 'eu-west-3a',\n 'eu-west-3b'\n )\n and start_time\ - \ = now() - interval '1' month\n and end_time = now() - interval '1' minute;" + QueryToExecute: | + SELECT + availability_zone, + instance_type, + product_description, + spot_price::numeric AS spot_price, + create_timestamp AS start_time, + LEAD(create_timestamp, 1, NOW()) OVER ( + PARTITION BY instance_type, availability_zone, product_description + ORDER BY create_timestamp + ) AS stop_time + FROM + aws_ec2_spot_price + WHERE + instance_type = 'm5.4xlarge' + AND product_description = 'Linux/UNIX' + AND availability_zone IN ( + 'eu-west-3a', + 'eu-west-3b' + ) + AND start_time = NOW() - INTERVAL '1' MONTH + AND end_time = NOW() - INTERVAL '1' MINUTE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Spot Price Data for Specific Instances + - EC2 +Title: Find AWS EC2 Spot Price Data for Specific Instances \ No newline at end of file diff --git a/queries/aws_ec2_ssl_policy_1.yaml b/queries/aws_ec2_ssl_policy_1.yaml old mode 100755 new mode 100644 index 187c83a86..5720c0147 --- a/queries/aws_ec2_ssl_policy_1.yaml +++ b/queries/aws_ec2_ssl_policy_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS EC2 SSL Policies to retrieve detailed information - about SSL policies used in AWS EC2 Load Balancers. +Description: Allows users to query AWS EC2 SSL Policies to retrieve detailed information about SSL policies used in AWS EC2 Load Balancers. ID: aws_ec2_ssl_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n ssl_protocols\nfrom\n aws_ec2_ssl_policy;" + QueryToExecute: | + SELECT + name, + ssl_protocols + FROM + aws_ec2_ssl_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 SSL Policies Used in Load Balancers + - EC2 +Title: Find AWS EC2 SSL Policies Used in Load Balancers \ No newline at end of file diff --git a/queries/aws_ec2_ssl_policy_2.yaml b/queries/aws_ec2_ssl_policy_2.yaml old mode 100755 new mode 100644 index b7d300456..6ec1d8537 --- a/queries/aws_ec2_ssl_policy_2.yaml +++ b/queries/aws_ec2_ssl_policy_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS EC2 SSL Policies to retrieve detailed information - about SSL policies used in AWS EC2 Load Balancers. +Description: Allows users to query AWS EC2 SSL Policies to retrieve detailed information about SSL policies used in AWS EC2 Load Balancers. ID: aws_ec2_ssl_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n ssl_policy\nfrom\n aws_ec2_load_balancer_listener\ - \ listener\njoin \n aws_ec2_ssl_policy ssl_policy\non\n listener.ssl_policy\ - \ = ssl_policy.Name\nwhere\n ssl_policy.ciphers @> '[{\"Name\":\"DES-CBC3-SHA\"\ - }]';" + QueryToExecute: | + SELECT + arn, + ssl_policy + FROM + aws_ec2_load_balancer_listener listener + JOIN + aws_ec2_ssl_policy ssl_policy + ON + listener.ssl_policy = ssl_policy.Name + WHERE + ssl_policy.ciphers @> '[{"Name":"DES-CBC3-SHA"}]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 SSL Policies Used in Load Balancers + - EC2 +Title: Find AWS EC2 SSL Policies Used in Load Balancers \ No newline at end of file diff --git a/queries/aws_ec2_target_group_1.yaml b/queries/aws_ec2_target_group_1.yaml old mode 100755 new mode 100644 index 70f8c2ebe..2398936cc --- a/queries/aws_ec2_target_group_1.yaml +++ b/queries/aws_ec2_target_group_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Target Groups and provides information - about each Target Group within an AWS account. +Description: Allows users to query AWS EC2 Target Groups and provides information about each Target Group within an AWS account. ID: aws_ec2_target_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n target_group_name,\n target_type,\n load_balancer_arns,\n\ - \ vpc_id\nfrom\n aws_ec2_target_group;" + QueryToExecute: | + SELECT + target_group_name, + target_type, + load_balancer_arns, + vpc_id + FROM + aws_ec2_target_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find EC2 Target Groups in AWS Account + - EC2 +Title: Find EC2 Target Groups in AWS Account \ No newline at end of file diff --git a/queries/aws_ec2_target_group_2.yaml b/queries/aws_ec2_target_group_2.yaml old mode 100755 new mode 100644 index 7a0bf069b..121923d78 --- a/queries/aws_ec2_target_group_2.yaml +++ b/queries/aws_ec2_target_group_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS EC2 Target Groups and provides information - about each Target Group within an AWS account. +Description: Allows users to query AWS EC2 Target Groups and provides information about each Target Group within an AWS account. ID: aws_ec2_target_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n health_check_enabled,\n protocol,\n matcher_http_code,\n\ - \ healthy_threshold_count,\n unhealthy_threshold_count,\n health_check_enabled,\n\ - \ health_check_interval_seconds,\n health_check_path,\n health_check_port,\n\ - \ health_check_protocol,\n health_check_timeout_seconds\nfrom\n aws_ec2_target_group;" + QueryToExecute: | + SELECT + health_check_enabled, + protocol, + matcher_http_code, + healthy_threshold_count, + unhealthy_threshold_count, + health_check_enabled, + health_check_interval_seconds, + health_check_path, + health_check_port, + health_check_protocol, + health_check_timeout_seconds + FROM + aws_ec2_target_group; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find AWS EC2 Target Groups with Health Check Info + - EC2 +Title: Find AWS EC2 Target Groups with Health Check Info \ No newline at end of file diff --git a/queries/aws_ec2_target_group_3.yaml b/queries/aws_ec2_target_group_3.yaml old mode 100755 new mode 100644 index d8ceadc02..a4e81060f --- a/queries/aws_ec2_target_group_3.yaml +++ b/queries/aws_ec2_target_group_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Target Groups and provides information - about each Target Group within an AWS account. +Description: Allows users to query AWS EC2 Target Groups and provides information about each Target Group within an AWS account. ID: aws_ec2_target_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n target_group_name,\n target_type,\n target -> 'Target'\ - \ ->> 'AvailabilityZone' as availability_zone,\n target -> 'Target' ->> 'Id'\ - \ as id,\n target -> 'Target' ->> 'Port' as port\nfrom\n aws_ec2_target_group\n\ - \ cross join jsonb_array_elements(target_health_descriptions) as target;" + QueryToExecute: | + SELECT + target_group_name, + target_type, + target -> 'Target' ->> 'AvailabilityZone' AS availability_zone, + target -> 'Target' ->> 'Id' AS id, + target -> 'Target' ->> 'Port' AS port + FROM + aws_ec2_target_group + CROSS JOIN + jsonb_array_elements(target_health_descriptions) AS target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS EC2 -Title: List all AWS EC2 Target Groups and Relevant Details + - AWS EC2 +Title: List all AWS EC2 Target Groups and Relevant Details \ No newline at end of file diff --git a/queries/aws_ec2_target_group_4.yaml b/queries/aws_ec2_target_group_4.yaml old mode 100755 new mode 100644 index d67490e12..5b399ac06 --- a/queries/aws_ec2_target_group_4.yaml +++ b/queries/aws_ec2_target_group_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS EC2 Target Groups and provides information - about each Target Group within an AWS account. +Description: Allows users to query AWS EC2 Target Groups and provides information about each Target Group within an AWS account. ID: aws_ec2_target_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n target_group_name,\n target_type,\n target -> 'TargetHealth'\ - \ ->> 'Description' as description,\n target -> 'TargetHealth' ->> 'Reason' reason,\n\ - \ target -> 'TargetHealth' ->> 'State' as state\nfrom\n aws_ec2_target_group\n\ - \ cross join jsonb_array_elements(target_health_descriptions) as target;" + QueryToExecute: | + SELECT + target_group_name, + target_type, + target -> 'TargetHealth' ->> 'Description' AS description, + target -> 'TargetHealth' ->> 'Reason' AS reason, + target -> 'TargetHealth' ->> 'State' AS state + FROM + aws_ec2_target_group + CROSS JOIN + jsonb_array_elements(target_health_descriptions) AS target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: Find all AWS EC2 Target Groups and their states + - EC2 +Title: Find all AWS EC2 Target Groups and their states \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_1.yaml b/queries/aws_ec2_transit_gateway_1.yaml old mode 100755 new mode 100644 index b4a828a73..47f00b222 --- a/queries/aws_ec2_transit_gateway_1.yaml +++ b/queries/aws_ec2_transit_gateway_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Transit Gateway resources for detailed - information on configuration, status, and associations. +Description: Allows users to query AWS EC2 Transit Gateway resources for detailed information on configuration, status, and associations. ID: aws_ec2_transit_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_id,\n state,\n owner_id,\n creation_time\n\ - from\n aws_ec2_transit_gateway;" + QueryToExecute: | + SELECT + transit_gateway_id, + state, + owner_id, + creation_time + FROM + aws_ec2_transit_gateway; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: List all AWS EC2 Transit Gateway configurations and statuses + - EC2 Transit Gateway +Title: List all AWS EC2 Transit Gateway configurations and statuses \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_2.yaml b/queries/aws_ec2_transit_gateway_2.yaml old mode 100755 new mode 100644 index eb9500615..62d8c1aa7 --- a/queries/aws_ec2_transit_gateway_2.yaml +++ b/queries/aws_ec2_transit_gateway_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Transit Gateway resources for detailed - information on configuration, status, and associations. +Description: Allows users to query AWS EC2 Transit Gateway resources for detailed information on configuration, status, and associations. ID: aws_ec2_transit_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_id,\n auto_accept_shared_attachments\n\ - from\n aws_ec2_transit_gateway\nwhere\n auto_accept_shared_attachments = 'enable';" + QueryToExecute: | + SELECT + transit_gateway_id, + auto_accept_shared_attachments + FROM + aws_ec2_transit_gateway + WHERE + auto_accept_shared_attachments = 'enable'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: Find AWS EC2 Transit Gateway Configuration Details + - EC2 Transit Gateway +Title: Find AWS EC2 Transit Gateway Configuration Details \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_3.yaml b/queries/aws_ec2_transit_gateway_3.yaml old mode 100755 new mode 100644 index 542c620ed..9c0f78f83 --- a/queries/aws_ec2_transit_gateway_3.yaml +++ b/queries/aws_ec2_transit_gateway_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Transit Gateway resources for detailed - information on configuration, status, and associations. +Description: Allows users to query AWS EC2 Transit Gateway resources for detailed information on configuration, status, and associations. ID: aws_ec2_transit_gateway_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n association_default_route_table_id,\n count(transit_gateway_id)\ - \ as transit_gateway\nfrom\n aws_ec2_transit_gateway\ngroup by\n association_default_route_table_id;" + QueryToExecute: | + SELECT + association_default_route_table_id, + COUNT(transit_gateway_id) AS transit_gateway + FROM + aws_ec2_transit_gateway + GROUP BY + association_default_route_table_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: Find AWS EC2 Transit Gateway Configuration and Status + - EC2 Transit Gateway +Title: Find AWS EC2 Transit Gateway Configuration and Status \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_4.yaml b/queries/aws_ec2_transit_gateway_4.yaml old mode 100755 new mode 100644 index 5ae10ceaa..361a6e38b --- a/queries/aws_ec2_transit_gateway_4.yaml +++ b/queries/aws_ec2_transit_gateway_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EC2 Transit Gateway resources for detailed - information on configuration, status, and associations. +Description: Allows users to query AWS EC2 Transit Gateway resources for detailed information on configuration, status, and associations. ID: aws_ec2_transit_gateway_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_id,\n tags\nfrom\n aws_ec2_transit_gateway\n\ - where\n not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + transit_gateway_id, + tags + FROM + aws_ec2_transit_gateway + WHERE + NOT tags :: JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: Find AWS EC2 Transit Gateway Details + - EC2 Transit Gateway +Title: Find AWS EC2 Transit Gateway Details \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_route_1.yaml b/queries/aws_ec2_transit_gateway_route_1.yaml old mode 100755 new mode 100644 index 92c70dfb6..56c57c256 --- a/queries/aws_ec2_transit_gateway_route_1.yaml +++ b/queries/aws_ec2_transit_gateway_route_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EC2 Transit Gateway Routes for detailed information - about each route, including the destination CIDR block, the route''s current state, - and the transit gateway attachments. +Description: Allows users to query AWS EC2 Transit Gateway Routes for detailed information about each route, including the destination CIDR block, the route's current state, and the transit gateway attachments. ID: aws_ec2_transit_gateway_route_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_route_table_id,\n destination_cidr_block,\n\ - \ prefix_list_id,\n state,\n type\nfrom\n aws_ec2_transit_gateway_route;" + QueryToExecute: | + SELECT + transit_gateway_route_table_id, + destination_cidr_block, + prefix_list_id, + state, + type + FROM + aws_ec2_transit_gateway_route; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: Find AWS EC2 Transit Gateway Routes Information + - EC2 Transit Gateway +Title: Find AWS EC2 Transit Gateway Routes Information \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_route_2.yaml b/queries/aws_ec2_transit_gateway_route_2.yaml old mode 100755 new mode 100644 index 51ba584bf..5178e46d6 --- a/queries/aws_ec2_transit_gateway_route_2.yaml +++ b/queries/aws_ec2_transit_gateway_route_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Transit Gateway Routes for detailed information - about each route, including the destination CIDR block, the route''s current state, - and the transit gateway attachments. +Description: Allows users to query AWS EC2 Transit Gateway Routes for detailed information about each route, including the destination CIDR block, the route's current state, and the transit gateway attachments. ID: aws_ec2_transit_gateway_route_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_route_table_id,\n destination_cidr_block,\n\ - \ state,\n type\nfrom\n aws_ec2_transit_gateway_route\nwhere\n state = 'active';" + QueryToExecute: | + SELECT + transit_gateway_route_table_id, + destination_cidr_block, + state, + type + FROM + aws_ec2_transit_gateway_route + WHERE + state = 'active'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: Find All AWS EC2 Transit Gateway Routes by State + - EC2 Transit Gateway +Title: Find All AWS EC2 Transit Gateway Routes by State \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_route_table_1.yaml b/queries/aws_ec2_transit_gateway_route_table_1.yaml old mode 100755 new mode 100644 index f4905b0a1..8c2b93ca9 --- a/queries/aws_ec2_transit_gateway_route_table_1.yaml +++ b/queries/aws_ec2_transit_gateway_route_table_1.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS EC2 Transit Gateway Route Tables and retrieve - detailed information about each route table, including its ID, state, transit gateway - ID, and other associated metadata. +Description: Allows users to query AWS EC2 Transit Gateway Route Tables and retrieve detailed information about each route table, including its ID, state, transit gateway ID, and other associated metadata. ID: aws_ec2_transit_gateway_route_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_route_table_id,\n transit_gateway_id,\n\ - \ default_association_route_table,\n default_propagation_route_table\nfrom\n\ - \ aws_ec2_transit_gateway_route_table;" + QueryToExecute: | + SELECT + transit_gateway_route_table_id, + transit_gateway_id, + default_association_route_table, + default_propagation_route_table + FROM + aws_ec2_transit_gateway_route_table; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: List all AWS EC2 Transit Gateway Route Tables with Details + - EC2 Transit Gateway +Title: List all AWS EC2 Transit Gateway Route Tables with Details \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_route_table_2.yaml b/queries/aws_ec2_transit_gateway_route_table_2.yaml old mode 100755 new mode 100644 index 0f358b713..d01a4fdda --- a/queries/aws_ec2_transit_gateway_route_table_2.yaml +++ b/queries/aws_ec2_transit_gateway_route_table_2.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS EC2 Transit Gateway Route Tables and retrieve - detailed information about each route table, including its ID, state, transit gateway - ID, and other associated metadata. +Description: Allows users to query AWS EC2 Transit Gateway Route Tables and retrieve detailed information about each route table, including its ID, state, transit gateway ID, and other associated metadata. ID: aws_ec2_transit_gateway_route_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_id,\n count(transit_gateway_route_table_id)\ - \ as transit_gateway_route_table_count\nfrom\n aws_ec2_transit_gateway_route_table\n\ - group by\n transit_gateway_id;" + QueryToExecute: | + SELECT + transit_gateway_id, + COUNT(transit_gateway_route_table_id) AS transit_gateway_route_table_count + FROM + aws_ec2_transit_gateway_route_table + GROUP BY + transit_gateway_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: List all AWS EC2 Transit Gateway Route Tables by ID and State + - EC2 Transit Gateway +Title: List all AWS EC2 Transit Gateway Route Tables by ID and State \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_vpc_attachment_1.yaml b/queries/aws_ec2_transit_gateway_vpc_attachment_1.yaml old mode 100755 new mode 100644 index da218dae8..40272d137 --- a/queries/aws_ec2_transit_gateway_vpc_attachment_1.yaml +++ b/queries/aws_ec2_transit_gateway_vpc_attachment_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS EC2 Transit Gateway VPC Attachments for details - such as the attachment state, creation time, and more. +Description: Allows users to query AWS EC2 Transit Gateway VPC Attachments for details such as the attachment state, creation time, and more. ID: aws_ec2_transit_gateway_vpc_attachment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n transit_gateway_attachment_id,\n transit_gateway_id,\n\ - \ state,\n transit_gateway_owner_id,\n creation_time,\n association_state\n\ - from\n aws_ec2_transit_gateway_vpc_attachment;" + QueryToExecute: | + SELECT + transit_gateway_attachment_id, + transit_gateway_id, + state, + transit_gateway_owner_id, + creation_time, + association_state + FROM + aws_ec2_transit_gateway_vpc_attachment; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 -Title: List all AWS EC2 Transit Gateway VPC Attachments + - EC2 +Title: List all AWS EC2 Transit Gateway VPC Attachments \ No newline at end of file diff --git a/queries/aws_ec2_transit_gateway_vpc_attachment_2.yaml b/queries/aws_ec2_transit_gateway_vpc_attachment_2.yaml old mode 100755 new mode 100644 index e5d38dcfb..69ad71e70 --- a/queries/aws_ec2_transit_gateway_vpc_attachment_2.yaml +++ b/queries/aws_ec2_transit_gateway_vpc_attachment_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EC2 Transit Gateway VPC Attachments for details - such as the attachment state, creation time, and more. +Description: Allows users to query AWS EC2 Transit Gateway VPC Attachments for details such as the attachment state, creation time, and more. ID: aws_ec2_transit_gateway_vpc_attachment_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_type,\n count(transit_gateway_attachment_id)\ - \ as count\nfrom\n aws_ec2_transit_gateway_vpc_attachment\ngroup by\n resource_type;" + QueryToExecute: | + SELECT + resource_type, + COUNT(transit_gateway_attachment_id) AS count + FROM + aws_ec2_transit_gateway_vpc_attachment + GROUP BY + resource_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EC2 Transit Gateway -Title: List all AWS EC2 Transit Gateway VPC Attachments by Resource Type + - EC2 Transit Gateway +Title: List all AWS EC2 Transit Gateway VPC Attachments by Resource Type \ No newline at end of file diff --git a/queries/aws_ecr_image_1.yaml b/queries/aws_ecr_image_1.yaml old mode 100755 new mode 100644 index aacfe6e1f..04f578363 --- a/queries/aws_ecr_image_1.yaml +++ b/queries/aws_ecr_image_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_digest,\n image_pushed_at,\n\ - \ image_size_in_bytes,\n registry_id,\n image_scan_status,\n image_tags\n\ - from\n aws_ecr_image;" + QueryToExecute: | + SELECT + repository_name, + image_digest, + image_pushed_at, + image_size_in_bytes, + registry_id, + image_scan_status, + image_tags + FROM + aws_ecr_image; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ECR -Title: List all Amazon ECR Images with Detailed Information + - Amazon ECR +Title: List all Amazon ECR Images with Detailed Information \ No newline at end of file diff --git a/queries/aws_ecr_image_2.yaml b/queries/aws_ecr_image_2.yaml old mode 100755 new mode 100644 index 6b243981f..ca3c8ea06 --- a/queries/aws_ecr_image_2.yaml +++ b/queries/aws_ecr_image_2.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_scan_findings_summary ->> 'FindingSeverityCounts'\ - \ as finding_severity_counts,\n image_scan_findings_summary ->> 'ImageScanCompletedAt'\ - \ as image_scan_completed_at,\n image_scan_findings_summary ->> 'VulnerabilitySourceUpdatedAt'\ - \ as vulnerability_source_updated_at\nfrom\n aws_ecr_image;" + QueryToExecute: | + SELECT + repository_name, + image_scan_findings_summary ->> 'FindingSeverityCounts' AS finding_severity_counts, + image_scan_findings_summary ->> 'ImageScanCompletedAt' AS image_scan_completed_at, + image_scan_findings_summary ->> 'VulnerabilitySourceUpdatedAt' AS vulnerability_source_updated_at + FROM + aws_ecr_image; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List all Amazon ECR Images with Detailed Information + - Elastic Container Registry +Title: List all Amazon ECR Images with Detailed Information \ No newline at end of file diff --git a/queries/aws_ecr_image_3.yaml b/queries/aws_ecr_image_3.yaml old mode 100755 new mode 100644 index 1fef6ada6..e491f465c --- a/queries/aws_ecr_image_3.yaml +++ b/queries/aws_ecr_image_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n registry_id,\n image_digest,\n \ - \ image_tags\nfrom\n aws_ecr_image;" + QueryToExecute: | + SELECT + repository_name, + registry_id, + image_digest, + image_tags + FROM + aws_ecr_image; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Registry -Title: List all Amazon ECR Images and Retrieve Detailed Info + - Amazon Elastic Container Registry +Title: List all Amazon ECR Images and Retrieve Detailed Info \ No newline at end of file diff --git a/queries/aws_ecr_image_4.yaml b/queries/aws_ecr_image_4.yaml old mode 100755 new mode 100644 index ec65599cd..bc6491c32 --- a/queries/aws_ecr_image_4.yaml +++ b/queries/aws_ecr_image_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_digest,\n image_pushed_at,\n\ - \ image_size_in_bytes\nfrom\n aws_ecr_image\nwhere\n image_pushed_at >= now()\ - \ - interval '10' day\nand\n repository_name = 'test1';" + QueryToExecute: | + SELECT + repository_name, + image_digest, + image_pushed_at, + image_size_in_bytes + FROM + aws_ecr_image + WHERE + image_pushed_at >= NOW() - INTERVAL '10' DAY + AND repository_name = 'test1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Registry -Title: List All Amazon ECR Images and Their Details + - Amazon Elastic Container Registry +Title: List All Amazon ECR Images and Their Details \ No newline at end of file diff --git a/queries/aws_ecr_image_5.yaml b/queries/aws_ecr_image_5.yaml old mode 100755 new mode 100644 index b48f41496..48a4cf01a --- a/queries/aws_ecr_image_5.yaml +++ b/queries/aws_ecr_image_5.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.repository_name as repository_name,\n r.repository_uri\ - \ as repository_uri,\n i.image_digest as image_digest,\n i.image_tags as image_tags\n\ - from\n aws_ecr_image as i,\n aws_ecr_repository as r\nwhere\n i.repository_name\ - \ = r.repository_name\nand\n r.created_at >= now() - interval '20' day;" + QueryToExecute: | + SELECT + i.repository_name AS repository_name, + r.repository_uri AS repository_uri, + i.image_digest AS image_digest, + i.image_tags AS image_tags + FROM + aws_ecr_image AS i, + aws_ecr_repository AS r + WHERE + i.repository_name = r.repository_name + AND + r.created_at >= NOW() - INTERVAL '20' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Registry -Title: Find all Amazon ECR Images and Retrieve Detailed Info + - Amazon Elastic Container Registry +Title: Find all Amazon ECR Images and Retrieve Detailed Info \ No newline at end of file diff --git a/queries/aws_ecr_image_6.yaml b/queries/aws_ecr_image_6.yaml old mode 100755 new mode 100644 index cf14954e3..15fc2f910 --- a/queries/aws_ecr_image_6.yaml +++ b/queries/aws_ecr_image_6.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.repository_name as repository_name,\n r.repository_uri\ - \ as repository_uri,\n i.image_digest as image_digest,\n i.image_tags as image_tags,\n\ - \ s ->> 'Effect' as effect,\n s ->> 'Action' as action,\n s ->> 'Condition'\ - \ as condition,\n s ->> 'Principal' as principal\nfrom\n aws_ecr_image as i,\n\ - \ aws_ecr_repository as r,\n jsonb_array_elements(r.policy -> 'Statement') as\ - \ s\nwhere\n i.repository_name = r.repository_name;" + QueryToExecute: | + SELECT + i.repository_name AS repository_name, + r.repository_uri AS repository_uri, + i.image_digest AS image_digest, + i.image_tags AS image_tags, + s ->> 'Effect' AS effect, + s ->> 'Action' AS action, + s ->> 'Condition' AS condition, + s ->> 'Principal' AS principal + FROM + aws_ecr_image AS i, + aws_ecr_repository AS r, + jsonb_array_elements(r.policy -> 'Statement') AS s + WHERE + i.repository_name = r.repository_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Registry -Title: Find Amazon ECR Images and Retrieve Detailed Information + - Amazon Elastic Container Registry +Title: Find Amazon ECR Images and Retrieve Detailed Information \ No newline at end of file diff --git a/queries/aws_ecr_image_7.yaml b/queries/aws_ecr_image_7.yaml old mode 100755 new mode 100644 index 3f6d5b9da..048b4abfd --- a/queries/aws_ecr_image_7.yaml +++ b/queries/aws_ecr_image_7.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query Amazon Elastic Container Registry (ECR) Images - and retrieve detailed information about each image, including image tags, push timestamps, - image sizes, and more. +Description: Allows users to query Amazon Elastic Container Registry (ECR) Images and retrieve detailed information about each image, including image tags, push timestamps, image sizes, and more. ID: aws_ecr_image_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n artifact_name,\n artifact_type,\n metadata,\n results\n\ - from\n trivy_scan_artifact as a,\n aws_ecr_image as i\nwhere\n artifact_name\ - \ = image_uri\n and repository_name = 'hello';" + QueryToExecute: | + SELECT + artifact_name, + artifact_type, + metadata, + results + FROM + trivy_scan_artifact AS a, + aws_ecr_image AS i + WHERE + artifact_name = image_uri + AND repository_name = 'hello'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Registry -Title: List all Amazon ECR Images with Details + - Amazon Elastic Container Registry +Title: List all Amazon ECR Images with Details \ No newline at end of file diff --git a/queries/aws_ecr_image_scan_finding_1.yaml b/queries/aws_ecr_image_scan_finding_1.yaml old mode 100755 new mode 100644 index 0a1e85611..3b718034a --- a/queries/aws_ecr_image_scan_finding_1.yaml +++ b/queries/aws_ecr_image_scan_finding_1.yaml @@ -1,27 +1,38 @@ -Description: Allows users to query Amazon ECR Image Scan Findings to retrieve detailed - information about image scan findings, including attributes such as the severity - of the finding, description, and package name where the vulnerability was found. +Description: Allows users to query Amazon ECR Image Scan Findings to retrieve detailed information about image scan findings, including attributes such as the severity of the finding, description, and package name where the vulnerability was found. ID: aws_ecr_image_scan_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_tag,\n name,\n severity,\n\ - \ description,\n attributes,\n uri,\n image_scan_status,\n image_scan_completed_at,\n\ - \ vulnerability_source_updated_at\nfrom\n aws_ecr_image_scan_finding\nwhere\n\ - \ repository_name = 'my-repo'\n and image_tag = 'my-image-tag';" + QueryToExecute: | + SELECT + repository_name, + image_tag, + name, + severity, + description, + attributes, + uri, + image_scan_status, + image_scan_completed_at, + vulnerability_source_updated_at + FROM + aws_ecr_image_scan_finding + WHERE + repository_name = 'my-repo' + AND image_tag = 'my-image-tag'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find all AWS ECR Image Scan Findings Details + - Elastic Container Registry +Title: Find all AWS ECR Image Scan Findings Details \ No newline at end of file diff --git a/queries/aws_ecr_image_scan_finding_2.yaml b/queries/aws_ecr_image_scan_finding_2.yaml old mode 100755 new mode 100644 index 7f75ab444..f87851654 --- a/queries/aws_ecr_image_scan_finding_2.yaml +++ b/queries/aws_ecr_image_scan_finding_2.yaml @@ -1,25 +1,38 @@ -Description: Allows users to query Amazon ECR Image Scan Findings to retrieve detailed - information about image scan findings, including attributes such as the severity - of the finding, description, and package name where the vulnerability was found. +Description: Allows users to query Amazon ECR Image Scan Findings to retrieve detailed information about image scan findings, including attributes such as the severity of the finding, description, and package name where the vulnerability was found. ID: aws_ecr_image_scan_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.repository_name,\n f.image_tag,\n f.name,\n f.severity,\n\ - \ jsonb_pretty(f.attributes) as attributes\nfrom\n (\n select\n repository_name,\n\ - \ jsonb_array_elements_text(image_tags) as image_tag\n from\n aws_ecr_image\ - \ as i\n where\n i.image_pushed_at > now() - interval '24' hour\n )\n\ - \ images\n left outer join\n aws_ecr_image_scan_finding as f\n on images.repository_name\ - \ = f.repository_name\n and images.image_tag = f.image_tag;" + QueryToExecute: | + SELECT + f.repository_name, + f.image_tag, + f.name, + f.severity, + jsonb_pretty(f.attributes) AS attributes + FROM + ( + SELECT + repository_name, + jsonb_array_elements_text(image_tags) AS image_tag + FROM + aws_ecr_image AS i + WHERE + i.image_pushed_at > NOW() - INTERVAL '24' HOUR + ) images + LEFT OUTER JOIN + aws_ecr_image_scan_finding AS f + ON images.repository_name = f.repository_name + AND images.image_tag = f.image_tag; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ECR -Title: Find Amazon ECR Image Scan Findings for Recent Images + - Amazon ECR +Title: Find Amazon ECR Image Scan Findings for Recent Images \ No newline at end of file diff --git a/queries/aws_ecr_registry_scanning_configuration_1.yaml b/queries/aws_ecr_registry_scanning_configuration_1.yaml old mode 100755 new mode 100644 index ad00aa0d4..bbc9561ba --- a/queries/aws_ecr_registry_scanning_configuration_1.yaml +++ b/queries/aws_ecr_registry_scanning_configuration_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS ECR Registry Scanning Configuration at the - private registry level on a per-region basis. +Description: Allows users to query AWS ECR Registry Scanning Configuration at the private registry level on a per-region basis. ID: aws_ecr_registry_scanning_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n registry_id,\n jsonb_pretty(scanning_configuration),\n\ - \ region\nfrom\n aws_ecr_registry_scanning_configuration;" + QueryToExecute: | + SELECT + registry_id, + jsonb_pretty(scanning_configuration), + region + FROM + aws_ecr_registry_scanning_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECR -Title: List AWS ECR Registry Scanning Configurations by Region + - ECR +Title: List AWS ECR Registry Scanning Configurations by Region \ No newline at end of file diff --git a/queries/aws_ecr_registry_scanning_configuration_2.yaml b/queries/aws_ecr_registry_scanning_configuration_2.yaml old mode 100755 new mode 100644 index 7d1daace7..42e487953 --- a/queries/aws_ecr_registry_scanning_configuration_2.yaml +++ b/queries/aws_ecr_registry_scanning_configuration_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS ECR Registry Scanning Configuration at the - private registry level on a per-region basis. +Description: Allows users to query AWS ECR Registry Scanning Configuration at the private registry level on a per-region basis. ID: aws_ecr_registry_scanning_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n registry_id,\n jsonb_pretty(scanning_configuration),\n\ - \ region\nfrom\n aws_ecr_registry_scanning_configuration\nwhere\n region =\ - \ 'ap-south-1';" + QueryToExecute: | + SELECT + registry_id, + jsonb_pretty(scanning_configuration), + region + FROM + aws_ecr_registry_scanning_configuration + WHERE + region = 'ap-south-1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECR -Title: Find AWS ECR Registry Scanning Configuration per Region + - ECR +Title: Find AWS ECR Registry Scanning Configuration per Region \ No newline at end of file diff --git a/queries/aws_ecr_registry_scanning_configuration_3.yaml b/queries/aws_ecr_registry_scanning_configuration_3.yaml old mode 100755 new mode 100644 index 7d7ca0c69..699fdfdf3 --- a/queries/aws_ecr_registry_scanning_configuration_3.yaml +++ b/queries/aws_ecr_registry_scanning_configuration_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS ECR Registry Scanning Configuration at the - private registry level on a per-region basis. +Description: Allows users to query AWS ECR Registry Scanning Configuration at the private registry level on a per-region basis. ID: aws_ecr_registry_scanning_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n registry_id,\n region\nfrom\n aws_ecr_registry_scanning_configuration\n\ - where\n scanning_configuration ->> 'ScanType' = 'ENHANCED'" + QueryToExecute: | + SELECT + registry_id, + region + FROM + aws_ecr_registry_scanning_configuration + WHERE + scanning_configuration ->> 'ScanType' = 'ENHANCED' Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECR Registry -Title: Query AWS ECR Registry Scanning Configuration by Region + - ECR Registry +Title: Query AWS ECR Registry Scanning Configuration by Region \ No newline at end of file diff --git a/queries/aws_ecr_repository_1.yaml b/queries/aws_ecr_repository_1.yaml old mode 100755 new mode 100644 index b6f0d49ba..896af9e2d --- a/queries/aws_ecr_repository_1.yaml +++ b/queries/aws_ecr_repository_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n registry_id,\n arn,\n repository_uri,\n\ - \ created_at,\n region,\n account_id\nfrom\n aws_ecr_repository;" + QueryToExecute: | + SELECT + repository_name, + registry_id, + arn, + repository_uri, + created_at, + region, + account_id + FROM + aws_ecr_repository; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List all AWS ECR Repositories and Retrieve Details + - Elastic Container Registry +Title: List all AWS ECR Repositories and Retrieve Details \ No newline at end of file diff --git a/queries/aws_ecr_repository_10.yaml b/queries/aws_ecr_repository_10.yaml old mode 100755 new mode 100644 index 1314cd032..17fc44e5d --- a/queries/aws_ecr_repository_10.yaml +++ b/queries/aws_ecr_repository_10.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n r ->> 'RepositoryArn' as repository_arn,\n\ - \ r ->> 'ScanFrequency' as scan_frequency\nfrom\n aws_ecr_repository,\n jsonb_array_elements(repository_scanning_configuration\ - \ -> 'ScanningConfigurations') as r\nwhere\n r ->> 'ScanFrequency' = 'MANUAL';" + QueryToExecute: | + SELECT + repository_name, + r ->> 'RepositoryArn' AS repository_arn, + r ->> 'ScanFrequency' AS scan_frequency + FROM + aws_ecr_repository, + JSONB_ARRAY_ELEMENTS(repository_scanning_configuration -> 'ScanningConfigurations') AS r + WHERE + r ->> 'ScanFrequency' = 'MANUAL'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry (ECR) -Title: List all AWS ECR Repositories with Detailed Information + - Elastic Container Registry (ECR) +Title: List all AWS ECR Repositories with Detailed Information \ No newline at end of file diff --git a/queries/aws_ecr_repository_11.yaml b/queries/aws_ecr_repository_11.yaml old mode 100755 new mode 100644 index 449cee951..84ab8f69d --- a/queries/aws_ecr_repository_11.yaml +++ b/queries/aws_ecr_repository_11.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n r ->> 'RepositoryArn' as repository_arn,\n\ - \ r ->> 'ScanOnPush' as scan_on_push\nfrom\n aws_ecr_repository,\n jsonb_array_elements(repository_scanning_configuration\ - \ -> 'ScanningConfigurations') as r\nwhere\n r ->> 'ScanOnPush' = 'false';" + QueryToExecute: | + SELECT + repository_name, + r ->> 'RepositoryArn' AS repository_arn, + r ->> 'ScanOnPush' AS scan_on_push + FROM + aws_ecr_repository, + JSONB_ARRAY_ELEMENTS(repository_scanning_configuration -> 'ScanningConfigurations') AS r + WHERE + r ->> 'ScanOnPush' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List AWS ECR Repositories and their Scan Status + - Elastic Container Registry +Title: List AWS ECR Repositories and their Scan Status \ No newline at end of file diff --git a/queries/aws_ecr_repository_2.yaml b/queries/aws_ecr_repository_2.yaml old mode 100755 new mode 100644 index f60eed46d..6683f5fcc --- a/queries/aws_ecr_repository_2.yaml +++ b/queries/aws_ecr_repository_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n encryption_configuration ->> 'EncryptionType'\ - \ as encryption_type,\n encryption_configuration ->> 'KmsKey' as kms_key\nfrom\n\ - \ aws_ecr_repository\nwhere\n encryption_configuration ->> 'EncryptionType'\ - \ = 'AES256';" + QueryToExecute: | + SELECT + repository_name, + encryption_configuration ->> 'EncryptionType' AS encryption_type, + encryption_configuration ->> 'KmsKey' AS kms_key + FROM + aws_ecr_repository + WHERE + encryption_configuration ->> 'EncryptionType' = 'AES256'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find AWS ECR Repositories with AES256 Encryption + - Elastic Container Registry +Title: Find AWS ECR Repositories with AES256 Encryption \ No newline at end of file diff --git a/queries/aws_ecr_repository_3.yaml b/queries/aws_ecr_repository_3.yaml old mode 100755 new mode 100644 index 58a712f04..445010585 --- a/queries/aws_ecr_repository_3.yaml +++ b/queries/aws_ecr_repository_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_scanning_configuration ->>\ - \ 'ScanOnPush' as scan_on_push\nfrom\n aws_ecr_repository\nwhere\n image_scanning_configuration\ - \ ->> 'ScanOnPush' = 'false';" + QueryToExecute: | + SELECT + repository_name, + image_scanning_configuration ->> 'ScanOnPush' AS scan_on_push + FROM + aws_ecr_repository + WHERE + image_scanning_configuration ->> 'ScanOnPush' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find AWS ECR Repositories Not Scanning on Push + - Elastic Container Registry +Title: Find AWS ECR Repositories Not Scanning on Push \ No newline at end of file diff --git a/queries/aws_ecr_repository_4.yaml b/queries/aws_ecr_repository_4.yaml old mode 100755 new mode 100644 index 33f5a7cba..16e125429 --- a/queries/aws_ecr_repository_4.yaml +++ b/queries/aws_ecr_repository_4.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.repository_name as repository_name,\n i.image_digest\ - \ as image_digest,\n i.image_tags as image_tags,\n i.image_pushed_at as image_pushed_at,\n\ - \ i.image_size_in_bytes as image_size_in_bytes,\n i.last_recorded_pull_time\ - \ as last_recorded_pull_time,\n i.registry_id as registry_id,\n i.image_scan_status\ - \ as image_scan_status\nfrom\n aws_ecr_repository as r,\n aws_ecr_image as i\n\ - where\n r.repository_name = i.repository_name;" + QueryToExecute: | + SELECT + r.repository_name AS repository_name, + i.image_digest AS image_digest, + i.image_tags AS image_tags, + i.image_pushed_at AS image_pushed_at, + i.image_size_in_bytes AS image_size_in_bytes, + i.last_recorded_pull_time AS last_recorded_pull_time, + i.registry_id AS registry_id, + i.image_scan_status AS image_scan_status + FROM + aws_ecr_repository AS r, + aws_ecr_image AS i + WHERE + r.repository_name = i.repository_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List All AWS ECR Repositories and Retrieve Details + - Elastic Container Registry +Title: List All AWS ECR Repositories and Retrieve Details \ No newline at end of file diff --git a/queries/aws_ecr_repository_5.yaml b/queries/aws_ecr_repository_5.yaml old mode 100755 new mode 100644 index f830ffca4..a64040b65 --- a/queries/aws_ecr_repository_5.yaml +++ b/queries/aws_ecr_repository_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.repository_name as repository_name,\n i.image_digest\ - \ as image_digest,\n i.image_scan_status as image_scan_status\nfrom\n aws_ecr_repository\ - \ as r,\n aws_ecr_image as i\nwhere\n r.repository_name = i.repository_name\n\ - \ and i.image_scan_status ->> 'Status' = 'FAILED';" + QueryToExecute: | + SELECT + r.repository_name AS repository_name, + i.image_digest AS image_digest, + i.image_scan_status AS image_scan_status + FROM + aws_ecr_repository AS r, + aws_ecr_image AS i + WHERE + r.repository_name = i.repository_name + AND i.image_scan_status ->> 'Status' = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find AWS ECR Repositories with Failed Image Scans + - Elastic Container Registry +Title: Find AWS ECR Repositories with Failed Image Scans \ No newline at end of file diff --git a/queries/aws_ecr_repository_6.yaml b/queries/aws_ecr_repository_6.yaml old mode 100755 new mode 100644 index 13356f3a4..7579e4d90 --- a/queries/aws_ecr_repository_6.yaml +++ b/queries/aws_ecr_repository_6.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n image_tag_mutability\nfrom\n aws_ecr_repository\n\ - where\n image_tag_mutability = 'IMMUTABLE';" + QueryToExecute: | + SELECT + repository_name, + image_tag_mutability + FROM + aws_ecr_repository + WHERE + image_tag_mutability = 'IMMUTABLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List all AWS ECR Repositories with Immutable Tags + - Elastic Container Registry +Title: List all AWS ECR Repositories with Immutable Tags \ No newline at end of file diff --git a/queries/aws_ecr_repository_7.yaml b/queries/aws_ecr_repository_7.yaml old mode 100755 new mode 100644 index fbab131cf..a032a83ee --- a/queries/aws_ecr_repository_7.yaml +++ b/queries/aws_ecr_repository_7.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n r -> 'selection' ->> 'tagStatus'\ - \ as tag_status,\n r -> 'selection' ->> 'countType' as count_type\nfrom\n aws_ecr_repository,\n\ - \ jsonb_array_elements(lifecycle_policy -> 'rules') as r\nwhere\n (\n (r\ - \ -> 'selection' ->> 'tagStatus' <> 'untagged')\n and (\n r -> 'selection'\ - \ ->> 'countType' <> 'sinceImagePushed'\n )\n );" + QueryToExecute: | + SELECT + repository_name, + r -> 'selection' ->> 'tagStatus' AS tag_status, + r -> 'selection' ->> 'countType' AS count_type + FROM + aws_ecr_repository, + jsonb_array_elements(lifecycle_policy -> 'rules') AS r + WHERE + ( + (r -> 'selection' ->> 'tagStatus' <> 'untagged') + AND ( + r -> 'selection' ->> 'countType' <> 'sinceImagePushed' + ) + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: List all AWS ECR Repositories and Retrieve Detailed Information + - Elastic Container Registry +Title: List all AWS ECR Repositories and Retrieve Detailed Information \ No newline at end of file diff --git a/queries/aws_ecr_repository_8.yaml b/queries/aws_ecr_repository_8.yaml old mode 100755 new mode 100644 index a3a6469cc..682f0dbe2 --- a/queries/aws_ecr_repository_8.yaml +++ b/queries/aws_ecr_repository_8.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_ecr_repository,\n\ - \ jsonb_array_elements(policy -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n s ->> 'Effect' = 'Allow'\n and a in ('*', 'ecr:*');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_ecr_repository, + jsonb_array_elements(policy -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND a IN ('*', 'ecr:*'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find AWS ECR Repositories Details with SQL Query + - Elastic Container Registry +Title: Find AWS ECR Repositories Details with SQL Query \ No newline at end of file diff --git a/queries/aws_ecr_repository_9.yaml b/queries/aws_ecr_repository_9.yaml old mode 100755 new mode 100644 index 317340179..f3c6864d6 --- a/queries/aws_ecr_repository_9.yaml +++ b/queries/aws_ecr_repository_9.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories - and retrieve detailed information about each repository. +Description: Allows users to query AWS Elastic Container Registry (ECR) Repositories and retrieve detailed information about each repository. ID: aws_ecr_repository_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n r ->> 'AppliedScanFilters' as applied_scan_filters,\n\ - \ r ->> 'RepositoryArn' as repository_arn,\n r ->> 'ScanFrequency' as scan_frequency,\n\ - \ r ->> 'ScanOnPush' as scan_on_push\nfrom\n aws_ecr_repository,\n jsonb_array_elements(repository_scanning_configuration\ - \ -> 'ScanningConfigurations') as r;" + QueryToExecute: | + SELECT + repository_name, + r ->> 'AppliedScanFilters' AS applied_scan_filters, + r ->> 'RepositoryArn' AS repository_arn, + r ->> 'ScanFrequency' AS scan_frequency, + r ->> 'ScanOnPush' AS scan_on_push + FROM + aws_ecr_repository, + jsonb_array_elements(repository_scanning_configuration -> 'ScanningConfigurations') AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry -Title: Find All Repositories in AWS ECR with Details + - Elastic Container Registry +Title: Find All Repositories in AWS ECR with Details \ No newline at end of file diff --git a/queries/aws_ecrpublic_repository_1.yaml b/queries/aws_ecrpublic_repository_1.yaml old mode 100755 new mode 100644 index 0006fd0f1..aa77369cf --- a/queries/aws_ecrpublic_repository_1.yaml +++ b/queries/aws_ecrpublic_repository_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Elastic Container Registry Public Repository - to get detailed information about each ECR public repository within an AWS account. +Description: Allows users to query AWS Elastic Container Registry Public Repository to get detailed information about each ECR public repository within an AWS account. ID: aws_ecrpublic_repository_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n repository_name,\n registry_id,\n arn,\n repository_uri,\n\ - \ created_at,\n region,\n account_id\nfrom\n aws_ecrpublic_repository;" + QueryToExecute: | + SELECT + repository_name, + registry_id, + arn, + repository_uri, + created_at, + region, + account_id + FROM + aws_ecrpublic_repository; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry Public -Title: Find all AWS Elastic Container Registry Public Repositories + - Elastic Container Registry Public +Title: Find all AWS Elastic Container Registry Public Repositories \ No newline at end of file diff --git a/queries/aws_ecrpublic_repository_2.yaml b/queries/aws_ecrpublic_repository_2.yaml old mode 100755 new mode 100644 index 53b6d66ca..1214d22a3 --- a/queries/aws_ecrpublic_repository_2.yaml +++ b/queries/aws_ecrpublic_repository_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Elastic Container Registry Public Repository - to get detailed information about each ECR public repository within an AWS account. +Description: Allows users to query AWS Elastic Container Registry Public Repository to get detailed information about each ECR public repository within an AWS account. ID: aws_ecrpublic_repository_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_ecrpublic_repository,\n\ - \ jsonb_array_elements(policy -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n s ->> 'Effect' = 'Allow'\n and a in ('*', 'ecr-public:*');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_ecrpublic_repository, + jsonb_array_elements(policy -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND a IN ('*', 'ecr-public:*'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Registry Public -Title: Query Detailed Info for AWS ECR Public Repositories + - Elastic Container Registry Public +Title: Query Detailed Info for AWS ECR Public Repositories \ No newline at end of file diff --git a/queries/aws_ecs_cluster_1.yaml b/queries/aws_ecs_cluster_1.yaml old mode 100755 new mode 100644 index 4849437e9..74d7d4382 --- a/queries/aws_ecs_cluster_1.yaml +++ b/queries/aws_ecs_cluster_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS ECS Clusters to retrieve detailed information - about each cluster''s configuration, status, and associated resources. +Description: Allows users to query AWS ECS Clusters to retrieve detailed information about each cluster's configuration, status, and associated resources. ID: aws_ecs_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_arn,\n cluster_name,\n active_services_count,\n\ - \ attachments,\n attachments_status,\n status\nfrom\n aws_ecs_cluster;" + QueryToExecute: | + SELECT + cluster_arn, + cluster_name, + active_services_count, + attachments, + attachments_status, + status + FROM + aws_ecs_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List AWS ECS Clusters and Their Configuration Status + - ECS +Title: List AWS ECS Clusters and Their Configuration Status \ No newline at end of file diff --git a/queries/aws_ecs_cluster_2.yaml b/queries/aws_ecs_cluster_2.yaml old mode 100755 new mode 100644 index 68b3715a5..95e9ed03d --- a/queries/aws_ecs_cluster_2.yaml +++ b/queries/aws_ecs_cluster_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS ECS Clusters to retrieve detailed information - about each cluster''s configuration, status, and associated resources. +Description: Allows users to query AWS ECS Clusters to retrieve detailed information about each cluster's configuration, status, and associated resources. ID: aws_ecs_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_arn,\n status\nfrom\n aws_ecs_cluster\nwhere\n\ - \ status = 'FAILED';" + QueryToExecute: | + SELECT + cluster_arn, + status + FROM + aws_ecs_cluster + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Clusters with Detailed Information + - ECS +Title: Find AWS ECS Clusters with Detailed Information \ No newline at end of file diff --git a/queries/aws_ecs_cluster_3.yaml b/queries/aws_ecs_cluster_3.yaml old mode 100755 new mode 100644 index 6a8bef33d..cea0e0f7a --- a/queries/aws_ecs_cluster_3.yaml +++ b/queries/aws_ecs_cluster_3.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS ECS Clusters to retrieve detailed information - about each cluster''s configuration, status, and associated resources. +Description: Allows users to query AWS ECS Clusters to retrieve detailed information about each cluster's configuration, status, and associated resources. ID: aws_ecs_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_arn,\n attachment ->> 'id' as attachment_id,\n\ - \ attachment ->> 'status' as attachment_status,\n attachment ->> 'type' as attachment_type\n\ - from\n aws_ecs_cluster,\n jsonb_array_elements(attachments) as attachment;" + QueryToExecute: | + SELECT + cluster_arn, + attachment ->> 'id' AS attachment_id, + attachment ->> 'status' AS attachment_status, + attachment ->> 'type' AS attachment_type + FROM + aws_ecs_cluster, + jsonb_array_elements(attachments) AS attachment; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List all AWS ECS Clusters with detailed configuration and status + - ECS +Title: List all AWS ECS Clusters with detailed configuration and status \ No newline at end of file diff --git a/queries/aws_ecs_cluster_4.yaml b/queries/aws_ecs_cluster_4.yaml old mode 100755 new mode 100644 index 7509bd2cb..ca86b0ffe --- a/queries/aws_ecs_cluster_4.yaml +++ b/queries/aws_ecs_cluster_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS ECS Clusters to retrieve detailed information - about each cluster''s configuration, status, and associated resources. +Description: Allows users to query AWS ECS Clusters to retrieve detailed information about each cluster's configuration, status, and associated resources. ID: aws_ecs_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_arn,\n setting ->> 'Name' as name,\n setting\ - \ ->> 'Value' as value\nfrom\n aws_ecs_cluster,\n jsonb_array_elements(settings)\ - \ as setting\nwhere\n setting ->> 'Value' = 'disabled';" + QueryToExecute: | + SELECT + cluster_arn, + setting ->> 'Name' AS name, + setting ->> 'Value' AS value + FROM + aws_ecs_cluster, + jsonb_array_elements(settings) AS setting + WHERE + setting ->> 'Value' = 'disabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Clusters Configuration and Status + - ECS +Title: Find AWS ECS Clusters Configuration and Status \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_1.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_1.yaml old mode 100755 new mode 100644 index 9a057c816..ab8861038 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_1.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query ECS Cluster CPU Utilization Metrics for a specified - period. +Description: Allows users to query ECS Cluster CPU Utilization Metrics for a specified period. ID: aws_ecs_cluster_metric_cpu_utilization_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization\n\ - order by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Cluster CPU Utilization Metrics for a Period + - ECS +Title: Find AWS ECS Cluster CPU Utilization Metrics for a Period \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_2.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_2.yaml old mode 100755 new mode 100644 index 4cb1ca0f5..79183ce8f --- a/queries/aws_ecs_cluster_metric_cpu_utilization_2.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query ECS Cluster CPU Utilization Metrics for a specified - period. +Description: Allows users to query ECS Cluster CPU Utilization Metrics for a specified period. ID: aws_ecs_cluster_metric_cpu_utilization_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization\n\ - where\n average > 80\norder by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization + WHERE + AVERAGE > 80 + ORDER BY + cluster_name, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find ECS Cluster CPU Utilization Metrics Over Period + - ECS +Title: Find ECS Cluster CPU Utilization Metrics Over Period \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_1.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_1.yaml old mode 100755 new mode 100644 index 2c8497764..c2c527703 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_1.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, - specifically CPU utilization on a daily basis. +Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, specifically CPU utilization on a daily basis. ID: aws_ecs_cluster_metric_cpu_utilization_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_daily\n\ - order by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_daily + ORDER BY + cluster_name, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: List all AWS ECS Cluster Metrics for Daily CPU Utilization + - Elastic Container Service +Title: List all AWS ECS Cluster Metrics for Daily CPU Utilization \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_2.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_2.yaml old mode 100755 new mode 100644 index eea5aa8fd..2ebb84d30 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_2.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, - specifically CPU utilization on a daily basis. +Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, specifically CPU utilization on a daily basis. ID: aws_ecs_cluster_metric_cpu_utilization_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_daily\n\ - where\n average > 80\norder by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_daily + WHERE + AVERAGE > 80 + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: List all AWS ECS Cluster Metrics for Daily CPU Utilization + - Elastic Container Service +Title: List all AWS ECS Cluster Metrics for Daily CPU Utilization \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_3.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_3.yaml old mode 100755 new mode 100644 index c46320b27..b7031eec0 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_daily_3.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_daily_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, - specifically CPU utilization on a daily basis. +Description: Allows users to query AWS Elastic Container Service (ECS) Cluster Metrics, specifically CPU utilization on a daily basis. ID: aws_ecs_cluster_metric_cpu_utilization_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_daily\n\ - where\n average < 1\norder by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_daily + WHERE + AVERAGE < 1 + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: Find AWS ECS Cluster Daily CPU Utilization Metrics + - Elastic Container Service +Title: Find AWS ECS Cluster Daily CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_1.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_1.yaml old mode 100755 new mode 100644 index 140c0a4a0..f17d2861a --- a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_1.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly - basis. +Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly basis. ID: aws_ecs_cluster_metric_cpu_utilization_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_hourly\n\ - order by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_hourly + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ECS -Title: List AWS ECS Cluster Hourly CPU Utilization Metrics + - Amazon ECS +Title: List AWS ECS Cluster Hourly CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_2.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_2.yaml old mode 100755 new mode 100644 index 1d91c700f..76271ed25 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_2.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly - basis. +Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly basis. ID: aws_ecs_cluster_metric_cpu_utilization_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_hourly\n\ - where\n average > 80\norder by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_hourly + WHERE + AVERAGE > 80 + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List AWS ECS Cluster CPU Utilization Metrics Hourly + - ECS +Title: List AWS ECS Cluster CPU Utilization Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_3.yaml b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_3.yaml old mode 100755 new mode 100644 index 2143f92e7..bcc3fcbb0 --- a/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_3.yaml +++ b/queries/aws_ecs_cluster_metric_cpu_utilization_hourly_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly - basis. +Description: Allows users to query AWS ECS Cluster CPU Utilization Metrics on an hourly basis. ID: aws_ecs_cluster_metric_cpu_utilization_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_ecs_cluster_metric_cpu_utilization_hourly\n\ - where\n average < 1\norder by\n cluster_name,\n timestamp;" + QueryToExecute: | + SELECT + cluster_name, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_ecs_cluster_metric_cpu_utilization_hourly + WHERE + AVERAGE < 1 + ORDER BY + cluster_name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Cluster CPU Utilization Metrics Hourly + - ECS +Title: Find AWS ECS Cluster CPU Utilization Metrics Hourly \ No newline at end of file diff --git a/queries/aws_ecs_container_instance_1.yaml b/queries/aws_ecs_container_instance_1.yaml old mode 100755 new mode 100644 index f880e8944..239cfd542 --- a/queries/aws_ecs_container_instance_1.yaml +++ b/queries/aws_ecs_container_instance_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS ECS Container Instance to retrieve data about - the Amazon Elastic Container Service (ECS) container instances. This includes information - about the container instance ARN, status, running tasks count, pending tasks count, - agent connected status, and more. +Description: Allows users to query AWS ECS Container Instance to retrieve data about the Amazon Elastic Container Service (ECS) container instances. This includes information about the container instance ARN, status, running tasks count, pending tasks count, agent connected status, and more. ID: aws_ecs_container_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n ec2_instance_id,\n status,\n status_reason,\n\ - \ running_tasks_count,\n pending_tasks_count\nfrom\n aws_ecs_container_instance;" + QueryToExecute: | + SELECT + arn, + ec2_instance_id, + status, + status_reason, + running_tasks_count, + pending_tasks_count + FROM + aws_ecs_container_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Service (ECS) -Title: Find All Running and Pending Tasks for AWS ECS Instances + - Amazon Elastic Container Service (ECS) +Title: Find All Running and Pending Tasks for AWS ECS Instances \ No newline at end of file diff --git a/queries/aws_ecs_container_instance_2.yaml b/queries/aws_ecs_container_instance_2.yaml old mode 100755 new mode 100644 index 07a91d759..b6ddc85d5 --- a/queries/aws_ecs_container_instance_2.yaml +++ b/queries/aws_ecs_container_instance_2.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS ECS Container Instance to retrieve data about - the Amazon Elastic Container Service (ECS) container instances. This includes information - about the container instance ARN, status, running tasks count, pending tasks count, - agent connected status, and more. +Description: Allows users to query AWS ECS Container Instance to retrieve data about the Amazon Elastic Container Service (ECS) container instances. This includes information about the container instance ARN, status, running tasks count, pending tasks count, agent connected status, and more. ID: aws_ecs_container_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n status_reason\nfrom\n aws_ecs_container_instance\n\ - where\n status = 'REGISTRATION_FAILED';" + QueryToExecute: | + SELECT + arn, + status, + status_reason + FROM + aws_ecs_container_instance + WHERE + status = 'REGISTRATION_FAILED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: Find All AWS ECS Container Instances with Registration Failed + - Elastic Container Service +Title: Find All AWS ECS Container Instances with Registration Failed \ No newline at end of file diff --git a/queries/aws_ecs_container_instance_3.yaml b/queries/aws_ecs_container_instance_3.yaml old mode 100755 new mode 100644 index df3e73ac2..b5effc602 --- a/queries/aws_ecs_container_instance_3.yaml +++ b/queries/aws_ecs_container_instance_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS ECS Container Instance to retrieve data about - the Amazon Elastic Container Service (ECS) container instances. This includes information - about the container instance ARN, status, running tasks count, pending tasks count, - agent connected status, and more. +Description: Allows users to query AWS ECS Container Instance to retrieve data about the Amazon Elastic Container Service (ECS) container instances. This includes information about the container instance ARN, status, running tasks count, pending tasks count, agent connected status, and more. ID: aws_ecs_container_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n attachment ->> 'id' as attachment_id,\n attachment\ - \ ->> 'status' as attachment_status,\n attachment ->> 'type' as attachment_type\n\ - from\n aws_ecs_container_instance,\n jsonb_array_elements(attachments) as attachment;" + QueryToExecute: | + SELECT + arn, + attachment ->> 'id' AS attachment_id, + attachment ->> 'status' AS attachment_status, + attachment ->> 'type' AS attachment_type + FROM + aws_ecs_container_instance, + jsonb_array_elements(attachments) AS attachment; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Service -Title: List all AWS ECS Container Instances with SQL + - Amazon Elastic Container Service +Title: List all AWS ECS Container Instances with SQL \ No newline at end of file diff --git a/queries/aws_ecs_container_instance_4.yaml b/queries/aws_ecs_container_instance_4.yaml old mode 100755 new mode 100644 index 2a72b50e7..22b1f77b7 --- a/queries/aws_ecs_container_instance_4.yaml +++ b/queries/aws_ecs_container_instance_4.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS ECS Container Instance to retrieve data about - the Amazon Elastic Container Service (ECS) container instances. This includes information - about the container instance ARN, status, running tasks count, pending tasks count, - agent connected status, and more. +Description: Allows users to query AWS ECS Container Instance to retrieve data about the Amazon Elastic Container Service (ECS) container instances. This includes information about the container instance ARN, status, running tasks count, pending tasks count, agent connected status, and more. ID: aws_ecs_container_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n setting ->> 'Name' as name,\n setting ->> 'Value'\ - \ as value\nfrom\n aws_ecs_container_instance,\n jsonb_array_elements(attributes)\ - \ as setting\nwhere\n setting ->> 'Name' = 'ecs.ami-id' and\n setting ->> 'Value'\ - \ = 'ami-0babb0c4a4e5769b8';" + QueryToExecute: | + SELECT + arn, + setting ->> 'Name' AS name, + setting ->> 'Value' AS value + FROM + aws_ecs_container_instance, + jsonb_array_elements(attributes) AS setting + WHERE + setting ->> 'Name' = 'ecs.ami-id' + AND setting ->> 'Value' = 'ami-0babb0c4a4e5769b8'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Elastic Container Service -Title: Find AWS ECS Container Instances with Specific AMI IDs + - Amazon Elastic Container Service +Title: Find AWS ECS Container Instances with Specific AMI IDs \ No newline at end of file diff --git a/queries/aws_ecs_service_1.yaml b/queries/aws_ecs_service_1.yaml old mode 100755 new mode 100644 index 5ef785abc..24bc8889e --- a/queries/aws_ecs_service_1.yaml +++ b/queries/aws_ecs_service_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve - information about the services within the ECS clusters. +Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve information about the services within the ECS clusters. ID: aws_ecs_service_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n cluster_arn,\n task_definition,\n\ - \ status\nfrom\n aws_ecs_service;" + QueryToExecute: | + SELECT + service_name, + arn, + cluster_arn, + task_definition, + status + FROM + aws_ecs_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: List all services within AWS Elastic Container Service + - Elastic Container Service +Title: List all services within AWS Elastic Container Service \ No newline at end of file diff --git a/queries/aws_ecs_service_2.yaml b/queries/aws_ecs_service_2.yaml old mode 100755 new mode 100644 index 0d45b4062..1fe141417 --- a/queries/aws_ecs_service_2.yaml +++ b/queries/aws_ecs_service_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve - information about the services within the ECS clusters. +Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve information about the services within the ECS clusters. ID: aws_ecs_service_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n launch_type,\n platform_version\n\ - from\n aws_ecs_service\nwhere\n launch_type = 'FARGATE'\n and platform_version\ - \ is not null;" + QueryToExecute: | + SELECT + service_name, + arn, + launch_type, + platform_version + FROM + aws_ecs_service + WHERE + launch_type = 'FARGATE' + AND platform_version IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: List all AWS ECS services in clusters + - Elastic Container Service +Title: List all AWS ECS services in clusters \ No newline at end of file diff --git a/queries/aws_ecs_service_3.yaml b/queries/aws_ecs_service_3.yaml old mode 100755 new mode 100644 index 7c2407668..33d725ffe --- a/queries/aws_ecs_service_3.yaml +++ b/queries/aws_ecs_service_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve - information about the services within the ECS clusters. +Description: Allows users to query AWS Elastic Container Service (ECS) to retrieve information about the services within the ECS clusters. ID: aws_ecs_service_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n arn,\n status\nfrom\n aws_ecs_service\n\ - where\n status = 'INACTIVE';" + QueryToExecute: | + SELECT + service_name, + arn, + status + FROM + aws_ecs_service + WHERE + status = 'INACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Container Service -Title: List all inactive services in AWS ECS clusters + - Elastic Container Service +Title: List all inactive services in AWS ECS clusters \ No newline at end of file diff --git a/queries/aws_ecs_task_1.yaml b/queries/aws_ecs_task_1.yaml old mode 100755 new mode 100644 index 14fa76cf7..9b37468db --- a/queries/aws_ecs_task_1.yaml +++ b/queries/aws_ecs_task_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS ECS Tasks to obtain detailed information about - each task, including its status, task definition, cluster, and other related metadata. +Description: Allows users to query AWS ECS Tasks to obtain detailed information about each task, including its status, task definition, cluster, and other related metadata. ID: aws_ecs_task_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n desired_status,\n launch_type,\n task_arn\n\ - from\n aws_ecs_task;" + QueryToExecute: | + SELECT + cluster_name, + desired_status, + launch_type, + task_arn + FROM + aws_ecs_task; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List all AWS ECS Tasks with their Status and Metadata + - ECS +Title: List all AWS ECS Tasks with their Status and Metadata \ No newline at end of file diff --git a/queries/aws_ecs_task_2.yaml b/queries/aws_ecs_task_2.yaml old mode 100755 new mode 100644 index 54ff205c7..5975895b9 --- a/queries/aws_ecs_task_2.yaml +++ b/queries/aws_ecs_task_2.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS ECS Tasks to obtain detailed information about - each task, including its status, task definition, cluster, and other related metadata. +Description: Allows users to query AWS ECS Tasks to obtain detailed information about each task, including its status, task definition, cluster, and other related metadata. ID: aws_ecs_task_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n task_arn,\n a ->> 'Id' as attachment_id,\n\ - \ a ->> 'Status' as attachment_status,\n a ->> 'Type' as attachment_type,\n\ - \ jsonb_pretty(a -> 'Details') as attachment_details\nfrom\n aws_ecs_task,\n\ - \ jsonb_array_elements(attachments) as a;" + QueryToExecute: | + SELECT + cluster_name, + task_arn, + a ->> 'Id' AS attachment_id, + a ->> 'Status' AS attachment_status, + a ->> 'Type' AS attachment_type, + jsonb_pretty(a -> 'Details') AS attachment_details + FROM + aws_ecs_task, + jsonb_array_elements(attachments) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List all AWS ECS Tasks with Status, Definition, and Metadata + - ECS +Title: List all AWS ECS Tasks with Status, Definition, and Metadata \ No newline at end of file diff --git a/queries/aws_ecs_task_3.yaml b/queries/aws_ecs_task_3.yaml old mode 100755 new mode 100644 index 1137885a0..fffa0cdc8 --- a/queries/aws_ecs_task_3.yaml +++ b/queries/aws_ecs_task_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS ECS Tasks to obtain detailed information about - each task, including its status, task definition, cluster, and other related metadata. +Description: Allows users to query AWS ECS Tasks to obtain detailed information about each task, including its status, task definition, cluster, and other related metadata. ID: aws_ecs_task_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n task_arn,\n protection ->> 'ProtectionEnabled'\ - \ as protection_enabled,\n protection ->> 'ExpirationDate' as protection_expiration_date\n\ - from\n aws_ecs_task;" + QueryToExecute: | + SELECT + cluster_name, + task_arn, + protection ->> 'ProtectionEnabled' AS protection_enabled, + protection ->> 'ExpirationDate' AS protection_expiration_date + FROM + aws_ecs_task; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List all AWS ECS Tasks with Detailed Metadata + - ECS +Title: List all AWS ECS Tasks with Detailed Metadata \ No newline at end of file diff --git a/queries/aws_ecs_task_definition_1.yaml b/queries/aws_ecs_task_definition_1.yaml old mode 100755 new mode 100644 index 629eb0c67..981be5695 --- a/queries/aws_ecs_task_definition_1.yaml +++ b/queries/aws_ecs_task_definition_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS ECS Task Definitions to gain insights into - the configuration of running tasks in an ECS service. The table provides details - such as task definition ARN, family, network mode, revision, status, and more. +Description: Allows users to query AWS ECS Task Definitions to gain insights into the configuration of running tasks in an ECS service. The table provides details such as task definition ARN, family, network mode, revision, status, and more. ID: aws_ecs_task_definition_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n task_definition_arn,\n cpu,\n network_mode,\n title,\n\ - \ status,\n tags\nfrom\n aws_ecs_task_definition;" + QueryToExecute: | + SELECT + task_definition_arn, + cpu, + network_mode, + title, + status, + tags + FROM + aws_ecs_task_definition; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List AWS ECS Task Definitions to Gain Service Insights + - ECS +Title: List AWS ECS Task Definitions to Gain Service Insights \ No newline at end of file diff --git a/queries/aws_ecs_task_definition_2.yaml b/queries/aws_ecs_task_definition_2.yaml old mode 100755 new mode 100644 index 70fa1134a..71c5513e4 --- a/queries/aws_ecs_task_definition_2.yaml +++ b/queries/aws_ecs_task_definition_2.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query AWS ECS Task Definitions to gain insights into - the configuration of running tasks in an ECS service. The table provides details - such as task definition ARN, family, network mode, revision, status, and more. +Description: Allows users to query AWS ECS Task Definitions to gain insights into the configuration of running tasks in an ECS service. The table provides details such as task definition ARN, family, network mode, revision, status, and more. ID: aws_ecs_task_definition_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n task_definition_arn,\n jsonb_array_length(container_definitions)\ - \ as num_of_conatiners\nfrom\n aws_ecs_task_definition;" + QueryToExecute: | + SELECT + task_definition_arn, + JSONB_ARRAY_LENGTH(container_definitions) AS num_of_containers + FROM + aws_ecs_task_definition; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Task Definitions Configuration Details + - ECS +Title: Find AWS ECS Task Definitions Configuration Details \ No newline at end of file diff --git a/queries/aws_ecs_task_definition_3.yaml b/queries/aws_ecs_task_definition_3.yaml old mode 100755 new mode 100644 index 267924abb..b72c2c2f0 --- a/queries/aws_ecs_task_definition_3.yaml +++ b/queries/aws_ecs_task_definition_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS ECS Task Definitions to gain insights into - the configuration of running tasks in an ECS service. The table provides details - such as task definition ARN, family, network mode, revision, status, and more. +Description: Allows users to query AWS ECS Task Definitions to gain insights into the configuration of running tasks in an ECS service. The table provides details such as task definition ARN, family, network mode, revision, status, and more. ID: aws_ecs_task_definition_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n task_definition_arn,\n cd ->> 'Privileged' as privileged,\n\ - \ cd ->> 'Name' as container_name\nfrom\n aws_ecs_task_definition,\n jsonb_array_elements(container_definitions)\ - \ as cd\nwhere\n cd ->> 'Privileged' = 'true';" + QueryToExecute: | + SELECT + task_definition_arn, + cd ->> 'Privileged' AS privileged, + cd ->> 'Name' AS container_name + FROM + aws_ecs_task_definition, + jsonb_array_elements(container_definitions) AS cd + WHERE + cd ->> 'Privileged' = 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: List all AWS ECS Task Definitions with Privileged Containers + - ECS +Title: List all AWS ECS Task Definitions with Privileged Containers \ No newline at end of file diff --git a/queries/aws_ecs_task_definition_4.yaml b/queries/aws_ecs_task_definition_4.yaml old mode 100755 new mode 100644 index aef2655c9..0f77dc1bf --- a/queries/aws_ecs_task_definition_4.yaml +++ b/queries/aws_ecs_task_definition_4.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS ECS Task Definitions to gain insights into - the configuration of running tasks in an ECS service. The table provides details - such as task definition ARN, family, network mode, revision, status, and more. +Description: Allows users to query AWS ECS Task Definitions to gain insights into the configuration of running tasks in an ECS service. The table provides details such as task definition ARN, family, network mode, revision, status, and more. ID: aws_ecs_task_definition_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n task_definition_arn,\n cd ->> 'Name' as container_name,\n\ - \ cd ->> 'LogConfiguration' as log_configuration\nfrom\n aws_ecs_task_definition,\n\ - \ jsonb_array_elements(container_definitions) as cd\nwhere\n cd ->> 'LogConfiguration'\ - \ is null;" + QueryToExecute: | + SELECT + task_definition_arn, + cd ->> 'Name' AS container_name, + cd ->> 'LogConfiguration' AS log_configuration + FROM + aws_ecs_task_definition, + JSONB_ARRAY_ELEMENTS(container_definitions) AS cd + WHERE + cd ->> 'LogConfiguration' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ECS -Title: Find AWS ECS Task Definitions Without Log Config + - ECS +Title: Find AWS ECS Task Definitions Without Log Config \ No newline at end of file diff --git a/queries/aws_efs_access_point_1.yaml b/queries/aws_efs_access_point_1.yaml old mode 100755 new mode 100644 index 74ef24154..05822bc0f --- a/queries/aws_efs_access_point_1.yaml +++ b/queries/aws_efs_access_point_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query Amazon EFS Access Points, providing detailed information - about each access point''s configuration, including the file system it is associated - with, its access point ID, and other related metadata. +Description: Allows users to query Amazon EFS Access Points, providing detailed information about each access point's configuration, including the file system it is associated with, its access point ID, and other related metadata. ID: aws_efs_access_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_id,\n access_point_arn,\n file_system_id,\n\ - \ life_cycle_state,\n owner_id,\n root_directory\nfrom\n aws_efs_access_point;" + QueryToExecute: | + SELECT + name, + access_point_id, + access_point_arn, + file_system_id, + life_cycle_state, + owner_id, + root_directory + FROM + aws_efs_access_point; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EFS -Title: List all Amazon EFS Access Points Configurations + - Amazon EFS +Title: List all Amazon EFS Access Points Configurations \ No newline at end of file diff --git a/queries/aws_efs_access_point_2.yaml b/queries/aws_efs_access_point_2.yaml old mode 100755 new mode 100644 index 3374b923b..a00c01157 --- a/queries/aws_efs_access_point_2.yaml +++ b/queries/aws_efs_access_point_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query Amazon EFS Access Points, providing detailed information - about each access point''s configuration, including the file system it is associated - with, its access point ID, and other related metadata. +Description: Allows users to query Amazon EFS Access Points, providing detailed information about each access point's configuration, including the file system it is associated with, its access point ID, and other related metadata. ID: aws_efs_access_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_id,\n file_system_id,\n owner_id,\n\ - \ root_directory\nfrom\n aws_efs_access_point" + QueryToExecute: | + SELECT + name, + access_point_id, + file_system_id, + owner_id, + root_directory + FROM + aws_efs_access_point Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EFS -Title: Find all Detailed Info About AWS EFS Access Points + - Amazon EFS +Title: Find all Detailed Info About AWS EFS Access Points \ No newline at end of file diff --git a/queries/aws_efs_access_point_3.yaml b/queries/aws_efs_access_point_3.yaml old mode 100755 new mode 100644 index 309e08e36..3dce8f047 --- a/queries/aws_efs_access_point_3.yaml +++ b/queries/aws_efs_access_point_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query Amazon EFS Access Points, providing detailed information - about each access point''s configuration, including the file system it is associated - with, its access point ID, and other related metadata. +Description: Allows users to query Amazon EFS Access Points, providing detailed information about each access point's configuration, including the file system it is associated with, its access point ID, and other related metadata. ID: aws_efs_access_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_id,\n life_cycle_state,\n file_system_id,\n\ - \ owner_id,\n root_directory\nfrom\n aws_efs_access_point\nwhere\n life_cycle_state\ - \ = 'error';" + QueryToExecute: | + SELECT + name, + access_point_id, + life_cycle_state, + file_system_id, + owner_id, + root_directory + FROM + aws_efs_access_point + WHERE + life_cycle_state = 'error'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EFS -Title: List all Amazon EFS Access Points with State 'Error' + - Amazon EFS +Title: List all Amazon EFS Access Points with State 'Error' \ No newline at end of file diff --git a/queries/aws_efs_file_system_1.yaml b/queries/aws_efs_file_system_1.yaml old mode 100755 new mode 100644 index 0bea63006..7365ffbc7 --- a/queries/aws_efs_file_system_1.yaml +++ b/queries/aws_efs_file_system_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n file_system_id,\n owner_id,\n automatic_backups,\n\ - \ creation_token,\n creation_time,\n life_cycle_state,\n number_of_mount_targets,\n\ - \ performance_mode,\n throughput_mode\nfrom\n aws_efs_file_system;" + QueryToExecute: | + SELECT + name, + file_system_id, + owner_id, + automatic_backups, + creation_token, + creation_time, + life_cycle_state, + number_of_mount_targets, + performance_mode, + throughput_mode + FROM + aws_efs_file_system; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System -Title: Find EFS File Systems with Details from AWS + - Elastic File System +Title: Find EFS File Systems with Details from AWS \ No newline at end of file diff --git a/queries/aws_efs_file_system_2.yaml b/queries/aws_efs_file_system_2.yaml old mode 100755 new mode 100644 index a0e7e29f9..e0b4f0246 --- a/queries/aws_efs_file_system_2.yaml +++ b/queries/aws_efs_file_system_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n file_system_id,\n encrypted,\n kms_key_id,\n region\n\ - from\n aws_efs_file_system\nwhere\n not encrypted;" + QueryToExecute: | + SELECT + file_system_id, + encrypted, + kms_key_id, + region + FROM + aws_efs_file_system + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System -Title: Find AWS EFS file systems with detailed information + - Elastic File System +Title: Find AWS EFS file systems with detailed information \ No newline at end of file diff --git a/queries/aws_efs_file_system_3.yaml b/queries/aws_efs_file_system_3.yaml old mode 100755 new mode 100644 index aefb3dc12..82805b10c --- a/queries/aws_efs_file_system_3.yaml +++ b/queries/aws_efs_file_system_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n file_system_id,\n size_in_bytes ->> 'Value' as data_size,\n\ - \ size_in_bytes ->> 'Timestamp' as data_size_timestamp,\n size_in_bytes ->>\ - \ 'ValueInIA' as data_size_infrequent_access_storage,\n size_in_bytes ->> 'ValueInStandard'\ - \ as data_size_standard_storage\nfrom\n aws_efs_file_system;" + QueryToExecute: | + SELECT + file_system_id, + size_in_bytes ->> 'Value' AS data_size, + size_in_bytes ->> 'Timestamp' AS data_size_timestamp, + size_in_bytes ->> 'ValueInIA' AS data_size_infrequent_access_storage, + size_in_bytes ->> 'ValueInStandard' AS data_size_standard_storage + FROM + aws_efs_file_system; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System -Title: Find detailed info about AWS EFS file systems + - Elastic File System +Title: Find detailed info about AWS EFS file systems \ No newline at end of file diff --git a/queries/aws_efs_file_system_4.yaml b/queries/aws_efs_file_system_4.yaml old mode 100755 new mode 100644 index cd006ecc6..20710b342 --- a/queries/aws_efs_file_system_4.yaml +++ b/queries/aws_efs_file_system_4.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_efs_file_system,\n\ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n a in ('elasticfilesystem:clientrootaccess');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_efs_file_system, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + a IN ('elasticfilesystem:clientrootaccess'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System -Title: Find AWS EFS File System with Specific Client Root Access + - Elastic File System +Title: Find AWS EFS File System with Specific Client Root Access \ No newline at end of file diff --git a/queries/aws_efs_file_system_5.yaml b/queries/aws_efs_file_system_5.yaml old mode 100755 new mode 100644 index a0efac226..2d272dff1 --- a/queries/aws_efs_file_system_5.yaml +++ b/queries/aws_efs_file_system_5.yaml @@ -1,26 +1,39 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title\nfrom\n aws_efs_file_system\nwhere\n title not\ - \ in (\n select\n title\n from\n aws_efs_file_system,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a,\n jsonb_array_elements_text(\n\ - \ s -> 'Condition' -> 'Bool' -> 'aws:securetransport'\n ) as ssl\n\ - \ where\n p = '*'\n and s ->> 'Effect' = 'Deny'\n and ssl ::\ - \ bool = false\n );" + QueryToExecute: | + SELECT + title + FROM + aws_efs_file_system + WHERE + title NOT IN ( + SELECT + title + FROM + aws_efs_file_system, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a, + jsonb_array_elements_text( + s -> 'Condition' -> 'Bool' -> 'aws:securetransport' + ) AS ssl + WHERE + p = '*' + AND s ->> 'Effect' = 'Deny' + AND ssl::bool = FALSE + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System -Title: List all AWS EFS File Systems with Detailed Information + - Elastic File System +Title: List all AWS EFS File Systems with Detailed Information \ No newline at end of file diff --git a/queries/aws_efs_file_system_6.yaml b/queries/aws_efs_file_system_6.yaml old mode 100755 new mode 100644 index 45ed36c41..20d032ce9 --- a/queries/aws_efs_file_system_6.yaml +++ b/queries/aws_efs_file_system_6.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Elastic File System (EFS) file systems, providing - detailed information about each file system such as its ID, ARN, creation token, - performance mode, and lifecycle state. +Description: Allows users to query AWS Elastic File System (EFS) file systems, providing detailed information about each file system such as its ID, ARN, creation token, performance mode, and lifecycle state. ID: aws_efs_file_system_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n automatic_backups,\n arn,\n file_system_id\n\ - from\n aws_efs_file_system\nwhere\n automatic_backups = 'enabled';" + QueryToExecute: | + SELECT + name, + automatic_backups, + arn, + file_system_id + FROM + aws_efs_file_system + WHERE + automatic_backups = 'enabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic File System (EFS) -Title: List AWS EFS file systems with automatic backups enabled + - Elastic File System (EFS) +Title: List AWS EFS file systems with automatic backups enabled \ No newline at end of file diff --git a/queries/aws_efs_mount_target_1.yaml b/queries/aws_efs_mount_target_1.yaml old mode 100755 new mode 100644 index 2dbddd193..ea76db088 --- a/queries/aws_efs_mount_target_1.yaml +++ b/queries/aws_efs_mount_target_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EFS Mount Targets for detailed information - about each mount target''s configuration, status, and associated resources. +Description: Allows users to query AWS EFS Mount Targets for detailed information about each mount target's configuration, status, and associated resources. ID: aws_efs_mount_target_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n mount_target_id,\n file_system_id,\n life_cycle_state,\n\ - \ availability_zone_id,\n availability_zone_name\nfrom\n aws_efs_mount_target;" + QueryToExecute: | + SELECT + mount_target_id, + file_system_id, + life_cycle_state, + availability_zone_id, + availability_zone_name + FROM + aws_efs_mount_target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EFS -Title: Find AWS EFS Mount Targets Configuration and Status + - EFS +Title: Find AWS EFS Mount Targets Configuration and Status \ No newline at end of file diff --git a/queries/aws_efs_mount_target_2.yaml b/queries/aws_efs_mount_target_2.yaml old mode 100755 new mode 100644 index 17f93fdd3..6088a39f5 --- a/queries/aws_efs_mount_target_2.yaml +++ b/queries/aws_efs_mount_target_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EFS Mount Targets for detailed information - about each mount target''s configuration, status, and associated resources. +Description: Allows users to query AWS EFS Mount Targets for detailed information about each mount target's configuration, status, and associated resources. ID: aws_efs_mount_target_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n mount_target_id,\n network_interface_id,\n subnet_id,\n\ - \ vpc_id\nfrom\n aws_efs_mount_target;" + QueryToExecute: | + SELECT + mount_target_id, + network_interface_id, + subnet_id, + vpc_id + FROM + aws_efs_mount_target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EFS Mount Targets -Title: Find AWS EFS Mount Targets Configuration and Status + - EFS Mount Targets +Title: Find AWS EFS Mount Targets Configuration and Status \ No newline at end of file diff --git a/queries/aws_eks_addon_1.yaml b/queries/aws_eks_addon_1.yaml old mode 100755 new mode 100644 index a3c1c16bc..22ecf4743 --- a/queries/aws_eks_addon_1.yaml +++ b/queries/aws_eks_addon_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons - associated with each Amazon EKS cluster. +Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons associated with each Amazon EKS cluster. ID: aws_eks_addon_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n addon_name,\n arn,\n addon_version,\n cluster_name,\n\ - \ status,\n service_account_role_arn\nfrom\n aws_eks_addon;" + QueryToExecute: | + SELECT + addon_name, + arn, + addon_version, + cluster_name, + status, + service_account_role_arn + FROM + aws_eks_addon; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EKS -Title: Find AWS EKS Add-Ons Information + - Amazon EKS +Title: Find AWS EKS Add-Ons Information \ No newline at end of file diff --git a/queries/aws_eks_addon_2.yaml b/queries/aws_eks_addon_2.yaml old mode 100755 new mode 100644 index c8a30c82c..bb6209675 --- a/queries/aws_eks_addon_2.yaml +++ b/queries/aws_eks_addon_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons - associated with each Amazon EKS cluster. +Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons associated with each Amazon EKS cluster. ID: aws_eks_addon_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n addon_name,\n arn,\n cluster_name,\n status\nfrom\n\ - \ aws_eks_addon\nwhere\n status <> 'ACTIVE';" + QueryToExecute: | + SELECT + addon_name, + arn, + cluster_name, + status + FROM + aws_eks_addon + WHERE + status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EKS -Title: Find all AWS EKS add-ons associated with EKS clusters + - Amazon EKS +Title: Find all AWS EKS add-ons associated with EKS clusters \ No newline at end of file diff --git a/queries/aws_eks_addon_3.yaml b/queries/aws_eks_addon_3.yaml old mode 100755 new mode 100644 index 0d4f8a49d..6a1ea9fc9 --- a/queries/aws_eks_addon_3.yaml +++ b/queries/aws_eks_addon_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons - associated with each Amazon EKS cluster. +Description: Allows users to query AWS EKS Add-Ons to retrieve information about add-ons associated with each Amazon EKS cluster. ID: aws_eks_addon_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_name,\n count(addon_name) as addon_count\nfrom\n\ - \ aws_eks_addon\ngroup by\n cluster_name;" + QueryToExecute: | + SELECT + cluster_name, + COUNT(addon_name) AS addon_count + FROM + aws_eks_addon + GROUP BY + cluster_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EKS -Title: List all Add-Ons Associated with Each Amazon EKS Cluster + - Amazon EKS +Title: List all Add-Ons Associated with Each Amazon EKS Cluster \ No newline at end of file diff --git a/queries/aws_eks_addon_version_1.yaml b/queries/aws_eks_addon_version_1.yaml old mode 100755 new mode 100644 index 274c208e5..d88c31c75 --- a/queries/aws_eks_addon_version_1.yaml +++ b/queries/aws_eks_addon_version_1.yaml @@ -1,18 +1,24 @@ Description: Allows users to query AWS EKS Add-On Versions. ID: aws_eks_addon_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n addon_name,\n addon_version,\n type\nfrom\n aws_eks_addon_version;" + QueryToExecute: | + SELECT + addon_name, + addon_version, + type + FROM + aws_eks_addon_version; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List AWS EKS Add-On Versions + - EKS +Title: List AWS EKS Add-On Versions \ No newline at end of file diff --git a/queries/aws_eks_addon_version_2.yaml b/queries/aws_eks_addon_version_2.yaml old mode 100755 new mode 100644 index afef01205..bccfb326f --- a/queries/aws_eks_addon_version_2.yaml +++ b/queries/aws_eks_addon_version_2.yaml @@ -1,21 +1,27 @@ Description: Allows users to query AWS EKS Add-On Versions. ID: aws_eks_addon_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n addon_name,\n count(addon_version) as addon_version_count\n\ - from\n aws_eks_addon_version\ngroup by\n addon_name;" + QueryToExecute: | + SELECT + addon_name, + COUNT(addon_version) AS addon_version_count + FROM + aws_eks_addon_version + GROUP BY + addon_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List All AWS EKS Add-On Versions and Their Counts + - EKS +Title: List All AWS EKS Add-On Versions and Their Counts \ No newline at end of file diff --git a/queries/aws_eks_addon_version_3.yaml b/queries/aws_eks_addon_version_3.yaml old mode 100755 new mode 100644 index d932b03e3..3f2077197 --- a/queries/aws_eks_addon_version_3.yaml +++ b/queries/aws_eks_addon_version_3.yaml @@ -1,23 +1,28 @@ Description: Allows users to query AWS EKS Add-On Versions. ID: aws_eks_addon_version_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n addon_name,\n addon_version,\n addon_configuration\ - \ -> '$defs' -> 'extraVolumeTags' ->> 'description' as addon_configuration_def_description,\n\ - \ addon_configuration -> '$defs' -> 'extraVolumeTags' -> 'propertyNames' as addon_configuration_def_property_names,\n\ - \ addon_configuration -> '$defs' -> 'extraVolumeTags' -> 'patternProperties'\ - \ as addon_configuration_def_pattern_properties,\n addon_configuration -> 'properties'\ - \ as addon_configuration_properties\nfrom\n aws_eks_addon_version limit 10;" + QueryToExecute: | + SELECT + addon_name, + addon_version, + addon_configuration -> '$defs' -> 'extraVolumeTags' ->> 'description' AS addon_configuration_def_description, + addon_configuration -> '$defs' -> 'extraVolumeTags' -> 'propertyNames' AS addon_configuration_def_property_names, + addon_configuration -> '$defs' -> 'extraVolumeTags' -> 'patternProperties' AS addon_configuration_def_pattern_properties, + addon_configuration -> 'properties' AS addon_configuration_properties + FROM + aws_eks_addon_version + LIMIT 10; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: Find AWS EKS Add-On Versions + - EKS +Title: Find AWS EKS Add-On Versions \ No newline at end of file diff --git a/queries/aws_eks_cluster_1.yaml b/queries/aws_eks_cluster_1.yaml old mode 100755 new mode 100644 index 6ad93dd9a..1489e226b --- a/queries/aws_eks_cluster_1.yaml +++ b/queries/aws_eks_cluster_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including - cluster configurations, statuses, and associated metadata. +Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including cluster configurations, statuses, and associated metadata. ID: aws_eks_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n endpoint,\n identity,\n status\nfrom\n\ - \ aws_eks_cluster;" + QueryToExecute: | + SELECT + name, + arn, + endpoint, + identity, + status + FROM + aws_eks_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service -Title: Query AWS EKS Cluster Configuration and Statuses + - Elastic Kubernetes Service +Title: Query AWS EKS Cluster Configuration and Statuses \ No newline at end of file diff --git a/queries/aws_eks_cluster_2.yaml b/queries/aws_eks_cluster_2.yaml old mode 100755 new mode 100644 index 0bdbf2e13..5e2f53480 --- a/queries/aws_eks_cluster_2.yaml +++ b/queries/aws_eks_cluster_2.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including - cluster configurations, statuses, and associated metadata. +Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including cluster configurations, statuses, and associated metadata. ID: aws_eks_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n resources_vpc_config ->> 'ClusterSecurityGroupId'\ - \ as cluster_security_group_id,\n resources_vpc_config ->> 'EndpointPrivateAccess'\ - \ as endpoint_private_access,\n resources_vpc_config ->> 'EndpointPublicAccess'\ - \ as endpoint_public_access,\n resources_vpc_config ->> 'PublicAccessCidrs' as\ - \ public_access_cidrs,\n resources_vpc_config ->> 'SecurityGroupIds' as security_group_ids,\n\ - \ resources_vpc_config -> 'SubnetIds' as subnet_ids,\n resources_vpc_config\ - \ ->> 'VpcId' as vpc_id\nfrom\n aws_eks_cluster;" + QueryToExecute: | + SELECT + name, + resources_vpc_config ->> 'ClusterSecurityGroupId' AS cluster_security_group_id, + resources_vpc_config ->> 'EndpointPrivateAccess' AS endpoint_private_access, + resources_vpc_config ->> 'EndpointPublicAccess' AS endpoint_public_access, + resources_vpc_config ->> 'PublicAccessCidrs' AS public_access_cidrs, + resources_vpc_config ->> 'SecurityGroupIds' AS security_group_ids, + resources_vpc_config -> 'SubnetIds' AS subnet_ids, + resources_vpc_config ->> 'VpcId' AS vpc_id + FROM + aws_eks_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service -Title: Find AWS EKS Cluster Configurations and Metadata + - Elastic Kubernetes Service +Title: Find AWS EKS Cluster Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_eks_cluster_3.yaml b/queries/aws_eks_cluster_3.yaml old mode 100755 new mode 100644 index af4916294..404414829 --- a/queries/aws_eks_cluster_3.yaml +++ b/queries/aws_eks_cluster_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including - cluster configurations, statuses, and associated metadata. +Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including cluster configurations, statuses, and associated metadata. ID: aws_eks_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n i ->> 'Enabled' as enabled,\n i ->> 'Types'\ - \ as types\nfrom\n aws_eks_cluster,\n jsonb_array_elements(logging -> 'ClusterLogging')\ - \ as i\nwhere\n i ->> 'Enabled' = 'false';" + QueryToExecute: | + SELECT + name, + i ->> 'Enabled' AS enabled, + i ->> 'Types' AS types + FROM + aws_eks_cluster, + jsonb_array_elements(logging -> 'ClusterLogging') AS i + WHERE + i ->> 'Enabled' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service -Title: Find AWS EKS Cluster Configurations and Statuses + - Elastic Kubernetes Service +Title: Find AWS EKS Cluster Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_eks_cluster_4.yaml b/queries/aws_eks_cluster_4.yaml old mode 100755 new mode 100644 index 1281f9bbd..524b6dbe4 --- a/queries/aws_eks_cluster_4.yaml +++ b/queries/aws_eks_cluster_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including - cluster configurations, statuses, and associated metadata. +Description: Allows users to query AWS Elastic Kubernetes Service Cluster data, including cluster configurations, statuses, and associated metadata. ID: aws_eks_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n version\nfrom\n aws_eks_cluster\nwhere\n\ - \ version <> '1.19';" + QueryToExecute: | + SELECT + name, + arn, + version + FROM + aws_eks_cluster + WHERE + version <> '1.19'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service -Title: Find AWS EKS Cluster Configurations and Statuses + - Elastic Kubernetes Service +Title: Find AWS EKS Cluster Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_eks_fargate_profile_1.yaml b/queries/aws_eks_fargate_profile_1.yaml old mode 100755 new mode 100644 index 371c1d588..ddabcaa08 --- a/queries/aws_eks_fargate_profile_1.yaml +++ b/queries/aws_eks_fargate_profile_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such - as the Fargate profile name, ARN, status, and more. +Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such as the Fargate profile name, ARN, status, and more. ID: aws_eks_fargate_profile_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n fargate_profile_name,\n fargate_profile_arn,\n cluster_name,\n\ - \ created_at,\n status,\n tags\nfrom\n aws_eks_fargate_profile;" + QueryToExecute: | + SELECT + fargate_profile_name, + fargate_profile_arn, + cluster_name, + created_at, + status, + tags + FROM + aws_eks_fargate_profile; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List all AWS EKS Fargate Profiles and their Details + - EKS +Title: List all AWS EKS Fargate Profiles and their Details \ No newline at end of file diff --git a/queries/aws_eks_fargate_profile_2.yaml b/queries/aws_eks_fargate_profile_2.yaml old mode 100755 new mode 100644 index 7a342d6b8..d2e34beb3 --- a/queries/aws_eks_fargate_profile_2.yaml +++ b/queries/aws_eks_fargate_profile_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such - as the Fargate profile name, ARN, status, and more. +Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such as the Fargate profile name, ARN, status, and more. ID: aws_eks_fargate_profile_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n fargate_profile_name,\n fargate_profile_arn,\n cluster_name,\n\ - \ created_at,\n status\nfrom\n aws_eks_fargate_profile\nwhere\n status <>\ - \ 'ACTIVE';" + QueryToExecute: | + SELECT + fargate_profile_name, + fargate_profile_arn, + cluster_name, + created_at, + status + FROM + aws_eks_fargate_profile + WHERE + status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List all AWS EKS Fargate Profiles by name, ARN, and status + - EKS +Title: List all AWS EKS Fargate Profiles by name, ARN, and status \ No newline at end of file diff --git a/queries/aws_eks_fargate_profile_3.yaml b/queries/aws_eks_fargate_profile_3.yaml old mode 100755 new mode 100644 index 838bcea3f..a230f1166 --- a/queries/aws_eks_fargate_profile_3.yaml +++ b/queries/aws_eks_fargate_profile_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such - as the Fargate profile name, ARN, status, and more. +Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such as the Fargate profile name, ARN, status, and more. ID: aws_eks_fargate_profile_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.fargate_profile_name,\n f.cluster_name,\n f.status\ - \ as fargate_profile_status,\n s.availability_zone,\n s.available_ip_address_count,\n\ - \ s.cidr_block,\n s.vpc_id\nfrom\n aws_eks_fargate_profile as f,\n aws_vpc_subnet\ - \ as s,\n jsonb_array_elements(f.subnets) as subnet_id\nwhere\n s.subnet_id\ - \ = subnet_id;" + QueryToExecute: | + SELECT + f.fargate_profile_name, + f.cluster_name, + f.status AS fargate_profile_status, + s.availability_zone, + s.available_ip_address_count, + s.cidr_block, + s.vpc_id + FROM + aws_eks_fargate_profile AS f, + aws_vpc_subnet AS s, + jsonb_array_elements(f.subnets) AS subnet_id + WHERE + s.subnet_id = subnet_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: Find AWS EKS Fargate Profile Details with SQL + - EKS +Title: Find AWS EKS Fargate Profile Details with SQL \ No newline at end of file diff --git a/queries/aws_eks_fargate_profile_4.yaml b/queries/aws_eks_fargate_profile_4.yaml old mode 100755 new mode 100644 index ea0ed56a7..49c10344c --- a/queries/aws_eks_fargate_profile_4.yaml +++ b/queries/aws_eks_fargate_profile_4.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such - as the Fargate profile name, ARN, status, and more. +Description: Allows users to query AWS EKS Fargate Profiles and retrieve data such as the Fargate profile name, ARN, status, and more. ID: aws_eks_fargate_profile_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.name as cluster_name,\n c.arn as cluster_arn,\n c.version\ - \ as cluster_version,\n f.fargate_profile_name as fargate_profile_name,\n f.fargate_profile_arn\ - \ as fargate_profile_arn,\n f.created_at as created_at,\n f.pod_execution_role_arn\ - \ as pod_execution_role_arn,\n f.status as fargate_profile_status\nfrom\n aws_eks_fargate_profile\ - \ as f,\n aws_eks_cluster as c\nwhere\n c.version::float > 1.19 and f.cluster_name\ - \ = c.name;" + QueryToExecute: | + SELECT + c.name AS cluster_name, + c.arn AS cluster_arn, + c.version AS cluster_version, + f.fargate_profile_name AS fargate_profile_name, + f.fargate_profile_arn AS fargate_profile_arn, + f.created_at AS created_at, + f.pod_execution_role_arn AS pod_execution_role_arn, + f.status AS fargate_profile_status + FROM + aws_eks_fargate_profile AS f, + aws_eks_cluster AS c + WHERE + c.version::FLOAT > 1.19 + AND f.cluster_name = c.name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List AWS EKS Fargate Profiles with Details + - EKS +Title: List AWS EKS Fargate Profiles with Details \ No newline at end of file diff --git a/queries/aws_eks_identity_provider_config_1.yaml b/queries/aws_eks_identity_provider_config_1.yaml old mode 100755 new mode 100644 index b1746b1e3..2522651ec --- a/queries/aws_eks_identity_provider_config_1.yaml +++ b/queries/aws_eks_identity_provider_config_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query Amazon EKS Identity Provider Configurations for - detailed information about the identity provider configurations for Amazon EKS clusters. +Description: Allows users to query Amazon EKS Identity Provider Configurations for detailed information about the identity provider configurations for Amazon EKS clusters. ID: aws_eks_identity_provider_config_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n cluster_name,\n tags,\n status\nfrom\n\ - \ aws_eks_identity_provider_config;" + QueryToExecute: | + SELECT + name, + arn, + cluster_name, + tags, + status + FROM + aws_eks_identity_provider_config; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EKS -Title: Find Amazon EKS Identity Providers' Configurations + - Amazon EKS +Title: Find Amazon EKS Identity Providers' Configurations \ No newline at end of file diff --git a/queries/aws_eks_identity_provider_config_2.yaml b/queries/aws_eks_identity_provider_config_2.yaml old mode 100755 new mode 100644 index d4eb269b8..fa015471b --- a/queries/aws_eks_identity_provider_config_2.yaml +++ b/queries/aws_eks_identity_provider_config_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Amazon EKS Identity Provider Configurations for - detailed information about the identity provider configurations for Amazon EKS clusters. +Description: Allows users to query Amazon EKS Identity Provider Configurations for detailed information about the identity provider configurations for Amazon EKS clusters. ID: aws_eks_identity_provider_config_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n cluster_name,\n type\nfrom\n aws_eks_identity_provider_config\n\ - where \n type = 'oidc';" + QueryToExecute: | + SELECT + name, + arn, + cluster_name, + type + FROM + aws_eks_identity_provider_config + WHERE + type = 'oidc'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon EKS -Title: Find all Amazon EKS Identity Provider Configurations + - Amazon EKS +Title: Find all Amazon EKS Identity Provider Configurations \ No newline at end of file diff --git a/queries/aws_eks_node_group_1.yaml b/queries/aws_eks_node_group_1.yaml old mode 100755 new mode 100644 index beef8c700..b08fad893 --- a/queries/aws_eks_node_group_1.yaml +++ b/queries/aws_eks_node_group_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EKS Node Group data, providing information - about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. +Description: Allows users to query AWS EKS Node Group data, providing information about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. ID: aws_eks_node_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nodegroup_name,\n arn,\n created_at,\n cluster_name,\n\ - \ status\nfrom\n aws_eks_node_group;" + QueryToExecute: | + SELECT + nodegroup_name, + arn, + created_at, + cluster_name, + status + FROM + aws_eks_node_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List all node groups in AWS EKS clusters using SQL + - EKS +Title: List all node groups in AWS EKS clusters using SQL \ No newline at end of file diff --git a/queries/aws_eks_node_group_2.yaml b/queries/aws_eks_node_group_2.yaml old mode 100755 new mode 100644 index bd6f8cc67..952fffa04 --- a/queries/aws_eks_node_group_2.yaml +++ b/queries/aws_eks_node_group_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS EKS Node Group data, providing information - about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. +Description: Allows users to query AWS EKS Node Group data, providing information about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. ID: aws_eks_node_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nodegroup_name,\n arn,\n created_at,\n cluster_name,\n\ - \ status\nfrom\n aws_eks_node_group\nwhere\n status <> 'ACTIVE';" + QueryToExecute: | + SELECT + nodegroup_name, + arn, + created_at, + cluster_name, + status + FROM + aws_eks_node_group + WHERE + status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service (EKS) -Title: List all AWS EKS Node Group data within a cluster + - Elastic Kubernetes Service (EKS) +Title: List all AWS EKS Node Group data within a cluster \ No newline at end of file diff --git a/queries/aws_eks_node_group_3.yaml b/queries/aws_eks_node_group_3.yaml old mode 100755 new mode 100644 index 906f7de6c..8fa5970ae --- a/queries/aws_eks_node_group_3.yaml +++ b/queries/aws_eks_node_group_3.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS EKS Node Group data, providing information - about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. +Description: Allows users to query AWS EKS Node Group data, providing information about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. ID: aws_eks_node_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nodegroup_name,\n cluster_name,\n jsonb_pretty(health)\ - \ as health\nfrom\n aws_eks_node_group;" + QueryToExecute: | + SELECT + nodegroup_name, + cluster_name, + JSONB_PRETTY(health) AS health + FROM + aws_eks_node_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Kubernetes Service -Title: List all AWS EKS Node Groups with Health Information + - Elastic Kubernetes Service +Title: List all AWS EKS Node Groups with Health Information \ No newline at end of file diff --git a/queries/aws_eks_node_group_4.yaml b/queries/aws_eks_node_group_4.yaml old mode 100755 new mode 100644 index 7d33babfe..671bdda31 --- a/queries/aws_eks_node_group_4.yaml +++ b/queries/aws_eks_node_group_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS EKS Node Group data, providing information - about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. +Description: Allows users to query AWS EKS Node Group data, providing information about each node group within an AWS Elastic Kubernetes Service (EKS) cluster. ID: aws_eks_node_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nodegroup_name,\n cluster_name,\n jsonb_pretty(launch_template)\ - \ as launch_template\nfrom\n aws_eks_node_group;" + QueryToExecute: | + SELECT + nodegroup_name, + cluster_name, + JSONB_PRETTY(launch_template) AS launch_template + FROM + aws_eks_node_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EKS -Title: List all AWS EKS Node Groups with Template Info + - EKS +Title: List all AWS EKS Node Groups with Template Info \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_1.yaml b/queries/aws_elastic_beanstalk_application_1.yaml old mode 100755 new mode 100644 index e6a505370..470ef7bf2 --- a/queries/aws_elastic_beanstalk_application_1.yaml +++ b/queries/aws_elastic_beanstalk_application_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Elastic Beanstalk Applications to obtain details - about their configurations, versions, environment, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Applications to obtain details about their configurations, versions, environment, and other metadata. ID: aws_elastic_beanstalk_application_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n description,\n date_created,\n date_updated,\n\ - \ versions\nfrom\n aws_elastic_beanstalk_application;" + QueryToExecute: | + SELECT + name, + arn, + description, + date_created, + date_updated, + versions + FROM + aws_elastic_beanstalk_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: Find AWS Elastic Beanstalk Application Details + - Elastic Beanstalk +Title: Find AWS Elastic Beanstalk Application Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_2.yaml b/queries/aws_elastic_beanstalk_application_2.yaml old mode 100755 new mode 100644 index 767d1fab2..a27783424 --- a/queries/aws_elastic_beanstalk_application_2.yaml +++ b/queries/aws_elastic_beanstalk_application_2.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS Elastic Beanstalk Applications to obtain details - about their configurations, versions, environment, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Applications to obtain details about their configurations, versions, environment, and other metadata. ID: aws_elastic_beanstalk_application_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n resource_lifecycle_config ->> 'ServiceRole'\ - \ as role,\n resource_lifecycle_config -> 'VersionLifecycleConfig' ->> 'MaxAgeRule'\ - \ as max_age_rule,\n resource_lifecycle_config -> 'VersionLifecycleConfig' ->>\ - \ 'MaxCountRule' as max_count_rule\nfrom\n aws_elastic_beanstalk_application;" + QueryToExecute: | + SELECT + name, + resource_lifecycle_config ->> 'ServiceRole' AS role, + resource_lifecycle_config -> 'VersionLifecycleConfig' ->> 'MaxAgeRule' AS max_age_rule, + resource_lifecycle_config -> 'VersionLifecycleConfig' ->> 'MaxCountRule' AS max_count_rule + FROM + aws_elastic_beanstalk_application; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all AWS Elastic Beanstalk Application Configurations + - Elastic Beanstalk +Title: List all AWS Elastic Beanstalk Application Configurations \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_1.yaml b/queries/aws_elastic_beanstalk_application_version_1.yaml old mode 100755 new mode 100644 index 37970d0e9..6fe50a425 --- a/queries/aws_elastic_beanstalk_application_version_1.yaml +++ b/queries/aws_elastic_beanstalk_application_version_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label,\n\ - \ description,\n date_created,\n date_updated,\n source_bundle\nfrom\n aws_elastic_beanstalk_application_version;" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label, + description, + date_created, + date_updated, + source_bundle + FROM + aws_elastic_beanstalk_application_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: Find Elastic Beanstalk Application Versions Details + - Elastic Beanstalk +Title: Find Elastic Beanstalk Application Versions Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_2.yaml b/queries/aws_elastic_beanstalk_application_version_2.yaml old mode 100755 new mode 100644 index 8046aa8e7..2ebabc111 --- a/queries/aws_elastic_beanstalk_application_version_2.yaml +++ b/queries/aws_elastic_beanstalk_application_version_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label,\n\ - \ date_updated\nfrom\n aws_elastic_beanstalk_application_version\norder by\n\ - \ date_updated desc;" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label, + date_updated + FROM + aws_elastic_beanstalk_application_version + ORDER BY + date_updated DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all details of AWS Elastic Beanstalk Versions + - Elastic Beanstalk +Title: List all details of AWS Elastic Beanstalk Versions \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_3.yaml b/queries/aws_elastic_beanstalk_application_version_3.yaml old mode 100755 new mode 100644 index df237d05b..e549768ab --- a/queries/aws_elastic_beanstalk_application_version_3.yaml +++ b/queries/aws_elastic_beanstalk_application_version_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label,\n\ - \ status\nfrom\n aws_elastic_beanstalk_application_version\nwhere\n status\ - \ = 'Processed';" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label, + status + FROM + aws_elastic_beanstalk_application_version + WHERE + status = 'Processed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Elastic Beanstalk -Title: List AWS Elastic Beanstalk Application Versions Details + - AWS Elastic Beanstalk +Title: List AWS Elastic Beanstalk Application Versions Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_4.yaml b/queries/aws_elastic_beanstalk_application_version_4.yaml old mode 100755 new mode 100644 index 07d32136c..62449c627 --- a/queries/aws_elastic_beanstalk_application_version_4.yaml +++ b/queries/aws_elastic_beanstalk_application_version_4.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label,\n\ - \ description,\n date_created,\n date_updated,\n source_bundle\nfrom\n aws_elastic_beanstalk_application_version\n\ - where\n application_name = 'my-application';" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label, + description, + date_created, + date_updated, + source_bundle + FROM + aws_elastic_beanstalk_application_version + WHERE + application_name = 'my-application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all AWS Elastic Beanstalk App Version Details + - Elastic Beanstalk +Title: List all AWS Elastic Beanstalk App Version Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_5.yaml b/queries/aws_elastic_beanstalk_application_version_5.yaml old mode 100755 new mode 100644 index 44170b157..f6d62735a --- a/queries/aws_elastic_beanstalk_application_version_5.yaml +++ b/queries/aws_elastic_beanstalk_application_version_5.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label,\n\ - \ tags\nfrom\n aws_elastic_beanstalk_application_version\nwhere\n tags ->>\ - \ 'Environment' = 'Production';" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label, + tags + FROM + aws_elastic_beanstalk_application_version + WHERE + tags ->> 'Environment' = 'Production'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Elastic Beanstalk -Title: Find Elastic Beanstalk App Version Details and Metadata + - AWS Elastic Beanstalk +Title: Find Elastic Beanstalk App Version Details and Metadata \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_application_version_6.yaml b/queries/aws_elastic_beanstalk_application_version_6.yaml old mode 100755 new mode 100644 index bbeabce2d..3b6007eec --- a/queries/aws_elastic_beanstalk_application_version_6.yaml +++ b/queries/aws_elastic_beanstalk_application_version_6.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain - details about their configurations, environments, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Application Versions to obtain details about their configurations, environments, and other metadata. ID: aws_elastic_beanstalk_application_version_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_arn,\n version_label\n\ - from\n aws_elastic_beanstalk_application_version\nwhere\n source_build_information\ - \ ->> 'SourceRepository' = 'CodeCommit';" + QueryToExecute: | + SELECT + application_name, + application_version_arn, + version_label + FROM + aws_elastic_beanstalk_application_version + WHERE + source_build_information ->> 'SourceRepository' = 'CodeCommit'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all AWS Elastic Beanstalk Application Versions Details + - Elastic Beanstalk +Title: List all AWS Elastic Beanstalk Application Versions Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_1.yaml b/queries/aws_elastic_beanstalk_environment_1.yaml old mode 100755 new mode 100644 index 96a9ac155..57a036985 --- a/queries/aws_elastic_beanstalk_environment_1.yaml +++ b/queries/aws_elastic_beanstalk_environment_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_id,\n environment_name,\n application_name,\n\ - \ arn,\n tier\nfrom\n aws_elastic_beanstalk_environment;" + QueryToExecute: | + SELECT + environment_id, + environment_name, + application_name, + arn, + tier + FROM + aws_elastic_beanstalk_environment; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all AWS Elastic Beanstalk Environment Details + - Elastic Beanstalk +Title: List all AWS Elastic Beanstalk Environment Details \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_2.yaml b/queries/aws_elastic_beanstalk_environment_2.yaml old mode 100755 new mode 100644 index 97c2c2644..15e338330 --- a/queries/aws_elastic_beanstalk_environment_2.yaml +++ b/queries/aws_elastic_beanstalk_environment_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_name,\n abortable_operation_in_progress\n\ - from\n aws_elastic_beanstalk_environment\nwhere\n abortable_operation_in_progress\ - \ = 'true';" + QueryToExecute: | + SELECT + environment_name, + abortable_operation_in_progress + FROM + aws_elastic_beanstalk_environment + WHERE + abortable_operation_in_progress = 'true'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: Find AWS Elastic Beanstalk Environments and Operations + - Elastic Beanstalk +Title: Find AWS Elastic Beanstalk Environments and Operations \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_3.yaml b/queries/aws_elastic_beanstalk_environment_3.yaml old mode 100755 new mode 100644 index 8c4d64a5b..2f50d1175 --- a/queries/aws_elastic_beanstalk_environment_3.yaml +++ b/queries/aws_elastic_beanstalk_environment_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_name,\n application_name,\n environment_id,\n\ - \ health\nfrom\n aws_elastic_beanstalk_environment\nwhere\n health = 'Red';" + QueryToExecute: | + SELECT + environment_name, + application_name, + environment_id, + health + FROM + aws_elastic_beanstalk_environment + WHERE + health = 'Red'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: Find AWS Elastic Beanstalk Environments with Health Status Red + - Elastic Beanstalk +Title: Find AWS Elastic Beanstalk Environments with Health Status Red \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_4.yaml b/queries/aws_elastic_beanstalk_environment_4.yaml old mode 100755 new mode 100644 index 6111ec5d3..36150a676 --- a/queries/aws_elastic_beanstalk_environment_4.yaml +++ b/queries/aws_elastic_beanstalk_environment_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_name,\n health_status\nfrom\n aws_elastic_beanstalk_environment\n\ - where\n health_status = 'Suspended';" + QueryToExecute: | + SELECT + environment_name, + health_status + FROM + aws_elastic_beanstalk_environment + WHERE + health_status = 'Suspended'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: Find all AWS Elastic Beanstalk Environments' Health Status + - Elastic Beanstalk +Title: Find all AWS Elastic Beanstalk Environments' Health Status \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_5.yaml b/queries/aws_elastic_beanstalk_environment_5.yaml old mode 100755 new mode 100644 index ed5d4b0cf..61ae4dea0 --- a/queries/aws_elastic_beanstalk_environment_5.yaml +++ b/queries/aws_elastic_beanstalk_environment_5.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_name,\n a ->> 'ActionDescription' as action_description,\n\ - \ a ->> 'ActionId' as action_id,\n a ->> 'ActionType' as action_type,\n a ->>\ - \ 'Status' as action_status,\n a ->> 'WindowStartTime' as action_window_start_time\n\ - from\n aws_elastic_beanstalk_environment,\n jsonb_array_elements(managed_actions)\ - \ as a;" + QueryToExecute: | + SELECT + environment_name, + a ->> 'ActionDescription' AS action_description, + a ->> 'ActionId' AS action_id, + a ->> 'ActionType' AS action_type, + a ->> 'Status' AS action_status, + a ->> 'WindowStartTime' AS action_window_start_time + FROM + aws_elastic_beanstalk_environment, + jsonb_array_elements(managed_actions) AS a; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List All AWS Elastic Beanstalk Environment Configurations and Status + - Elastic Beanstalk +Title: List All AWS Elastic Beanstalk Environment Configurations and Status \ No newline at end of file diff --git a/queries/aws_elastic_beanstalk_environment_6.yaml b/queries/aws_elastic_beanstalk_environment_6.yaml old mode 100755 new mode 100644 index f427ac259..84d1d6d80 --- a/queries/aws_elastic_beanstalk_environment_6.yaml +++ b/queries/aws_elastic_beanstalk_environment_6.yaml @@ -1,29 +1,37 @@ -Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights - into their configuration, status, health, related applications, and other metadata. +Description: Allows users to query AWS Elastic Beanstalk Environments to gain insights into their configuration, status, health, related applications, and other metadata. ID: aws_elastic_beanstalk_environment_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n environment_name,\n application_name,\n c ->> 'DateCreated'\ - \ as date_created,\n c ->> 'DateUpdated' as date_updated,\n c ->> 'DeploymentStatus'\ - \ as deployment_status,\n c ->> 'Description' as description,\n c -> 'OptionSettings'\ - \ ->> 'Namespace' as option_settings_namespace,\n c -> 'OptionSettings' ->> 'OptionName'\ - \ as option_name,\n c -> 'OptionSettings' ->> 'ResourceName' as option_resource_name,\n\ - \ c -> 'OptionSettings' ->> 'Value' as option_value,\n c ->> 'PlatformArn' as\ - \ platform_arn,\n c ->> 'SolutionStackName' as solution_stack_name,\n c ->>\ - \ 'TemplateName' as template_name\nfrom\n aws_elastic_beanstalk_environment,\n\ - \ jsonb_array_elements(configuration_settings) as c;" + QueryToExecute: | + SELECT + environment_name, + application_name, + c ->> 'DateCreated' AS date_created, + c ->> 'DateUpdated' AS date_updated, + c ->> 'DeploymentStatus' AS deployment_status, + c ->> 'Description' AS description, + c -> 'OptionSettings' ->> 'Namespace' AS option_settings_namespace, + c -> 'OptionSettings' ->> 'OptionName' AS option_name, + c -> 'OptionSettings' ->> 'ResourceName' AS option_resource_name, + c -> 'OptionSettings' ->> 'Value' AS option_value, + c ->> 'PlatformArn' AS platform_arn, + c ->> 'SolutionStackName' AS solution_stack_name, + c ->> 'TemplateName' AS template_name + FROM + aws_elastic_beanstalk_environment, + jsonb_array_elements(configuration_settings) AS c; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic Beanstalk -Title: List all AWS Elastic Beanstalk Environments with Metadata + - Elastic Beanstalk +Title: List all AWS Elastic Beanstalk Environments with Metadata \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_1.yaml b/queries/aws_elasticache_cluster_1.yaml old mode 100755 new mode 100644 index cb588cebc..b239c75ae --- a/queries/aws_elasticache_cluster_1.yaml +++ b/queries/aws_elasticache_cluster_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n cache_node_type,\n at_rest_encryption_enabled\n\ - from\n aws_elasticache_cluster\nwhere\n not at_rest_encryption_enabled;" + QueryToExecute: | + SELECT + cache_cluster_id, + cache_node_type, + at_rest_encryption_enabled + FROM + aws_elasticache_cluster + WHERE + NOT at_rest_encryption_enabled; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Clusters with Encryption Disabled + - ElastiCache +Title: List all AWS ElastiCache Clusters with Encryption Disabled \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_2.yaml b/queries/aws_elasticache_cluster_2.yaml old mode 100755 new mode 100644 index cf391a43f..81c557a4d --- a/queries/aws_elasticache_cluster_2.yaml +++ b/queries/aws_elasticache_cluster_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n preferred_availability_zone\nfrom\n\ - \ aws_elasticache_cluster\nwhere\n preferred_availability_zone <> 'Multiple';" + QueryToExecute: | + SELECT + cache_cluster_id, + preferred_availability_zone + FROM + aws_elasticache_cluster + WHERE + preferred_availability_zone <> 'Multiple'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ElastiCache -Title: Find Amazon ElastiCache Cluster Information within AWS + - Amazon ElastiCache +Title: Find Amazon ElastiCache Cluster Information within AWS \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_3.yaml b/queries/aws_elasticache_cluster_3.yaml old mode 100755 new mode 100644 index ef02b6da7..1bb17d8da --- a/queries/aws_elasticache_cluster_3.yaml +++ b/queries/aws_elasticache_cluster_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n cache_node_type,\n transit_encryption_enabled\n\ - from\n aws_elasticache_cluster\nwhere\n not transit_encryption_enabled;" + QueryToExecute: | + SELECT + cache_cluster_id, + cache_node_type, + transit_encryption_enabled + FROM + aws_elasticache_cluster + WHERE + NOT transit_encryption_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ElastiCache -Title: Query Amazon ElastiCache Cluster Data with SQL + - Amazon ElastiCache +Title: Query Amazon ElastiCache Cluster Data with SQL \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_4.yaml b/queries/aws_elasticache_cluster_4.yaml old mode 100755 new mode 100644 index d34f40661..2e321b2d8 --- a/queries/aws_elasticache_cluster_4.yaml +++ b/queries/aws_elasticache_cluster_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_node_type,\n count(*) as count\nfrom\n aws_elasticache_cluster\n\ - where\n cache_node_type not in ('cache.m5.large', 'cache.m4.4xlarge')\ngroup\ - \ by\n cache_node_type;" + QueryToExecute: | + SELECT + cache_node_type, + COUNT(*) AS count + FROM + aws_elasticache_cluster + WHERE + cache_node_type NOT IN ('cache.m5.large', 'cache.m4.4xlarge') + GROUP BY + cache_node_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ElastiCache -Title: List all Amazon ElastiCache Cluster data in AWS account + - Amazon ElastiCache +Title: List all Amazon ElastiCache Cluster data in AWS account \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_5.yaml b/queries/aws_elasticache_cluster_5.yaml old mode 100755 new mode 100644 index d9556dafb..f6ee3a626 --- a/queries/aws_elasticache_cluster_5.yaml +++ b/queries/aws_elasticache_cluster_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n cache_cluster_status,\n notification_configuration\ - \ ->> 'TopicArn' as topic_arn,\n notification_configuration ->> 'TopicStatus'\ - \ as topic_status\nfrom\n aws_elasticache_cluster\nwhere\n notification_configuration\ - \ ->> 'TopicStatus' = 'inactive';" + QueryToExecute: | + SELECT + cache_cluster_id, + cache_cluster_status, + notification_configuration ->> 'TopicArn' AS topic_arn, + notification_configuration ->> 'TopicStatus' AS topic_status + FROM + aws_elasticache_cluster + WHERE + notification_configuration ->> 'TopicStatus' = 'inactive'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ElastiCache -Title: Find Inactive Amazon ElastiCache Clusters + - Amazon ElastiCache +Title: Find Inactive Amazon ElastiCache Clusters \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_6.yaml b/queries/aws_elasticache_cluster_6.yaml old mode 100755 new mode 100644 index 7104bf7bb..9d91914ff --- a/queries/aws_elasticache_cluster_6.yaml +++ b/queries/aws_elasticache_cluster_6.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n sg ->> 'SecurityGroupId' as security_group_id,\n\ - \ sg ->> 'Status' as status\nfrom\n aws_elasticache_cluster,\n jsonb_array_elements(security_groups)\ - \ as sg;" + QueryToExecute: | + SELECT + cache_cluster_id, + sg ->> 'SecurityGroupId' AS security_group_id, + sg ->> 'Status' AS status + FROM + aws_elasticache_cluster, + jsonb_array_elements(security_groups) AS sg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List All Amazon ElastiCache Clusters with Security Details + - ElastiCache +Title: List All Amazon ElastiCache Clusters with Security Details \ No newline at end of file diff --git a/queries/aws_elasticache_cluster_7.yaml b/queries/aws_elasticache_cluster_7.yaml old mode 100755 new mode 100644 index a9f3f2a38..ae9970014 --- a/queries/aws_elasticache_cluster_7.yaml +++ b/queries/aws_elasticache_cluster_7.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query Amazon ElastiCache Cluster data, providing information - about each ElastiCache Cluster within the AWS account. +Description: Allows users to query Amazon ElastiCache Cluster data, providing information about each ElastiCache Cluster within the AWS account. ID: aws_elasticache_cluster_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n cache_node_type,\n cache_cluster_status,\n\ - \ snapshot_retention_limit\nfrom\n aws_elasticache_cluster\nwhere\n snapshot_retention_limit\ - \ is null;" + QueryToExecute: | + SELECT + cache_cluster_id, + cache_node_type, + cache_cluster_status, + snapshot_retention_limit + FROM + aws_elasticache_cluster + WHERE + snapshot_retention_limit IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all information about each ElastiCache Cluster + - ElastiCache +Title: List all information about each ElastiCache Cluster \ No newline at end of file diff --git a/queries/aws_elasticache_parameter_group_1.yaml b/queries/aws_elasticache_parameter_group_1.yaml old mode 100755 new mode 100644 index e6102fcd5..2821b3d66 --- a/queries/aws_elasticache_parameter_group_1.yaml +++ b/queries/aws_elasticache_parameter_group_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Elasticache Parameter Groups, providing detailed - information about each group''s configurations, parameters, and associated metadata. +Description: Allows users to query AWS Elasticache Parameter Groups, providing detailed information about each group's configurations, parameters, and associated metadata. ID: aws_elasticache_parameter_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_parameter_group_name,\n description,\n cache_parameter_group_family,\n\ - \ description,\n is_global\nfrom\n aws_elasticache_parameter_group;" + QueryToExecute: | + SELECT + cache_parameter_group_name, + description, + cache_parameter_group_family, + description, + is_global + FROM + aws_elasticache_parameter_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticache -Title: Find AWS Elasticache Parameter Groups configurations + - Elasticache +Title: Find AWS Elasticache Parameter Groups configurations \ No newline at end of file diff --git a/queries/aws_elasticache_parameter_group_2.yaml b/queries/aws_elasticache_parameter_group_2.yaml old mode 100755 new mode 100644 index 0c07222f2..c7ce3d36f --- a/queries/aws_elasticache_parameter_group_2.yaml +++ b/queries/aws_elasticache_parameter_group_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Elasticache Parameter Groups, providing detailed - information about each group''s configurations, parameters, and associated metadata. +Description: Allows users to query AWS Elasticache Parameter Groups, providing detailed information about each group's configurations, parameters, and associated metadata. ID: aws_elasticache_parameter_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_parameter_group_family,\n count(*) as count\n\ - from\n aws_elasticache_parameter_group\nwhere\n cache_parameter_group_family\ - \ not in ('redis5.0', 'memcached1.5')\ngroup by\n cache_parameter_group_family;" + QueryToExecute: | + SELECT + cache_parameter_group_family, + COUNT(*) AS count + FROM + aws_elasticache_parameter_group + WHERE + cache_parameter_group_family NOT IN ('redis5.0', 'memcached1.5') + GROUP BY + cache_parameter_group_family; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticache -Title: Find AWS Elasticache Parameter Groups and Configurations + - Elasticache +Title: Find AWS Elasticache Parameter Groups and Configurations \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_cache_hits_hourly_1.yaml b/queries/aws_elasticache_redis_metric_cache_hits_hourly_1.yaml old mode 100755 new mode 100644 index 223e7501f..3ee53c60b --- a/queries/aws_elasticache_redis_metric_cache_hits_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_cache_hits_hourly_1.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly - basis. +Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly basis. ID: aws_elasticache_redis_metric_cache_hits_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sum,\n sample_count\nfrom\n aws_elasticache_redis_metric_cache_hits_hourly\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_elasticache_redis_metric_cache_hits_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List All AWS ElastiCache Redis Cache Hits Hourly + - ElastiCache +Title: List All AWS ElastiCache Redis Cache Hits Hourly \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_cache_hits_hourly_2.yaml b/queries/aws_elasticache_redis_metric_cache_hits_hourly_2.yaml old mode 100755 new mode 100644 index ce22bb025..420820b07 --- a/queries/aws_elasticache_redis_metric_cache_hits_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_cache_hits_hourly_2.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly - basis. +Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly basis. ID: aws_elasticache_redis_metric_cache_hits_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(sum::numeric,2)\ - \ as sum_cachehits,\n round(average::numeric,2) as average_cachehits,\n sample_count\n\ - from\n aws_elasticache_redis_metric_cache_hits_hourly\nwhere sum < 10\norder\ - \ by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(SUM::numeric, 2) AS sum_cachehits, + ROUND(average::numeric, 2) AS average_cachehits, + sample_count + FROM + aws_elasticache_redis_metric_cache_hits_hourly + WHERE + SUM < 10 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon ElastiCache -Title: List All Amazon ElastiCache Redis Hourly Cache Hits + - Amazon ElastiCache +Title: List All Amazon ElastiCache Redis Hourly Cache Hits \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_cache_hits_hourly_3.yaml b/queries/aws_elasticache_redis_metric_cache_hits_hourly_3.yaml old mode 100755 new mode 100644 index 8657eeacf..81bce4332 --- a/queries/aws_elasticache_redis_metric_cache_hits_hourly_3.yaml +++ b/queries/aws_elasticache_redis_metric_cache_hits_hourly_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly - basis. +Description: Allows users to query Amazon ElastiCache Redis Cache Hits on an hourly basis. ID: aws_elasticache_redis_metric_cache_hits_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cachehits,\n round(maximum::numeric,2) as max_cachehits,\n round(average::numeric,2)\ - \ as avg_cachehits,\n sample_count\nfrom\n aws_elasticache_redis_metric_cache_hits_hourly\n\ - where average < 100\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(minimum::numeric, 2) AS min_cachehits, + ROUND(maximum::numeric, 2) AS max_cachehits, + ROUND(average::numeric, 2) AS avg_cachehits, + sample_count + FROM + aws_elasticache_redis_metric_cache_hits_hourly + WHERE + average < 100 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: Find hourly Amazon ElastiCache Redis Cache Hits + - ElastiCache Redis +Title: Find hourly Amazon ElastiCache Redis Cache Hits \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_curr_connections_hourly_1.yaml b/queries/aws_elasticache_redis_metric_curr_connections_hourly_1.yaml old mode 100755 new mode 100644 index d00743cc6..8cae31d42 --- a/queries/aws_elasticache_redis_metric_curr_connections_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_curr_connections_hourly_1.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query ElastiCache Redis current connections metrics on - an hourly basis. +Description: Allows users to query ElastiCache Redis current connections metrics on an hourly basis. ID: aws_elasticache_redis_metric_curr_connections_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sum,\n sample_count\nfrom\n aws_elasticache_redis_metric_curr_connections_hourly\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_elasticache_redis_metric_curr_connections_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all Redis current connections metrics hourly + - ElastiCache +Title: List all Redis current connections metrics hourly \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_curr_connections_hourly_2.yaml b/queries/aws_elasticache_redis_metric_curr_connections_hourly_2.yaml old mode 100755 new mode 100644 index 5a9dab880..174a5db2e --- a/queries/aws_elasticache_redis_metric_curr_connections_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_curr_connections_hourly_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query ElastiCache Redis current connections metrics on - an hourly basis. +Description: Allows users to query ElastiCache Redis current connections metrics on an hourly basis. ID: aws_elasticache_redis_metric_curr_connections_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_currconnections,\n round(maximum::numeric,2) as max_currconnections,\n\ - \ round(average::numeric,2) as avg_currconnections,\n sample_count\nfrom\n \ - \ aws_elasticache_redis_metric_curr_connections_hourly\nwhere average > 100\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(MIN(minimum::numeric), 2) AS min_currconnections, + ROUND(MAX(maximum::numeric), 2) AS max_currconnections, + ROUND(AVG(average::numeric), 2) AS avg_currconnections, + sample_count + FROM + aws_elasticache_redis_metric_curr_connections_hourly + WHERE + average > 100 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find ElastiCache Redis Current Hourly Connections + - ElastiCache +Title: Find ElastiCache Redis Current Hourly Connections \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_1.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_1.yaml old mode 100755 new mode 100644 index a166b67c8..83a9db3f0 --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_1.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics - for Engine CPU Utilization. +Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics for Engine CPU Utilization. ID: aws_elasticache_redis_metric_engine_cpu_utilization_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_daily\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_daily + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: List all AWS ElastiCache Redis Engine CPU Utilization Metrics + - ElastiCache Redis +Title: List all AWS ElastiCache Redis Engine CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_2.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_2.yaml old mode 100755 new mode 100644 index a67d31a05..7f26b1be5 --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_2.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics - for Engine CPU Utilization. +Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics for Engine CPU Utilization. ID: aws_elasticache_redis_metric_engine_cpu_utilization_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_daily\n\ - where average > 80\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(MIN(minimum::numeric), 2) AS min_cpu, + ROUND(MAX(maximum::numeric), 2) AS max_cpu, + ROUND(AVG(average::numeric), 2) AS avg_cpu, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_daily + WHERE + average > 80 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find ElastiCache Redis CPU Utilization Metrics Daily + - ElastiCache +Title: Find ElastiCache Redis CPU Utilization Metrics Daily \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_3.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_3.yaml old mode 100755 new mode 100644 index b420bc48e..8d5330bab --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_3.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_daily_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics - for Engine CPU Utilization. +Description: Allows users to query ElastiCache Redis Metrics and provides daily statistics for Engine CPU Utilization. ID: aws_elasticache_redis_metric_engine_cpu_utilization_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_daily\n\ - where average < 2\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(minimum::numeric, 2) AS min_cpu, + ROUND(maximum::numeric, 2) AS max_cpu, + ROUND(average::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_daily + WHERE + average < 2 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List All AWS ElastiCache Redis Engine CPU Utilization Daily + - ElastiCache +Title: List All AWS ElastiCache Redis Engine CPU Utilization Daily \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_1.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_1.yaml old mode 100755 new mode 100644 index 2d22fbb3d..be1d4d733 --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache - Redis. +Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache Redis. ID: aws_elasticache_redis_metric_engine_cpu_utilization_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_hourly\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: List hourly CPU utilization metrics for ElastiCache Redis + - ElastiCache Redis +Title: List hourly CPU utilization metrics for ElastiCache Redis \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_2.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_2.yaml old mode 100755 new mode 100644 index 5d3cb5a58..3e0f9e004 --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache - Redis. +Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache Redis. ID: aws_elasticache_redis_metric_engine_cpu_utilization_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_hourly\n\ - where average > 80\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(minimum::numeric, 2) AS min_cpu, + ROUND(maximum::numeric, 2) AS max_cpu, + ROUND(average::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_hourly + WHERE + average > 80 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: List All Hourly CPU Utilization Metrics for AWS ElastiCache Redis + - ElastiCache Redis +Title: List All Hourly CPU Utilization Metrics for AWS ElastiCache Redis \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_3.yaml b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_3.yaml old mode 100755 new mode 100644 index 5209ce414..9fb997351 --- a/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_3.yaml +++ b/queries/aws_elasticache_redis_metric_engine_cpu_utilization_hourly_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache - Redis. +Description: Allows users to query hourly CPU utilization metrics for AWS ElastiCache Redis. ID: aws_elasticache_redis_metric_engine_cpu_utilization_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_elasticache_redis_metric_engine_cpu_utilization_hourly\n\ - where average < 2\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_elasticache_redis_metric_engine_cpu_utilization_hourly + WHERE + AVERAGE < 2 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all hourly CPU utilization metrics for ElastiCache Redis + - ElastiCache +Title: List all hourly CPU utilization metrics for ElastiCache Redis \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_1.yaml b/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_1.yaml old mode 100755 new mode 100644 index 640602bd4..86114df2e --- a/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query ElastiCache Redis Metrics on an hourly basis. This - includes information on GET type commands executed in the selected ElastiCache Redis - cluster during the last hour. +Description: Allows users to query ElastiCache Redis Metrics on an hourly basis. This includes information on GET type commands executed in the selected ElastiCache Redis cluster during the last hour. ID: aws_elasticache_redis_metric_get_type_cmds_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_elasticache_redis_metric_get_type_cmds_hourly\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_elasticache_redis_metric_get_type_cmds_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all ElastiCache Redis Metrics on GET Commands Hourly + - ElastiCache +Title: List all ElastiCache Redis Metrics on GET Commands Hourly \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_2.yaml b/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_2.yaml old mode 100755 new mode 100644 index 2a343e3ad..b521301be --- a/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_get_type_cmds_hourly_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query ElastiCache Redis Metrics on an hourly basis. This - includes information on GET type commands executed in the selected ElastiCache Redis - cluster during the last hour. +Description: Allows users to query ElastiCache Redis Metrics on an hourly basis. This includes information on GET type commands executed in the selected ElastiCache Redis cluster during the last hour. ID: aws_elasticache_redis_metric_get_type_cmds_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_gettypecmds,\n round(maximum::numeric,2) as max_gettypecmds,\n round(average::numeric,2)\ - \ as avg_gettypecmds,\n round(sum::numeric,2) as sum_gettypecmds\nfrom\n aws_elasticache_redis_metric_get_type_cmds_hourly\n\ - where sum > 100\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(minimum::numeric, 2) AS min_gettypecmds, + ROUND(maximum::numeric, 2) AS max_gettypecmds, + ROUND(average::numeric, 2) AS avg_gettypecmds, + ROUND(sum::numeric, 2) AS sum_gettypecmds + FROM + aws_elasticache_redis_metric_get_type_cmds_hourly + WHERE + sum > 100 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List ElastiCache Redis GET Commands Executed Hourly + - ElastiCache +Title: List ElastiCache Redis GET Commands Executed Hourly \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_1.yaml b/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_1.yaml old mode 100755 new mode 100644 index 4acd8bbf5..d352a9a95 --- a/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_1.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query ElastiCache Redis Metrics on an hourly basis, providing - data on list-based commands executed in the ElastiCache Redis environment. +Description: Allows users to query ElastiCache Redis Metrics on an hourly basis, providing data on list-based commands executed in the ElastiCache Redis environment. ID: aws_elasticache_redis_metric_list_based_cmds_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count,\n sum\nfrom\n aws_elasticache_redis_metric_list_based_cmds_hourly\n\ - order by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average, + sample_count, + sum + FROM + aws_elasticache_redis_metric_list_based_cmds_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: List All ElastiCache Redis List-Based Command Metrics + - ElastiCache Redis +Title: List All ElastiCache Redis List-Based Command Metrics \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_2.yaml b/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_2.yaml old mode 100755 new mode 100644 index ff9204c8d..994ba0abd --- a/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_list_based_cmds_hourly_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query ElastiCache Redis Metrics on an hourly basis, providing - data on list-based commands executed in the ElastiCache Redis environment. +Description: Allows users to query ElastiCache Redis Metrics on an hourly basis, providing data on list-based commands executed in the ElastiCache Redis environment. ID: aws_elasticache_redis_metric_list_based_cmds_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_listbasedcmds,\n round(maximum::numeric,2) as max_listbasedcmds,\n \ - \ round(average::numeric,2) as avg_listbasedcmds,\n round(sum::numeric,2) as\ - \ sum_listbasedcmds\nfrom\n aws_elasticache_redis_metric_list_based_cmds_hourly\n\ - where sum > 100\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(minimum::NUMERIC, 2) AS min_listbasedcmds, + ROUND(maximum::NUMERIC, 2) AS max_listbasedcmds, + ROUND(average::NUMERIC, 2) AS avg_listbasedcmds, + ROUND(sum::NUMERIC, 2) AS sum_listbasedcmds + FROM + aws_elasticache_redis_metric_list_based_cmds_hourly + WHERE + sum > 100 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache Redis -Title: List All Hourly AWS ElastiCache Redis List-based Metrics + - ElastiCache Redis +Title: List All Hourly AWS ElastiCache Redis List-based Metrics \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_new_connections_hourly_1.yaml b/queries/aws_elasticache_redis_metric_new_connections_hourly_1.yaml old mode 100755 new mode 100644 index 8cf08e01a..d2885d814 --- a/queries/aws_elasticache_redis_metric_new_connections_hourly_1.yaml +++ b/queries/aws_elasticache_redis_metric_new_connections_hourly_1.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS ElastiCache Redis Metrics to get hourly data - on new connections. +Description: Allows users to query AWS ElastiCache Redis Metrics to get hourly data on new connections. ID: aws_elasticache_redis_metric_new_connections_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average\nfrom\n aws_elasticache_redis_metric_new_connections_hourly\norder\ - \ by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + minimum, + maximum, + average + FROM + aws_elasticache_redis_metric_new_connections_hourly + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS ElastiCache -Title: List hourly AWS ElastiCache Redis new connection metrics + - AWS ElastiCache +Title: List hourly AWS ElastiCache Redis new connection metrics \ No newline at end of file diff --git a/queries/aws_elasticache_redis_metric_new_connections_hourly_2.yaml b/queries/aws_elasticache_redis_metric_new_connections_hourly_2.yaml old mode 100755 new mode 100644 index ac1753dc8..9c22ffa11 --- a/queries/aws_elasticache_redis_metric_new_connections_hourly_2.yaml +++ b/queries/aws_elasticache_redis_metric_new_connections_hourly_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS ElastiCache Redis Metrics to get hourly data - on new connections. +Description: Allows users to query AWS ElastiCache Redis Metrics to get hourly data on new connections. ID: aws_elasticache_redis_metric_new_connections_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_cluster_id,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_newconnections,\n round(maximum::numeric,2) as max_newconnections,\n\ - \ round(average::numeric,2) as avg_newconnections,\n round(sum::numeric,2) as\ - \ sum_newconnections\nfrom\n aws_elasticache_redis_metric_new_connections_hourly\n\ - where sum > 10\norder by\n cache_cluster_id,\n timestamp;" + QueryToExecute: | + SELECT + cache_cluster_id, + timestamp, + ROUND(MIN(minimum::numeric), 2) AS min_newconnections, + ROUND(MAX(maximum::numeric), 2) AS max_newconnections, + ROUND(AVG(average::numeric), 2) AS avg_newconnections, + ROUND(SUM(sum::numeric), 2) AS sum_newconnections + FROM + aws_elasticache_redis_metric_new_connections_hourly + WHERE + sum > 10 + ORDER BY + cache_cluster_id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List hourly AWS ElastiCache Redis new connections + - ElastiCache +Title: List hourly AWS ElastiCache Redis new connections \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_1.yaml b/queries/aws_elasticache_replication_group_1.yaml old mode 100755 new mode 100644 index c5b42488c..b2abbc876 --- a/queries/aws_elasticache_replication_group_1.yaml +++ b/queries/aws_elasticache_replication_group_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_group_id,\n description,\n cache_node_type,\n\ - \ cluster_enabled,\n auth_token_enabled,\n automatic_failover\nfrom\n aws_elasticache_replication_group;" + QueryToExecute: | + SELECT + replication_group_id, + description, + cache_node_type, + cluster_enabled, + auth_token_enabled, + automatic_failover + FROM + aws_elasticache_replication_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Replication Groups with SQL + - ElastiCache +Title: List all AWS ElastiCache Replication Groups with SQL \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_2.yaml b/queries/aws_elasticache_replication_group_2.yaml old mode 100755 new mode 100644 index e76f66b27..33b8dddc3 --- a/queries/aws_elasticache_replication_group_2.yaml +++ b/queries/aws_elasticache_replication_group_2.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_group_id,\n cache_node_type,\n at_rest_encryption_enabled\n\ - from\n aws_elasticache_replication_group\nwhere\n not at_rest_encryption_enabled;" + QueryToExecute: | + SELECT + replication_group_id, + cache_node_type, + at_rest_encryption_enabled + FROM + aws_elasticache_replication_group + WHERE + NOT at_rest_encryption_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List AWS ElastiCache Replication Groups Configuration + - ElastiCache +Title: List AWS ElastiCache Replication Groups Configuration \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_3.yaml b/queries/aws_elasticache_replication_group_3.yaml old mode 100755 new mode 100644 index 68ab81b17..471e7c4f3 --- a/queries/aws_elasticache_replication_group_3.yaml +++ b/queries/aws_elasticache_replication_group_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_group_id,\n cache_node_type,\n multi_az\n\ - from\n aws_elasticache_replication_group\nwhere\n multi_az = 'disabled';" + QueryToExecute: | + SELECT + replication_group_id, + cache_node_type, + multi_az + FROM + aws_elasticache_replication_group + WHERE + multi_az = 'disabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find AWS ElastiCache Replication Groups Configuration + - ElastiCache +Title: Find AWS ElastiCache Replication Groups Configuration \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_4.yaml b/queries/aws_elasticache_replication_group_4.yaml old mode 100755 new mode 100644 index d20809c9f..a20aebb29 --- a/queries/aws_elasticache_replication_group_4.yaml +++ b/queries/aws_elasticache_replication_group_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_group_id,\n snapshot_retention_limit,\n\ - \ snapshot_window,\n snapshotting_cluster_id\nfrom\n aws_elasticache_replication_group\n\ - where\n snapshot_retention_limit < 30;" + QueryToExecute: | + SELECT + replication_group_id, + snapshot_retention_limit, + snapshot_window, + snapshotting_cluster_id + FROM + aws_elasticache_replication_group + WHERE + snapshot_retention_limit < 30; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Replication Groups with Config and Status + - ElastiCache +Title: List all AWS ElastiCache Replication Groups with Config and Status \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_5.yaml b/queries/aws_elasticache_replication_group_5.yaml old mode 100755 new mode 100644 index cabb71e30..b5ab04799 --- a/queries/aws_elasticache_replication_group_5.yaml +++ b/queries/aws_elasticache_replication_group_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_node_type,\n count (*)\nfrom\n aws_elasticache_replication_group\n\ - group by\n cache_node_type;" + QueryToExecute: | + SELECT + cache_node_type, + COUNT(*) + FROM + aws_elasticache_replication_group + GROUP BY + cache_node_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Replication Groups Configurations + - ElastiCache +Title: List all AWS ElastiCache Replication Groups Configurations \ No newline at end of file diff --git a/queries/aws_elasticache_replication_group_6.yaml b/queries/aws_elasticache_replication_group_6.yaml old mode 100755 new mode 100644 index 1d76698e8..260265686 --- a/queries/aws_elasticache_replication_group_6.yaml +++ b/queries/aws_elasticache_replication_group_6.yaml @@ -1,20 +1,23 @@ -Description: Allows users to query AWS ElastiCache Replication Groups to retrieve - information related to their configuration, status, and associated resources. +Description: Allows users to query AWS ElastiCache Replication Groups to retrieve information related to their configuration, status, and associated resources. ID: aws_elasticache_replication_group_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n replication_group_id,\n jsonb_array_elements_text(member_clusters)\ - \ as member_clusters\nfrom\n aws_elasticache_replication_group;" + QueryToExecute: | + SELECT + replication_group_id, + jsonb_array_elements_text(member_clusters) AS member_clusters + FROM + aws_elasticache_replication_group; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find AWS ElastiCache Replication Groups and Status + - ElastiCache +Title: Find AWS ElastiCache Replication Groups and Status \ No newline at end of file diff --git a/queries/aws_elasticache_reserved_cache_node_1.yaml b/queries/aws_elasticache_reserved_cache_node_1.yaml old mode 100755 new mode 100644 index d990c0ca6..3444ceec2 --- a/queries/aws_elasticache_reserved_cache_node_1.yaml +++ b/queries/aws_elasticache_reserved_cache_node_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather - details such as the reservation status, start time, duration, and associated metadata. +Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather details such as the reservation status, start time, duration, and associated metadata. ID: aws_elasticache_reserved_cache_node_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_cache_node_id,\n arn,\n reserved_cache_nodes_offering_id,\n\ - \ state,\n cache_node_type\nfrom\n aws_elasticache_reserved_cache_node;" + QueryToExecute: | + SELECT + reserved_cache_node_id, + arn, + reserved_cache_nodes_offering_id, + state, + cache_node_type + FROM + aws_elasticache_reserved_cache_node; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Reserved Cache Nodes details + - ElastiCache +Title: List all AWS ElastiCache Reserved Cache Nodes details \ No newline at end of file diff --git a/queries/aws_elasticache_reserved_cache_node_2.yaml b/queries/aws_elasticache_reserved_cache_node_2.yaml old mode 100755 new mode 100644 index 706414bc4..a00370b6b --- a/queries/aws_elasticache_reserved_cache_node_2.yaml +++ b/queries/aws_elasticache_reserved_cache_node_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather - details such as the reservation status, start time, duration, and associated metadata. +Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather details such as the reservation status, start time, duration, and associated metadata. ID: aws_elasticache_reserved_cache_node_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_cache_node_id,\n arn,\n reserved_cache_nodes_offering_id,\n\ - \ state,\n cache_node_type\nfrom\n aws_elasticache_reserved_cache_node\nwhere\n\ - \ offering_type = 'All Upfront';" + QueryToExecute: | + SELECT + reserved_cache_node_id, + arn, + reserved_cache_nodes_offering_id, + state, + cache_node_type + FROM + aws_elasticache_reserved_cache_node + WHERE + offering_type = 'All Upfront'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find AWS ElastiCache Reserved Cache Node Details + - ElastiCache +Title: Find AWS ElastiCache Reserved Cache Node Details \ No newline at end of file diff --git a/queries/aws_elasticache_reserved_cache_node_3.yaml b/queries/aws_elasticache_reserved_cache_node_3.yaml old mode 100755 new mode 100644 index 40e933d18..5def23fdc --- a/queries/aws_elasticache_reserved_cache_node_3.yaml +++ b/queries/aws_elasticache_reserved_cache_node_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather - details such as the reservation status, start time, duration, and associated metadata. +Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather details such as the reservation status, start time, duration, and associated metadata. ID: aws_elasticache_reserved_cache_node_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_cache_node_id,\n arn,\n reserved_cache_nodes_offering_id,\n\ - \ state,\n cache_node_type\nfrom\n aws_elasticache_reserved_cache_node\norder\ - \ by\n duration desc;" + QueryToExecute: | + SELECT + reserved_cache_node_id, + arn, + reserved_cache_nodes_offering_id, + state, + cache_node_type + FROM + aws_elasticache_reserved_cache_node + ORDER BY + duration DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List AWS ElastiCache Reserved Cache Nodes with Details + - ElastiCache +Title: List AWS ElastiCache Reserved Cache Nodes with Details \ No newline at end of file diff --git a/queries/aws_elasticache_reserved_cache_node_4.yaml b/queries/aws_elasticache_reserved_cache_node_4.yaml old mode 100755 new mode 100644 index b89525129..e123b7ebd --- a/queries/aws_elasticache_reserved_cache_node_4.yaml +++ b/queries/aws_elasticache_reserved_cache_node_4.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather - details such as the reservation status, start time, duration, and associated metadata. +Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather details such as the reservation status, start time, duration, and associated metadata. ID: aws_elasticache_reserved_cache_node_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_cache_node_id,\n arn,\n reserved_cache_nodes_offering_id,\n\ - \ state,\n cache_node_type\nfrom\n aws_elasticache_reserved_cache_node\norder\ - \ by\n usage_price desc;" + QueryToExecute: | + SELECT + reserved_cache_node_id, + arn, + reserved_cache_nodes_offering_id, + state, + cache_node_type + FROM + aws_elasticache_reserved_cache_node + ORDER BY + usage_price DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Reserved Cache Nodes + - ElastiCache +Title: List all AWS ElastiCache Reserved Cache Nodes \ No newline at end of file diff --git a/queries/aws_elasticache_reserved_cache_node_5.yaml b/queries/aws_elasticache_reserved_cache_node_5.yaml old mode 100755 new mode 100644 index 482a2ef59..fd901f347 --- a/queries/aws_elasticache_reserved_cache_node_5.yaml +++ b/queries/aws_elasticache_reserved_cache_node_5.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather - details such as the reservation status, start time, duration, and associated metadata. +Description: Allows users to query AWS ElastiCache Reserved Cache Nodes to gather details such as the reservation status, start time, duration, and associated metadata. ID: aws_elasticache_reserved_cache_node_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_cache_node_id,\n arn,\n reserved_cache_nodes_offering_id,\n\ - \ state,\n cache_node_type\nfrom\n aws_elasticache_reserved_cache_node\nwhere\n\ - \ state <> 'active';" + QueryToExecute: | + SELECT + reserved_cache_node_id, + arn, + reserved_cache_nodes_offering_id, + state, + cache_node_type + FROM + aws_elasticache_reserved_cache_node + WHERE + state <> 'active'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find AWS ElastiCache Reserved Cache Nodes Details + - ElastiCache +Title: Find AWS ElastiCache Reserved Cache Nodes Details \ No newline at end of file diff --git a/queries/aws_elasticache_subnet_group_1.yaml b/queries/aws_elasticache_subnet_group_1.yaml old mode 100755 new mode 100644 index 1bf2f7495..f468e9f75 --- a/queries/aws_elasticache_subnet_group_1.yaml +++ b/queries/aws_elasticache_subnet_group_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS ElastiCache Subnet Groups, providing details - about each subnet group within their ElastiCache service, including the associated - VPC, subnets, and status. +Description: Allows users to query AWS ElastiCache Subnet Groups, providing details about each subnet group within their ElastiCache service, including the associated VPC, subnets, and status. ID: aws_elasticache_subnet_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cache_subnet_group_name,\n cache_subnet_group_description,\n\ - \ region,\n account_id\nfrom\n aws_elasticache_subnet_group;" + QueryToExecute: | + SELECT + cache_subnet_group_name, + cache_subnet_group_description, + region, + account_id + FROM + aws_elasticache_subnet_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Subnet Groups and Details + - ElastiCache +Title: List all AWS ElastiCache Subnet Groups and Details \ No newline at end of file diff --git a/queries/aws_elasticache_subnet_group_2.yaml b/queries/aws_elasticache_subnet_group_2.yaml old mode 100755 new mode 100644 index a033cc591..c9e3a3f30 --- a/queries/aws_elasticache_subnet_group_2.yaml +++ b/queries/aws_elasticache_subnet_group_2.yaml @@ -1,25 +1,28 @@ -Description: Allows users to query AWS ElastiCache Subnet Groups, providing details - about each subnet group within their ElastiCache service, including the associated - VPC, subnets, and status. +Description: Allows users to query AWS ElastiCache Subnet Groups, providing details about each subnet group within their ElastiCache service, including the associated VPC, subnets, and status. ID: aws_elasticache_subnet_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n sub -> 'SubnetAvailabilityZone' ->> 'Name'\ - \ as subnet_availability_zone,\n sub ->> 'SubnetIdentifier' as subnet_identifier,\n\ - \ sub ->> 'SubnetOutpost' as subnet_outpost\nfrom\n aws_elasticache_subnet_group,\n\ - \ jsonb_array_elements(subnets) as sub;" + QueryToExecute: | + SELECT + vpc_id, + sub -> 'SubnetAvailabilityZone' ->> 'Name' AS subnet_availability_zone, + sub ->> 'SubnetIdentifier' AS subnet_identifier, + sub ->> 'SubnetOutpost' AS subnet_outpost + FROM + aws_elasticache_subnet_group, + jsonb_array_elements(subnets) AS sub; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: List all AWS ElastiCache Subnet Groups and Details + - ElastiCache +Title: List all AWS ElastiCache Subnet Groups and Details \ No newline at end of file diff --git a/queries/aws_elasticache_subnet_group_3.yaml b/queries/aws_elasticache_subnet_group_3.yaml old mode 100755 new mode 100644 index 579235799..c4d9e00c2 --- a/queries/aws_elasticache_subnet_group_3.yaml +++ b/queries/aws_elasticache_subnet_group_3.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS ElastiCache Subnet Groups, providing details - about each subnet group within their ElastiCache service, including the associated - VPC, subnets, and status. +Description: Allows users to query AWS ElastiCache Subnet Groups, providing details about each subnet group within their ElastiCache service, including the associated VPC, subnets, and status. ID: aws_elasticache_subnet_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.cache_cluster_id,\n sg.cache_subnet_group_name,\n\ - \ sg.vpc_id\nfrom\n aws_elasticache_subnet_group as sg\n join aws_elasticache_cluster\ - \ as c on sg.cache_subnet_group_name = c.cache_subnet_group_name;" + QueryToExecute: | + SELECT + c.cache_cluster_id, + sg.cache_subnet_group_name, + sg.vpc_id + FROM + aws_elasticache_subnet_group AS sg + JOIN aws_elasticache_cluster AS c + ON sg.cache_subnet_group_name = c.cache_subnet_group_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - ElastiCache -Title: Find AWS ElastiCache Subnet Groups and VPC Details + - ElastiCache +Title: Find AWS ElastiCache Subnet Groups and VPC Details \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_1.yaml b/queries/aws_elasticsearch_domain_1.yaml old mode 100755 new mode 100644 index 31b130100..60828f48e --- a/queries/aws_elasticsearch_domain_1.yaml +++ b/queries/aws_elasticsearch_domain_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n arn,\n elasticsearch_version,\n\ - \ created\nfrom\n aws_elasticsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + arn, + elasticsearch_version, + created + FROM + aws_elasticsearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: Find all AWS Elasticsearch Service Domain details using SQL + - Elasticsearch Service +Title: Find all AWS Elasticsearch Service Domain details using SQL \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_2.yaml b/queries/aws_elasticsearch_domain_2.yaml old mode 100755 new mode 100644 index 91e8befa9..c32a9cde7 --- a/queries/aws_elasticsearch_domain_2.yaml +++ b/queries/aws_elasticsearch_domain_2.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n encryption_at_rest_options\ - \ ->> 'Enabled' as enabled,\n encryption_at_rest_options ->> 'KmsKeyId' as kms_key_id\n\ - from\n aws_elasticsearch_domain\nwhere\n encryption_at_rest_options ->> 'Enabled'\ - \ = 'false';" + QueryToExecute: | + SELECT + domain_name, + domain_id, + encryption_at_rest_options ->> 'Enabled' AS enabled, + encryption_at_rest_options ->> 'KmsKeyId' AS kms_key_id + FROM + aws_elasticsearch_domain + WHERE + encryption_at_rest_options ->> 'Enabled' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: List all AWS Elasticsearch Service Domains with Disabled Encryption + - Elasticsearch Service +Title: List all AWS Elasticsearch Service Domains with Disabled Encryption \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_3.yaml b/queries/aws_elasticsearch_domain_3.yaml old mode 100755 new mode 100644 index 5cefae2ea..a73401b43 --- a/queries/aws_elasticsearch_domain_3.yaml +++ b/queries/aws_elasticsearch_domain_3.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n ebs_options ->> 'VolumeSize'\ - \ as volume_size,\n ebs_options ->> 'VolumeType' as volume_type,\n ebs_options\ - \ ->> 'EBSEnabled' as ebs_enabled\nfrom\n aws_elasticsearch_domain\nwhere\n \ - \ ebs_options ->> 'EBSEnabled' = 'true';" + QueryToExecute: | + SELECT + domain_name, + domain_id, + ebs_options ->> 'VolumeSize' AS volume_size, + ebs_options ->> 'VolumeType' AS volume_type, + ebs_options ->> 'EBSEnabled' AS ebs_enabled + FROM + aws_elasticsearch_domain + WHERE + ebs_options ->> 'EBSEnabled' = 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: List all AWS Elasticsearch Service Domains with Configuration + - Elasticsearch Service +Title: List all AWS Elasticsearch Service Domains with Configuration \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_4.yaml b/queries/aws_elasticsearch_domain_4.yaml old mode 100755 new mode 100644 index 397a0dee9..a114701d2 --- a/queries/aws_elasticsearch_domain_4.yaml +++ b/queries/aws_elasticsearch_domain_4.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n vpc_options ->> 'AvailabilityZones' as\ - \ availability_zones,\n vpc_options ->> 'SecurityGroupIds' as security_group_ids,\n\ - \ vpc_options ->> 'SubnetIds' as subnet_ids,\n vpc_options ->> 'VPCId' as vpc_id\n\ - from\n aws_elasticsearch_domain\nwhere\n vpc_options ->> 'AvailabilityZones'\ - \ is not null;" + QueryToExecute: | + SELECT + domain_name, + vpc_options ->> 'AvailabilityZones' AS availability_zones, + vpc_options ->> 'SecurityGroupIds' AS security_group_ids, + vpc_options ->> 'SubnetIds' AS subnet_ids, + vpc_options ->> 'VPCId' AS vpc_id + FROM + aws_elasticsearch_domain + WHERE + vpc_options ->> 'AvailabilityZones' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: List all AWS Elasticsearch Service Domains configuration + - Elasticsearch Service +Title: List all AWS Elasticsearch Service Domains configuration \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_5.yaml b/queries/aws_elasticsearch_domain_5.yaml old mode 100755 new mode 100644 index 3c7ef631d..a560357b0 --- a/queries/aws_elasticsearch_domain_5.yaml +++ b/queries/aws_elasticsearch_domain_5.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n elasticsearch_cluster_config\ - \ ->> 'InstanceType' as instance_type,\n elasticsearch_cluster_config ->> 'InstanceCount'\ - \ as instance_count\nfrom\n aws_elasticsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + elasticsearch_cluster_config ->> 'InstanceType' AS instance_type, + elasticsearch_cluster_config ->> 'InstanceCount' AS instance_count + FROM + aws_elasticsearch_domain; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: Find AWS Elasticsearch Domain Configuration and Status + - Elasticsearch Service +Title: Find AWS Elasticsearch Domain Configuration and Status \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_6.yaml b/queries/aws_elasticsearch_domain_6.yaml old mode 100755 new mode 100644 index 3208f65b4..95c7cd194 --- a/queries/aws_elasticsearch_domain_6.yaml +++ b/queries/aws_elasticsearch_domain_6.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n p as principal,\n a as action,\n s\ - \ ->> 'Effect' as effect\nfrom\n aws_elasticsearch_domain,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a\nwhere\n p = '*'\n \ - \ and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + domain_name, + p AS principal, + a AS action, + s ->> 'Effect' AS effect + FROM + aws_elasticsearch_domain, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + p = '*' + AND s ->> 'Effect' = 'Allow'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: Find AWS Elasticsearch Service Domain Config and Status + - Elasticsearch Service +Title: Find AWS Elasticsearch Service Domain Config and Status \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_7.yaml b/queries/aws_elasticsearch_domain_7.yaml old mode 100755 new mode 100644 index 8224067de..48060ed97 --- a/queries/aws_elasticsearch_domain_7.yaml +++ b/queries/aws_elasticsearch_domain_7.yaml @@ -1,25 +1,28 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n log_publishing_options\n\ - from\n aws_elasticsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + log_publishing_options + FROM + aws_elasticsearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: Find AWS Elasticsearch Service Domain Details + - Elasticsearch Service +Title: Find AWS Elasticsearch Service Domain Details \ No newline at end of file diff --git a/queries/aws_elasticsearch_domain_8.yaml b/queries/aws_elasticsearch_domain_8.yaml old mode 100755 new mode 100644 index 7b069cf76..f674b1224 --- a/queries/aws_elasticsearch_domain_8.yaml +++ b/queries/aws_elasticsearch_domain_8.yaml @@ -1,25 +1,27 @@ -Description: Allows users to query AWS Elasticsearch Service Domains for detailed - information related to the configuration, status, and access policies of the Elasticsearch - domains. +Description: Allows users to query AWS Elasticsearch Service Domains for detailed information related to the configuration, status, and access policies of the Elasticsearch domains. ID: aws_elasticsearch_domain_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n log_publishing_options\ - \ -> 'SEARCH_SLOW_LOGS' -> 'Enabled' as enabled,\n log_publishing_options ->\ - \ 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' as cloud_watch_logs_log_group_arn\n\ - from\n aws_elasticsearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' AS enabled, + log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' AS cloud_watch_logs_log_group_arn + FROM + aws_elasticsearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elasticsearch Service -Title: Find AWS Elasticsearch Service Domain Configuration + - Elasticsearch Service +Title: Find AWS Elasticsearch Service Domain Configuration \ No newline at end of file diff --git a/queries/aws_emr_block_public_access_configuration_1.yaml b/queries/aws_emr_block_public_access_configuration_1.yaml old mode 100755 new mode 100644 index 04f1eaa0f..662077c60 --- a/queries/aws_emr_block_public_access_configuration_1.yaml +++ b/queries/aws_emr_block_public_access_configuration_1.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve - details about the block public access configurations for EMR clusters. +Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve details about the block public access configurations for EMR clusters. ID: aws_emr_block_public_access_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n created_by_arn,\n block_public_security_group_rules,\n\ - \ creation_date,\n classification,\n permitted_public_security_group_rule_ranges\n\ - from\n aws_emr_block_public_access_configuration\norder by\n created_by_arn,\n\ - \ creation_date;" + QueryToExecute: | + SELECT + created_by_arn, + block_public_security_group_rules, + creation_date, + classification, + permitted_public_security_group_rule_ranges + FROM + aws_emr_block_public_access_configuration + ORDER BY + created_by_arn, + creation_date; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find AWS EMR Block Public Access Configuration Details + - EMR +Title: Find AWS EMR Block Public Access Configuration Details \ No newline at end of file diff --git a/queries/aws_emr_block_public_access_configuration_2.yaml b/queries/aws_emr_block_public_access_configuration_2.yaml old mode 100755 new mode 100644 index 40eb3a4ed..53b626df4 --- a/queries/aws_emr_block_public_access_configuration_2.yaml +++ b/queries/aws_emr_block_public_access_configuration_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve - details about the block public access configurations for EMR clusters. +Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve details about the block public access configurations for EMR clusters. ID: aws_emr_block_public_access_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n created_by_arn,\n creation_date\nfrom\n aws_emr_block_public_access_configuration\n\ - where\n block_public_security_group_rules;" + QueryToExecute: | + SELECT + created_by_arn, + creation_date + FROM + aws_emr_block_public_access_configuration + WHERE + block_public_security_group_rules; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS EMR -Title: List AWS EMR Block Public Access Configuration Details + - AWS EMR +Title: List AWS EMR Block Public Access Configuration Details \ No newline at end of file diff --git a/queries/aws_emr_block_public_access_configuration_3.yaml b/queries/aws_emr_block_public_access_configuration_3.yaml old mode 100755 new mode 100644 index 2e7a02e25..69a57d63e --- a/queries/aws_emr_block_public_access_configuration_3.yaml +++ b/queries/aws_emr_block_public_access_configuration_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve - details about the block public access configurations for EMR clusters. +Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve details about the block public access configurations for EMR clusters. ID: aws_emr_block_public_access_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n created_by_arn,\n creation_date,\n rules ->> 'MaxRange'\ - \ as max_range,\n rules ->> 'MinRange' as min_range\nfrom\n aws_emr_block_public_access_configuration\n\ - \ cross join jsonb_array_elements(permitted_public_security_group_rule_ranges)\ - \ as rules;" + QueryToExecute: | + SELECT + created_by_arn, + creation_date, + rules ->> 'MaxRange' AS max_range, + rules ->> 'MinRange' AS min_range + FROM + aws_emr_block_public_access_configuration + CROSS JOIN + jsonb_array_elements(permitted_public_security_group_rule_ranges) AS rules; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR Block Public Access Configuration -Title: Find AWS EMR Block Public Access Configurations + - EMR Block Public Access Configuration +Title: Find AWS EMR Block Public Access Configurations \ No newline at end of file diff --git a/queries/aws_emr_block_public_access_configuration_4.yaml b/queries/aws_emr_block_public_access_configuration_4.yaml old mode 100755 new mode 100644 index f0f2e3beb..fb21bd38b --- a/queries/aws_emr_block_public_access_configuration_4.yaml +++ b/queries/aws_emr_block_public_access_configuration_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve - details about the block public access configurations for EMR clusters. +Description: Allows users to query AWS EMR Block Public Access Configuration to retrieve details about the block public access configurations for EMR clusters. ID: aws_emr_block_public_access_configuration_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n created_by_arn,\n creation_date\nfrom\n aws_emr_block_public_access_configuration\n\ - where\n date_part('day', now() - creation_date) < 90;" + QueryToExecute: | + SELECT + created_by_arn, + creation_date + FROM + aws_emr_block_public_access_configuration + WHERE + DATE_PART('day', NOW() - creation_date) < 90; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find AWS EMR Block Public Access Configuration Details + - EMR +Title: Find AWS EMR Block Public Access Configuration Details \ No newline at end of file diff --git a/queries/aws_emr_cluster_1.yaml b/queries/aws_emr_cluster_1.yaml old mode 100755 new mode 100644 index 3c5380c0a..48abf6a4a --- a/queries/aws_emr_cluster_1.yaml +++ b/queries/aws_emr_cluster_1.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n cluster_arn,\n name,\n auto_terminate,\n status\ - \ ->> 'State' as state,\n tags\nfrom\n aws_emr_cluster;" + QueryToExecute: | + SELECT + id, + cluster_arn, + name, + auto_terminate, + status ->> 'State' AS state, + tags + FROM + aws_emr_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: List all AWS Elastic MapReduce Cluster data + - Elastic MapReduce +Title: List all AWS Elastic MapReduce Cluster data \ No newline at end of file diff --git a/queries/aws_emr_cluster_2.yaml b/queries/aws_emr_cluster_2.yaml old mode 100755 new mode 100644 index 799e65db5..4fe4da79c --- a/queries/aws_emr_cluster_2.yaml +++ b/queries/aws_emr_cluster_2.yaml @@ -1,19 +1,26 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cluster_arn,\n auto_terminate\nfrom\n aws_emr_cluster\n\ - where\n not auto_terminate;" + QueryToExecute: | + SELECT + name, + cluster_arn, + auto_terminate + FROM + aws_emr_cluster + WHERE + NOT auto_terminate; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: Find AWS EMR Clusters That Do Not Auto-Terminate + - Elastic MapReduce +Title: Find AWS EMR Clusters That Do Not Auto-Terminate \ No newline at end of file diff --git a/queries/aws_emr_cluster_3.yaml b/queries/aws_emr_cluster_3.yaml old mode 100755 new mode 100644 index 59a4a8690..97daaf8de --- a/queries/aws_emr_cluster_3.yaml +++ b/queries/aws_emr_cluster_3.yaml @@ -1,22 +1,29 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n status ->> 'State' as state,\n status\ - \ -> 'StateChangeReason' ->> 'Message' as state_change_reason\nfrom\n aws_emr_cluster\n\ - where\n status ->> 'State' = 'TERMINATED_WITH_ERRORS';" + QueryToExecute: | + SELECT + id, + name, + status ->> 'State' AS state, + status -> 'StateChangeReason' ->> 'Message' AS state_change_reason + FROM + aws_emr_cluster + WHERE + status ->> 'State' = 'TERMINATED_WITH_ERRORS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: Find AWS Elastic MapReduce Clusters with Errors + - Elastic MapReduce +Title: Find AWS Elastic MapReduce Clusters with Errors \ No newline at end of file diff --git a/queries/aws_emr_cluster_4.yaml b/queries/aws_emr_cluster_4.yaml old mode 100755 new mode 100644 index 7648fa8ec..8efb7c323 --- a/queries/aws_emr_cluster_4.yaml +++ b/queries/aws_emr_cluster_4.yaml @@ -1,20 +1,26 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cluster_arn,\n a ->> 'Name' as application_name,\n\ - \ a ->> 'Version' as application_version\nfrom\n aws_emr_cluster,\n jsonb_array_elements(applications)\ - \ as a;" + QueryToExecute: | + SELECT + name, + cluster_arn, + a ->> 'Name' AS application_name, + a ->> 'Version' AS application_version + FROM + aws_emr_cluster, + jsonb_array_elements(applications) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: Find AWS Elastic MapReduce Cluster Data + - Elastic MapReduce +Title: Find AWS Elastic MapReduce Cluster Data \ No newline at end of file diff --git a/queries/aws_emr_cluster_5.yaml b/queries/aws_emr_cluster_5.yaml old mode 100755 new mode 100644 index 806e4bed5..26c5fcdbb --- a/queries/aws_emr_cluster_5.yaml +++ b/queries/aws_emr_cluster_5.yaml @@ -1,19 +1,26 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cluster_arn,\n log_uri\nfrom\n aws_emr_cluster\n\ - where\n log_uri is null" + QueryToExecute: | + SELECT + name, + cluster_arn, + log_uri + FROM + aws_emr_cluster + WHERE + log_uri IS NULL Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: Find AWS Elastic MapReduce Cluster Data + - Elastic MapReduce +Title: Find AWS Elastic MapReduce Cluster Data \ No newline at end of file diff --git a/queries/aws_emr_cluster_6.yaml b/queries/aws_emr_cluster_6.yaml old mode 100755 new mode 100644 index 1e5f012e7..8512563a7 --- a/queries/aws_emr_cluster_6.yaml +++ b/queries/aws_emr_cluster_6.yaml @@ -1,22 +1,30 @@ Description: Allows users to query AWS Elastic MapReduce Cluster data. ID: aws_emr_cluster_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cluster_arn,\n log_uri,\n log_encryption_kms_key_id\n\ - from\n aws_emr_cluster\nwhere\n log_uri is not null and log_encryption_kms_key_id\ - \ is null;" + QueryToExecute: | + SELECT + name, + cluster_arn, + log_uri, + log_encryption_kms_key_id + FROM + aws_emr_cluster + WHERE + log_uri IS NOT NULL + AND log_encryption_kms_key_id IS NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Elastic MapReduce -Title: Find AWS EMR Cluster Data with Specific Log URIs + - Elastic MapReduce +Title: Find AWS EMR Cluster Data with Specific Log URIs \ No newline at end of file diff --git a/queries/aws_emr_cluster_metric_is_idle_1.yaml b/queries/aws_emr_cluster_metric_is_idle_1.yaml old mode 100755 new mode 100644 index c0ac134b7..a3186114c --- a/queries/aws_emr_cluster_metric_is_idle_1.yaml +++ b/queries/aws_emr_cluster_metric_is_idle_1.yaml @@ -1,20 +1,30 @@ -Description: Allows users to query AWS EMR Cluster Metrics to determine if a cluster - is idle. +Description: Allows users to query AWS EMR Cluster Metrics to determine if a cluster is idle. ID: aws_emr_cluster_metric_is_idle_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sample_count\nfrom\n aws_emr_cluster_metric_is_idle\norder by\n id,\n timestamp;" + QueryToExecute: | + SELECT + id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_emr_cluster_metric_is_idle + ORDER BY + id, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find Idle Status of AWS EMR Cluster Metrics + - EMR +Title: Find Idle Status of AWS EMR Cluster Metrics \ No newline at end of file diff --git a/queries/aws_emr_instance_1.yaml b/queries/aws_emr_instance_1.yaml old mode 100755 new mode 100644 index 43e83527c..398c1b526 --- a/queries/aws_emr_instance_1.yaml +++ b/queries/aws_emr_instance_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EMR Instances for detailed information about - the status, configuration, and other metadata of each instance. +Description: Allows users to query AWS EMR Instances for detailed information about the status, configuration, and other metadata of each instance. ID: aws_emr_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n cluster_id,\n ec2_instance_id,\n instance_type,\n\ - \ private_dns_name,\n private_ip_address\nfrom\n aws_emr_instance;" + QueryToExecute: | + SELECT + id, + cluster_id, + ec2_instance_id, + instance_type, + private_dns_name, + private_ip_address + FROM + aws_emr_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find all AWS EMR Instances for status and configuration + - EMR +Title: Find all AWS EMR Instances for status and configuration \ No newline at end of file diff --git a/queries/aws_emr_instance_2.yaml b/queries/aws_emr_instance_2.yaml old mode 100755 new mode 100644 index 39a2878af..cc469a6be --- a/queries/aws_emr_instance_2.yaml +++ b/queries/aws_emr_instance_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EMR Instances for detailed information about - the status, configuration, and other metadata of each instance. +Description: Allows users to query AWS EMR Instances for detailed information about the status, configuration, and other metadata of each instance. ID: aws_emr_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n ec2_instance_id,\n instance_type\nfrom\n aws_emr_instance\n\ - where\n instance_type = 'm2.4xlarge';" + QueryToExecute: | + SELECT + id, + ec2_instance_id, + instance_type + FROM + aws_emr_instance + WHERE + instance_type = 'm2.4xlarge'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find detailed AWS EMR Instances status and configuration + - EMR +Title: Find detailed AWS EMR Instances status and configuration \ No newline at end of file diff --git a/queries/aws_emr_instance_3.yaml b/queries/aws_emr_instance_3.yaml old mode 100755 new mode 100644 index bf65a11fd..9e71e2e95 --- a/queries/aws_emr_instance_3.yaml +++ b/queries/aws_emr_instance_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EMR Instances for detailed information about - the status, configuration, and other metadata of each instance. +Description: Allows users to query AWS EMR Instances for detailed information about the status, configuration, and other metadata of each instance. ID: aws_emr_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n ec2_instance_id,\n instance_type\nfrom\n aws_emr_instance\n\ - where\n cluster_id = 'j-21HIX5R2NZMXJ';" + QueryToExecute: | + SELECT + id, + ec2_instance_id, + instance_type + FROM + aws_emr_instance + WHERE + cluster_id = 'j-21HIX5R2NZMXJ'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find all AWS EMR Instances with Detailed Information + - EMR +Title: Find all AWS EMR Instances with Detailed Information \ No newline at end of file diff --git a/queries/aws_emr_instance_4.yaml b/queries/aws_emr_instance_4.yaml old mode 100755 new mode 100644 index 5e9ff2d8f..5e16b4880 --- a/queries/aws_emr_instance_4.yaml +++ b/queries/aws_emr_instance_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS EMR Instances for detailed information about - the status, configuration, and other metadata of each instance. +Description: Allows users to query AWS EMR Instances for detailed information about the status, configuration, and other metadata of each instance. ID: aws_emr_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n ec2_instance_id,\n instance_type,\n v -> 'Device'\ - \ as device,\n v -> 'VolumeId' as volume_id\nfrom\n aws_emr_instance,\n jsonb_array_elements(ebs_volumes)\ - \ as v\nwhere\n ei.id = 'ci-ULCFS2ZN0FK7';" + QueryToExecute: | + SELECT + id, + ec2_instance_id, + instance_type, + v -> 'Device' AS device, + v -> 'VolumeId' AS volume_id + FROM + aws_emr_instance, + jsonb_array_elements(ebs_volumes) AS v + WHERE + ei.id = 'ci-ULCFS2ZN0FK7'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Query AWS EMR Instances and Detailed Metadata + - EMR +Title: Query AWS EMR Instances and Detailed Metadata \ No newline at end of file diff --git a/queries/aws_emr_instance_fleet_1.yaml b/queries/aws_emr_instance_fleet_1.yaml old mode 100755 new mode 100644 index 871c11cc5..44e28df78 --- a/queries/aws_emr_instance_fleet_1.yaml +++ b/queries/aws_emr_instance_fleet_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information - about each instance fleet, including its configuration, instance type specifications, - target capacities, and associated metadata. +Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information about each instance fleet, including its configuration, instance type specifications, target capacities, and associated metadata. ID: aws_emr_instance_fleet_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n cluster_id,\n instance_fleet_type,\n\ - \ state\nfrom\n aws_emr_instance_fleet;" + QueryToExecute: | + SELECT + id, + arn, + cluster_id, + instance_fleet_type, + state + FROM + aws_emr_instance_fleet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: List all AWS EMR Instance Fleets with Configuration Details + - EMR +Title: List all AWS EMR Instance Fleets with Configuration Details \ No newline at end of file diff --git a/queries/aws_emr_instance_fleet_2.yaml b/queries/aws_emr_instance_fleet_2.yaml old mode 100755 new mode 100644 index 3f277e241..4a818d70b --- a/queries/aws_emr_instance_fleet_2.yaml +++ b/queries/aws_emr_instance_fleet_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information - about each instance fleet, including its configuration, instance type specifications, - target capacities, and associated metadata. +Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information about each instance fleet, including its configuration, instance type specifications, target capacities, and associated metadata. ID: aws_emr_instance_fleet_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_id,\n c.name as cluster_name,\n c.state as\ - \ cluster_state\nfrom\n aws_emr_instance_fleet as f,\n aws_emr_cluster as c\n\ - where\n f.cluster_id = c.id;" + QueryToExecute: | + SELECT + cluster_id, + c.name AS cluster_name, + c.state AS cluster_state + FROM + aws_emr_instance_fleet AS f, + aws_emr_cluster AS c + WHERE + f.cluster_id = c.id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: List all AWS EMR Instance Fleets with Configuration Details + - EMR +Title: List all AWS EMR Instance Fleets with Configuration Details \ No newline at end of file diff --git a/queries/aws_emr_instance_fleet_3.yaml b/queries/aws_emr_instance_fleet_3.yaml old mode 100755 new mode 100644 index fd2a96050..530ab37bc --- a/queries/aws_emr_instance_fleet_3.yaml +++ b/queries/aws_emr_instance_fleet_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information - about each instance fleet, including its configuration, instance type specifications, - target capacities, and associated metadata. +Description: Allows users to query AWS EMR Instance Fleets to obtain detailed information about each instance fleet, including its configuration, instance type specifications, target capacities, and associated metadata. ID: aws_emr_instance_fleet_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_id,\n provisioned_on_demand_capacity,\n target_on_demand_capacity\n\ - from\n aws_emr_instance_fleet;" + QueryToExecute: | + SELECT + cluster_id, + provisioned_on_demand_capacity, + target_on_demand_capacity + FROM + aws_emr_instance_fleet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR Instance Fleet -Title: List all AWS EMR Instance Fleets and Their Capabilities + - EMR Instance Fleet +Title: List all AWS EMR Instance Fleets and Their Capabilities \ No newline at end of file diff --git a/queries/aws_emr_instance_group_1.yaml b/queries/aws_emr_instance_group_1.yaml old mode 100755 new mode 100644 index 7c1d2b982..a06358251 --- a/queries/aws_emr_instance_group_1.yaml +++ b/queries/aws_emr_instance_group_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS EMR Instance Groups to fetch details about - each instance group within an EMR cluster. +Description: Allows users to query AWS EMR Instance Groups to fetch details about each instance group within an EMR cluster. ID: aws_emr_instance_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n cluster_id,\n instance_group_type,\n\ - \ state\nfrom\n aws_emr_instance_group;" + QueryToExecute: | + SELECT + id, + arn, + cluster_id, + instance_group_type, + state + FROM + aws_emr_instance_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find AWS EMR Instance Groups within a Cluster + - EMR +Title: Find AWS EMR Instance Groups within a Cluster \ No newline at end of file diff --git a/queries/aws_emr_instance_group_2.yaml b/queries/aws_emr_instance_group_2.yaml old mode 100755 new mode 100644 index ead1e9f7c..e9724e06a --- a/queries/aws_emr_instance_group_2.yaml +++ b/queries/aws_emr_instance_group_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS EMR Instance Groups to fetch details about - each instance group within an EMR cluster. +Description: Allows users to query AWS EMR Instance Groups to fetch details about each instance group within an EMR cluster. ID: aws_emr_instance_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n ig.id as instance_group_id,\n ig.cluster_id,\n c.name\ - \ as cluster_name,\n ig.instance_type\nfrom\n aws_emr_instance_group as ig,\n\ - \ aws_emr_cluster as c\nwhere\n ig.cluster_id = c.id\n and ig.instance_group_type\ - \ = 'MASTER';" + QueryToExecute: | + SELECT + ig.id AS instance_group_id, + ig.cluster_id, + c.name AS cluster_name, + ig.instance_type + FROM + aws_emr_instance_group AS ig, + aws_emr_cluster AS c + WHERE + ig.cluster_id = c.id + AND ig.instance_group_type = 'MASTER'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: List AWS EMR instance groups within clusters + - EMR +Title: List AWS EMR instance groups within clusters \ No newline at end of file diff --git a/queries/aws_emr_instance_group_3.yaml b/queries/aws_emr_instance_group_3.yaml old mode 100755 new mode 100644 index 449f79b67..6f748be48 --- a/queries/aws_emr_instance_group_3.yaml +++ b/queries/aws_emr_instance_group_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS EMR Instance Groups to fetch details about - each instance group within an EMR cluster. +Description: Allows users to query AWS EMR Instance Groups to fetch details about each instance group within an EMR cluster. ID: aws_emr_instance_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_id,\n sum(running_instance_count) as running_instance_count\n\ - from\n aws_emr_instance_group\nwhere\n state = 'RUNNING'\ngroup by cluster_id;" + QueryToExecute: | + SELECT + cluster_id, + SUM(running_instance_count) AS running_instance_count + FROM + aws_emr_instance_group + WHERE + state = 'RUNNING' + GROUP BY + cluster_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS EMR -Title: List All AWS EMR Instance Groups and Running Instances + - AWS EMR +Title: List All AWS EMR Instance Groups and Running Instances \ No newline at end of file diff --git a/queries/aws_emr_security_configuration_1.yaml b/queries/aws_emr_security_configuration_1.yaml old mode 100755 new mode 100644 index d2b6707d6..56c2508f0 --- a/queries/aws_emr_security_configuration_1.yaml +++ b/queries/aws_emr_security_configuration_1.yaml @@ -1,28 +1,30 @@ -Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. - This table provides information about security settings and configurations that - can be applied to EMR clusters, managing encryption, authentication, and authorization. - These configurations are crucial for ensuring the secure handling of data, protecting - sensitive information, and complying with various data security standards and regulations. +Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. This table provides information about security settings and configurations that can be applied to EMR clusters, managing encryption, authentication, and authorization. These configurations are crucial for ensuring the secure handling of data, protecting sensitive information, and complying with various data security standards and regulations. ID: aws_emr_security_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n creation_date_time,\n encryption_configuration,\n\ - \ instance_metadata_service_configuration,\n security_configuration\nfrom\n\ - \ aws_emr_security_configuration;" + QueryToExecute: | + SELECT + name, + creation_date_time, + encryption_configuration, + instance_metadata_service_configuration, + security_configuration + FROM + aws_emr_security_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: Find AWS EMR Security Configurations Details + - EMR +Title: Find AWS EMR Security Configurations Details \ No newline at end of file diff --git a/queries/aws_emr_security_configuration_2.yaml b/queries/aws_emr_security_configuration_2.yaml old mode 100755 new mode 100644 index 20e9a34e6..db7b699c8 --- a/queries/aws_emr_security_configuration_2.yaml +++ b/queries/aws_emr_security_configuration_2.yaml @@ -1,26 +1,28 @@ -Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. - This table provides information about security settings and configurations that - can be applied to EMR clusters, managing encryption, authentication, and authorization. - These configurations are crucial for ensuring the secure handling of data, protecting - sensitive information, and complying with various data security standards and regulations. +Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. This table provides information about security settings and configurations that can be applied to EMR clusters, managing encryption, authentication, and authorization. These configurations are crucial for ensuring the secure handling of data, protecting sensitive information, and complying with various data security standards and regulations. ID: aws_emr_security_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n creation_date_time,\n security_configuration\n\ - from\n aws_emr_security_configuration\nwhere\n creation_date_time >= now() -\ - \ interval '30' day;" + QueryToExecute: | + SELECT + name, + creation_date_time, + security_configuration + FROM + aws_emr_security_configuration + WHERE + creation_date_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: List EMR Security Configs from Last 30 Days + - EMR +Title: List EMR Security Configs from Last 30 Days \ No newline at end of file diff --git a/queries/aws_emr_security_configuration_3.yaml b/queries/aws_emr_security_configuration_3.yaml old mode 100755 new mode 100644 index 23fa6ece7..32f925828 --- a/queries/aws_emr_security_configuration_3.yaml +++ b/queries/aws_emr_security_configuration_3.yaml @@ -1,34 +1,32 @@ -Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. - This table provides information about security settings and configurations that - can be applied to EMR clusters, managing encryption, authentication, and authorization. - These configurations are crucial for ensuring the secure handling of data, protecting - sensitive information, and complying with various data security standards and regulations. +Description: Allows users to query AWS EMR (Amazon Elastic MapReduce) Security Configurations. This table provides information about security settings and configurations that can be applied to EMR clusters, managing encryption, authentication, and authorization. These configurations are crucial for ensuring the secure handling of data, protecting sensitive information, and complying with various data security standards and regulations. ID: aws_emr_security_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n creation_date_time,\n encryption_configuration\ - \ -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->>\ - \ 'AwsKmsKey' as aws_kms_key,\n encryption_configuration -> 'AtRestEncryptionConfiguration'\ - \ -> 'LocalDiskEncryptionConfiguration' ->> 'EnableEbsEncryption' as enable_ebs_encryption,\n\ - \ encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration'\ - \ ->> 'EncryptionKeyProviderType' as encryption_key_provider_type,\n encryption_configuration\ - \ -> 'S3EncryptionConfiguration' as s3_encryption_configuration,\n encryption_configuration\ - \ ->> 'EnableAtRestEncryption' as enable_at_rest_encryption,\n encryption_configuration\ - \ ->> 'EnableInTransitEncryption' as enable_in_transit_encryption,\n encryption_configuration\ - \ -> 'InTransitEncryptionConfiguration' as in_transit_encryption_configuration\n\ - from\n aws_emr_security_configuration;" + QueryToExecute: | + SELECT + name, + creation_date_time, + encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->> 'AwsKmsKey' AS aws_kms_key, + encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->> 'EnableEbsEncryption' AS enable_ebs_encryption, + encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->> 'EncryptionKeyProviderType' AS encryption_key_provider_type, + encryption_configuration -> 'S3EncryptionConfiguration' AS s3_encryption_configuration, + encryption_configuration ->> 'EnableAtRestEncryption' AS enable_at_rest_encryption, + encryption_configuration ->> 'EnableInTransitEncryption' AS enable_in_transit_encryption, + encryption_configuration -> 'InTransitEncryptionConfiguration' AS in_transit_encryption_configuration + FROM + aws_emr_security_configuration; Tags: cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EMR -Title: List all AWS EMR Security Configurations using SQL + - EMR +Title: List all AWS EMR Security Configurations using SQL \ No newline at end of file diff --git a/queries/aws_eventbridge_bus_1.yaml b/queries/aws_eventbridge_bus_1.yaml old mode 100755 new mode 100644 index 1048e4f9a..8dc584b1e --- a/queries/aws_eventbridge_bus_1.yaml +++ b/queries/aws_eventbridge_bus_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS EventBridge Buses for detailed information - about each bus, including its name, ARN, policy, and more. +Description: Allows users to query AWS EventBridge Buses for detailed information about each bus, including its name, ARN, policy, and more. ID: aws_eventbridge_bus_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_eventbridge_bus;" + QueryToExecute: | + SELECT + name, + arn, + JSONB_PRETTY(policy) AS policy, + JSONB_PRETTY(policy_std) AS policy_std + FROM + aws_eventbridge_bus; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EventBridge -Title: Find all AWS EventBridge Buses and their Details + - EventBridge +Title: Find all AWS EventBridge Buses and their Details \ No newline at end of file diff --git a/queries/aws_eventbridge_rule_1.yaml b/queries/aws_eventbridge_rule_1.yaml old mode 100755 new mode 100644 index 8154e1068..1b844b32c --- a/queries/aws_eventbridge_rule_1.yaml +++ b/queries/aws_eventbridge_rule_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS EventBridge Rule to access information regarding - the EventBridge rules defined within an AWS account. +Description: Allows users to query AWS EventBridge Rule to access information regarding the EventBridge rules defined within an AWS account. ID: aws_eventbridge_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state,\n created_by,\n event_bus_name\n\ - from\n aws_eventbridge_rule;" + QueryToExecute: | + SELECT + name, + arn, + state, + created_by, + event_bus_name + FROM + aws_eventbridge_rule; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EventBridge -Title: Find EventBridge Rule Information in AWS Account + - EventBridge +Title: Find EventBridge Rule Information in AWS Account \ No newline at end of file diff --git a/queries/aws_eventbridge_rule_2.yaml b/queries/aws_eventbridge_rule_2.yaml old mode 100755 new mode 100644 index 9a7a949a6..089d5f866 --- a/queries/aws_eventbridge_rule_2.yaml +++ b/queries/aws_eventbridge_rule_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS EventBridge Rule to access information regarding - the EventBridge rules defined within an AWS account. +Description: Allows users to query AWS EventBridge Rule to access information regarding the EventBridge rules defined within an AWS account. ID: aws_eventbridge_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state,\n created_by\nfrom\n aws_eventbridge_rule\n\ - where\n state != 'ENABLED';" + QueryToExecute: | + SELECT + name, + arn, + state, + created_by + FROM + aws_eventbridge_rule + WHERE + state != 'ENABLED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EventBridge -Title: Find all AWS EventBridge Rules not enabled + - EventBridge +Title: Find all AWS EventBridge Rules not enabled \ No newline at end of file diff --git a/queries/aws_eventbridge_rule_3.yaml b/queries/aws_eventbridge_rule_3.yaml old mode 100755 new mode 100644 index c8cad61e9..3e2a07d71 --- a/queries/aws_eventbridge_rule_3.yaml +++ b/queries/aws_eventbridge_rule_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS EventBridge Rule to access information regarding - the EventBridge rules defined within an AWS account. +Description: Allows users to query AWS EventBridge Rule to access information regarding the EventBridge rules defined within an AWS account. ID: aws_eventbridge_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cd ->> 'Id' as target_id,\n cd ->> 'Arn' as\ - \ target_arn,\n cd ->> 'RoleArn' as role_arn\nfrom\n aws_eventbridge_rule,\n\ - \ jsonb_array_elements(targets) as cd;" + QueryToExecute: | + SELECT + name, + cd ->> 'Id' AS target_id, + cd ->> 'Arn' AS target_arn, + cd ->> 'RoleArn' AS role_arn + FROM + aws_eventbridge_rule, + jsonb_array_elements(targets) AS cd; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - EventBridge -Title: Find AWS EventBridge Rules using SQL + - EventBridge +Title: Find AWS EventBridge Rules using SQL \ No newline at end of file diff --git a/queries/aws_fms_app_list_1.yaml b/queries/aws_fms_app_list_1.yaml old mode 100755 new mode 100644 index 3509ffe94..1774da8b6 --- a/queries/aws_fms_app_list_1.yaml +++ b/queries/aws_fms_app_list_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive - details about each application, including application ID, protocol, source and destination - IP ranges, and source and destination ports. +Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive details about each application, including application ID, protocol, source and destination IP ranges, and source and destination ports. ID: aws_fms_app_list_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n list_name,\n list_id,\n arn,\n create_time\nfrom\n\ - \ aws_fms_app_list;" + QueryToExecute: | + SELECT + list_name, + list_id, + arn, + create_time + FROM + aws_fms_app_list; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Firewall Manager -Title: Find AWS Firewall Manager Application Details + - AWS Firewall Manager +Title: Find AWS Firewall Manager Application Details \ No newline at end of file diff --git a/queries/aws_fms_app_list_2.yaml b/queries/aws_fms_app_list_2.yaml old mode 100755 new mode 100644 index 6e4331e01..217115c38 --- a/queries/aws_fms_app_list_2.yaml +++ b/queries/aws_fms_app_list_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive - details about each application, including application ID, protocol, source and destination - IP ranges, and source and destination ports. +Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive details about each application, including application ID, protocol, source and destination IP ranges, and source and destination ports. ID: aws_fms_app_list_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n list_name,\n list_id,\n arn,\n create_time\nfrom\n\ - \ aws_fms_app_list\nwhere\n create_time >= now() - interval '30' day;" + QueryToExecute: | + SELECT + list_name, + list_id, + arn, + create_time + FROM + aws_fms_app_list + WHERE + create_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Firewall Manager -Title: Find AWS Firewall Manager Application Details in Last 30 Days + - Firewall Manager +Title: Find AWS Firewall Manager Application Details in Last 30 Days \ No newline at end of file diff --git a/queries/aws_fms_app_list_3.yaml b/queries/aws_fms_app_list_3.yaml old mode 100755 new mode 100644 index 9e06addcd..66161ae0a --- a/queries/aws_fms_app_list_3.yaml +++ b/queries/aws_fms_app_list_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive - details about each application, including application ID, protocol, source and destination - IP ranges, and source and destination ports. +Description: Allows users to query AWS Firewall Manager Applications to obtain comprehensive details about each application, including application ID, protocol, source and destination IP ranges, and source and destination ports. ID: aws_fms_app_list_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n list_name,\n list_id,\n a ->> 'AppName' as app_name,\n\ - \ a ->> 'Port' as port,\n a ->> 'Protocol' as protocol\nfrom\n aws_fms_app_list,\n\ - \ jsonb_array_elements(apps_list -> 'AppsList') as a;" + QueryToExecute: | + SELECT + list_name, + list_id, + a ->> 'AppName' AS app_name, + a ->> 'Port' AS port, + a ->> 'Protocol' AS protocol + FROM + aws_fms_app_list, + jsonb_array_elements(apps_list -> 'AppsList') AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Firewall Manager -Title: Query AWS Firewall Manager Applications with Details + - Firewall Manager +Title: Query AWS Firewall Manager Applications with Details \ No newline at end of file diff --git a/queries/aws_fms_policy_1.yaml b/queries/aws_fms_policy_1.yaml old mode 100755 new mode 100644 index b4983fb32..4d3103da7 --- a/queries/aws_fms_policy_1.yaml +++ b/queries/aws_fms_policy_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Firewall Manager Policies using SQL. This table - provides information about each AWS Firewall Manager (FMS) policy in an AWS account. - It can be used to gain insights into policy details such as the policy name, ID, - resource type, security service type, and more. +Description: Allows users to query AWS Firewall Manager Policies using SQL. This table provides information about each AWS Firewall Manager (FMS) policy in an AWS account. It can be used to gain insights into policy details such as the policy name, ID, resource type, security service type, and more. ID: aws_fms_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_name,\n policy_id,\n arn,\n policy_description,\n\ - \ resource_type\nfrom\n aws_fms_policy;" + QueryToExecute: | + SELECT + policy_name, + policy_id, + arn, + policy_description, + resource_type + FROM + aws_fms_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Firewall Manager -Title: List All AWS Firewall Manager Policy Details + - AWS Firewall Manager +Title: List All AWS Firewall Manager Policy Details \ No newline at end of file diff --git a/queries/aws_fms_policy_2.yaml b/queries/aws_fms_policy_2.yaml old mode 100755 new mode 100644 index 28253ae49..494c2b099 --- a/queries/aws_fms_policy_2.yaml +++ b/queries/aws_fms_policy_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Firewall Manager Policies using SQL. This table - provides information about each AWS Firewall Manager (FMS) policy in an AWS account. - It can be used to gain insights into policy details such as the policy name, ID, - resource type, security service type, and more. +Description: Allows users to query AWS Firewall Manager Policies using SQL. This table provides information about each AWS Firewall Manager (FMS) policy in an AWS account. It can be used to gain insights into policy details such as the policy name, ID, resource type, security service type, and more. ID: aws_fms_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_name,\n policy_id,\n arn,\n policy_description,\n\ - \ resource_type,\n remediation_enabled\nfrom\n aws_fms_policy\nwhere\n remediation_enabled;" + QueryToExecute: | + SELECT + policy_name, + policy_id, + arn, + policy_description, + resource_type, + remediation_enabled + FROM + aws_fms_policy + WHERE + remediation_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Firewall Manager -Title: Find AWS Firewall Manager Policies with SQL + - Firewall Manager +Title: Find AWS Firewall Manager Policies with SQL \ No newline at end of file diff --git a/queries/aws_fms_policy_3.yaml b/queries/aws_fms_policy_3.yaml old mode 100755 new mode 100644 index f5a446713..cc441cd22 --- a/queries/aws_fms_policy_3.yaml +++ b/queries/aws_fms_policy_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Firewall Manager Policies using SQL. This table - provides information about each AWS Firewall Manager (FMS) policy in an AWS account. - It can be used to gain insights into policy details such as the policy name, ID, - resource type, security service type, and more. +Description: Allows users to query AWS Firewall Manager Policies using SQL. This table provides information about each AWS Firewall Manager (FMS) policy in an AWS account. It can be used to gain insights into policy details such as the policy name, ID, resource type, security service type, and more. ID: aws_fms_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_name,\n resource_type,\n count(policy_id) as\ - \ policy_applied\nfrom\n aws_fms_policy\ngroup by\n policy_name,\n resource_type;" + QueryToExecute: | + SELECT + policy_name, + resource_type, + COUNT(policy_id) AS policy_applied + FROM + aws_fms_policy + GROUP BY + policy_name, + resource_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Firewall Manager -Title: List all AWS Firewall Manager Policies and Details + - AWS Firewall Manager +Title: List all AWS Firewall Manager Policies and Details \ No newline at end of file diff --git a/queries/aws_fms_policy_4.yaml b/queries/aws_fms_policy_4.yaml old mode 100755 new mode 100644 index d42837ed4..90560f63d --- a/queries/aws_fms_policy_4.yaml +++ b/queries/aws_fms_policy_4.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Firewall Manager Policies using SQL. This table - provides information about each AWS Firewall Manager (FMS) policy in an AWS account. - It can be used to gain insights into policy details such as the policy name, ID, - resource type, security service type, and more. +Description: Allows users to query AWS Firewall Manager Policies using SQL. This table provides information about each AWS Firewall Manager (FMS) policy in an AWS account. It can be used to gain insights into policy details such as the policy name, ID, resource type, security service type, and more. ID: aws_fms_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_name,\n policy_id,\n policy_status\nfrom\n \ - \ aws_fms_policy\nwhere\n policy_status <> 'ACTIVE';" + QueryToExecute: | + SELECT + policy_name, + policy_id, + policy_status + FROM + aws_fms_policy + WHERE + policy_status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Firewall Manager -Title: List AWS Firewall Manager (FMS) Policies Details + - Firewall Manager +Title: List AWS Firewall Manager (FMS) Policies Details \ No newline at end of file diff --git a/queries/aws_fsx_file_system_1.yaml b/queries/aws_fsx_file_system_1.yaml old mode 100755 new mode 100644 index 2a5d5b479..a34b616a7 --- a/queries/aws_fsx_file_system_1.yaml +++ b/queries/aws_fsx_file_system_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS FSx File Systems to gather information about - the file system''s details, including its lifecycle, type, storage capacity, and - associated tags. +Description: Allows users to query AWS FSx File Systems to gather information about the file system's details, including its lifecycle, type, storage capacity, and associated tags. ID: aws_fsx_file_system_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n file_system_id,\n arn,\n dns_name,\n owner_id,\n \ - \ creation_time,\n lifecycle,\n storage_capacity\nfrom\n aws_fsx_file_system;" + QueryToExecute: | + SELECT + file_system_id, + arn, + dns_name, + owner_id, + creation_time, + lifecycle, + storage_capacity + FROM + aws_fsx_file_system; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - FSx -Title: List AWS FSx File Systems details including lifecycle + - FSx +Title: List AWS FSx File Systems details including lifecycle \ No newline at end of file diff --git a/queries/aws_fsx_file_system_2.yaml b/queries/aws_fsx_file_system_2.yaml old mode 100755 new mode 100644 index c307cd6c3..19aab2bd6 --- a/queries/aws_fsx_file_system_2.yaml +++ b/queries/aws_fsx_file_system_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS FSx File Systems to gather information about - the file system''s details, including its lifecycle, type, storage capacity, and - associated tags. +Description: Allows users to query AWS FSx File Systems to gather information about the file system's details, including its lifecycle, type, storage capacity, and associated tags. ID: aws_fsx_file_system_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n file_system_id,\n kms_key_id,\n region\nfrom\n aws_fsx_file_system\n\ - where\n kms_key_id is not null;" + QueryToExecute: | + SELECT + file_system_id, + kms_key_id, + region + FROM + aws_fsx_file_system + WHERE + kms_key_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - FSx -Title: List AWS FSx File Systems and Details + - FSx +Title: List AWS FSx File Systems and Details \ No newline at end of file diff --git a/queries/aws_glacier_vault_1.yaml b/queries/aws_glacier_vault_1.yaml old mode 100755 new mode 100644 index c10526b14..db6501acd --- a/queries/aws_glacier_vault_1.yaml +++ b/queries/aws_glacier_vault_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vault_name,\n creation_date,\n last_inventory_date,\n\ - \ number_of_archives,\n size_in_bytes\nfrom\n aws_glacier_vault;" + QueryToExecute: | + SELECT + vault_name, + creation_date, + last_inventory_date, + number_of_archives, + size_in_bytes + FROM + aws_glacier_vault; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glacier -Title: List all AWS Glacier Vault details with SQL Query + - Glacier +Title: List all AWS Glacier Vault details with SQL Query \ No newline at end of file diff --git a/queries/aws_glacier_vault_2.yaml b/queries/aws_glacier_vault_2.yaml old mode 100755 new mode 100644 index 80b74cea1..2cd299aff --- a/queries/aws_glacier_vault_2.yaml +++ b/queries/aws_glacier_vault_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_glacier_vault,\n \ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n s ->> 'Effect' = 'Allow'\n and a in ('*', 'glacier:*');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_glacier_vault, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND a IN ('*', 'glacier:*'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glacier -Title: Find all AWS Glacier Vaults and Detailed Information + - AWS Glacier +Title: Find all AWS Glacier Vaults and Detailed Information \ No newline at end of file diff --git a/queries/aws_glacier_vault_3.yaml b/queries/aws_glacier_vault_3.yaml old mode 100755 new mode 100644 index 208e591e1..ac0e1aa80 --- a/queries/aws_glacier_vault_3.yaml +++ b/queries/aws_glacier_vault_3.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_glacier_vault,\n \ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a\nwhere\n p = '*'\n and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_glacier_vault, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + p = '*' + AND s ->> 'Effect' = 'Allow'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glacier -Title: List AWS Glacier Vaults with Detailed Information + - Glacier +Title: List AWS Glacier Vaults with Detailed Information \ No newline at end of file diff --git a/queries/aws_glacier_vault_4.yaml b/queries/aws_glacier_vault_4.yaml old mode 100755 new mode 100644 index 53377e83f..b50428656 --- a/queries/aws_glacier_vault_4.yaml +++ b/queries/aws_glacier_vault_4.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n a as action,\n s ->> 'Effect' as effect,\n\ - \ s -> 'Condition' -> 'NumericLessThan' ->> 'glacier:archiveageindays' as archive_age_in_days\n\ - from\n aws_glacier_vault,\n jsonb_array_elements(vault_lock_policy_std -> 'Statement')\ - \ as s,\n jsonb_array_elements_text(s -> 'Action') as a;" + QueryToExecute: | + SELECT + title, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' -> 'NumericLessThan' ->> 'glacier:archiveageindays' AS archive_age_in_days + FROM + aws_glacier_vault, + jsonb_array_elements(vault_lock_policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Action') AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glacier -Title: Find AWS Glacier Vault Details including Name, ARN, and Archives + - AWS Glacier +Title: Find AWS Glacier Vault Details including Name, ARN, and Archives \ No newline at end of file diff --git a/queries/aws_glacier_vault_5.yaml b/queries/aws_glacier_vault_5.yaml old mode 100755 new mode 100644 index c23157365..061f8021c --- a/queries/aws_glacier_vault_5.yaml +++ b/queries/aws_glacier_vault_5.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vault_name,\n tags\nfrom\n aws_glacier_vault\nwhere\n\ - \ not tags :: JSONB ? 'owner';" + QueryToExecute: | + SELECT + vault_name, + tags + FROM + aws_glacier_vault + WHERE + NOT tags :: JSONB ? 'owner'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glacier -Title: List all AWS Glacier Vaults for Detailed Information + - Glacier +Title: List all AWS Glacier Vaults for Detailed Information \ No newline at end of file diff --git a/queries/aws_glacier_vault_6.yaml b/queries/aws_glacier_vault_6.yaml old mode 100755 new mode 100644 index be43a20eb..540e22f04 --- a/queries/aws_glacier_vault_6.yaml +++ b/queries/aws_glacier_vault_6.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Glacier Vaults for detailed information on - each vault, including the vault''s name, ARN, creation date, number of archives, - size of archives, and more. +Description: Allows users to query AWS Glacier Vaults for detailed information on each vault, including the vault's name, ARN, creation date, number of archives, size of archives, and more. ID: aws_glacier_vault_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vault_name,\n vault_notification_config ->> 'SNSTopic'\ - \ as sns_topic,\n vault_notification_config ->> 'Events' as notification_events\n\ - from\n aws_glacier_vault\nwhere\n vault_notification_config is not null;" + QueryToExecute: | + SELECT + vault_name, + vault_notification_config ->> 'SNSTopic' AS sns_topic, + vault_notification_config ->> 'Events' AS notification_events + FROM + aws_glacier_vault + WHERE + vault_notification_config IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glacier -Title: Find all AWS Glacier Vaults and Notification Configs + - Glacier +Title: Find all AWS Glacier Vaults and Notification Configs \ No newline at end of file diff --git a/queries/aws_globalaccelerator_accelerator_1.yaml b/queries/aws_globalaccelerator_accelerator_1.yaml old mode 100755 new mode 100644 index 5cb5d83c3..df6b01c5f --- a/queries/aws_globalaccelerator_accelerator_1.yaml +++ b/queries/aws_globalaccelerator_accelerator_1.yaml @@ -1,19 +1,28 @@ -Description: Allows users to query AWS Global Accelerator''s accelerators. +Description: Allows users to query AWS Global Accelerator's accelerators. ID: aws_globalaccelerator_accelerator_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n dns_name,\n enabled,\n ip_address_type,\n\ - \ last_modified_time,\n status\nfrom\n aws_globalaccelerator_accelerator;" + QueryToExecute: | + SELECT + name, + created_time, + dns_name, + enabled, + ip_address_type, + last_modified_time, + status + FROM + aws_globalaccelerator_accelerator; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find all AWS Global Accelerator Accelerators + - Global Accelerator +Title: Find all AWS Global Accelerator Accelerators \ No newline at end of file diff --git a/queries/aws_globalaccelerator_accelerator_2.yaml b/queries/aws_globalaccelerator_accelerator_2.yaml old mode 100755 new mode 100644 index 7ee6e56b1..9bf8a2a2b --- a/queries/aws_globalaccelerator_accelerator_2.yaml +++ b/queries/aws_globalaccelerator_accelerator_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Global Accelerator''s accelerators. +Description: Allows users to query AWS Global Accelerator's accelerators. ID: aws_globalaccelerator_accelerator_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time,\n dns_name,\n enabled,\n ip_address_type,\n\ - \ last_modified_time,\n status,\n anycast_ip\nfrom\n aws_globalaccelerator_accelerator,\n\ - \ jsonb_array_elements(ip_sets -> 0 -> 'IpAddresses') as anycast_ip;" + QueryToExecute: | + SELECT + name, + created_time, + dns_name, + enabled, + ip_address_type, + last_modified_time, + status, + anycast_ip + FROM + aws_globalaccelerator_accelerator, + jsonb_array_elements(ip_sets -> 0 -> 'IpAddresses') AS anycast_ip; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find all AWS Global Accelerator accelerators + - Global Accelerator +Title: Find all AWS Global Accelerator accelerators \ No newline at end of file diff --git a/queries/aws_globalaccelerator_accelerator_3.yaml b/queries/aws_globalaccelerator_accelerator_3.yaml old mode 100755 new mode 100644 index c87c95e09..f6c42e729 --- a/queries/aws_globalaccelerator_accelerator_3.yaml +++ b/queries/aws_globalaccelerator_accelerator_3.yaml @@ -1,19 +1,25 @@ Description: Allows users to query AWS Global Accelerator''s accelerators. ID: aws_globalaccelerator_accelerator_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tags\nfrom\n aws_globalaccelerator_accelerator\n\ - where\n not tags::JSONB ? 'owner';" + QueryToExecute: | + SELECT + name, + tags + FROM + aws_globalaccelerator_accelerator + WHERE + NOT tags::JSONB ? 'owner'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find AWS Global Accelerator's Accelerators + - Global Accelerator +Title: Find AWS Global Accelerator's Accelerators \ No newline at end of file diff --git a/queries/aws_globalaccelerator_endpoint_group_1.yaml b/queries/aws_globalaccelerator_endpoint_group_1.yaml old mode 100755 new mode 100644 index ff8cb7b6d..ab665a468 --- a/queries/aws_globalaccelerator_endpoint_group_1.yaml +++ b/queries/aws_globalaccelerator_endpoint_group_1.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain - detailed information about each group''s configuration, state, and associated endpoints. +Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain detailed information about each group's configuration, state, and associated endpoints. ID: aws_globalaccelerator_endpoint_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n endpoint_descriptions,\n endpoint_group_region,\n\ - \ traffic_dial_percentage,\n port_overrides,\n health_check_interval_seconds,\n\ - \ health_check_path,\n health_check_port,\n health_check_protocol,\n threshold_count\n\ - from\n aws_globalaccelerator_endpoint_group;" + QueryToExecute: | + SELECT + title, + endpoint_descriptions, + endpoint_group_region, + traffic_dial_percentage, + port_overrides, + health_check_interval_seconds, + health_check_path, + health_check_port, + health_check_protocol, + threshold_count + FROM + aws_globalaccelerator_endpoint_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: List AWS Global Accelerator Endpoint Groups Configuration + - Global Accelerator +Title: List AWS Global Accelerator Endpoint Groups Configuration \ No newline at end of file diff --git a/queries/aws_globalaccelerator_endpoint_group_2.yaml b/queries/aws_globalaccelerator_endpoint_group_2.yaml old mode 100755 new mode 100644 index bad747cbc..0cfd7e9a4 --- a/queries/aws_globalaccelerator_endpoint_group_2.yaml +++ b/queries/aws_globalaccelerator_endpoint_group_2.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain - detailed information about each group''s configuration, state, and associated endpoints. +Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain detailed information about each group''s configuration, state, and associated endpoints. ID: aws_globalaccelerator_endpoint_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n endpoint_descriptions,\n endpoint_group_region,\n\ - \ traffic_dial_percentage,\n port_overrides,\n health_check_interval_seconds,\n\ - \ health_check_path,\n health_check_port,\n health_check_protocol,\n threshold_count\n\ - from\n aws_globalaccelerator_endpoint_group\nwhere\n listener_arn = 'arn:aws:globalaccelerator::012345678901:accelerator/1234abcd-abcd-1234-abcd-1234abcdefgh/listener/abcdef1234';" + QueryToExecute: | + SELECT + title, + endpoint_descriptions, + endpoint_group_region, + traffic_dial_percentage, + port_overrides, + health_check_interval_seconds, + health_check_path, + health_check_port, + health_check_protocol, + threshold_count + FROM + aws_globalaccelerator_endpoint_group + WHERE + listener_arn = 'arn:aws:globalaccelerator::012345678901:accelerator/1234abcd-abcd-1234-abcd-1234abcdefgh/listener/abcdef1234'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: List all AWS Global Accelerator Endpoint Groups + - Global Accelerator +Title: List all AWS Global Accelerator Endpoint Groups \ No newline at end of file diff --git a/queries/aws_globalaccelerator_endpoint_group_3.yaml b/queries/aws_globalaccelerator_endpoint_group_3.yaml old mode 100755 new mode 100644 index 71eaa5d7d..9e83e2876 --- a/queries/aws_globalaccelerator_endpoint_group_3.yaml +++ b/queries/aws_globalaccelerator_endpoint_group_3.yaml @@ -1,28 +1,41 @@ -Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain - detailed information about each group''s configuration, state, and associated endpoints. +Description: Allows users to query AWS Global Accelerator Endpoint Groups and obtain detailed information about each group's configuration, state, and associated endpoints. ID: aws_globalaccelerator_endpoint_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.name as accelerator_name,\n l.client_affinity as listener_client_affinity,\n\ - \ l.port_ranges as listener_port_ranges,\n l.protocol as listener_protocol,\n\ - \ eg.endpoint_descriptions,\n eg.endpoint_group_region,\n eg.traffic_dial_percentage,\n\ - \ eg.port_overrides,\n eg.health_check_interval_seconds,\n eg.health_check_path,\n\ - \ eg.health_check_port,\n eg.health_check_protocol,\n eg.threshold_count\n\ - from\n aws_globalaccelerator_accelerator a,\n aws_globalaccelerator_listener\ - \ l,\n aws_globalaccelerator_endpoint_group eg\nwhere\n eg.listener_arn = l.arn\n\ - \ and l.accelerator_arn = a.arn;" + QueryToExecute: | + SELECT + a.name AS accelerator_name, + l.client_affinity AS listener_client_affinity, + l.port_ranges AS listener_port_ranges, + l.protocol AS listener_protocol, + eg.endpoint_descriptions, + eg.endpoint_group_region, + eg.traffic_dial_percentage, + eg.port_overrides, + eg.health_check_interval_seconds, + eg.health_check_path, + eg.health_check_port, + eg.health_check_protocol, + eg.threshold_count + FROM + aws_globalaccelerator_accelerator a, + aws_globalaccelerator_listener l, + aws_globalaccelerator_endpoint_group eg + WHERE + eg.listener_arn = l.arn + AND l.accelerator_arn = a.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find AWS Global Accelerator Endpoint Groups Configuration + - Global Accelerator +Title: Find AWS Global Accelerator Endpoint Groups Configuration \ No newline at end of file diff --git a/queries/aws_globalaccelerator_listener_1.yaml b/queries/aws_globalaccelerator_listener_1.yaml old mode 100755 new mode 100644 index 47aa569a3..713ba7c98 --- a/queries/aws_globalaccelerator_listener_1.yaml +++ b/queries/aws_globalaccelerator_listener_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Global Accelerator Listener data, including - details about each listener that processes inbound connections based on the port - or port ranges that you configure. +Description: Allows users to query AWS Global Accelerator Listener data, including details about each listener that processes inbound connections based on the port or port ranges that you configure. ID: aws_globalaccelerator_listener_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n client_affinity,\n port_ranges,\n protocol\n\ - from\n aws_globalaccelerator_listener;" + QueryToExecute: | + SELECT + title, + client_affinity, + port_ranges, + protocol + FROM + aws_globalaccelerator_listener; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: List all AWS Global Accelerator Listener details + - Global Accelerator +Title: List all AWS Global Accelerator Listener details \ No newline at end of file diff --git a/queries/aws_globalaccelerator_listener_2.yaml b/queries/aws_globalaccelerator_listener_2.yaml old mode 100755 new mode 100644 index 7584d6a0b..8a38e2e3c --- a/queries/aws_globalaccelerator_listener_2.yaml +++ b/queries/aws_globalaccelerator_listener_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Global Accelerator Listener data, including - details about each listener that processes inbound connections based on the port - or port ranges that you configure. +Description: Allows users to query AWS Global Accelerator Listener data, including details about each listener that processes inbound connections based on the port or port ranges that you configure. ID: aws_globalaccelerator_listener_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n client_affinity,\n port_ranges,\n protocol\n\ - from\n aws_globalaccelerator_listener\nwhere\n accelerator_arn = 'arn:aws:globalaccelerator::012345678901:accelerator/1234abcd';" + QueryToExecute: | + SELECT + title, + client_affinity, + port_ranges, + protocol + FROM + aws_globalaccelerator_listener + WHERE + accelerator_arn = 'arn:aws:globalaccelerator::012345678901:accelerator/1234abcd'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find AWS Global Accelerator Listener Details + - Global Accelerator +Title: Find AWS Global Accelerator Listener Details \ No newline at end of file diff --git a/queries/aws_globalaccelerator_listener_3.yaml b/queries/aws_globalaccelerator_listener_3.yaml old mode 100755 new mode 100644 index e29611b62..1f8b4faf1 --- a/queries/aws_globalaccelerator_listener_3.yaml +++ b/queries/aws_globalaccelerator_listener_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Global Accelerator Listener data, including - details about each listener that processes inbound connections based on the port - or port ranges that you configure. +Description: Allows users to query AWS Global Accelerator Listener data, including details about each listener that processes inbound connections based on the port or port ranges that you configure. ID: aws_globalaccelerator_listener_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.name as accelerator_name,\n a.status as accelerator_status,\n\ - \ l.title as listener_title,\n l.client_affinity as listener_client_affinity,\n\ - \ l.port_ranges as listener_port_ranges,\n l.protocol as listener_protocol\n\ - from\n aws_globalaccelerator_accelerator a,\n aws_globalaccelerator_listener\ - \ l\nwhere\n l.accelerator_arn = a.arn;" + QueryToExecute: | + SELECT + a.name AS accelerator_name, + a.status AS accelerator_status, + l.title AS listener_title, + l.client_affinity AS listener_client_affinity, + l.port_ranges AS listener_port_ranges, + l.protocol AS listener_protocol + FROM + aws_globalaccelerator_accelerator a, + aws_globalaccelerator_listener l + WHERE + l.accelerator_arn = a.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: Find AWS Global Accelerator Listener Details + - Global Accelerator +Title: Find AWS Global Accelerator Listener Details \ No newline at end of file diff --git a/queries/aws_globalaccelerator_listener_4.yaml b/queries/aws_globalaccelerator_listener_4.yaml old mode 100755 new mode 100644 index 6dddfcd4e..8769a022f --- a/queries/aws_globalaccelerator_listener_4.yaml +++ b/queries/aws_globalaccelerator_listener_4.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Global Accelerator Listener data, including - details about each listener that processes inbound connections based on the port - or port ranges that you configure. +Description: Allows users to query AWS Global Accelerator Listener data, including details about each listener that processes inbound connections based on the port or port ranges that you configure. ID: aws_globalaccelerator_listener_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.name as accelerator_name,\n a.status as accelerator_status,\n\ - \ l.protocol,\n port_range -> 'FromPort' as from_port,\n port_range -> 'ToPort'\ - \ as to_port\nfrom\n aws_globalaccelerator_accelerator a,\n aws_globalaccelerator_listener\ - \ l,\n jsonb_array_elements(l.port_ranges) as port_range\nwhere\n l.accelerator_arn\ - \ = a.arn\n and l.protocol = 'TCP'\n and (port_range -> 'FromPort')::int <=\ - \ 443\n and (port_range -> 'ToPort')::int >= 443;" + QueryToExecute: | + SELECT + a.name AS accelerator_name, + a.status AS accelerator_status, + l.protocol, + port_range -> 'FromPort' AS from_port, + port_range -> 'ToPort' AS to_port + FROM + aws_globalaccelerator_accelerator a, + aws_globalaccelerator_listener l, + jsonb_array_elements(l.port_ranges) AS port_range + WHERE + l.accelerator_arn = a.arn + AND l.protocol = 'TCP' + AND (port_range -> 'FromPort')::int <= 443 + AND (port_range -> 'ToPort')::int >= 443; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Global Accelerator -Title: List all AWS Global Accelerator Listener including details + - Global Accelerator +Title: List all AWS Global Accelerator Listener including details \ No newline at end of file diff --git a/queries/aws_glue_catalog_database_1.yaml b/queries/aws_glue_catalog_database_1.yaml old mode 100755 new mode 100644 index 08e048e87..aa1629e07 --- a/queries/aws_glue_catalog_database_1.yaml +++ b/queries/aws_glue_catalog_database_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Glue Databases for detailed information about - their Glue Catalog Databases. +Description: Allows users to query AWS Glue Databases for detailed information about their Glue Catalog Databases. ID: aws_glue_catalog_database_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n catalog_id,\n create_time,\n description,\n\ - \ location_uri,\n create_table_default_permissions\nfrom\n aws_glue_catalog_database;" + QueryToExecute: | + SELECT + name, + catalog_id, + create_time, + description, + location_uri, + create_table_default_permissions + FROM + aws_glue_catalog_database; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List All AWS Glue Catalog Databases with Details + - Glue +Title: List All AWS Glue Catalog Databases with Details \ No newline at end of file diff --git a/queries/aws_glue_catalog_database_2.yaml b/queries/aws_glue_catalog_database_2.yaml old mode 100755 new mode 100644 index f5dda4054..5848393a2 --- a/queries/aws_glue_catalog_database_2.yaml +++ b/queries/aws_glue_catalog_database_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Glue Databases for detailed information about - their Glue Catalog Databases. +Description: Allows users to query AWS Glue Databases for detailed information about their Glue Catalog Databases. ID: aws_glue_catalog_database_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n catalog_id,\n count(name) as database_count\nfrom\n\ - \ aws_glue_catalog_database\ngroup by\n catalog_id;" + QueryToExecute: | + SELECT + catalog_id, + COUNT(name) AS database_count + FROM + aws_glue_catalog_database + GROUP BY + catalog_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find all AWS Glue Databases with Catalog Info + - AWS Glue +Title: Find all AWS Glue Databases with Catalog Info \ No newline at end of file diff --git a/queries/aws_glue_catalog_table_1.yaml b/queries/aws_glue_catalog_table_1.yaml old mode 100755 new mode 100644 index e62792ae1..104121ca5 --- a/queries/aws_glue_catalog_table_1.yaml +++ b/queries/aws_glue_catalog_table_1.yaml @@ -1,15 +1,20 @@ -Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview - of table metadata, including table names, database names, owner information, and - more. +Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview of table metadata, including table names, database names, owner information, and more. ID: aws_glue_catalog_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n catalog_id,\n create_time,\n description,\n\ - \ database_name\nfrom\n aws_glue_catalog_table;" + QueryToExecute: | + SELECT + name, + catalog_id, + create_time, + description, + database_name + FROM + aws_glue_catalog_table; Tags: {} -Title: Find AWS Glue Catalog Table Metadata +Title: Find AWS Glue Catalog Table Metadata \ No newline at end of file diff --git a/queries/aws_glue_catalog_table_2.yaml b/queries/aws_glue_catalog_table_2.yaml old mode 100755 new mode 100644 index 58c003cf1..2cab3b540 --- a/queries/aws_glue_catalog_table_2.yaml +++ b/queries/aws_glue_catalog_table_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview - of table metadata, including table names, database names, owner information, and - more. +Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview of table metadata, including table names, database names, owner information, and more. ID: aws_glue_catalog_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n catalog_id,\n count(name) as table_count\nfrom\n aws_glue_catalog_table\n\ - group by\n catalog_id;" + QueryToExecute: | + SELECT + catalog_id, + COUNT(name) AS table_count + FROM + aws_glue_catalog_table + GROUP BY + catalog_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue Catalog -Title: List all AWS Glue Catalog Tables and Metadata + - Glue Catalog +Title: List all AWS Glue Catalog Tables and Metadata \ No newline at end of file diff --git a/queries/aws_glue_catalog_table_3.yaml b/queries/aws_glue_catalog_table_3.yaml old mode 100755 new mode 100644 index 439d5431d..0c30d25a9 --- a/queries/aws_glue_catalog_table_3.yaml +++ b/queries/aws_glue_catalog_table_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview - of table metadata, including table names, database names, owner information, and - more. +Description: Allows users to query AWS Glue Catalog Tables for a comprehensive overview of table metadata, including table names, database names, owner information, and more. ID: aws_glue_catalog_table_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n catalog_id,\n create_time,\n description,\n\ - \ retention\nfrom\n aws_glue_catalog_table\nwhere\n retention < 30;" + QueryToExecute: | + SELECT + name, + catalog_id, + create_time, + description, + retention + FROM + aws_glue_catalog_table + WHERE + retention < 30; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Catalog Tables with metadata + - AWS Glue +Title: List all AWS Glue Catalog Tables with metadata \ No newline at end of file diff --git a/queries/aws_glue_connection_1.yaml b/queries/aws_glue_connection_1.yaml old mode 100755 new mode 100644 index d202ee19c..fc4f59828 --- a/queries/aws_glue_connection_1.yaml +++ b/queries/aws_glue_connection_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Glue Connections to retrieve detailed information - about each connection. +Description: Allows users to query AWS Glue Connections to retrieve detailed information about each connection. ID: aws_glue_connection_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n connection_type,\n creation_time,\n description,\n\ - \ region\nfrom\n aws_glue_connection;" + QueryToExecute: | + SELECT + name, + connection_type, + creation_time, + description, + region + FROM + aws_glue_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all AWS Glue Connections with Details + - Glue +Title: List all AWS Glue Connections with Details \ No newline at end of file diff --git a/queries/aws_glue_connection_2.yaml b/queries/aws_glue_connection_2.yaml old mode 100755 new mode 100644 index 023edbc51..dcf988ca9 --- a/queries/aws_glue_connection_2.yaml +++ b/queries/aws_glue_connection_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Glue Connections to retrieve detailed information - about each connection. +Description: Allows users to query AWS Glue Connections to retrieve detailed information about each connection. ID: aws_glue_connection_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n connection_type,\n connection_properties ->>\ - \ 'JDBC_CONNECTION_URL' as connection_url,\n connection_properties ->> 'JDBC_ENFORCE_SSL'\ - \ as ssl_enabled,\n creation_time\nfrom\n aws_glue_connection\nwhere\n connection_type\ - \ = 'JDBC';" + QueryToExecute: | + SELECT + name, + connection_type, + connection_properties ->> 'JDBC_CONNECTION_URL' AS connection_url, + connection_properties ->> 'JDBC_ENFORCE_SSL' AS ssl_enabled, + creation_time + FROM + aws_glue_connection + WHERE + connection_type = 'JDBC'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all SQL Queryable AWS Glue Connections + - Glue +Title: List all SQL Queryable AWS Glue Connections \ No newline at end of file diff --git a/queries/aws_glue_connection_3.yaml b/queries/aws_glue_connection_3.yaml old mode 100755 new mode 100644 index cfd470fe9..b51515cd5 --- a/queries/aws_glue_connection_3.yaml +++ b/queries/aws_glue_connection_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Glue Connections to retrieve detailed information - about each connection. +Description: Allows users to query AWS Glue Connections to retrieve detailed information about each connection. ID: aws_glue_connection_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n connection_type,\n connection_properties ->>\ - \ 'CONNECTION_URL' as connection_url,\n connection_properties ->> 'JDBC_ENFORCE_SSL'\ - \ as ssl_enabled,\n creation_time\nfrom\n aws_glue_connection\nwhere\n connection_type\ - \ = 'JDBC'\n and connection_properties ->> 'JDBC_ENFORCE_SSL' = 'false';" + QueryToExecute: | + SELECT + name, + connection_type, + connection_properties ->> 'CONNECTION_URL' AS connection_url, + connection_properties ->> 'JDBC_ENFORCE_SSL' AS ssl_enabled, + creation_time + FROM + aws_glue_connection + WHERE + connection_type = 'JDBC' + AND connection_properties ->> 'JDBC_ENFORCE_SSL' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all AWS Glue Connections with JDBC not enforcing SSL + - Glue +Title: List all AWS Glue Connections with JDBC not enforcing SSL \ No newline at end of file diff --git a/queries/aws_glue_connection_4.yaml b/queries/aws_glue_connection_4.yaml old mode 100755 new mode 100644 index 88f5dbace..2d37eb1f5 --- a/queries/aws_glue_connection_4.yaml +++ b/queries/aws_glue_connection_4.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS Glue Connections to retrieve detailed information - about each connection. +Description: Allows users to query AWS Glue Connections to retrieve detailed information about each connection. ID: aws_glue_connection_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.name as connection_name,\n s.vpc_id as vpc_id,\n \ - \ s.title as subnet_name,\n physical_connection_requirements ->> 'SubnetId' as\ - \ subnet_id,\n physical_connection_requirements ->> 'AvailabilityZone' as availability_zone,\n\ - \ cidr_block,\n physical_connection_requirements ->> 'SecurityGroupIdList' as\ - \ security_group_ids\nfrom\n aws_glue_connection c\n join aws_vpc_subnet s on\ - \ physical_connection_requirements ->> 'SubnetId' = s.subnet_id;" + QueryToExecute: | + SELECT + c.name AS connection_name, + s.vpc_id AS vpc_id, + s.title AS subnet_name, + physical_connection_requirements ->> 'SubnetId' AS subnet_id, + physical_connection_requirements ->> 'AvailabilityZone' AS availability_zone, + cidr_block, + physical_connection_requirements ->> 'SecurityGroupIdList' AS security_group_ids + FROM + aws_glue_connection c + JOIN + aws_vpc_subnet s + ON + physical_connection_requirements ->> 'SubnetId' = s.subnet_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find AWS Glue Connections Details + - Glue +Title: Find AWS Glue Connections Details \ No newline at end of file diff --git a/queries/aws_glue_crawler_1.yaml b/queries/aws_glue_crawler_1.yaml old mode 100755 new mode 100644 index c12aed4ad..43bf17d06 --- a/queries/aws_glue_crawler_1.yaml +++ b/queries/aws_glue_crawler_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Glue Crawlers and retrieve essential information - about the crawler''s configuration, status, and associated metadata. +Description: Allows users to query AWS Glue Crawlers and retrieve essential information about the crawler's configuration, status, and associated metadata. ID: aws_glue_crawler_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state,\n database_name,\n creation_time,\n\ - \ description,\n recrawl_behavior\nfrom\n aws_glue_crawler;" + QueryToExecute: | + SELECT + name, + state, + database_name, + creation_time, + description, + recrawl_behavior + FROM + aws_glue_crawler; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Crawlers and Their Essential Information + - AWS Glue +Title: List all AWS Glue Crawlers and Their Essential Information \ No newline at end of file diff --git a/queries/aws_glue_crawler_2.yaml b/queries/aws_glue_crawler_2.yaml old mode 100755 new mode 100644 index f50ab4e1e..bb464d28b --- a/queries/aws_glue_crawler_2.yaml +++ b/queries/aws_glue_crawler_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Glue Crawlers and retrieve essential information - about the crawler''s configuration, status, and associated metadata. +Description: Allows users to query AWS Glue Crawlers and retrieve essential information about the crawler's configuration, status, and associated metadata. ID: aws_glue_crawler_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state,\n database_name,\n creation_time,\n\ - \ description,\n recrawl_behavior\nfrom\n aws_glue_crawler\nwhere\n state\ - \ = 'RUNNING'; " + QueryToExecute: | + SELECT + name, + state, + database_name, + creation_time, + description, + recrawl_behavior + FROM + aws_glue_crawler + WHERE + state = 'RUNNING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Crawlers and Retrieve their Metadata + - AWS Glue +Title: List all AWS Glue Crawlers and Retrieve their Metadata \ No newline at end of file diff --git a/queries/aws_glue_data_catalog_encryption_settings_1.yaml b/queries/aws_glue_data_catalog_encryption_settings_1.yaml old mode 100755 new mode 100644 index 698532c9a..46cb5b4b7 --- a/queries/aws_glue_data_catalog_encryption_settings_1.yaml +++ b/queries/aws_glue_data_catalog_encryption_settings_1.yaml @@ -1,21 +1,27 @@ Description: Allows users to query AWS Glue Data Catalog Encryption Settings. ID: aws_glue_data_catalog_encryption_settings_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_at_rest,\n connection_password_encryption,\n\ - \ region,\n account_id\nfrom\n aws_glue_data_catalog_encryption_settings;" + QueryToExecute: | + SELECT + encryption_at_rest, + connection_password_encryption, + region, + account_id + FROM + aws_glue_data_catalog_encryption_settings; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Data Catalog Encryption Settings + - AWS Glue +Title: Find AWS Glue Data Catalog Encryption Settings \ No newline at end of file diff --git a/queries/aws_glue_data_catalog_encryption_settings_2.yaml b/queries/aws_glue_data_catalog_encryption_settings_2.yaml old mode 100755 new mode 100644 index f36a27bd0..4f6f4c053 --- a/queries/aws_glue_data_catalog_encryption_settings_2.yaml +++ b/queries/aws_glue_data_catalog_encryption_settings_2.yaml @@ -1,20 +1,27 @@ Description: Allows users to query AWS Glue Data Catalog Encryption Settings. ID: aws_glue_data_catalog_encryption_settings_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_at_rest,\n connection_password_encryption,\n\ - \ region,\n account_id\nfrom\n aws_glue_data_catalog_encryption_settings\n\ - where\n encryption_at_rest ->> 'CatalogEncryptionMode' = 'DISABLED';" + QueryToExecute: | + SELECT + encryption_at_rest, + connection_password_encryption, + region, + account_id + FROM + aws_glue_data_catalog_encryption_settings + WHERE + encryption_at_rest ->> 'CatalogEncryptionMode' = 'DISABLED'; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue Data Catalog -Title: Find AWS Glue Data Catalog Encryption Settings + - Glue Data Catalog +Title: Find AWS Glue Data Catalog Encryption Settings \ No newline at end of file diff --git a/queries/aws_glue_data_catalog_encryption_settings_3.yaml b/queries/aws_glue_data_catalog_encryption_settings_3.yaml old mode 100755 new mode 100644 index 4e6716349..a4c4946b8 --- a/queries/aws_glue_data_catalog_encryption_settings_3.yaml +++ b/queries/aws_glue_data_catalog_encryption_settings_3.yaml @@ -1,23 +1,29 @@ Description: Allows users to query AWS Glue Data Catalog Encryption Settings. ID: aws_glue_data_catalog_encryption_settings_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_at_rest,\n connection_password_encryption,\n\ - \ region,\n account_id\nfrom\n aws_glue_data_catalog_encryption_settings\n\ - where\n connection_password_encryption ->> 'ReturnConnectionPasswordEncrypted'\ - \ = 'false';" + QueryToExecute: | + SELECT + encryption_at_rest, + connection_password_encryption, + region, + account_id + FROM + aws_glue_data_catalog_encryption_settings + WHERE + connection_password_encryption ->> 'ReturnConnectionPasswordEncrypted' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue Data Catalog -Title: List all AWS Glue Data Catalog Encryption Settings + - AWS Glue Data Catalog +Title: List all AWS Glue Data Catalog Encryption Settings \ No newline at end of file diff --git a/queries/aws_glue_data_catalog_encryption_settings_4.yaml b/queries/aws_glue_data_catalog_encryption_settings_4.yaml old mode 100755 new mode 100644 index 13aa48a42..32380dc48 --- a/queries/aws_glue_data_catalog_encryption_settings_4.yaml +++ b/queries/aws_glue_data_catalog_encryption_settings_4.yaml @@ -1,23 +1,33 @@ Description: Allows users to query AWS Glue Data Catalog Encryption Settings. ID: aws_glue_data_catalog_encryption_settings_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_at_rest ->> 'SseAwsKmsKeyId' as key_arn,\n\ - \ k.key_manager as key_manager,\n k.creation_date as key_creation_date,\n s.region,\n\ - \ s.account_id\nfrom\n aws_glue_data_catalog_encryption_settings s\n join aws_kms_key\ - \ k on s.encryption_at_rest ->> 'SseAwsKmsKeyId' = k.arn\n and s.region = k.region;" + QueryToExecute: | + SELECT + encryption_at_rest ->> 'SseAwsKmsKeyId' AS key_arn, + k.key_manager AS key_manager, + k.creation_date AS key_creation_date, + s.region, + s.account_id + FROM + aws_glue_data_catalog_encryption_settings s + JOIN + aws_kms_key k + ON + s.encryption_at_rest ->> 'SseAwsKmsKeyId' = k.arn + AND s.region = k.region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue Data Catalog -Title: Query AWS Glue Data Catalog Encryption Settings + - Glue Data Catalog +Title: Query AWS Glue Data Catalog Encryption Settings \ No newline at end of file diff --git a/queries/aws_glue_data_catalog_encryption_settings_5.yaml b/queries/aws_glue_data_catalog_encryption_settings_5.yaml old mode 100755 new mode 100644 index 8fbd827bc..418b9a664 --- a/queries/aws_glue_data_catalog_encryption_settings_5.yaml +++ b/queries/aws_glue_data_catalog_encryption_settings_5.yaml @@ -1,24 +1,31 @@ Description: Allows users to query AWS Glue Data Catalog Encryption Settings. ID: aws_glue_data_catalog_encryption_settings_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n connection_password_encryption ->> 'AwsKmsKeyId' as key_arn,\n\ - \ k.key_manager as key_manager,\n k.creation_date as key_creation_date,\n s.region,\n\ - \ s.account_id\nfrom\n aws_glue_data_catalog_encryption_settings s\n join aws_kms_key\ - \ k on s.connection_password_encryption ->> 'AwsKmsKeyId' = k.arn\n and s.region\ - \ = k.region;" + QueryToExecute: | + SELECT + connection_password_encryption ->> 'AwsKmsKeyId' AS key_arn, + k.key_manager AS key_manager, + k.creation_date AS key_creation_date, + s.region, + s.account_id + FROM + aws_glue_data_catalog_encryption_settings s + JOIN aws_kms_key k + ON s.connection_password_encryption ->> 'AwsKmsKeyId' = k.arn + AND s.region = k.region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Data Catalog Encryption Settings + - AWS Glue +Title: Find AWS Glue Data Catalog Encryption Settings \ No newline at end of file diff --git a/queries/aws_glue_data_quality_ruleset_1.yaml b/queries/aws_glue_data_quality_ruleset_1.yaml old mode 100755 new mode 100644 index 360b72682..8b010e78f --- a/queries/aws_glue_data_quality_ruleset_1.yaml +++ b/queries/aws_glue_data_quality_ruleset_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information - about the rulesets used for data quality checks in AWS Glue. +Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information about the rulesets used for data quality checks in AWS Glue. ID: aws_glue_data_quality_ruleset_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n database_name,\n table_name,\n created_on,\n\ - \ description,\n rule_set,\n recommendation_run_id\nfrom\n aws_glue_data_quality_ruleset;" + QueryToExecute: | + SELECT + name, + database_name, + table_name, + created_on, + description, + rule_set, + recommendation_run_id + FROM + aws_glue_data_quality_ruleset; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Data Quality Rulesets + - AWS Glue +Title: List all AWS Glue Data Quality Rulesets \ No newline at end of file diff --git a/queries/aws_glue_data_quality_ruleset_2.yaml b/queries/aws_glue_data_quality_ruleset_2.yaml old mode 100755 new mode 100644 index 33823fcae..ee318baa4 --- a/queries/aws_glue_data_quality_ruleset_2.yaml +++ b/queries/aws_glue_data_quality_ruleset_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information - about the rulesets used for data quality checks in AWS Glue. +Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information about the rulesets used for data quality checks in AWS Glue. ID: aws_glue_data_quality_ruleset_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n database_name,\n table_name,\n created_on,\n\ - \ description,\n rule_set,\n recommendation_run_id\nfrom\n aws_glue_data_quality_ruleset\n\ - where\n created_on >= now() - interval '30' day;" + QueryToExecute: | + SELECT + name, + database_name, + table_name, + created_on, + description, + rule_set, + recommendation_run_id + FROM + aws_glue_data_quality_ruleset + WHERE + created_on >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Query AWS Glue Data Quality Rulesets + - AWS Glue +Title: Query AWS Glue Data Quality Rulesets \ No newline at end of file diff --git a/queries/aws_glue_data_quality_ruleset_3.yaml b/queries/aws_glue_data_quality_ruleset_3.yaml old mode 100755 new mode 100644 index ebf4aa38c..3ad7347b4 --- a/queries/aws_glue_data_quality_ruleset_3.yaml +++ b/queries/aws_glue_data_quality_ruleset_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information - about the rulesets used for data quality checks in AWS Glue. +Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information about the rulesets used for data quality checks in AWS Glue. ID: aws_glue_data_quality_ruleset_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n count(\"name\") as rulset_count\nfrom\n\ - \ aws_glue_data_quality_ruleset\ngroup by\n database_name;" + QueryToExecute: | + SELECT + database_name, + COUNT("name") AS rulset_count + FROM + aws_glue_data_quality_ruleset + GROUP BY + database_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List All AWS Glue Data Quality Rulesets by Database + - AWS Glue +Title: List All AWS Glue Data Quality Rulesets by Database \ No newline at end of file diff --git a/queries/aws_glue_data_quality_ruleset_4.yaml b/queries/aws_glue_data_quality_ruleset_4.yaml old mode 100755 new mode 100644 index 0135d9862..ef8e59a78 --- a/queries/aws_glue_data_quality_ruleset_4.yaml +++ b/queries/aws_glue_data_quality_ruleset_4.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information - about the rulesets used for data quality checks in AWS Glue. +Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information about the rulesets used for data quality checks in AWS Glue. ID: aws_glue_data_quality_ruleset_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n r.database_name,\n d.catalog_id,\n d.create_time\ - \ as databse_create_time,\n d.location_uri\nfrom\n aws_glue_data_quality_ruleset\ - \ as r,\n aws_glue_catalog_database as d\nwhere\n r.database_name = d.name\n\ - and\n r.name = 'ruleset1';" + QueryToExecute: | + SELECT + r.name, + r.database_name, + d.catalog_id, + d.create_time AS databse_create_time, + d.location_uri + FROM + aws_glue_data_quality_ruleset AS r, + aws_glue_catalog_database AS d + WHERE + r.database_name = d.name + AND + r.name = 'ruleset1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all Glue Data Quality Rulesets in AWS + - Glue +Title: List all Glue Data Quality Rulesets in AWS \ No newline at end of file diff --git a/queries/aws_glue_data_quality_ruleset_5.yaml b/queries/aws_glue_data_quality_ruleset_5.yaml old mode 100755 new mode 100644 index dbfff44a5..9e439117d --- a/queries/aws_glue_data_quality_ruleset_5.yaml +++ b/queries/aws_glue_data_quality_ruleset_5.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information - about the rulesets used for data quality checks in AWS Glue. +Description: Allows users to query AWS Glue Data Quality Ruleset to obtain information about the rulesets used for data quality checks in AWS Glue. ID: aws_glue_data_quality_ruleset_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_count\nfrom\n aws_glue_data_quality_ruleset;" + QueryToExecute: | + SELECT + name, + rule_count + FROM + aws_glue_data_quality_ruleset; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Data Quality Rulesets with Rule Count + - AWS Glue +Title: Find AWS Glue Data Quality Rulesets with Rule Count \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_1.yaml b/queries/aws_glue_dev_endpoint_1.yaml old mode 100755 new mode 100644 index 66e44fccb..1852c97be --- a/queries/aws_glue_dev_endpoint_1.yaml +++ b/queries/aws_glue_dev_endpoint_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_name,\n status,\n availability_zone,\n created_timestamp,\n\ - \ extra_jars_s3_path,\n glue_version,\n private_address,\n public_address\n\ - from\n aws_glue_dev_endpoint;" + QueryToExecute: | + SELECT + endpoint_name, + status, + availability_zone, + created_timestamp, + extra_jars_s3_path, + glue_version, + private_address, + public_address + FROM + aws_glue_dev_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all AWS Glue Development Endpoints and Metadata + - Glue +Title: List all AWS Glue Development Endpoints and Metadata \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_2.yaml b/queries/aws_glue_dev_endpoint_2.yaml old mode 100755 new mode 100644 index d3524697c..ad73aa9ac --- a/queries/aws_glue_dev_endpoint_2.yaml +++ b/queries/aws_glue_dev_endpoint_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_name,\n status,\n created_timestamp,\n extra_jars_s3_path,\n\ - \ glue_version,\n private_address,\n public_address\nfrom\n aws_glue_dev_endpoint\n\ - where\n status <> 'READY'; " + QueryToExecute: | + SELECT + endpoint_name, + status, + created_timestamp, + extra_jars_s3_path, + glue_version, + private_address, + public_address + FROM + aws_glue_dev_endpoint + WHERE + status <> 'READY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find all AWS Glue Development Endpoints with Metadata + - AWS Glue +Title: Find all AWS Glue Development Endpoints with Metadata \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_3.yaml b/queries/aws_glue_dev_endpoint_3.yaml old mode 100755 new mode 100644 index e3ee32bbf..5eb23b59c --- a/queries/aws_glue_dev_endpoint_3.yaml +++ b/queries/aws_glue_dev_endpoint_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n status,\n glue_version,\n last_modified_timestamp\n\ - from\n aws_glue_dev_endpoint\nwhere\n last_modified_timestamp >= now() - interval\ - \ '30' day;" + QueryToExecute: | + SELECT + title, + arn, + status, + glue_version, + last_modified_timestamp + FROM + aws_glue_dev_endpoint + WHERE + last_modified_timestamp >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue Development Endpoint -Title: List all AWS Glue Development Endpoints with Metadata + - Glue Development Endpoint +Title: List all AWS Glue Development Endpoints with Metadata \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_4.yaml b/queries/aws_glue_dev_endpoint_4.yaml old mode 100755 new mode 100644 index bfa6a07ce..a820286b7 --- a/queries/aws_glue_dev_endpoint_4.yaml +++ b/queries/aws_glue_dev_endpoint_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n endpoint_name,\n arn,\n status,\n glue_version,\n\ - \ created_timestamp\nfrom\n aws_glue_dev_endpoint\nwhere\n created_timestamp\ - \ >= now() - interval '30' day;" + QueryToExecute: | + SELECT + endpoint_name, + arn, + status, + glue_version, + created_timestamp + FROM + aws_glue_dev_endpoint + WHERE + created_timestamp >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List AWS Glue Development Endpoints and Configurations + - AWS Glue +Title: List AWS Glue Development Endpoints and Configurations \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_5.yaml b/queries/aws_glue_dev_endpoint_5.yaml old mode 100755 new mode 100644 index 5c4b8dd66..11b04b54f --- a/queries/aws_glue_dev_endpoint_5.yaml +++ b/queries/aws_glue_dev_endpoint_5.yaml @@ -1,25 +1,36 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.endpoint_name,\n s.availability_zone,\n s.available_ip_address_count,\n\ - \ s.cidr_block,\n s.default_for_az,\n s.map_customer_owned_ip_on_launch,\n\ - \ s.map_public_ip_on_launch,\n s.state\nfrom\n aws_glue_dev_endpoint as e,\n\ - \ aws_vpc_subnet as s\nwhere\n e.endpoint_name = 'test5'\nand\n e.subnet_id\ - \ = s.subnet_id;" + QueryToExecute: | + SELECT + e.endpoint_name, + s.availability_zone, + s.available_ip_address_count, + s.cidr_block, + s.default_for_az, + s.map_customer_owned_ip_on_launch, + s.map_public_ip_on_launch, + s.state + FROM + aws_glue_dev_endpoint AS e, + aws_vpc_subnet AS s + WHERE + e.endpoint_name = 'test5' + AND + e.subnet_id = s.subnet_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find AWS Glue Development Endpoints and Subnet Details + - Glue +Title: Find AWS Glue Development Endpoints and Subnet Details \ No newline at end of file diff --git a/queries/aws_glue_dev_endpoint_6.yaml b/queries/aws_glue_dev_endpoint_6.yaml old mode 100755 new mode 100644 index 767a4c733..1f91f654c --- a/queries/aws_glue_dev_endpoint_6.yaml +++ b/queries/aws_glue_dev_endpoint_6.yaml @@ -1,23 +1,34 @@ -Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed - information about individual endpoints, their configurations, and related metadata. +Description: Allows users to query AWS Glue Development Endpoints to retrieve detailed information about individual endpoints, their configurations, and related metadata. ID: aws_glue_dev_endpoint_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.endpoint_name,\n split_part(j, '/', '3') as extra_jars_s3_bucket,\n\ - \ b.versioning_enabled,\n b.policy,\n b.object_lock_configuration,\n b.restrict_public_buckets,\n\ - \ b.policy\nfrom\n aws_glue_dev_endpoint as e,\n aws_s3_bucket as b,\n unnest\ - \ (string_to_array(e.extra_jars_s3_path, ',')) as j\nwhere\n b.name = split_part(j,\ - \ '/', '3')\nand\n e.endpoint_name = 'test34';" + QueryToExecute: | + SELECT + e.endpoint_name, + SPLIT_PART(j, '/', 3) AS extra_jars_s3_bucket, + b.versioning_enabled, + b.policy, + b.object_lock_configuration, + b.restrict_public_buckets, + b.policy + FROM + aws_glue_dev_endpoint AS e, + aws_s3_bucket AS b, + UNNEST(STRING_TO_ARRAY(e.extra_jars_s3_path, ',')) AS j + WHERE + b.name = SPLIT_PART(j, '/', 3) + AND + e.endpoint_name = 'test34'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Development Endpoints Configurations and Metadata + - AWS Glue +Title: Find AWS Glue Development Endpoints Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_glue_job_1.yaml b/queries/aws_glue_job_1.yaml old mode 100755 new mode 100644 index e9dcac879..eee101085 --- a/queries/aws_glue_job_1.yaml +++ b/queries/aws_glue_job_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_on,\n description,\n max_capacity,\n\ - \ number_of_workers,\n region,\n timeout\nfrom\n aws_glue_job;" + QueryToExecute: | + SELECT + name, + created_on, + description, + max_capacity, + number_of_workers, + region, + timeout + FROM + aws_glue_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List AWS Glue Jobs with Details on Execution and Status + - Glue +Title: List AWS Glue Jobs with Details on Execution and Status \ No newline at end of file diff --git a/queries/aws_glue_job_10.yaml b/queries/aws_glue_job_10.yaml old mode 100755 new mode 100644 index bbfc716a6..5874a28b0 --- a/queries/aws_glue_job_10.yaml +++ b/queries/aws_glue_job_10.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on\n region,\n account_id,\n\ - \ default_arguments ->> '--encryption-type' as encryption_type\nfrom\n aws_glue_job\n\ - where\n default_arguments ->> '--encryption-type' is null;" + QueryToExecute: | + SELECT + title, + arn, + created_on, + region, + account_id, + default_arguments ->> '--encryption-type' AS encryption_type + FROM + aws_glue_job + WHERE + default_arguments ->> '--encryption-type' IS NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Jobs Missing Encryption Type + - AWS Glue +Title: Find AWS Glue Jobs Missing Encryption Type \ No newline at end of file diff --git a/queries/aws_glue_job_2.yaml b/queries/aws_glue_job_2.yaml old mode 100755 new mode 100644 index ac6c617c4..9e6d36a48 --- a/queries/aws_glue_job_2.yaml +++ b/queries/aws_glue_job_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on,\n connections -> 'Connections'\ - \ as connections\nfrom\n aws_glue_job\nwhere\n connections is not null;" + QueryToExecute: | + SELECT + title, + arn, + created_on, + connections -> 'Connections' AS connections + FROM + aws_glue_job + WHERE + connections IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: Find AWS Glue Jobs and Their Detailed Job Properties + - AWS Glue +Title: Find AWS Glue Jobs and Their Detailed Job Properties \ No newline at end of file diff --git a/queries/aws_glue_job_3.yaml b/queries/aws_glue_job_3.yaml old mode 100755 new mode 100644 index abdbf2102..0febd70d9 --- a/queries/aws_glue_job_3.yaml +++ b/queries/aws_glue_job_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on,\n job_bookmark ->> 'Attempt'\ - \ as total_attempts,\n job_bookmark ->> 'Run' as total_runs,\n job_bookmark\ - \ ->> 'RunId' as run_id\nfrom\n aws_glue_job\nwhere\n job_bookmark is not null;" + QueryToExecute: | + SELECT + title, + arn, + created_on, + job_bookmark ->> 'Attempt' AS total_attempts, + job_bookmark ->> 'Run' AS total_runs, + job_bookmark ->> 'RunId' AS run_id + FROM + aws_glue_job + WHERE + job_bookmark IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Jobs with detailed properties + - AWS Glue +Title: List all AWS Glue Jobs with detailed properties \ No newline at end of file diff --git a/queries/aws_glue_job_4.yaml b/queries/aws_glue_job_4.yaml old mode 100755 new mode 100644 index 7aa51a545..7780c91b9 --- a/queries/aws_glue_job_4.yaml +++ b/queries/aws_glue_job_4.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n j.title,\n j.arn,\n j.created_on,\n j.region,\n j.account_id,\n\ - \ cloud_watch_encryption\nfrom\n aws_glue_job j\n left join aws_glue_security_configuration\ - \ s on j.security_configuration = s.name\nwhere\n cloud_watch_encryption is null\ - \ or cloud_watch_encryption ->> 'CloudWatchEncryptionMode' = 'DISABLED';" + QueryToExecute: | + SELECT + j.title, + j.arn, + j.created_on, + j.region, + j.account_id, + cloud_watch_encryption + FROM + aws_glue_job j + LEFT JOIN + aws_glue_security_configuration s + ON + j.security_configuration = s.name + WHERE + cloud_watch_encryption IS NULL + OR cloud_watch_encryption ->> 'CloudWatchEncryptionMode' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find all AWS Glue Jobs with Query Execution Detail + - Glue +Title: Find all AWS Glue Jobs with Query Execution Detail \ No newline at end of file diff --git a/queries/aws_glue_job_5.yaml b/queries/aws_glue_job_5.yaml old mode 100755 new mode 100644 index 8ae669a33..450fb430e --- a/queries/aws_glue_job_5.yaml +++ b/queries/aws_glue_job_5.yaml @@ -1,26 +1,38 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n j.title,\n j.arn,\n j.created_on,\n j.region,\n j.account_id,\n\ - \ job_bookmarks_encryption\nfrom\n aws_glue_job j\n left join aws_glue_security_configuration\ - \ s on j.security_configuration = s.name\nwhere\n job_bookmarks_encryption is\ - \ null or job_bookmarks_encryption ->> 'JobBookmarksEncryptionMode' = 'DISABLED';" + QueryToExecute: | + SELECT + j.title, + j.arn, + j.created_on, + j.region, + j.account_id, + job_bookmarks_encryption + FROM + aws_glue_job j + LEFT JOIN + aws_glue_security_configuration s + ON + j.security_configuration = s.name + WHERE + job_bookmarks_encryption IS NULL + OR job_bookmarks_encryption ->> 'JobBookmarksEncryptionMode' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Jobs Detailing Status and Properties + - AWS Glue +Title: List all AWS Glue Jobs Detailing Status and Properties \ No newline at end of file diff --git a/queries/aws_glue_job_6.yaml b/queries/aws_glue_job_6.yaml old mode 100755 new mode 100644 index 491c6b01e..9c735d2bf --- a/queries/aws_glue_job_6.yaml +++ b/queries/aws_glue_job_6.yaml @@ -1,24 +1,37 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n j.title,\n j.arn,\n j.created_on,\n j.region,\n j.account_id,\n\ - \ e as s3_encryption\nfrom\n aws_glue_job j\n left join aws_glue_security_configuration\ - \ s on j.security_configuration = s.name,\n jsonb_array_elements(s.s3_encryption)\ - \ e\nwhere\n e is null or e ->> 'S3EncryptionMode' = 'DISABLED';" + QueryToExecute: | + SELECT + j.title, + j.arn, + j.created_on, + j.region, + j.account_id, + e AS s3_encryption + FROM + aws_glue_job j + LEFT JOIN + aws_glue_security_configuration s + ON + j.security_configuration = s.name, + jsonb_array_elements(s.s3_encryption) e + WHERE + e IS NULL + OR e ->> 'S3EncryptionMode' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find all AWS Glue Jobs with Detailed Information + - Glue +Title: Find all AWS Glue Jobs with Detailed Information \ No newline at end of file diff --git a/queries/aws_glue_job_7.yaml b/queries/aws_glue_job_7.yaml old mode 100755 new mode 100644 index 16efee46a..4fedcefab --- a/queries/aws_glue_job_7.yaml +++ b/queries/aws_glue_job_7.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on\n region,\n account_id\n\ - from\n aws_glue_job\nwhere\n default_arguments ->> '--enable-continuous-cloudwatch-log'\ - \ = 'false';" + QueryToExecute: | + SELECT + title, + arn, + created_on, + region, + account_id + FROM + aws_glue_job + WHERE + default_arguments ->> '--enable-continuous-cloudwatch-log' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List all AWS Glue Jobs with Continuous CloudWatch Logs Disabled + - AWS Glue +Title: List all AWS Glue Jobs with Continuous CloudWatch Logs Disabled \ No newline at end of file diff --git a/queries/aws_glue_job_8.yaml b/queries/aws_glue_job_8.yaml old mode 100755 new mode 100644 index 6ade5695e..9e1df9b39 --- a/queries/aws_glue_job_8.yaml +++ b/queries/aws_glue_job_8.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on\n region,\n account_id\n\ - from\n aws_glue_job\nwhere\n default_arguments ->> '--enable-metrics' = 'false';" + QueryToExecute: | + SELECT + title, + arn, + created_on, + region, + account_id + FROM + aws_glue_job + WHERE + default_arguments ->> '--enable-metrics' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Glue -Title: List AWS Glue Jobs with Detailed Properties and Status + - AWS Glue +Title: List AWS Glue Jobs with Detailed Properties and Status \ No newline at end of file diff --git a/queries/aws_glue_job_9.yaml b/queries/aws_glue_job_9.yaml old mode 100755 new mode 100644 index 24ded1ea2..af992b813 --- a/queries/aws_glue_job_9.yaml +++ b/queries/aws_glue_job_9.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Glue Jobs to retrieve detailed information - related to job properties, execution, and status. +Description: Allows users to query AWS Glue Jobs to retrieve detailed information related to job properties, execution, and status. ID: aws_glue_job_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n created_on,\n command ->> 'Name' as\ - \ script_name,\n command ->> 'ScriptLocation' as script_location,\n default_arguments\ - \ ->> '--job-language' as job_language\nfrom\n aws_glue_job;" + QueryToExecute: | + SELECT + title, + arn, + created_on, + command ->> 'Name' AS script_name, + command ->> 'ScriptLocation' AS script_location, + default_arguments ->> '--job-language' AS job_language + FROM + aws_glue_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all AWS Glue Job Properties and Execution Details + - Glue +Title: List all AWS Glue Job Properties and Execution Details \ No newline at end of file diff --git a/queries/aws_glue_security_configuration_1.yaml b/queries/aws_glue_security_configuration_1.yaml old mode 100755 new mode 100644 index 98ba2809b..105791861 --- a/queries/aws_glue_security_configuration_1.yaml +++ b/queries/aws_glue_security_configuration_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Glue Security Configurations and gain insights - into the security configurations of Glue resources. +Description: Allows users to query AWS Glue Security Configurations and gain insights into the security configurations of Glue resources. ID: aws_glue_security_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_time_stamp,\n cloud_watch_encryption,\n\ - \ job_bookmarks_encryption,\n s3_encryption\nfrom\n aws_glue_security_configuration;" + QueryToExecute: | + SELECT + name, + created_time_stamp, + cloud_watch_encryption, + job_bookmarks_encryption, + s3_encryption + FROM + aws_glue_security_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find AWS Glue Security Configurations and Insights + - Glue +Title: Find AWS Glue Security Configurations and Insights \ No newline at end of file diff --git a/queries/aws_glue_security_configuration_2.yaml b/queries/aws_glue_security_configuration_2.yaml old mode 100755 new mode 100644 index cddb24360..20bc5db60 --- a/queries/aws_glue_security_configuration_2.yaml +++ b/queries/aws_glue_security_configuration_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Glue Security Configurations and gain insights - into the security configurations of Glue resources. +Description: Allows users to query AWS Glue Security Configurations and gain insights into the security configurations of Glue resources. ID: aws_glue_security_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n cloud_watch_encryption ->> 'CloudWatchEncryptionMode'\ - \ as encyption_mode,\n cloud_watch_encryption ->> 'KmsKeyArn' as kms_key_arn\n\ - from\n aws_glue_security_configuration\nwhere\n cloud_watch_encryption ->> 'CloudWatchEncryptionMode'\ - \ != 'DISABLED';" + QueryToExecute: | + SELECT + name, + cloud_watch_encryption ->> 'CloudWatchEncryptionMode' AS encryption_mode, + cloud_watch_encryption ->> 'KmsKeyArn' AS kms_key_arn + FROM + aws_glue_security_configuration + WHERE + cloud_watch_encryption ->> 'CloudWatchEncryptionMode' != 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue Security -Title: Find AWS Glue Security Configurations with Encryption + - Glue Security +Title: Find AWS Glue Security Configurations with Encryption \ No newline at end of file diff --git a/queries/aws_glue_security_configuration_3.yaml b/queries/aws_glue_security_configuration_3.yaml old mode 100755 new mode 100644 index 5eca8313a..80a91a5f1 --- a/queries/aws_glue_security_configuration_3.yaml +++ b/queries/aws_glue_security_configuration_3.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Glue Security Configurations and gain insights - into the security configurations of Glue resources. +Description: Allows users to query AWS Glue Security Configurations and gain insights into the security configurations of Glue resources. ID: aws_glue_security_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n job_bookmarks_encryption ->> 'JobBookmarksEncryptionMode'\ - \ as encyption_mode,\n job_bookmarks_encryption ->> 'KmsKeyArn' as kms_key_arn\n\ - from\n aws_glue_security_configuration\nwhere\n job_bookmarks_encryption ->>\ - \ 'JobBookmarksEncryptionMode' != 'DISABLED';" + QueryToExecute: | + SELECT + name, + job_bookmarks_encryption ->> 'JobBookmarksEncryptionMode' AS encryption_mode, + job_bookmarks_encryption ->> 'KmsKeyArn' AS kms_key_arn + FROM + aws_glue_security_configuration + WHERE + job_bookmarks_encryption ->> 'JobBookmarksEncryptionMode' != 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: List all AWS Glue Security Configurations and Encryption Modes + - Glue +Title: List all AWS Glue Security Configurations and Encryption Modes \ No newline at end of file diff --git a/queries/aws_glue_security_configuration_4.yaml b/queries/aws_glue_security_configuration_4.yaml old mode 100755 new mode 100644 index 917638525..c506c9745 --- a/queries/aws_glue_security_configuration_4.yaml +++ b/queries/aws_glue_security_configuration_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Glue Security Configurations and gain insights - into the security configurations of Glue resources. +Description: Allows users to query AWS Glue Security Configurations and gain insights into the security configurations of Glue resources. ID: aws_glue_security_configuration_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n e ->> 'S3EncryptionMode' as encyption_mode,\n\ - \ e ->> 'KmsKeyArn' as kms_key_arn\nfrom\n aws_glue_security_configuration,\n\ - \ jsonb_array_elements(s3_encryption) e\nwhere\n e ->> 'S3EncryptionMode' !=\ - \ 'DISABLED';" + QueryToExecute: | + SELECT + name, + e ->> 'S3EncryptionMode' AS encryption_mode, + e ->> 'KmsKeyArn' AS kms_key_arn + FROM + aws_glue_security_configuration, + jsonb_array_elements(s3_encryption) e + WHERE + e ->> 'S3EncryptionMode' != 'DISABLED'; Tags: cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Glue -Title: Find AWS Glue Security Configurations + - Glue +Title: Find AWS Glue Security Configurations \ No newline at end of file diff --git a/queries/aws_guardduty_detector_1.yaml b/queries/aws_guardduty_detector_1.yaml old mode 100755 new mode 100644 index 3bea640dc..d575a6f92 --- a/queries/aws_guardduty_detector_1.yaml +++ b/queries/aws_guardduty_detector_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS GuardDuty Detector data, including detector - details, status, and associated metadata. +Description: Allows users to query AWS GuardDuty Detector data, including detector details, status, and associated metadata. ID: aws_guardduty_detector_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n arn,\n created_at,\n status,\n service_role\n\ - from\n aws_guardduty_detector;" + QueryToExecute: | + SELECT + detector_id, + arn, + created_at, + status, + service_role + FROM + aws_guardduty_detector; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Detector Details and Status + - GuardDuty +Title: Find AWS GuardDuty Detector Details and Status \ No newline at end of file diff --git a/queries/aws_guardduty_detector_2.yaml b/queries/aws_guardduty_detector_2.yaml old mode 100755 new mode 100644 index 9a0088850..0f0a968a6 --- a/queries/aws_guardduty_detector_2.yaml +++ b/queries/aws_guardduty_detector_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS GuardDuty Detector data, including detector - details, status, and associated metadata. +Description: Allows users to query AWS GuardDuty Detector data, including detector details, status, and associated metadata. ID: aws_guardduty_detector_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n created_at,\n status\nfrom\n aws_guardduty_detector\n\ - where\n status = 'ENABLED';" + QueryToExecute: | + SELECT + detector_id, + created_at, + status + FROM + aws_guardduty_detector + WHERE + status = 'ENABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List all AWS GuardDuty Detectors and their Status + - GuardDuty +Title: List all AWS GuardDuty Detectors and their Status \ No newline at end of file diff --git a/queries/aws_guardduty_detector_3.yaml b/queries/aws_guardduty_detector_3.yaml old mode 100755 new mode 100644 index 929e84f8a..a3a9ba897 --- a/queries/aws_guardduty_detector_3.yaml +++ b/queries/aws_guardduty_detector_3.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS GuardDuty Detector data, including detector - details, status, and associated metadata. +Description: Allows users to query AWS GuardDuty Detector data, including detector details, status, and associated metadata. ID: aws_guardduty_detector_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n status as detector_status,\n data_sources\ - \ -> 'CloudTrail' ->> 'Status' as cloud_trail_status,\n data_sources -> 'DNSLogs'\ - \ ->> 'Status' as dns_logs_status,\n data_sources -> 'FlowLogs' ->> 'Status'\ - \ as flow_logs_status\nfrom\n aws_guardduty_detector;" + QueryToExecute: | + SELECT + detector_id, + status AS detector_status, + data_sources -> 'CloudTrail' ->> 'Status' AS cloud_trail_status, + data_sources -> 'DNSLogs' ->> 'Status' AS dns_logs_status, + data_sources -> 'FlowLogs' ->> 'Status' AS flow_logs_status + FROM + aws_guardduty_detector; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List all AWS GuardDuty Detector details and status + - GuardDuty +Title: List all AWS GuardDuty Detector details and status \ No newline at end of file diff --git a/queries/aws_guardduty_detector_4.yaml b/queries/aws_guardduty_detector_4.yaml old mode 100755 new mode 100644 index 5f845a8d0..8eaf85808 --- a/queries/aws_guardduty_detector_4.yaml +++ b/queries/aws_guardduty_detector_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS GuardDuty Detector data, including detector - details, status, and associated metadata. +Description: Allows users to query AWS GuardDuty Detector data, including detector details, status, and associated metadata. ID: aws_guardduty_detector_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n detector_id,\n master_account ->> 'AccountId' as master_account_id,\n\ - \ master_account ->> 'InvitationId' as invitation_id, \n master_account ->>\ - \ 'RelationshipStatus' as relationship_status \nfrom \n aws_guardduty_detector\n\ - where master_account is not null;" + QueryToExecute: | + SELECT + detector_id, + master_account ->> 'AccountId' AS master_account_id, + master_account ->> 'InvitationId' AS invitation_id, + master_account ->> 'RelationshipStatus' AS relationship_status + FROM + aws_guardduty_detector + WHERE + master_account IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Detector with SQL + - GuardDuty +Title: Find AWS GuardDuty Detector with SQL \ No newline at end of file diff --git a/queries/aws_guardduty_filter_1.yaml b/queries/aws_guardduty_filter_1.yaml old mode 100755 new mode 100644 index 1f763b255..10ed85128 --- a/queries/aws_guardduty_filter_1.yaml +++ b/queries/aws_guardduty_filter_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS GuardDuty Filters to retrieve information about - existing filters, their conditions, actions, and associated metadata. +Description: Allows users to query AWS GuardDuty Filters to retrieve information about existing filters, their conditions, actions, and associated metadata. ID: aws_guardduty_filter_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n detector_id,\n action,\n rank\nfrom\n aws_guardduty_filter;" + QueryToExecute: | + SELECT + name, + detector_id, + action, + rank + FROM + aws_guardduty_filter; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Filters and Associated Metadata + - GuardDuty +Title: Find AWS GuardDuty Filters and Associated Metadata \ No newline at end of file diff --git a/queries/aws_guardduty_filter_2.yaml b/queries/aws_guardduty_filter_2.yaml old mode 100755 new mode 100644 index 30f35ec16..32deafb3f --- a/queries/aws_guardduty_filter_2.yaml +++ b/queries/aws_guardduty_filter_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS GuardDuty Filters to retrieve information about - existing filters, their conditions, actions, and associated metadata. +Description: Allows users to query AWS GuardDuty Filters to retrieve information about existing filters, their conditions, actions, and associated metadata. ID: aws_guardduty_filter_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n detector_id,\n action,\n rank\nfrom\n aws_guardduty_filter\n\ - where\n action = 'ARCHIVE';" + QueryToExecute: | + SELECT + name, + detector_id, + action, + rank + FROM + aws_guardduty_filter + WHERE + action = 'ARCHIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Filter Information with SQL + - GuardDuty +Title: Find AWS GuardDuty Filter Information with SQL \ No newline at end of file diff --git a/queries/aws_guardduty_filter_3.yaml b/queries/aws_guardduty_filter_3.yaml old mode 100755 new mode 100644 index df054e94a..40d8859d4 --- a/queries/aws_guardduty_filter_3.yaml +++ b/queries/aws_guardduty_filter_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS GuardDuty Filters to retrieve information about - existing filters, their conditions, actions, and associated metadata. +Description: Allows users to query AWS GuardDuty Filters to retrieve information about existing filters, their conditions, actions, and associated metadata. ID: aws_guardduty_filter_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n region,\n detector_id,\n action,\n rank\n\ - from\n aws_guardduty_filter\nwhere\n rank = 1;" + QueryToExecute: | + SELECT + name, + region, + detector_id, + action, + rank + FROM + aws_guardduty_filter + WHERE + rank = 1; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Filter Conditions, Actions, Metadata + - GuardDuty +Title: Find AWS GuardDuty Filter Conditions, Actions, Metadata \ No newline at end of file diff --git a/queries/aws_guardduty_filter_4.yaml b/queries/aws_guardduty_filter_4.yaml old mode 100755 new mode 100644 index c3230f9d9..e5a253ee6 --- a/queries/aws_guardduty_filter_4.yaml +++ b/queries/aws_guardduty_filter_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS GuardDuty Filters to retrieve information about - existing filters, their conditions, actions, and associated metadata. +Description: Allows users to query AWS GuardDuty Filters to retrieve information about existing filters, their conditions, actions, and associated metadata. ID: aws_guardduty_filter_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_pretty(finding_criteria) as finding_criteria\n\ - from\n aws_guardduty_filter\nwhere\n name = 'filter-1';" + QueryToExecute: | + SELECT + name, + jsonb_pretty(finding_criteria) AS finding_criteria + FROM + aws_guardduty_filter + WHERE + name = 'filter-1'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Filter Information using SQL + - GuardDuty +Title: Find AWS GuardDuty Filter Information using SQL \ No newline at end of file diff --git a/queries/aws_guardduty_filter_5.yaml b/queries/aws_guardduty_filter_5.yaml old mode 100755 new mode 100644 index 7724c80f2..d512f03e2 --- a/queries/aws_guardduty_filter_5.yaml +++ b/queries/aws_guardduty_filter_5.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS GuardDuty Filters to retrieve information about - existing filters, their conditions, actions, and associated metadata. +Description: Allows users to query AWS GuardDuty Filters to retrieve information about existing filters, their conditions, actions, and associated metadata. ID: aws_guardduty_filter_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n region,\n detector_id,\n count(name)\nfrom\n aws_guardduty_filter\n\ - group by\n region,\n detector_id\norder by\n count desc;" + QueryToExecute: | + SELECT + region, + detector_id, + COUNT(name) + FROM + aws_guardduty_filter + GROUP BY + region, + detector_id + ORDER BY + COUNT DESC; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List AWS GuardDuty Filters and Associated Metadata + - GuardDuty +Title: List AWS GuardDuty Filters and Associated Metadata \ No newline at end of file diff --git a/queries/aws_guardduty_finding_1.yaml b/queries/aws_guardduty_finding_1.yaml old mode 100755 new mode 100644 index 52af122be..a4304fe55 --- a/queries/aws_guardduty_finding_1.yaml +++ b/queries/aws_guardduty_finding_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS GuardDuty Findings to access detailed information - about potential security threats or suspicious activities detected in their AWS - environment. +Description: Allows users to query AWS GuardDuty Findings to access detailed information about potential security threats or suspicious activities detected in their AWS environment. ID: aws_guardduty_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n detector_id,\n arn,\n created_at\nfrom\n aws_guardduty_finding;" + QueryToExecute: | + SELECT + id, + detector_id, + arn, + created_at + FROM + aws_guardduty_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find all AWS GuardDuty Findings for Security Threats + - GuardDuty +Title: Find all AWS GuardDuty Findings for Security Threats \ No newline at end of file diff --git a/queries/aws_guardduty_finding_2.yaml b/queries/aws_guardduty_finding_2.yaml old mode 100755 new mode 100644 index 9db620e5d..261d77b4e --- a/queries/aws_guardduty_finding_2.yaml +++ b/queries/aws_guardduty_finding_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS GuardDuty Findings to access detailed information - about potential security threats or suspicious activities detected in their AWS - environment. +Description: Allows users to query AWS GuardDuty Findings to access detailed information about potential security threats or suspicious activities detected in their AWS environment. ID: aws_guardduty_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n detector_id,\n arn,\n created_at\nfrom\n aws_guardduty_finding\n\ - where\n service ->> 'Archived' = 'false';" + QueryToExecute: | + SELECT + id, + detector_id, + arn, + created_at + FROM + aws_guardduty_finding + WHERE + service ->> 'Archived' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Findings on Security Threats + - GuardDuty +Title: Find AWS GuardDuty Findings on Security Threats \ No newline at end of file diff --git a/queries/aws_guardduty_ipset_1.yaml b/queries/aws_guardduty_ipset_1.yaml old mode 100755 new mode 100644 index d6bc5d36f..0433584af --- a/queries/aws_guardduty_ipset_1.yaml +++ b/queries/aws_guardduty_ipset_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS GuardDuty IPSet to retrieve information about - the IPSet, such as the detector ID, IPSet ID, name, format, location, and status. +Description: Allows users to query AWS GuardDuty IPSet to retrieve information about the IPSet, such as the detector ID, IPSet ID, name, format, location, and status. ID: aws_guardduty_ipset_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n ipset_id,\n name,\n format,\n location\n\ - from\n aws_guardduty_ipset;" + QueryToExecute: | + SELECT + detector_id, + ipset_id, + name, + format, + location + FROM + aws_guardduty_ipset; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty IPSets with Details + - GuardDuty +Title: Find AWS GuardDuty IPSets with Details \ No newline at end of file diff --git a/queries/aws_guardduty_ipset_2.yaml b/queries/aws_guardduty_ipset_2.yaml old mode 100755 new mode 100644 index 144b62f97..f61166a98 --- a/queries/aws_guardduty_ipset_2.yaml +++ b/queries/aws_guardduty_ipset_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS GuardDuty IPSet to retrieve information about - the IPSet, such as the detector ID, IPSet ID, name, format, location, and status. +Description: Allows users to query AWS GuardDuty IPSet to retrieve information about the IPSet, such as the detector ID, IPSet ID, name, format, location, and status. ID: aws_guardduty_ipset_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n ipset_id,\n name,\n status\nfrom\n aws_guardduty_ipset\n\ - where\n status = 'INACTIVE';" + QueryToExecute: | + SELECT + ipset_id, + name, + status + FROM + aws_guardduty_ipset + WHERE + status = 'INACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List All Inactive IP Sets in AWS GuardDuty + - GuardDuty +Title: List All Inactive IP Sets in AWS GuardDuty \ No newline at end of file diff --git a/queries/aws_guardduty_member_1.yaml b/queries/aws_guardduty_member_1.yaml old mode 100755 new mode 100644 index 484fb3044..c1876b2c2 --- a/queries/aws_guardduty_member_1.yaml +++ b/queries/aws_guardduty_member_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS GuardDuty Member data, including member account - details, detector ID, invitation status, and relationship status. +Description: Allows users to query AWS GuardDuty Member data, including member account details, detector ID, invitation status, and relationship status. ID: aws_guardduty_member_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n detector_id,\n invited_at,\n \ - \ relationship_status\nfrom\n aws_guardduty_member;" + QueryToExecute: | + SELECT + member_account_id, + detector_id, + invited_at, + relationship_status + FROM + aws_guardduty_member; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Member Data, Details, and Status + - GuardDuty +Title: Find AWS GuardDuty Member Data, Details, and Status \ No newline at end of file diff --git a/queries/aws_guardduty_member_2.yaml b/queries/aws_guardduty_member_2.yaml old mode 100755 new mode 100644 index 02734a7e9..f4cc4365c --- a/queries/aws_guardduty_member_2.yaml +++ b/queries/aws_guardduty_member_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS GuardDuty Member data, including member account - details, detector ID, invitation status, and relationship status. +Description: Allows users to query AWS GuardDuty Member data, including member account details, detector ID, invitation status, and relationship status. ID: aws_guardduty_member_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n detector_id,\n invited_at,\n \ - \ relationship_status\nfrom\n aws_guardduty_member\nwhere\n relationship_status\ - \ = 'EmailVerificationFailed';" + QueryToExecute: | + SELECT + member_account_id, + detector_id, + invited_at, + relationship_status + FROM + aws_guardduty_member + WHERE + relationship_status = 'EmailVerificationFailed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Member Account Details and Status + - GuardDuty +Title: Find AWS GuardDuty Member Account Details and Status \ No newline at end of file diff --git a/queries/aws_guardduty_member_3.yaml b/queries/aws_guardduty_member_3.yaml old mode 100755 new mode 100644 index ba54dd642..6771b3a62 --- a/queries/aws_guardduty_member_3.yaml +++ b/queries/aws_guardduty_member_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS GuardDuty Member data, including member account - details, detector ID, invitation status, and relationship status. +Description: Allows users to query AWS GuardDuty Member data, including member account details, detector ID, invitation status, and relationship status. ID: aws_guardduty_member_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n detector_id,\n invited_at,\n \ - \ relationship_status\nfrom\n aws_guardduty_member\nwhere\n invited_at is null;" + QueryToExecute: | + SELECT + member_account_id, + detector_id, + invited_at, + relationship_status + FROM + aws_guardduty_member + WHERE + invited_at IS NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Member Details + - GuardDuty +Title: Find AWS GuardDuty Member Details \ No newline at end of file diff --git a/queries/aws_guardduty_member_4.yaml b/queries/aws_guardduty_member_4.yaml old mode 100755 new mode 100644 index 20f87dc29..a52310f1f --- a/queries/aws_guardduty_member_4.yaml +++ b/queries/aws_guardduty_member_4.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS GuardDuty Member data, including member account - details, detector ID, invitation status, and relationship status. +Description: Allows users to query AWS GuardDuty Member data, including member account details, detector ID, invitation status, and relationship status. ID: aws_guardduty_member_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n detector_id,\n invited_at,\n \ - \ relationship_status\nfrom\n aws_guardduty_member\nwhere\n invited_at >= (now()\ - \ - interval '10' day);" + QueryToExecute: | + SELECT + member_account_id, + detector_id, + invited_at, + relationship_status + FROM + aws_guardduty_member + WHERE + invited_at >= (NOW() - INTERVAL '10' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find all AWS GuardDuty Member with details + - GuardDuty +Title: Find all AWS GuardDuty Member with details \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_1.yaml b/queries/aws_guardduty_publishing_destination_1.yaml old mode 100755 new mode 100644 index 8106eeb93..3fca66a82 --- a/queries/aws_guardduty_publishing_destination_1.yaml +++ b/queries/aws_guardduty_publishing_destination_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n destination_id,\n arn,\n destination_arn,\n\ - \ status\nfrom\n aws_guardduty_publishing_destination;" + QueryToExecute: | + SELECT + detector_id, + destination_id, + arn, + destination_arn, + status + FROM + aws_guardduty_publishing_destination; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List AWS GuardDuty Publishing Destinations Info + - GuardDuty +Title: List AWS GuardDuty Publishing Destinations Info \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_2.yaml b/queries/aws_guardduty_publishing_destination_2.yaml old mode 100755 new mode 100644 index 2b2060ba2..8ef5582c7 --- a/queries/aws_guardduty_publishing_destination_2.yaml +++ b/queries/aws_guardduty_publishing_destination_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n destination_id,\n arn,\n status\nfrom\n aws_guardduty_publishing_destination\n\ - where\n status = 'PENDING_VERIFICATION';" + QueryToExecute: | + SELECT + destination_id, + arn, + status + FROM + aws_guardduty_publishing_destination + WHERE + status = 'PENDING_VERIFICATION'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Publishing Destinations + - GuardDuty +Title: Find AWS GuardDuty Publishing Destinations \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_3.yaml b/queries/aws_guardduty_publishing_destination_3.yaml old mode 100755 new mode 100644 index 80f18bbe4..088860cb3 --- a/queries/aws_guardduty_publishing_destination_3.yaml +++ b/queries/aws_guardduty_publishing_destination_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n destination_id,\n kms_key_arn,\n status,\n destination_type\n\ - from\n aws_guardduty_publishing_destination\nwhere\n kms_key_arn is null;" + QueryToExecute: | + SELECT + destination_id, + kms_key_arn, + status, + destination_type + FROM + aws_guardduty_publishing_destination + WHERE + kms_key_arn IS NULL; Tags: cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List All AWS GuardDuty Publishing Destinations + - GuardDuty +Title: List All AWS GuardDuty Publishing Destinations \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_4.yaml b/queries/aws_guardduty_publishing_destination_4.yaml old mode 100755 new mode 100644 index f26c4e713..23df600a0 --- a/queries/aws_guardduty_publishing_destination_4.yaml +++ b/queries/aws_guardduty_publishing_destination_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n destination_type,\n count(destination_id)\nfrom\n aws_guardduty_publishing_destination\n\ - group by \n destination_type\norder by\n count desc;" + QueryToExecute: | + SELECT + destination_type, + COUNT(destination_id) + FROM + aws_guardduty_publishing_destination + GROUP BY + destination_type + ORDER BY + COUNT DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: List all AWS GuardDuty Publishing Destination Types + - GuardDuty +Title: List all AWS GuardDuty Publishing Destination Types \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_5.yaml b/queries/aws_guardduty_publishing_destination_5.yaml old mode 100755 new mode 100644 index 3639558c0..75852b285 --- a/queries/aws_guardduty_publishing_destination_5.yaml +++ b/queries/aws_guardduty_publishing_destination_5.yaml @@ -1,23 +1,34 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.destination_id,\n d.destination_arn,\n d.destination_type,\n\ - \ p ->> 'Sid' as sid,\n p ->> 'Action' as policy_action,\n p ->> 'Effect' as\ - \ effect,\n p -> 'Principal' ->> 'Service' as principal_service\nfrom\n aws_guardduty_publishing_destination\ - \ as d,\n aws_s3_bucket as s,\n jsonb_array_elements(s.policy -> 'Statement')\ - \ as p\nwhere\n d.destination_type = 'S3'\nand\n s.arn = d.destination_arn;" + QueryToExecute: | + SELECT + d.destination_id, + d.destination_arn, + d.destination_type, + p ->> 'Sid' AS sid, + p ->> 'Action' AS policy_action, + p ->> 'Effect' AS effect, + p -> 'Principal' ->> 'Service' AS principal_service + FROM + aws_guardduty_publishing_destination AS d, + aws_s3_bucket AS s, + jsonb_array_elements(s.policy -> 'Statement') AS p + WHERE + d.destination_type = 'S3' + AND + s.arn = d.destination_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty Publishing Destinations + - GuardDuty +Title: Find AWS GuardDuty Publishing Destinations \ No newline at end of file diff --git a/queries/aws_guardduty_publishing_destination_6.yaml b/queries/aws_guardduty_publishing_destination_6.yaml old mode 100755 new mode 100644 index 07a19946b..3b0f8090f --- a/queries/aws_guardduty_publishing_destination_6.yaml +++ b/queries/aws_guardduty_publishing_destination_6.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve - information about where GuardDuty findings are published. +Description: Allows users to query AWS GuardDuty Publishing Destinations to retrieve information about where GuardDuty findings are published. ID: aws_guardduty_publishing_destination_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n d.destination_id,\n p ->> 'Sid' as sid,\n p ->> 'Action'\ - \ as policy_action,\n p ->> 'Effect' as effect,\n p ->> 'Principal' as policy_principal,\n\ - \ p ->> 'Condition' as policy_condition\nfrom\n aws_guardduty_publishing_destination\ - \ as d,\n aws_kms_key as k,\n jsonb_array_elements(k.policy -> 'Statement')\ - \ as p\nwhere\n d.kms_key_arn is not null\nand\n k.arn = d.kms_key_arn;" + QueryToExecute: | + SELECT + d.destination_id, + p ->> 'Sid' AS sid, + p ->> 'Action' AS policy_action, + p ->> 'Effect' AS effect, + p ->> 'Principal' AS policy_principal, + p ->> 'Condition' AS policy_condition + FROM + aws_guardduty_publishing_destination AS d, + aws_kms_key AS k, + jsonb_array_elements(k.policy -> 'Statement') AS p + WHERE + d.kms_key_arn IS NOT NULL + AND + k.arn = d.kms_key_arn; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find all AWS GuardDuty Publishing Destinations + - GuardDuty +Title: Find all AWS GuardDuty Publishing Destinations \ No newline at end of file diff --git a/queries/aws_guardduty_threat_intel_set_1.yaml b/queries/aws_guardduty_threat_intel_set_1.yaml old mode 100755 new mode 100644 index 0c0aa6e8b..3351918e2 --- a/queries/aws_guardduty_threat_intel_set_1.yaml +++ b/queries/aws_guardduty_threat_intel_set_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS GuardDuty ThreatIntelSet to fetch information - about threat intelligence sets that are associated with a GuardDuty detector. +Description: Allows users to query AWS GuardDuty ThreatIntelSet to fetch information about threat intelligence sets that are associated with a GuardDuty detector. ID: aws_guardduty_threat_intel_set_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n detector_id,\n threat_intel_set_id,\n name,\n format,\n\ - \ location\nfrom\n aws_guardduty_threat_intel_set;" + QueryToExecute: | + SELECT + detector_id, + threat_intel_set_id, + name, + format, + location + FROM + aws_guardduty_threat_intel_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find AWS GuardDuty ThreatIntelSet Information + - GuardDuty +Title: Find AWS GuardDuty ThreatIntelSet Information \ No newline at end of file diff --git a/queries/aws_guardduty_threat_intel_set_2.yaml b/queries/aws_guardduty_threat_intel_set_2.yaml old mode 100755 new mode 100644 index fa0731c3b..5359588f7 --- a/queries/aws_guardduty_threat_intel_set_2.yaml +++ b/queries/aws_guardduty_threat_intel_set_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS GuardDuty ThreatIntelSet to fetch information - about threat intelligence sets that are associated with a GuardDuty detector. +Description: Allows users to query AWS GuardDuty ThreatIntelSet to fetch information about threat intelligence sets that are associated with a GuardDuty detector. ID: aws_guardduty_threat_intel_set_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n threat_intel_set_id,\n status\nfrom\n aws_guardduty_threat_intel_set\n\ - where\n status = 'INACTIVE';" + QueryToExecute: | + SELECT + threat_intel_set_id, + status + FROM + aws_guardduty_threat_intel_set + WHERE + status = 'INACTIVE'; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - GuardDuty -Title: Find all AWS GuardDuty ThreatIntelSet threat data + - GuardDuty +Title: Find all AWS GuardDuty ThreatIntelSet threat data \ No newline at end of file diff --git a/queries/aws_health_affected_entity_1.yaml b/queries/aws_health_affected_entity_1.yaml old mode 100755 new mode 100644 index 23f71ed88..856802276 --- a/queries/aws_health_affected_entity_1.yaml +++ b/queries/aws_health_affected_entity_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` - table provides comprehensive details about each entity affected by AWS Health events. - It can be utilized to gain insights into the health status of AWS resources, allowing - for proactive monitoring and maintenance. +Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` table provides comprehensive details about each entity affected by AWS Health events. It can be utilized to gain insights into the health status of AWS resources, allowing for proactive monitoring and maintenance. ID: aws_health_affected_entity_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n entity_url,\n entity_value,\n event_arn,\n\ - \ last_updated_time,\n status_code\nfrom\n aws_health_affected_entity;" + QueryToExecute: | + SELECT + arn, + entity_url, + entity_value, + event_arn, + last_updated_time, + status_code + FROM + aws_health_affected_entity; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Health -Title: Find Health Status of AWS Resources via SQL + - AWS Health +Title: Find Health Status of AWS Resources via SQL \ No newline at end of file diff --git a/queries/aws_health_affected_entity_2.yaml b/queries/aws_health_affected_entity_2.yaml old mode 100755 new mode 100644 index 491023d6f..af6618960 --- a/queries/aws_health_affected_entity_2.yaml +++ b/queries/aws_health_affected_entity_2.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` - table provides comprehensive details about each entity affected by AWS Health events. - It can be utilized to gain insights into the health status of AWS resources, allowing - for proactive monitoring and maintenance. +Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` table provides comprehensive details about each entity affected by AWS Health events. It can be utilized to gain insights into the health status of AWS resources, allowing for proactive monitoring and maintenance. ID: aws_health_affected_entity_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n entity_url,\n entity_value,\n event_arn,\n\ - \ last_updated_time,\n status_code\nfrom\n aws_health_affected_entity\nwhere\n\ - \ status_code = 'UNIMPAIRED';" + QueryToExecute: | + SELECT + arn, + entity_url, + entity_value, + event_arn, + last_updated_time, + status_code + FROM + aws_health_affected_entity + WHERE + status_code = 'UNIMPAIRED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Health -Title: List all AWS Health Affected Entities + - Health +Title: List all AWS Health Affected Entities \ No newline at end of file diff --git a/queries/aws_health_affected_entity_3.yaml b/queries/aws_health_affected_entity_3.yaml old mode 100755 new mode 100644 index ce6239c38..45b903e2b --- a/queries/aws_health_affected_entity_3.yaml +++ b/queries/aws_health_affected_entity_3.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` - table provides comprehensive details about each entity affected by AWS Health events. - It can be utilized to gain insights into the health status of AWS resources, allowing - for proactive monitoring and maintenance. +Description: Allows users to query Affected Entities in AWS Health. The `aws_health_affected_entity` table provides comprehensive details about each entity affected by AWS Health events. It can be utilized to gain insights into the health status of AWS resources, allowing for proactive monitoring and maintenance. ID: aws_health_affected_entity_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.arn,\n e.entity_url,\n e.event_arn,\n v.event_type_category,\n\ - \ v.event_type_code,\n v.service\nfrom\n aws_health_affected_entity as e,\n\ - \ aws_health_event as v;" + QueryToExecute: | + SELECT + e.arn, + e.entity_url, + e.event_arn, + v.event_type_category, + v.event_type_code, + v.service + FROM + aws_health_affected_entity AS e, + aws_health_event AS v; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Health -Title: List AWS Health Affected Entities with Detailed Insights + - AWS Health +Title: List AWS Health Affected Entities with Detailed Insights \ No newline at end of file diff --git a/queries/aws_health_event_1.yaml b/queries/aws_health_event_1.yaml old mode 100755 new mode 100644 index 3a8697518..5bd069cdc --- a/queries/aws_health_event_1.yaml +++ b/queries/aws_health_event_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Health Events to retrieve information about - events that affect your AWS services and accounts. +Description: Allows users to query AWS Health Events to retrieve information about events that affect your AWS services and accounts. ID: aws_health_event_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n availability_zone,\n start_time,\n end_time,\n\ - \ event_type_category,\n event_type_code,\n event_scope_code,\n service,\n\ - \ region\nfrom\n aws_health_event;" + QueryToExecute: | + SELECT + arn, + availability_zone, + start_time, + end_time, + event_type_category, + event_type_code, + event_scope_code, + service, + region + FROM + aws_health_event; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Health -Title: Query AWS Health Events Affecting Services and Accounts + - AWS Health +Title: Query AWS Health Events Affecting Services and Accounts \ No newline at end of file diff --git a/queries/aws_health_event_2.yaml b/queries/aws_health_event_2.yaml deleted file mode 100755 index 5057e3833..000000000 --- a/queries/aws_health_event_2.yaml +++ /dev/null @@ -1,15 +0,0 @@ -Description: Allows users to query AWS Health Events to retrieve information about - events that affect your AWS services and accounts. -ID: aws_health_event_2 -IntegrationType: -- aws_cloud_account -Query: - Engine: CloudQL-v0.0.1 - ListOfTables: [] - Parameters: [] - PrimaryTable: null - QueryToExecute: "select\n arn,\n start_time,\n end_time,\n event_type_category,\n\ - \ event_type_code,\n event_scope_code,\n status_code,\n service\nfrom\n aws_health_event\n\ - where\n status_code = 'upcoming';" -Tags: {} -Title: '' diff --git a/queries/aws_health_event_3.yaml b/queries/aws_health_event_3.yaml old mode 100755 new mode 100644 index c29a9cf39..a777af2d1 --- a/queries/aws_health_event_3.yaml +++ b/queries/aws_health_event_3.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query AWS Health Events to retrieve information about - events that affect your AWS services and accounts. +Description: Allows users to query AWS Health Events to retrieve information about events that affect your AWS services and accounts. ID: aws_health_event_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n start_time,\n end_time,\n event_type_category,\n\ - \ event_type_code,\n event_scope_code,\n status_code,\n service\nfrom\n aws_health_event\n\ - where\n service = 'EC2';" + QueryToExecute: | + SELECT + arn, + start_time, + end_time, + event_type_category, + event_type_code, + event_scope_code, + status_code, + service + FROM + aws_health_event + WHERE + service = 'EC2'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Health Events -Title: Find AWS Health Events Affecting Services and Accounts + - AWS Health Events +Title: Find AWS Health Events Affecting Services and Accounts \ No newline at end of file diff --git a/queries/aws_health_event_4.yaml b/queries/aws_health_event_4.yaml old mode 100755 new mode 100644 index aa0fa807f..d40b7471e --- a/queries/aws_health_event_4.yaml +++ b/queries/aws_health_event_4.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query AWS Health Events to retrieve information about - events that affect your AWS services and accounts. +Description: Allows users to query AWS Health Events to retrieve information about events that affect your AWS services and accounts. ID: aws_health_event_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n availability_zone,\n start_time,\n end_time,\n\ - \ event_type_category,\n event_type_code,\n event_scope_code,\n status_code,\n\ - \ service\nfrom\n aws_health_event\nwhere\n availability_zone = 'us-east-1a';" + QueryToExecute: | + SELECT + arn, + availability_zone, + start_time, + end_time, + event_type_category, + event_type_code, + event_scope_code, + status_code, + service + FROM + aws_health_event + WHERE + availability_zone = 'us-east-1a'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Health -Title: List all AWS Health Events affecting services and accounts + - AWS Health +Title: List all AWS Health Events affecting services and accounts \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_1.yaml b/queries/aws_iam_access_advisor_1.yaml old mode 100755 new mode 100644 index 7188a0cec..82b757aff --- a/queries/aws_iam_access_advisor_1.yaml +++ b/queries/aws_iam_access_advisor_1.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n principal_arn,\n service_name,\n last_authenticated,\n\ - \ age(last_authenticated::date) \nfrom \n aws_iam_access_advisor\nwhere\n principal_arn\ - \ = 'arn:aws:iam::123456789123:user/john'\n and last_authenticated is not null\n\ - order by \n age asc;" + QueryToExecute: | + SELECT + principal_arn, + service_name, + last_authenticated, + AGE(last_authenticated::date) + FROM + aws_iam_access_advisor + WHERE + principal_arn = 'arn:aws:iam::123456789123:user/john' + AND last_authenticated IS NOT NULL + ORDER BY + AGE ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Advisor -Title: Find AWS IAM Access Info via SQL Query + - IAM Access Advisor +Title: Find AWS IAM Access Info via SQL Query \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_2.yaml b/queries/aws_iam_access_advisor_2.yaml old mode 100755 new mode 100644 index 9d594a68c..340b1fc4b --- a/queries/aws_iam_access_advisor_2.yaml +++ b/queries/aws_iam_access_advisor_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n principal_arn,\n service_name\nfrom \n aws_iam_access_advisor\n\ - where\n principal_arn = 'arn:aws:iam::123456789123:role/turbot/admin'\n and\ - \ last_authenticated is null\norder by \n service_name" + QueryToExecute: | + SELECT + principal_arn, + service_name + FROM + aws_iam_access_advisor + WHERE + principal_arn = 'arn:aws:iam::123456789123:role/turbot/admin' + AND last_authenticated IS NULL + ORDER BY + service_name Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Advisor -Title: List all AWS IAM entities with no recent service access + - IAM Access Advisor +Title: List all AWS IAM entities with no recent service access \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_3.yaml b/queries/aws_iam_access_advisor_3.yaml old mode 100755 new mode 100644 index 82e0dd596..98f65ecef --- a/queries/aws_iam_access_advisor_3.yaml +++ b/queries/aws_iam_access_advisor_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n principal_arn,\n service_name,\n last_authenticated,\n\ - \ age(last_authenticated::date),\n last_authenticated_entity,\n last_authenticated_region\n\ - from \n aws_iam_access_advisor\nwhere\n principal_arn = 'arn:aws:iam::aws:policy/AdministratorAccess'\n\ - \ and last_authenticated is not null\norder by \n age asc;" + QueryToExecute: | + SELECT + principal_arn, + service_name, + last_authenticated, + age(last_authenticated::date), + last_authenticated_entity, + last_authenticated_region + FROM + aws_iam_access_advisor + WHERE + principal_arn = 'arn:aws:iam::aws:policy/AdministratorAccess' + AND last_authenticated IS NOT NULL + ORDER BY + age ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Advisor -Title: Find AWS IAM Access Advisor Info for Service Access Data + - IAM Access Advisor +Title: Find AWS IAM Access Advisor Info for Service Access Data \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_4.yaml b/queries/aws_iam_access_advisor_4.yaml old mode 100755 new mode 100644 index b966f58ac..5ba618a1d --- a/queries/aws_iam_access_advisor_4.yaml +++ b/queries/aws_iam_access_advisor_4.yaml @@ -1,29 +1,41 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n adv.service_name,\n action as action_granted,\n attached\ - \ as granted_in,\n adv.service_namespace\nfrom \n aws_iam_access_advisor as\ - \ adv,\n aws_iam_role as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as attached,\n aws_iam_policy as p, \n jsonb_array_elements(p.policy_std\ - \ -> 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action\n\ - where\n principal_arn = 'arn:aws:iam::123456789123:role/turbot/admin'\n and\ - \ r.arn = adv.principal_arn\n and last_authenticated is null\n and attached\ - \ = p.arn\n and stmt ->> 'Effect' = 'Allow'\n and action like adv.service_namespace\ - \ || ':%'\norder by \n adv.service_name;" + QueryToExecute: | + SELECT + adv.service_name, + action AS action_granted, + attached AS granted_in, + adv.service_namespace + FROM + aws_iam_access_advisor AS adv, + aws_iam_role AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS attached, + aws_iam_policy AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action + WHERE + principal_arn = 'arn:aws:iam::123456789123:role/turbot/admin' + AND r.arn = adv.principal_arn + AND last_authenticated IS NULL + AND attached = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND action LIKE adv.service_namespace || ':%' + ORDER BY + adv.service_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Access Advisor Data for User Entities + - IAM +Title: Find AWS IAM Access Advisor Data for User Entities \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_5.yaml b/queries/aws_iam_access_advisor_5.yaml old mode 100755 new mode 100644 index c71854442..5506f99a7 --- a/queries/aws_iam_access_advisor_5.yaml +++ b/queries/aws_iam_access_advisor_5.yaml @@ -1,26 +1,36 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n principal_arn,\n service_name,\n last_authenticated,\n\ - \ age(last_authenticated::date),\n a ->> 'ActionName' as action_name,\n a ->>\ - \ 'LastAccessedEntity' as action_last_accessed_entity,\n a ->> 'LastAccessedRegion'\ - \ as action_last_accessed_region,\n a ->> 'LastAccessedTime' as action_last_accessed_time\n\ - from \n aws_iam_access_advisor,\n jsonb_array_elements(tracked_actions_last_accessed)\ - \ as a\nwhere\n principal_arn = 'arn:aws:iam::123456789123:user/jane'\n and\ - \ last_authenticated is not null\n and service_namespace = 's3'\norder by \n\ - \ age asc;" + QueryToExecute: | + SELECT + principal_arn, + service_name, + last_authenticated, + AGE(last_authenticated::date) AS age, + a ->> 'ActionName' AS action_name, + a ->> 'LastAccessedEntity' AS action_last_accessed_entity, + a ->> 'LastAccessedRegion' AS action_last_accessed_region, + a ->> 'LastAccessedTime' AS action_last_accessed_time + FROM + aws_iam_access_advisor, + jsonb_array_elements(tracked_actions_last_accessed) AS a + WHERE + principal_arn = 'arn:aws:iam::123456789123:user/jane' + AND last_authenticated IS NOT NULL + AND service_namespace = 's3' + ORDER BY + age ASC; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Advisor -Title: Find All AWS IAM Access Advisor Last Access Data + - IAM Access Advisor +Title: Find All AWS IAM Access Advisor Last Access Data \ No newline at end of file diff --git a/queries/aws_iam_access_advisor_6.yaml b/queries/aws_iam_access_advisor_6.yaml old mode 100755 new mode 100644 index f71e11fba..8ad7b4728 --- a/queries/aws_iam_access_advisor_6.yaml +++ b/queries/aws_iam_access_advisor_6.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS IAM Access Advisor to retrieve information - about the service last accessed data for IAM entities (users, groups, and roles). +Description: Allows users to query AWS IAM Access Advisor to retrieve information about the service last accessed data for IAM entities (users, groups, and roles). ID: aws_iam_access_advisor_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n principal_arn,\n service_name\nfrom\n aws_iam_user\ - \ as u,\n aws_iam_access_advisor as adv\nwhere\n adv.principal_arn = u.arn\n\ - \ and last_authenticated is null;" + QueryToExecute: | + SELECT + principal_arn, + service_name + FROM + aws_iam_user AS u, + aws_iam_access_advisor AS adv + WHERE + adv.principal_arn = u.arn + AND last_authenticated IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Advisor -Title: List IAM Access Advisor Data for AWS Entities + - IAM Access Advisor +Title: List IAM Access Advisor Data for AWS Entities \ No newline at end of file diff --git a/queries/aws_iam_access_key_1.yaml b/queries/aws_iam_access_key_1.yaml old mode 100755 new mode 100644 index 8eb812da9..5d2f9eb16 --- a/queries/aws_iam_access_key_1.yaml +++ b/queries/aws_iam_access_key_1.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query IAM Access Keys in AWS to obtain details about - the access keys associated with an IAM user. This includes the access key ID, status, - creation date, and more. +Description: Allows users to query IAM Access Keys in AWS to obtain details about the access keys associated with an IAM user. This includes the access key ID, status, creation date, and more. ID: aws_iam_access_key_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n access_key_id,\n user_name,\n create_date\nfrom\n \ - \ aws_iam_access_key;" + QueryToExecute: | + SELECT + access_key_id, + user_name, + create_date + FROM + aws_iam_access_key; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM User Access Keys Details + - IAM +Title: Find AWS IAM User Access Keys Details \ No newline at end of file diff --git a/queries/aws_iam_access_key_2.yaml b/queries/aws_iam_access_key_2.yaml old mode 100755 new mode 100644 index 6ba695c2f..9a076fbf4 --- a/queries/aws_iam_access_key_2.yaml +++ b/queries/aws_iam_access_key_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query IAM Access Keys in AWS to obtain details about - the access keys associated with an IAM user. This includes the access key ID, status, - creation date, and more. +Description: Allows users to query IAM Access Keys in AWS to obtain details about the access keys associated with an IAM user. This includes the access key ID, status, creation date, and more. ID: aws_iam_access_key_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n access_key_id,\n user_name,\n status\nfrom\n aws_iam_access_key\n\ - where\n status = 'Inactive';" + QueryToExecute: | + SELECT + access_key_id, + user_name, + status + FROM + aws_iam_access_key + WHERE + status = 'Inactive'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find Inactive IAM Access Keys with AWS via SQL + - IAM +Title: Find Inactive IAM Access Keys with AWS via SQL \ No newline at end of file diff --git a/queries/aws_iam_access_key_3.yaml b/queries/aws_iam_access_key_3.yaml old mode 100755 new mode 100644 index 98b130f84..1d16dcff1 --- a/queries/aws_iam_access_key_3.yaml +++ b/queries/aws_iam_access_key_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query IAM Access Keys in AWS to obtain details about - the access keys associated with an IAM user. This includes the access key ID, status, - creation date, and more. +Description: Allows users to query IAM Access Keys in AWS to obtain details about the access keys associated with an IAM user. This includes the access key ID, status, creation date, and more. ID: aws_iam_access_key_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name,\n count (access_key_id) as access_key_count\n\ - from\n aws_iam_access_key\ngroup by\n user_name;" + QueryToExecute: | + SELECT + user_name, + COUNT(access_key_id) AS access_key_count + FROM + aws_iam_access_key + GROUP BY + user_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Access Keys -Title: List all AWS IAM Access Keys with User Details + - IAM Access Keys +Title: List all AWS IAM Access Keys with User Details \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_1.yaml b/queries/aws_iam_account_password_policy_1.yaml old mode 100755 new mode 100644 index fa966a32e..163a68b7c --- a/queries/aws_iam_account_password_policy_1.yaml +++ b/queries/aws_iam_account_password_policy_1.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n allow_users_to_change_password,\n expire_passwords,\n\ - \ hard_expiry,\n max_password_age,\n minimum_password_length,\n password_reuse_prevention,\n\ - \ require_lowercase_characters,\n require_numbers,\n require_symbols,\n require_uppercase_characters\n\ - from\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + allow_users_to_change_password, + expire_passwords, + hard_expiry, + max_password_age, + minimum_password_length, + password_reuse_prevention, + require_lowercase_characters, + require_numbers, + require_symbols, + require_uppercase_characters + FROM + aws_iam_account_password_policy; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policy Details + - IAM +Title: Find AWS IAM Account Password Policy Details \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_2.yaml b/queries/aws_iam_account_password_policy_2.yaml old mode 100755 new mode 100644 index 1f9c4e521..b9c5a157a --- a/queries/aws_iam_account_password_policy_2.yaml +++ b/queries/aws_iam_account_password_policy_2.yaml @@ -1,20 +1,22 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n require_uppercase_characters\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + require_uppercase_characters + FROM + aws_iam_account_password_policy; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policy Requirements + - IAM +Title: Find AWS IAM Account Password Policy Requirements \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_3.yaml b/queries/aws_iam_account_password_policy_3.yaml old mode 100755 new mode 100644 index a9da167ed..921786b5f --- a/queries/aws_iam_account_password_policy_3.yaml +++ b/queries/aws_iam_account_password_policy_3.yaml @@ -1,20 +1,22 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n require_lowercase_characters\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + require_lowercase_characters + FROM + aws_iam_account_password_policy; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policy Details + - IAM +Title: Find AWS IAM Account Password Policy Details \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_4.yaml b/queries/aws_iam_account_password_policy_4.yaml old mode 100755 new mode 100644 index 29ee03ced..6317bf069 --- a/queries/aws_iam_account_password_policy_4.yaml +++ b/queries/aws_iam_account_password_policy_4.yaml @@ -1,22 +1,24 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n require_symbols\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + require_symbols + FROM + aws_iam_account_password_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Account Password Policies -Title: Find AWS IAM Account Password Policy Requirements + - IAM Account Password Policies +Title: Find AWS IAM Account Password Policy Requirements \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_5.yaml b/queries/aws_iam_account_password_policy_5.yaml old mode 100755 new mode 100644 index 8329e11b0..be85f2446 --- a/queries/aws_iam_account_password_policy_5.yaml +++ b/queries/aws_iam_account_password_policy_5.yaml @@ -1,22 +1,24 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n require_numbers\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + require_numbers + FROM + aws_iam_account_password_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List AWS IAM Account Password Policies with SQL + - IAM +Title: List AWS IAM Account Password Policies with SQL \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_6.yaml b/queries/aws_iam_account_password_policy_6.yaml old mode 100755 new mode 100644 index bbd4bccc0..d901e715a --- a/queries/aws_iam_account_password_policy_6.yaml +++ b/queries/aws_iam_account_password_policy_6.yaml @@ -1,22 +1,24 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n minimum_password_length >= 14\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + minimum_password_length >= 14 + FROM + aws_iam_account_password_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policies Details + - IAM +Title: Find AWS IAM Account Password Policies Details \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_7.yaml b/queries/aws_iam_account_password_policy_7.yaml old mode 100755 new mode 100644 index 9407ac737..4b7b3745e --- a/queries/aws_iam_account_password_policy_7.yaml +++ b/queries/aws_iam_account_password_policy_7.yaml @@ -1,20 +1,22 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n password_reuse_prevention\nfrom\n aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + password_reuse_prevention + FROM + aws_iam_account_password_policy; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policies with SQL + - IAM +Title: Find AWS IAM Account Password Policies with SQL \ No newline at end of file diff --git a/queries/aws_iam_account_password_policy_8.yaml b/queries/aws_iam_account_password_policy_8.yaml old mode 100755 new mode 100644 index b487ce974..1013fc98a --- a/queries/aws_iam_account_password_policy_8.yaml +++ b/queries/aws_iam_account_password_policy_8.yaml @@ -1,23 +1,24 @@ -Description: Allows users to query AWS IAM Account Password Policies to gain insights - about password policy details such as minimum password length, password expiration - period, and whether it requires at least one number or symbol. +Description: Allows users to query AWS IAM Account Password Policies to gain insights about password policy details such as minimum password length, password expiration period, and whether it requires at least one number or symbol. ID: aws_iam_account_password_policy_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n (expire_passwords and max_password_age <= 90)\nfrom\n\ - \ aws_iam_account_password_policy;" + QueryToExecute: | + SELECT + (expire_passwords AND max_password_age <= 90) + FROM + aws_iam_account_password_policy; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Password Policies + - IAM +Title: Find AWS IAM Account Password Policies \ No newline at end of file diff --git a/queries/aws_iam_account_summary_1.yaml b/queries/aws_iam_account_summary_1.yaml old mode 100755 new mode 100644 index 121016eba..750adf9d6 --- a/queries/aws_iam_account_summary_1.yaml +++ b/queries/aws_iam_account_summary_1.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS IAM Account Summary to get a detailed overview - of the account''s IAM usage and resource consumption. +Description: Allows users to query AWS IAM Account Summary to get a detailed overview of the account's IAM usage and resource consumption. ID: aws_iam_account_summary_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n *\nfrom\n aws_iam_account_summary;" + QueryToExecute: | + SELECT + * + FROM + aws_iam_account_summary; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: List AWS IAM Account Summary Overview and Resource Usage + - Identity and Access Management +Title: List AWS IAM Account Summary Overview and Resource Usage \ No newline at end of file diff --git a/queries/aws_iam_account_summary_2.yaml b/queries/aws_iam_account_summary_2.yaml old mode 100755 new mode 100644 index bb151e204..83442869d --- a/queries/aws_iam_account_summary_2.yaml +++ b/queries/aws_iam_account_summary_2.yaml @@ -1,19 +1,22 @@ -Description: Allows users to query AWS IAM Account Summary to get a detailed overview - of the account''s IAM usage and resource consumption. +Description: Allows users to query AWS IAM Account Summary to get a detailed overview of the account's IAM usage and resource consumption. ID: aws_iam_account_summary_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n account_mfa_enabled\nfrom\n aws_iam_account_summary;" + QueryToExecute: | + SELECT + account_mfa_enabled + FROM + aws_iam_account_summary; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM Account Summary with SQL Query + - Identity and Access Management +Title: Find AWS IAM Account Summary with SQL Query \ No newline at end of file diff --git a/queries/aws_iam_account_summary_3.yaml b/queries/aws_iam_account_summary_3.yaml old mode 100755 new mode 100644 index f1ccffb66..7d3ab034c --- a/queries/aws_iam_account_summary_3.yaml +++ b/queries/aws_iam_account_summary_3.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query AWS IAM Account Summary to get a detailed overview - of the account''s IAM usage and resource consumption. +Description: Allows users to query AWS IAM Account Summary to get a detailed overview of the account's IAM usage and resource consumption. ID: aws_iam_account_summary_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n users,\n groups,\n roles,\n policies\nfrom\n aws_iam_account_summary;" + QueryToExecute: | + SELECT + users, + groups, + roles, + policies + FROM + aws_iam_account_summary; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Account Summary Details + - IAM +Title: Find AWS IAM Account Summary Details \ No newline at end of file diff --git a/queries/aws_iam_action_1.yaml b/queries/aws_iam_action_1.yaml old mode 100755 new mode 100644 index 887dc577c..6cc9424a9 --- a/queries/aws_iam_action_1.yaml +++ b/queries/aws_iam_action_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query IAM Actions in AWS Identity and Access Management - (IAM). +Description: Allows users to query IAM Actions in AWS Identity and Access Management (IAM). ID: aws_iam_action_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n action,\n description\nfrom\n aws_iam_action\nwhere\n\ - \ prefix = 's3'\norder by\n action;" + QueryToExecute: | + SELECT + action, + description + FROM + aws_iam_action + WHERE + prefix = 's3' + ORDER BY + action; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find IAM Actions in AWS IAM with SQL + - Identity and Access Management +Title: Find IAM Actions in AWS IAM with SQL \ No newline at end of file diff --git a/queries/aws_iam_action_2.yaml b/queries/aws_iam_action_2.yaml old mode 100755 new mode 100644 index cd0e8f065..bd1d16456 --- a/queries/aws_iam_action_2.yaml +++ b/queries/aws_iam_action_2.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query IAM Actions in AWS Identity and Access Management - (IAM). +Description: Allows users to query IAM Actions in AWS Identity and Access Management (IAM). ID: aws_iam_action_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n description\nfrom\n aws_iam_action\nwhere\n action\ - \ = 's3:deleteobject';" + QueryToExecute: | + SELECT + description + FROM + aws_iam_action + WHERE + action = 's3:DeleteObject'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find all IAM Actions in AWS Identity and Access Management + - Identity and Access Management +Title: Find all IAM Actions in AWS Identity and Access Management \ No newline at end of file diff --git a/queries/aws_iam_action_3.yaml b/queries/aws_iam_action_3.yaml old mode 100755 new mode 100644 index 831dec36b..72784ee29 --- a/queries/aws_iam_action_3.yaml +++ b/queries/aws_iam_action_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query IAM Actions in AWS Identity and Access Management - (IAM). +Description: Allows users to query IAM Actions in AWS Identity and Access Management (IAM). ID: aws_iam_action_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.action,\n a.description\nfrom\n aws_iam_action as\ - \ a,\n glob('s3:d*') as action_name\nwhere\n a.action like action_name;" + QueryToExecute: | + SELECT + a.action, + a.description + FROM + aws_iam_action AS a, + GLOB('s3:d*') AS action_name + WHERE + a.action LIKE action_name; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find IAM Actions in AWS Identity and Access Management + - Identity and Access Management +Title: Find IAM Actions in AWS Identity and Access Management \ No newline at end of file diff --git a/queries/aws_iam_action_4.yaml b/queries/aws_iam_action_4.yaml old mode 100755 new mode 100644 index b83c15e72..8af8898c9 --- a/queries/aws_iam_action_4.yaml +++ b/queries/aws_iam_action_4.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query IAM Actions in AWS Identity and Access Management - (IAM). +Description: Allows users to query IAM Actions in AWS Identity and Access Management (IAM). ID: aws_iam_action_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.action,\n a.access_level\nfrom\n aws_iam_policy p,\n\ - \ jsonb_array_elements(p.policy_std -> 'Statement') as stmt,\n jsonb_array_elements_text(stmt\ - \ -> 'Action') as action_glob,\n glob(action_glob) as action_regex\n join aws_iam_action\ - \ a ON a.action LIKE action_regex\nwhere\n p.name = 'AmazonEC2ReadOnlyAccess'\n\ - \ and stmt ->> 'Effect' = 'Allow'\norder by\n a.action;" + QueryToExecute: | + SELECT + a.action, + a.access_level + FROM + aws_iam_policy p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + p.name = 'AmazonEC2ReadOnlyAccess' + AND stmt ->> 'Effect' = 'Allow' + ORDER BY + a.action; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Identity and Access Management (IAM) -Title: Find IAM Actions in AWS Identity and Access Management + - AWS Identity and Access Management (IAM) +Title: Find IAM Actions in AWS Identity and Access Management \ No newline at end of file diff --git a/queries/aws_iam_action_5.yaml b/queries/aws_iam_action_5.yaml old mode 100755 new mode 100644 index ae482bc9b..aaf7c68e7 --- a/queries/aws_iam_action_5.yaml +++ b/queries/aws_iam_action_5.yaml @@ -1,27 +1,40 @@ -Description: Allows users to query IAM Actions in AWS Identity and Access Management - (IAM). +Description: Allows users to query IAM Actions in AWS Identity and Access Management (IAM). ID: aws_iam_action_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.name,\n f.role,\n a.action,\n a.access_level,\n\ - \ a.description\nfrom \n aws_lambda_function as f,\n aws_iam_role as r,\n \ - \ jsonb_array_elements_text(r.attached_policy_arns) as pol_arn,\n aws_iam_policy\ - \ as p,\n jsonb_array_elements(p.policy_std -> 'Statement') as stmt,\n jsonb_array_elements_text(stmt\ - \ -> 'Action') as action_glob,\n glob(action_glob) as action_regex\n join aws_iam_action\ - \ a ON a.action LIKE action_regex\nwhere\n f.role = r.arn\n and pol_arn = p.arn\ - \ \n and stmt ->> 'Effect' = 'Allow'\n and f.name = 'hellopython';" + QueryToExecute: | + SELECT + f.name, + f.role, + a.action, + a.access_level, + a.description + FROM + aws_lambda_function AS f, + aws_iam_role AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS pol_arn, + aws_iam_policy AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + f.role = r.arn + AND pol_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND f.name = 'hellopython'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM Actions in AWS Identity and Access Management + - Identity and Access Management +Title: Find AWS IAM Actions in AWS Identity and Access Management \ No newline at end of file diff --git a/queries/aws_iam_credential_report_1.yaml b/queries/aws_iam_credential_report_1.yaml old mode 100755 new mode 100644 index 7d3fafdd9..fbc79e3b5 --- a/queries/aws_iam_credential_report_1.yaml +++ b/queries/aws_iam_credential_report_1.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name\nfrom\n aws_iam_credential_report\nwhere\n\ - \ password_enabled\n and password_last_used > (current_date - interval '90'\ - \ day);" + QueryToExecute: | + SELECT + user_name + FROM + aws_iam_credential_report + WHERE + password_enabled + AND password_last_used > (current_date - INTERVAL '90' DAY); Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Identity and Access Management -Title: Find AWS IAM Credential Reports for Users with Activity + - AWS Identity and Access Management +Title: Find AWS IAM Credential Reports for Users with Activity \ No newline at end of file diff --git a/queries/aws_iam_credential_report_2.yaml b/queries/aws_iam_credential_report_2.yaml old mode 100755 new mode 100644 index 0565038f5..040c3f814 --- a/queries/aws_iam_credential_report_2.yaml +++ b/queries/aws_iam_credential_report_2.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name,\n password_last_used,\n age(password_last_used)\n\ - from\n aws_iam_credential_report\nwhere\n password_enabled\n and password_last_used\ - \ <= (current_date - interval '90' day)\norder by\n password_last_used;" + QueryToExecute: | + SELECT + user_name, + password_last_used, + AGE(password_last_used) + FROM + aws_iam_credential_report + WHERE + password_enabled + AND password_last_used <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + password_last_used; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Credential Reports and User Statuses + - IAM +Title: Find AWS IAM Credential Reports and User Statuses \ No newline at end of file diff --git a/queries/aws_iam_credential_report_3.yaml b/queries/aws_iam_credential_report_3.yaml old mode 100755 new mode 100644 index e6435cd50..83015de7f --- a/queries/aws_iam_credential_report_3.yaml +++ b/queries/aws_iam_credential_report_3.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name\nfrom\n aws_iam_credential_report\nwhere\n\ - \ password_status = 'never_used';" + QueryToExecute: | + SELECT + user_name + FROM + aws_iam_credential_report + WHERE + password_status = 'never_used'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Credential Reports -Title: Find AWS IAM Users with Never Used Passwords + - IAM Credential Reports +Title: Find AWS IAM Users with Never Used Passwords \ No newline at end of file diff --git a/queries/aws_iam_credential_report_4.yaml b/queries/aws_iam_credential_report_4.yaml old mode 100755 new mode 100644 index 45a58ef78..f2560a8a7 --- a/queries/aws_iam_credential_report_4.yaml +++ b/queries/aws_iam_credential_report_4.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name,\n access_key_1_last_rotated,\n age(access_key_1_last_rotated)\ - \ as access_key_1_age,\n access_key_2_last_rotated,\n age(access_key_2_last_rotated)\ - \ as access_key_2_age\nfrom\n aws_iam_credential_report\nwhere\n access_key_1_last_rotated\ - \ <= (current_date - interval '90' day)\n or access_key_2_last_rotated <= (current_date\ - \ - interval '90' day)\norder by\n user_name;" + QueryToExecute: | + SELECT + user_name, + access_key_1_last_rotated, + AGE(access_key_1_last_rotated) AS access_key_1_age, + access_key_2_last_rotated, + AGE(access_key_2_last_rotated) AS access_key_2_age + FROM + aws_iam_credential_report + WHERE + access_key_1_last_rotated <= (CURRENT_DATE - INTERVAL '90' DAY) + OR access_key_2_last_rotated <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + user_name; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management (IAM) -Title: Find all AWS IAM Credential Reports for Key Rotation + - Identity and Access Management (IAM) +Title: Find all AWS IAM Credential Reports for Key Rotation \ No newline at end of file diff --git a/queries/aws_iam_credential_report_5.yaml b/queries/aws_iam_credential_report_5.yaml old mode 100755 new mode 100644 index c27480c5c..63712ef30 --- a/queries/aws_iam_credential_report_5.yaml +++ b/queries/aws_iam_credential_report_5.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name,\n mfa_active,\n password_enabled\nfrom\n\ - \ aws_iam_credential_report\nwhere\n password_enabled\n and not mfa_active;" + QueryToExecute: | + SELECT + user_name, + mfa_active, + password_enabled + FROM + aws_iam_credential_report + WHERE + password_enabled + AND NOT mfa_active; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Credential Report -Title: Find AWS IAM Users Without MFA and With Password Enabled + - IAM Credential Report +Title: Find AWS IAM Users Without MFA and With Password Enabled \ No newline at end of file diff --git a/queries/aws_iam_credential_report_6.yaml b/queries/aws_iam_credential_report_6.yaml old mode 100755 new mode 100644 index 82268bae3..9782ca9e8 --- a/queries/aws_iam_credential_report_6.yaml +++ b/queries/aws_iam_credential_report_6.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive - overview of the AWS Identity and Access Management (IAM) users, their status, and - credential usage. +Description: Allows users to query AWS IAM Credential Reports, providing a comprehensive overview of the AWS Identity and Access Management (IAM) users, their status, and credential usage. ID: aws_iam_credential_report_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n user_name,\n mfa_active\nfrom\n aws_iam_credential_report\n\ - where\n user_name = '';" + QueryToExecute: | + SELECT + user_name, + mfa_active + FROM + aws_iam_credential_report + WHERE + user_name = ''; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Credential Report -Title: List all AWS IAM users and their credential status + - IAM Credential Report +Title: List all AWS IAM users and their credential status \ No newline at end of file diff --git a/queries/aws_iam_group_1.yaml b/queries/aws_iam_group_1.yaml old mode 100755 new mode 100644 index 36e664585..61e64176d --- a/queries/aws_iam_group_1.yaml +++ b/queries/aws_iam_group_1.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS IAM Group data such as group name, path, and - ARN. This table provides information about IAM groups within AWS Identity and Access - Management (IAM). +Description: Allows users to query AWS IAM Group data such as group name, path, and ARN. This table provides information about IAM groups within AWS Identity and Access Management (IAM). ID: aws_iam_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as group_name,\n iam_user ->> 'UserName' as user_name,\n\ - \ iam_user ->> 'UserId' as user_id,\n iam_user ->> 'PermissionsBoundary' as\ - \ permission_boundary,\n iam_user ->> 'PasswordLastUsed' as password_last_used,\n\ - \ iam_user ->> 'CreateDate' as user_create_date\nfrom\n aws_iam_group\n cross\ - \ join jsonb_array_elements(users) as iam_user;" + QueryToExecute: | + SELECT + name AS group_name, + iam_user ->> 'UserName' AS user_name, + iam_user ->> 'UserId' AS user_id, + iam_user ->> 'PermissionsBoundary' AS permission_boundary, + iam_user ->> 'PasswordLastUsed' AS password_last_used, + iam_user ->> 'CreateDate' AS user_create_date + FROM + aws_iam_group + CROSS JOIN + jsonb_array_elements(users) AS iam_user; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM Group Data using SQL Query + - Identity and Access Management +Title: Find AWS IAM Group Data using SQL Query \ No newline at end of file diff --git a/queries/aws_iam_group_2.yaml b/queries/aws_iam_group_2.yaml old mode 100755 new mode 100644 index 2e0542f08..8c33302b6 --- a/queries/aws_iam_group_2.yaml +++ b/queries/aws_iam_group_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS IAM Group data such as group name, path, and - ARN. This table provides information about IAM groups within AWS Identity and Access - Management (IAM). +Description: Allows users to query AWS IAM Group data such as group name, path, and ARN. This table provides information about IAM groups within AWS Identity and Access Management (IAM). ID: aws_iam_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as group_name,\n iam_user ->> 'UserName' as user_name,\n\ - \ split_part(attachments, '/', 2) as attached_policies\nfrom\n aws_iam_group\n\ - \ cross join jsonb_array_elements(users) as iam_user,\n jsonb_array_elements_text(attached_policy_arns)\ - \ as attachments\nwhere\n split_part(attachments, '/', 2) = 'AdministratorAccess';" + QueryToExecute: | + SELECT + name AS group_name, + iam_user ->> 'UserName' AS user_name, + SPLIT_PART(attachments, '/', 2) AS attached_policies + FROM + aws_iam_group + CROSS JOIN jsonb_array_elements(users) AS iam_user, + jsonb_array_elements_text(attached_policy_arns) AS attachments + WHERE + SPLIT_PART(attachments, '/', 2) = 'AdministratorAccess'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: 'Find AWS IAM Group Data: Name, Path, and ARN' + - Identity and Access Management +Title: 'Find AWS IAM Group Data: Name, Path, and ARN' \ No newline at end of file diff --git a/queries/aws_iam_group_3.yaml b/queries/aws_iam_group_3.yaml old mode 100755 new mode 100644 index 7d447c93d..877c4970f --- a/queries/aws_iam_group_3.yaml +++ b/queries/aws_iam_group_3.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS IAM Group data such as group name, path, and - ARN. This table provides information about IAM groups within AWS Identity and Access - Management (IAM). +Description: Allows users to query AWS IAM Group data such as group name, path, and ARN. This table provides information about IAM groups within AWS Identity and Access Management (IAM). ID: aws_iam_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as group_name,\n split_part(attachments, '/', 2)\ - \ as attached_policies\nfrom\n aws_iam_group\n cross join jsonb_array_elements_text(attached_policy_arns)\ - \ as attachments;" + QueryToExecute: | + SELECT + name AS group_name, + SPLIT_PART(attachments, '/', 2) AS attached_policies + FROM + aws_iam_group + CROSS JOIN + jsonb_array_elements_text(attached_policy_arns) AS attachments; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Group details with their attached policies + - IAM +Title: Find all AWS IAM Group details with their attached policies \ No newline at end of file diff --git a/queries/aws_iam_group_4.yaml b/queries/aws_iam_group_4.yaml old mode 100755 new mode 100644 index 8bb0f9b4c..b89658b9a --- a/queries/aws_iam_group_4.yaml +++ b/queries/aws_iam_group_4.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS IAM Group data such as group name, path, and - ARN. This table provides information about IAM groups within AWS Identity and Access - Management (IAM). +Description: Allows users to query AWS IAM Group data such as group name, path, and ARN. This table provides information about IAM groups within AWS Identity and Access Management (IAM). ID: aws_iam_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as group_name,\n inline_policies\nfrom\n aws_iam_group\n\ - where \n inline_policies is not null;" + QueryToExecute: | + SELECT + name AS group_name, + inline_policies + FROM + aws_iam_group + WHERE + inline_policies IS NOT NULL; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Group information like name and path + - IAM +Title: Find all AWS IAM Group information like name and path \ No newline at end of file diff --git a/queries/aws_iam_open_id_connect_provider_1.yaml b/queries/aws_iam_open_id_connect_provider_1.yaml old mode 100755 new mode 100644 index 1bfc83499..9233cce39 --- a/queries/aws_iam_open_id_connect_provider_1.yaml +++ b/queries/aws_iam_open_id_connect_provider_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details - about the OpenID Connect (OIDC) identity providers in their AWS account. +Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details about the OpenID Connect (OIDC) identity providers in their AWS account. ID: aws_iam_open_id_connect_provider_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n client_id_list,\n thumbprint_list,\n\ - \ url,\n account_id\nfrom\n aws_iam_open_id_connect_provider;" + QueryToExecute: | + SELECT + arn, + create_date, + client_id_list, + thumbprint_list, + url, + account_id + FROM + aws_iam_open_id_connect_provider; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM OpenID Connect Providers and Details + - IAM +Title: Find AWS IAM OpenID Connect Providers and Details \ No newline at end of file diff --git a/queries/aws_iam_open_id_connect_provider_2.yaml b/queries/aws_iam_open_id_connect_provider_2.yaml old mode 100755 new mode 100644 index 57921b527..217d0b868 --- a/queries/aws_iam_open_id_connect_provider_2.yaml +++ b/queries/aws_iam_open_id_connect_provider_2.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details - about the OpenID Connect (OIDC) identity providers in their AWS account. +Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details about the OpenID Connect (OIDC) identity providers in their AWS account. ID: aws_iam_open_id_connect_provider_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n client_id_list,\n thumbprint_list,\n\ - \ url,\n account_id\nfrom\n aws_iam_open_id_connect_provider\nwhere\n create_date\ - \ <= (current_date - interval '90' day)\norder by\n create_date;" + QueryToExecute: | + SELECT + arn, + create_date, + client_id_list, + thumbprint_list, + url, + account_id + FROM + aws_iam_open_id_connect_provider + WHERE + create_date <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + create_date; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List all AWS IAM OpenID Connect Providers in Account + - IAM +Title: List all AWS IAM OpenID Connect Providers in Account \ No newline at end of file diff --git a/queries/aws_iam_open_id_connect_provider_3.yaml b/queries/aws_iam_open_id_connect_provider_3.yaml old mode 100755 new mode 100644 index f5902233f..db3777c11 --- a/queries/aws_iam_open_id_connect_provider_3.yaml +++ b/queries/aws_iam_open_id_connect_provider_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details - about the OpenID Connect (OIDC) identity providers in their AWS account. +Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details about the OpenID Connect (OIDC) identity providers in their AWS account. ID: aws_iam_open_id_connect_provider_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n client_id_list,\n thumbprint_list,\n\ - \ tags,\n url,\n account_id\nfrom\n aws_iam_open_id_connect_provider\nwhere\n\ - \ tags ->> 'Environment' = 'Production';" + QueryToExecute: | + SELECT + arn, + create_date, + client_id_list, + thumbprint_list, + tags, + url, + account_id + FROM + aws_iam_open_id_connect_provider + WHERE + tags ->> 'Environment' = 'Production'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM OpenID Connect Providers and Retrieve Details + - IAM +Title: Find AWS IAM OpenID Connect Providers and Retrieve Details \ No newline at end of file diff --git a/queries/aws_iam_open_id_connect_provider_4.yaml b/queries/aws_iam_open_id_connect_provider_4.yaml old mode 100755 new mode 100644 index c8e30ddd3..bc7834caf --- a/queries/aws_iam_open_id_connect_provider_4.yaml +++ b/queries/aws_iam_open_id_connect_provider_4.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details - about the OpenID Connect (OIDC) identity providers in their AWS account. +Description: Allows users to query AWS IAM OpenID Connect Providers and retrieve details about the OpenID Connect (OIDC) identity providers in their AWS account. ID: aws_iam_open_id_connect_provider_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n client_id_list,\n thumbprint_list,\n\ - \ tags,\n url,\n account_id\nfrom\n aws_iam_open_id_connect_provider\nwhere\n\ - \ client_id_list @> '[\"sts.amazonaws.com\"]'::jsonb\n and not thumbprint_list\ - \ @> '[\"1c58a3a8518e8759bf075b76b750d4f2df264fcd\", \"6938fd4d98bab03faadb97b34396831e3780aea1\"\ - ]'::jsonb" + QueryToExecute: | + SELECT + arn, + create_date, + client_id_list, + thumbprint_list, + tags, + url, + account_id + FROM + aws_iam_open_id_connect_provider + WHERE + client_id_list @> '["sts.amazonaws.com"]'::jsonb + AND NOT thumbprint_list @> '["1c58a3a8518e8759bf075b76b750d4f2df264fcd", "6938fd4d98bab03faadb97b34396831e3780aea1"]'::jsonb Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws -Title: Find all AWS IAM OpenID Connect Providers with Details + - aws +Title: Find all AWS IAM OpenID Connect Providers with Details \ No newline at end of file diff --git a/queries/aws_iam_policy_1.yaml b/queries/aws_iam_policy_1.yaml old mode 100755 new mode 100644 index 338bd0134..4c0af81ed --- a/queries/aws_iam_policy_1.yaml +++ b/queries/aws_iam_policy_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn\nfrom\n aws_iam_policy\nwhere\n not is_aws_managed;" + QueryToExecute: | + SELECT + name, + arn + FROM + aws_iam_policy + WHERE + NOT is_aws_managed; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Policies with Detailed Information + - IAM +Title: Find all AWS IAM Policies with Detailed Information \ No newline at end of file diff --git a/queries/aws_iam_policy_2.yaml b/queries/aws_iam_policy_2.yaml old mode 100755 new mode 100644 index 5b1e8f5df..1dc65f210 --- a/queries/aws_iam_policy_2.yaml +++ b/queries/aws_iam_policy_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn\nfrom\n aws_iam_policy\nwhere\n not is_aws_managed\n\ - \ and path = '/turbot/';" + QueryToExecute: | + SELECT + name, + arn + FROM + aws_iam_policy + WHERE + NOT is_aws_managed + AND path = '/turbot/'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Policy -Title: Find all AWS IAM Policies and associated metadata + - IAM Policy +Title: Find all AWS IAM Policies and associated metadata \ No newline at end of file diff --git a/queries/aws_iam_policy_3.yaml b/queries/aws_iam_policy_3.yaml old mode 100755 new mode 100644 index 23413f0a2..091c0c939 --- a/queries/aws_iam_policy_3.yaml +++ b/queries/aws_iam_policy_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n permissions_boundary_usage_count\nfrom\n\ - \ aws_iam_policy\nwhere\n is_attached;" + QueryToExecute: | + SELECT + name, + arn, + permissions_boundary_usage_count + FROM + aws_iam_policy + WHERE + is_attached; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List all AWS IAM Policies and their Details + - IAM +Title: List all AWS IAM Policies and their Details \ No newline at end of file diff --git a/queries/aws_iam_policy_4.yaml b/queries/aws_iam_policy_4.yaml old mode 100755 new mode 100644 index ec63f4402..e45b30484 --- a/queries/aws_iam_policy_4.yaml +++ b/queries/aws_iam_policy_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n attachment_count,\n permissions_boundary_usage_count\n\ - from\n aws_iam_policy\nwhere\n not is_aws_managed\n and not is_attached\n \ - \ and permissions_boundary_usage_count = 0;" + QueryToExecute: | + SELECT + name, + attachment_count, + permissions_boundary_usage_count + FROM + aws_iam_policy + WHERE + NOT is_aws_managed + AND NOT is_attached + AND permissions_boundary_usage_count = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List all AWS IAM Policies with Detailed Information + - IAM +Title: List all AWS IAM Policies with Detailed Information \ No newline at end of file diff --git a/queries/aws_iam_policy_5.yaml b/queries/aws_iam_policy_5.yaml old mode 100755 new mode 100644 index f6c8e12fb..767587462 --- a/queries/aws_iam_policy_5.yaml +++ b/queries/aws_iam_policy_5.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n action,\n s ->> 'Effect' as effect\n\ - from\n aws_iam_policy,\n jsonb_array_elements(policy_std -> 'Statement') as\ - \ s,\n jsonb_array_elements_text(s -> 'Action') as action\nwhere\n action in\ - \ ('*', '*:*')\n and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + name, + arn, + action, + s ->> 'Effect' AS effect + FROM + aws_iam_policy, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Action') AS action + WHERE + action IN ('*', '*:*') + AND s ->> 'Effect' = 'Allow'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Policies with permissions and metadata + - IAM +Title: Find all AWS IAM Policies with permissions and metadata \ No newline at end of file diff --git a/queries/aws_iam_policy_6.yaml b/queries/aws_iam_policy_6.yaml old mode 100755 new mode 100644 index a30f8c47c..e474f4b0b --- a/queries/aws_iam_policy_6.yaml +++ b/queries/aws_iam_policy_6.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n action,\n s ->> 'Effect' as effect\n\ - from\n aws_iam_policy,\n jsonb_array_elements(policy_std -> 'Statement') as\ - \ s,\n jsonb_array_elements_text(s -> 'Action') as action\nwhere\n s ->> 'Effect'\ - \ = 'Allow'\n and (\n action = '*'\n or action like '%:*'\n );" + QueryToExecute: | + SELECT + name, + arn, + action, + s ->> 'Effect' AS effect + FROM + aws_iam_policy, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Action') AS action + WHERE + s ->> 'Effect' = 'Allow' + AND ( + action = '*' + OR action LIKE '%:*' + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Policies with Permissions and Metadata + - IAM +Title: Find all AWS IAM Policies with Permissions and Metadata \ No newline at end of file diff --git a/queries/aws_iam_policy_7.yaml b/queries/aws_iam_policy_7.yaml old mode 100755 new mode 100644 index 4d311ce41..0f65d0759 --- a/queries/aws_iam_policy_7.yaml +++ b/queries/aws_iam_policy_7.yaml @@ -1,26 +1,35 @@ -Description: Allows users to query AWS IAM Policies, providing detailed information - about each policy, including permissions, attachment, and associated metadata. +Description: Allows users to query AWS IAM Policies, providing detailed information about each policy, including permissions, attachment, and associated metadata. ID: aws_iam_policy_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.action,\n a.access_level,\n a.description\nfrom\n\ - \ aws_iam_policy p,\n jsonb_array_elements(p.policy_std -> 'Statement') as stmt,\n\ - \ jsonb_array_elements_text(stmt -> 'Action') as action_glob,\n glob(action_glob)\ - \ as action_regex\n join aws_iam_action a ON a.action LIKE action_regex\nwhere\n\ - \ p.name = 'AmazonEC2ReadOnlyAccess'\n and stmt ->> 'Effect' = 'Allow'\norder\ - \ by\n a.action;" + QueryToExecute: | + SELECT + a.action, + a.access_level, + a.description + FROM + aws_iam_policy p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + p.name = 'AmazonEC2ReadOnlyAccess' + AND stmt ->> 'Effect' = 'Allow' + ORDER BY + a.action; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Policies with Detailed Information + - IAM +Title: Find AWS IAM Policies with Detailed Information \ No newline at end of file diff --git a/queries/aws_iam_policy_attachment_1.yaml b/queries/aws_iam_policy_attachment_1.yaml old mode 100755 new mode 100644 index 456945069..682b75da9 --- a/queries/aws_iam_policy_attachment_1.yaml +++ b/queries/aws_iam_policy_attachment_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query IAM Policy Attachments in AWS to gather information - about the relationship between IAM policies and their associated entities (users, - groups, and roles). +Description: Allows users to query IAM Policy Attachments in AWS to gather information about the relationship between IAM policies and their associated entities (users, groups, and roles). ID: aws_iam_policy_attachment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_arn,\n is_attached,\n policy_groups\nfrom\n\ - \ aws_iam_policy_attachment\nwhere\n is_attached;" + QueryToExecute: | + SELECT + policy_arn, + is_attached, + policy_groups + FROM + aws_iam_policy_attachment + WHERE + is_attached; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Policy Attachments and Associations + - IAM +Title: Find all AWS IAM Policy Attachments and Associations \ No newline at end of file diff --git a/queries/aws_iam_policy_attachment_2.yaml b/queries/aws_iam_policy_attachment_2.yaml old mode 100755 new mode 100644 index d5aebff25..eb066bb94 --- a/queries/aws_iam_policy_attachment_2.yaml +++ b/queries/aws_iam_policy_attachment_2.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query IAM Policy Attachments in AWS to gather information - about the relationship between IAM policies and their associated entities (users, - groups, and roles). +Description: Allows users to query IAM Policy Attachments in AWS to gather information about the relationship between IAM policies and their associated entities (users, groups, and roles). ID: aws_iam_policy_attachment_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n policy_arn,\n is_attached,\n policy_users\nfrom\n \ - \ aws_iam_policy_attachment\nwhere\n is_attached;" + QueryToExecute: | + SELECT + policy_arn, + is_attached, + policy_users + FROM + aws_iam_policy_attachment + WHERE + is_attached; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find IAM Policy Attachments in AWS + - IAM +Title: Find IAM Policy Attachments in AWS \ No newline at end of file diff --git a/queries/aws_iam_policy_attachment_3.yaml b/queries/aws_iam_policy_attachment_3.yaml old mode 100755 new mode 100644 index b10958805..c5cdb0157 --- a/queries/aws_iam_policy_attachment_3.yaml +++ b/queries/aws_iam_policy_attachment_3.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query IAM Policy Attachments in AWS to gather information - about the relationship between IAM policies and their associated entities (users, - groups, and roles). +Description: Allows users to query IAM Policy Attachments in AWS to gather information about the relationship between IAM policies and their associated entities (users, groups, and roles). ID: aws_iam_policy_attachment_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as policy_name, \n policy_arn, \n jsonb_pretty(policy_users)\ - \ as policy_users\nfrom\n aws_iam_policy p\n left join aws_iam_policy_attachment\ - \ a on p.arn = a.policy_arn \nwhere\n name = 'AdministratorAccess' and a.is_attached;" + QueryToExecute: | + SELECT + name AS policy_name, + policy_arn, + jsonb_pretty(policy_users) AS policy_users + FROM + aws_iam_policy p + LEFT JOIN + aws_iam_policy_attachment a + ON p.arn = a.policy_arn + WHERE + name = 'AdministratorAccess' + AND a.is_attached; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Policy -Title: Find Relationships Between AWS IAM Policies and Entities + - IAM Policy +Title: Find Relationships Between AWS IAM Policies and Entities \ No newline at end of file diff --git a/queries/aws_iam_policy_simulator_1.yaml b/queries/aws_iam_policy_simulator_1.yaml old mode 100755 new mode 100644 index da28644af..8fb25e47e --- a/queries/aws_iam_policy_simulator_1.yaml +++ b/queries/aws_iam_policy_simulator_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query IAM Policy Simulator for evaluating the effects - of IAM access control policies. It provides information such as evaluation results, - matching resources, and involved actions. +Description: Allows users to query IAM Policy Simulator for evaluating the effects of IAM access control policies. It provides information such as evaluation results, matching resources, and involved actions. ID: aws_iam_policy_simulator_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n decision\nfrom\n aws_iam_policy_simulator\nwhere\n \ - \ action = 's3:DeleteBucket'\n and resource_arn = '*'\n and principal_arn =\ - \ 'arn:aws:iam::012345678901:user/bob';" + QueryToExecute: | + SELECT + decision + FROM + aws_iam_policy_simulator + WHERE + action = 's3:DeleteBucket' + AND resource_arn = '*' + AND principal_arn = 'arn:aws:iam::012345678901:user/bob'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Policy Simulator -Title: Find IAM Policy Simulator Results for Access Control Evaluation + - IAM Policy Simulator +Title: Find IAM Policy Simulator Results for Access Control Evaluation \ No newline at end of file diff --git a/queries/aws_iam_policy_simulator_2.yaml b/queries/aws_iam_policy_simulator_2.yaml old mode 100755 new mode 100644 index ce5cef335..a62cbf83e --- a/queries/aws_iam_policy_simulator_2.yaml +++ b/queries/aws_iam_policy_simulator_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query IAM Policy Simulator for evaluating the effects - of IAM access control policies. It provides information such as evaluation results, - matching resources, and involved actions. +Description: Allows users to query IAM Policy Simulator for evaluating the effects of IAM access control policies. It provides information such as evaluation results, matching resources, and involved actions. ID: aws_iam_policy_simulator_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n decision,\n jsonb_pretty(matched_statements)\nfrom\n\ - \ aws_iam_policy_simulator\nwhere\n action = 'ec2:terminateinstances'\n and\ - \ resource_arn = '*'\n and principal_arn = 'arn:aws:iam::012345678901:user/bob';" + QueryToExecute: | + SELECT + decision, + jsonb_pretty(matched_statements) + FROM + aws_iam_policy_simulator + WHERE + action = 'ec2:terminateinstances' + AND resource_arn = '*' + AND principal_arn = 'arn:aws:iam::012345678901:user/bob'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Policy Simulator -Title: Find AWS IAM Policy Simulator Evaluation Results for Control Policies + - IAM Policy Simulator +Title: Find AWS IAM Policy Simulator Evaluation Results for Control Policies \ No newline at end of file diff --git a/queries/aws_iam_policy_simulator_3.yaml b/queries/aws_iam_policy_simulator_3.yaml old mode 100755 new mode 100644 index a0c3b5de2..391c8071b --- a/queries/aws_iam_policy_simulator_3.yaml +++ b/queries/aws_iam_policy_simulator_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query IAM Policy Simulator for evaluating the effects - of IAM access control policies. It provides information such as evaluation results, - matching resources, and involved actions. +Description: Allows users to query IAM Policy Simulator for evaluating the effects of IAM access control policies. It provides information such as evaluation results, matching resources, and involved actions. ID: aws_iam_policy_simulator_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n u.name,\n decision\nfrom\n aws_iam_policy_simulator\ - \ p,\n aws_iam_user u\nwhere\n action = 'sts:AssumeRole'\n and resource_arn\ - \ = '*'\n and p.principal_arn = u.arn;" + QueryToExecute: | + SELECT + u.name, + decision + FROM + aws_iam_policy_simulator p, + aws_iam_user u + WHERE + action = 'sts:AssumeRole' + AND resource_arn = '*' + AND p.principal_arn = u.arn; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Policy Simulator -Title: List all AWS IAM Policy Simulator evaluation results + - IAM Policy Simulator +Title: List all AWS IAM Policy Simulator evaluation results \ No newline at end of file diff --git a/queries/aws_iam_role_1.yaml b/queries/aws_iam_role_1.yaml old mode 100755 new mode 100644 index a418e7e89..f06904002 --- a/queries/aws_iam_role_1.yaml +++ b/queries/aws_iam_role_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n create_date\nfrom\n aws_iam_role\nwhere\n \ - \ inline_policies is not null;" + QueryToExecute: | + SELECT + name, + create_date + FROM + aws_iam_role + WHERE + inline_policies IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find IAM Roles with Inline Policies in AWS + - IAM +Title: Find IAM Roles with Inline Policies in AWS \ No newline at end of file diff --git a/queries/aws_iam_role_10.yaml b/queries/aws_iam_role_10.yaml old mode 100755 new mode 100644 index 2d21f15d0..032332462 --- a/queries/aws_iam_role_10.yaml +++ b/queries/aws_iam_role_10.yaml @@ -1,29 +1,40 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n iam.arn as resource,\n iam.description,\n iam.assume_role_policy_std,\n\ - \ case\n when pstatement -> 'Condition' -> 'StringLike' -> 'token.actions.githubusercontent.com:sub'\ - \ is not null\n or pstatement -> 'Condition' -> 'StringEquals' -> 'token.actions.githubusercontent.com:sub'\ - \ is not null then 'ok'\n else 'alarm'\n end as status,\n case\n when\ - \ pstatement -> 'Condition' -> 'StringLike' -> 'token.actions.githubusercontent.com:sub'\ - \ is not null\n or pstatement -> 'Condition' -> 'StringEquals' -> 'token.actions.githubusercontent.com:sub'\ - \ is not null then iam.arn || ' Condition Check Exists'\n else iam.arn || '\ - \ Missing Condition Check'\n end as reason\nfrom\n aws_iam_role as iam,\n jsonb_array_elements(iam.assume_role_policy_std\ - \ -> 'Statement') as pstatement\nwhere\n pstatement -> 'Action' ?& array [ 'sts:assumerolewithwebidentity'\ - \ ]\n and (pstatement -> 'Principal' -> 'Federated') :: text like '%token.actions.githubusercontent.com%'\n\ - order by\n status asc" + QueryToExecute: | + SELECT + iam.arn AS resource, + iam.description, + iam.assume_role_policy_std, + CASE + WHEN pstatement -> 'Condition' -> 'StringLike' -> 'token.actions.githubusercontent.com:sub' IS NOT NULL + OR pstatement -> 'Condition' -> 'StringEquals' -> 'token.actions.githubusercontent.com:sub' IS NOT NULL THEN 'ok' + ELSE 'alarm' + END AS status, + CASE + WHEN pstatement -> 'Condition' -> 'StringLike' -> 'token.actions.githubusercontent.com:sub' IS NOT NULL + OR pstatement -> 'Condition' -> 'StringEquals' -> 'token.actions.githubusercontent.com:sub' IS NOT NULL THEN iam.arn || ' Condition Check Exists' + ELSE iam.arn || ' Missing Condition Check' + END AS reason + FROM + aws_iam_role AS iam, + jsonb_array_elements(iam.assume_role_policy_std -> 'Statement') AS pstatement + WHERE + pstatement -> 'Action' ?& ARRAY [ 'sts:assumerolewithwebidentity' ] + AND (pstatement -> 'Principal' -> 'Federated')::TEXT LIKE '%token.actions.githubusercontent.com%' + ORDER BY + status ASC Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM Roles -Title: Find all AWS Identity and Access Management (IAM) Roles + - IAM Roles +Title: Find all AWS Identity and Access Management (IAM) Roles \ No newline at end of file diff --git a/queries/aws_iam_role_2.yaml b/queries/aws_iam_role_2.yaml old mode 100755 new mode 100644 index fb7ab949f..13d367b0b --- a/queries/aws_iam_role_2.yaml +++ b/queries/aws_iam_role_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n split_part(policy, '/', 3) as\ - \ attached_policy\nfrom\n aws_iam_role\n cross join jsonb_array_elements_text(attached_policy_arns)\ - \ as policy;" + QueryToExecute: | + SELECT + name, + description, + SPLIT_PART(policy, '/', 3) AS attached_policy + FROM + aws_iam_role + CROSS JOIN jsonb_array_elements_text(attached_policy_arns) AS policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM Roles' Permissions, Policies & Metadata + - Identity and Access Management +Title: Find AWS IAM Roles' Permissions, Policies & Metadata \ No newline at end of file diff --git a/queries/aws_iam_role_3.yaml b/queries/aws_iam_role_3.yaml old mode 100755 new mode 100644 index af8d92c3e..6b05430ac --- a/queries/aws_iam_role_3.yaml +++ b/queries/aws_iam_role_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n permissions_boundary_arn,\n\ - \ permissions_boundary_type\nfrom\n aws_iam_role;" + QueryToExecute: | + SELECT + name, + description, + permissions_boundary_arn, + permissions_boundary_type + FROM + aws_iam_role; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Roles and Their Associated Metadata + - IAM +Title: Find AWS IAM Roles and Their Associated Metadata \ No newline at end of file diff --git a/queries/aws_iam_role_4.yaml b/queries/aws_iam_role_4.yaml old mode 100755 new mode 100644 index 9cb197ae2..a2f63b5cd --- a/queries/aws_iam_role_4.yaml +++ b/queries/aws_iam_role_4.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name as role_name,\n p.name as policy_name\nfrom\n\ - \ aws_iam_role as r,\n jsonb_array_elements_text(r.attached_policy_arns) as\ - \ policy_arn,\n aws_iam_policy as p,\n jsonb_array_elements(p.policy_std ->\ - \ 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action\n\ - where\n policy_arn = p.arn\n and stmt ->> 'Effect' = 'Allow'\n and action =\ - \ '*'\norder by\n r.name;" + QueryToExecute: | + SELECT + r.name AS role_name, + p.name AS policy_name + FROM + aws_iam_role AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS policy_arn, + aws_iam_policy AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action + WHERE + policy_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND action = '*' + ORDER BY + r.name; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Role Permissions and Trust Policies + - IAM +Title: Find all AWS IAM Role Permissions and Trust Policies \ No newline at end of file diff --git a/queries/aws_iam_role_5.yaml b/queries/aws_iam_role_5.yaml old mode 100755 new mode 100644 index bbc0db0be..9c70ecdd2 --- a/queries/aws_iam_role_5.yaml +++ b/queries/aws_iam_role_5.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name as role_name,\n p.name as policy_name,\n stmt\ - \ ->> 'Sid' as statement,\n action\nfrom\n aws_iam_role as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as policy_arn,\n aws_iam_policy as p,\n jsonb_array_elements(p.policy_std\ - \ -> 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action\n\ - where\n r.name = 'owner'\n and policy_arn = p.arn\n and (\n action like\ - \ '%*%'\n or action like '%?%'\n );" + QueryToExecute: | + SELECT + r.name AS role_name, + p.name AS policy_name, + stmt ->> 'Sid' AS statement, + action + FROM + aws_iam_role AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS policy_arn, + aws_iam_policy AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action + WHERE + r.name = 'owner' + AND policy_arn = p.arn + AND ( + action LIKE '%*%' + OR action LIKE '%?%' + ); Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM Roles and Policies Permissions Metadata + - Identity and Access Management +Title: Find AWS IAM Roles and Policies Permissions Metadata \ No newline at end of file diff --git a/queries/aws_iam_role_6.yaml b/queries/aws_iam_role_6.yaml old mode 100755 new mode 100644 index 57e40aea6..59c03f4d4 --- a/queries/aws_iam_role_6.yaml +++ b/queries/aws_iam_role_6.yaml @@ -1,28 +1,40 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n a.action,\n a.access_level,\n a.description\n\ - from\n aws_iam_role as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as pol_arn,\n aws_iam_policy as p,\n jsonb_array_elements(p.policy_std ->\ - \ 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action_glob,\n\ - \ glob(action_glob) as action_regex\n join aws_iam_action as a on a.action like\ - \ action_regex\nwhere\n pol_arn = p.arn\n and stmt ->> 'Effect' = 'Allow'\n\ - \ and r.name = 'AWSServiceRoleForRDS'\n and access_level not in ('List', 'Read')\n\ - order by\n action;" + QueryToExecute: | + SELECT + r.name, + a.action, + a.access_level, + a.description + FROM + aws_iam_role AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS pol_arn, + aws_iam_policy AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action AS a ON a.action LIKE action_regex + WHERE + pol_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND r.name = 'AWSServiceRoleForRDS' + AND access_level NOT IN ('List', 'Read') + ORDER BY + action; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find All AWS IAM Roles, Permissions, Trust Policies + - IAM +Title: Find All AWS IAM Roles, Permissions, Trust Policies \ No newline at end of file diff --git a/queries/aws_iam_role_7.yaml b/queries/aws_iam_role_7.yaml old mode 100755 new mode 100644 index 41e9ecf8d..406e60cbd --- a/queries/aws_iam_role_7.yaml +++ b/queries/aws_iam_role_7.yaml @@ -1,36 +1,81 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with roles as (\n select\n name,\n attached_policy_arns\n\ - \ from\n aws_iam_role\n where\n name in ('AWSServiceRoleForSSO', 'AWSServiceRoleForRDS')\n\ - ),\npolicies as (\n select\n name,\n arn,\n policy_std\n from\n \ - \ aws_iam_policy\n),\nrole1_permissions as (\n select\n r.name,\n a.action,\n\ - \ a.access_level,\n a.description\n from\n roles as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as pol_arn,\n policies as p,\n jsonb_array_elements(p.policy_std -> 'Statement')\ - \ as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action_glob,\n\ - \ glob (action_glob) as action_regex\n join aws_iam_action a on a.action\ - \ like action_regex\n where\n pol_arn = p.arn\n and stmt ->> 'Effect' =\ - \ 'Allow'\n and r.name = 'AWSServiceRoleForSSO'\n),\nrole2_permissions as (\n\ - \ select\n r.name,\n a.action,\n a.access_level,\n a.description\n\ - \ from\n roles as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as pol_arn,\n policies as p,\n jsonb_array_elements(p.policy_std -> 'Statement')\ - \ as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action_glob,\n\ - \ glob (action_glob) as action_regex\n join aws_iam_action a on a.action\ - \ like action_regex\n where\n pol_arn = p.arn\n and stmt ->> 'Effect' =\ - \ 'Allow'\n and r.name = 'AWSServiceRoleForRDS'\n)\nselect\n *\nfrom\n role2_permissions\n\ - where\n action not in ( select action from role1_permissions)\norder by\n action;" + QueryToExecute: | + WITH roles AS ( + SELECT + name, + attached_policy_arns + FROM + aws_iam_role + WHERE + name IN ('AWSServiceRoleForSSO', 'AWSServiceRoleForRDS') + ), + policies AS ( + SELECT + name, + arn, + policy_std + FROM + aws_iam_policy + ), + role1_permissions AS ( + SELECT + r.name, + a.action, + a.access_level, + a.description + FROM + roles AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS pol_arn, + policies AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + pol_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND r.name = 'AWSServiceRoleForSSO' + ), + role2_permissions AS ( + SELECT + r.name, + a.action, + a.access_level, + a.description + FROM + roles AS r, + jsonb_array_elements_text(r.attached_policy_arns) AS pol_arn, + policies AS p, + jsonb_array_elements(p.policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Action') AS action_glob, + glob(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + pol_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND r.name = 'AWSServiceRoleForRDS' + ) + SELECT + * + FROM + role2_permissions + WHERE + action NOT IN (SELECT action FROM role1_permissions) + ORDER BY + action; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find All AWS IAM Roles Permissions and Trust Policies + - IAM +Title: Find All AWS IAM Roles Permissions and Trust Policies \ No newline at end of file diff --git a/queries/aws_iam_role_8.yaml b/queries/aws_iam_role_8.yaml old mode 100755 new mode 100644 index 57b2c5e00..7b918d22c --- a/queries/aws_iam_role_8.yaml +++ b/queries/aws_iam_role_8.yaml @@ -1,32 +1,35 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n maintenance.name,\n admin.name,\n jsonb_pretty(maintenance_stmt),\n\ - \ jsonb_pretty(admin_stmt)\nfrom\n -- use the account to get the organization_id\n\ - \ aws_account as a,\n -- check any role as the \"maintenance-role\"\n aws_iam_role\ - \ as maintenance,\n -- Combine via join with any role as the \"admin-role\"\n\ - \ aws_iam_role as admin,\n jsonb_array_elements(maintenance.assume_role_policy_std\ - \ -> 'Statement') as maintenance_stmt,\n jsonb_array_elements(admin.assume_role_policy_std\ - \ -> 'Statement') as admin_stmt\nwhere\n -- maintenance role can be assumed by\ - \ any AWS principal\n maintenance_stmt -> 'Principal' -> 'AWS' ? '*'\n -- maintenance\ - \ role principal must be in same account\n and maintenance_stmt -> 'Condition'\ - \ -> 'StringEquals' -> 'aws:principalorgid' ? a.organization_id\n -- admin role\ - \ specifically allow maintenance role\n and admin_stmt -> 'Principal' -> 'AWS'\ - \ ? maintenance.arn;" + QueryToExecute: | + SELECT + maintenance.name, + admin.name, + JSONB_PRETTY(maintenance_stmt), + JSONB_PRETTY(admin_stmt) + FROM + aws_account AS a, + aws_iam_role AS maintenance, + aws_iam_role AS admin, + JSONB_ARRAY_ELEMENTS(maintenance.assume_role_policy_std -> 'Statement') AS maintenance_stmt, + JSONB_ARRAY_ELEMENTS(admin.assume_role_policy_std -> 'Statement') AS admin_stmt + WHERE + maintenance_stmt -> 'Principal' -> 'AWS' ? '*' + AND maintenance_stmt -> 'Condition' -> 'StringEquals' -> 'aws:principalorgid' ? a.organization_id + AND admin_stmt -> 'Principal' -> 'AWS' ? maintenance.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find IAM Roles, Insights into Permissions and Policies in AWS + - IAM +Title: Find IAM Roles, Insights into Permissions and Policies in AWS \ No newline at end of file diff --git a/queries/aws_iam_role_9.yaml b/queries/aws_iam_role_9.yaml old mode 100755 new mode 100644 index 56261ebe2..de2313084 --- a/queries/aws_iam_role_9.yaml +++ b/queries/aws_iam_role_9.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query IAM Roles to gain insights into their permissions, - trust policies, and associated metadata. +Description: Allows users to query IAM Roles to gain insights into their permissions, trust policies, and associated metadata. ID: aws_iam_role_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n stmt\nfrom\n aws_iam_role as r,\n jsonb_array_elements(r.assume_role_policy_std\ - \ -> 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Principal' ->\ - \ 'AWS') as trust\nwhere\n trust = '*'\n or trust like 'arn:aws:iam::%:role/%'" + QueryToExecute: | + SELECT + r.name, + stmt + FROM + aws_iam_role AS r, + jsonb_array_elements(r.assume_role_policy_std -> 'Statement') AS stmt, + jsonb_array_elements_text(stmt -> 'Principal' -> 'AWS') AS trust + WHERE + trust = '*' + OR trust LIKE 'arn:aws:iam::%:role/%' Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Roles with Permissions and Trust Policies + - IAM +Title: Find all AWS IAM Roles with Permissions and Trust Policies \ No newline at end of file diff --git a/queries/aws_iam_saml_provider_1.yaml b/queries/aws_iam_saml_provider_1.yaml old mode 100755 new mode 100644 index 29c121394..00a1cbf58 --- a/queries/aws_iam_saml_provider_1.yaml +++ b/queries/aws_iam_saml_provider_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information - about each SAML provider within AWS Identity and Access Management (IAM). +Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information about each SAML provider within AWS Identity and Access Management (IAM). ID: aws_iam_saml_provider_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n valid_until,\n region,\n account_id\n\ - from\n aws_iam_saml_provider;" + QueryToExecute: | + SELECT + arn, + create_date, + valid_until, + region, + account_id + FROM + aws_iam_saml_provider; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management (IAM) -Title: Find AWS IAM SAML Providers with Details + - Identity and Access Management (IAM) +Title: Find AWS IAM SAML Providers with Details \ No newline at end of file diff --git a/queries/aws_iam_saml_provider_2.yaml b/queries/aws_iam_saml_provider_2.yaml old mode 100755 new mode 100644 index c83eb4fda..f97c69c2c --- a/queries/aws_iam_saml_provider_2.yaml +++ b/queries/aws_iam_saml_provider_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information - about each SAML provider within AWS Identity and Access Management (IAM). +Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information about each SAML provider within AWS Identity and Access Management (IAM). ID: aws_iam_saml_provider_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n valid_until,\n region,\n account_id\n\ - from\n aws_iam_saml_provider\nwhere\n create_date <= (current_date - interval\ - \ '90' day)\norder by\n create_date;" + QueryToExecute: | + SELECT + arn, + create_date, + valid_until, + region, + account_id + FROM + aws_iam_saml_provider + WHERE + create_date <= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + create_date; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find all AWS IAM SAML Providers and Details + - Identity and Access Management +Title: Find all AWS IAM SAML Providers and Details \ No newline at end of file diff --git a/queries/aws_iam_saml_provider_3.yaml b/queries/aws_iam_saml_provider_3.yaml old mode 100755 new mode 100644 index 028408d85..6aaa8422b --- a/queries/aws_iam_saml_provider_3.yaml +++ b/queries/aws_iam_saml_provider_3.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information - about each SAML provider within AWS Identity and Access Management (IAM). +Description: Allows users to query AWS IAM SAML Providers and retrieve detailed information about each SAML provider within AWS Identity and Access Management (IAM). ID: aws_iam_saml_provider_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n create_date,\n valid_until,\n region,\n account_id\n\ - from\n aws_iam_saml_provider\nwhere\n valid_until <= (current_date - interval\ - \ '30' day)\norder by\n valid_until;" + QueryToExecute: | + SELECT + arn, + create_date, + valid_until, + region, + account_id + FROM + aws_iam_saml_provider + WHERE + valid_until <= (CURRENT_DATE - INTERVAL '30' DAY) + ORDER BY + valid_until; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find AWS IAM SAML Providers expiring within 30 days + - Identity and Access Management +Title: Find AWS IAM SAML Providers expiring within 30 days \ No newline at end of file diff --git a/queries/aws_iam_server_certificate_1.yaml b/queries/aws_iam_server_certificate_1.yaml old mode 100755 new mode 100644 index bcd8db838..219b3cbbe --- a/queries/aws_iam_server_certificate_1.yaml +++ b/queries/aws_iam_server_certificate_1.yaml @@ -1,19 +1,26 @@ Description: Allows users to query AWS IAM Server Certificates ID: aws_iam_server_certificate_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n server_certificate_id,\n upload_date,\n\ - \ expiration\nfrom\n aws_iam_server_certificate;" + QueryToExecute: | + SELECT + name, + arn, + server_certificate_id, + upload_date, + expiration + FROM + aws_iam_server_certificate; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Server Certificates + - IAM +Title: Find AWS IAM Server Certificates \ No newline at end of file diff --git a/queries/aws_iam_server_certificate_2.yaml b/queries/aws_iam_server_certificate_2.yaml old mode 100755 new mode 100644 index 6033d3d7b..e74ecd163 --- a/queries/aws_iam_server_certificate_2.yaml +++ b/queries/aws_iam_server_certificate_2.yaml @@ -1,19 +1,26 @@ Description: Allows users to query AWS IAM Server Certificates ID: aws_iam_server_certificate_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n expiration\nfrom\n aws_iam_server_certificate\n\ - where\n expiration < now()::timestamp;" + QueryToExecute: | + SELECT + name, + arn, + expiration + FROM + aws_iam_server_certificate + WHERE + expiration < NOW()::timestamp; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Server Certificates with Expiry Info + - IAM +Title: Find AWS IAM Server Certificates with Expiry Info \ No newline at end of file diff --git a/queries/aws_iam_service_specific_credential_1.yaml b/queries/aws_iam_service_specific_credential_1.yaml old mode 100755 new mode 100644 index f468f953f..025502c35 --- a/queries/aws_iam_service_specific_credential_1.yaml +++ b/queries/aws_iam_service_specific_credential_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS IAM Service Specific Credentials, retrieving - detailed information about each credential, such as the username, status, creation - date, and service name. +Description: Allows users to query AWS IAM Service Specific Credentials, retrieving detailed information about each credential, such as the username, status, creation date, and service name. ID: aws_iam_service_specific_credential_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_specific_credential_id,\n create_date,\n\ - \ user_name\nfrom\n aws_iam_service_specific_credential;" + QueryToExecute: | + SELECT + service_name, + service_specific_credential_id, + create_date, + user_name + FROM + aws_iam_service_specific_credential; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Service Specific Credentials Details + - IAM +Title: Find AWS IAM Service Specific Credentials Details \ No newline at end of file diff --git a/queries/aws_iam_service_specific_credential_2.yaml b/queries/aws_iam_service_specific_credential_2.yaml old mode 100755 new mode 100644 index 8d3251813..dcaeb6484 --- a/queries/aws_iam_service_specific_credential_2.yaml +++ b/queries/aws_iam_service_specific_credential_2.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS IAM Service Specific Credentials, retrieving - detailed information about each credential, such as the username, status, creation - date, and service name. +Description: Allows users to query AWS IAM Service Specific Credentials, retrieving detailed information about each credential, such as the username, status, creation date, and service name. ID: aws_iam_service_specific_credential_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.service_name as service_name,\n s.service_specific_credential_id\ - \ as service_specific_credential_id,\n u.name as user_name,\n u.user_id as user_id,\n\ - \ u.password_last_used as password_last_used,\n u.mfa_enabled as mfa_enabled\n\ - from\n aws_iam_service_specific_credential as s,\n aws_iam_user as u\nwhere\n\ - \ s.user_name = u.name;" + QueryToExecute: | + SELECT + s.service_name AS service_name, + s.service_specific_credential_id AS service_specific_credential_id, + u.name AS user_name, + u.user_id AS user_id, + u.password_last_used AS password_last_used, + u.mfa_enabled AS mfa_enabled + FROM + aws_iam_service_specific_credential AS s, + aws_iam_user AS u + WHERE + s.user_name = u.name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List AWS IAM Service Specific Credentials Details + - IAM +Title: List AWS IAM Service Specific Credentials Details \ No newline at end of file diff --git a/queries/aws_iam_service_specific_credential_3.yaml b/queries/aws_iam_service_specific_credential_3.yaml old mode 100755 new mode 100644 index 69dfaa020..e47e9ac1e --- a/queries/aws_iam_service_specific_credential_3.yaml +++ b/queries/aws_iam_service_specific_credential_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS IAM Service Specific Credentials, retrieving - detailed information about each credential, such as the username, status, creation - date, and service name. +Description: Allows users to query AWS IAM Service Specific Credentials, retrieving detailed information about each credential, such as the username, status, creation date, and service name. ID: aws_iam_service_specific_credential_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_specific_credential_id,\n create_date,\n\ - \ user_name\nfrom\n aws_iam_service_specific_credential\nwhere\n create_date\ - \ <= current_date - interval '30' day;" + QueryToExecute: | + SELECT + service_name, + service_specific_credential_id, + create_date, + user_name + FROM + aws_iam_service_specific_credential + WHERE + create_date <= CURRENT_DATE - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Service Credentials and Detailed Info + - IAM +Title: Find AWS IAM Service Credentials and Detailed Info \ No newline at end of file diff --git a/queries/aws_iam_user_1.yaml b/queries/aws_iam_user_1.yaml old mode 100755 new mode 100644 index 379941cdb..e65b3fba0 --- a/queries/aws_iam_user_1.yaml +++ b/queries/aws_iam_user_1.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n user_id,\n path,\n create_date,\n password_last_used\n\ - from\n aws_iam_user;" + QueryToExecute: | + SELECT + name, + user_id, + path, + create_date, + password_last_used + FROM + aws_iam_user; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: List all AWS IAM User details with creation date + - IAM +Title: List all AWS IAM User details with creation date \ No newline at end of file diff --git a/queries/aws_iam_user_2.yaml b/queries/aws_iam_user_2.yaml old mode 100755 new mode 100644 index 87a389979..567229414 --- a/queries/aws_iam_user_2.yaml +++ b/queries/aws_iam_user_2.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as user_name,\n iam_group ->> 'GroupName' as group_name,\n\ - \ iam_group ->> 'GroupId' as group_id,\n iam_group ->> 'CreateDate' as create_date\n\ - from\n aws_iam_user\n cross join jsonb_array_elements(groups) as iam_group;" + QueryToExecute: | + SELECT + name AS user_name, + iam_group ->> 'GroupName' AS group_name, + iam_group ->> 'GroupId' AS group_id, + iam_group ->> 'CreateDate' AS create_date + FROM + aws_iam_user + CROSS JOIN jsonb_array_elements(groups) AS iam_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM User Data for Security Audits & Enforcement + - IAM +Title: Find AWS IAM User Data for Security Audits & Enforcement \ No newline at end of file diff --git a/queries/aws_iam_user_3.yaml b/queries/aws_iam_user_3.yaml old mode 100755 new mode 100644 index 0447b8f8b..220f6bd22 --- a/queries/aws_iam_user_3.yaml +++ b/queries/aws_iam_user_3.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as user_name,\n split_part(attachments, '/', 2)\ - \ as attached_policies\nfrom\n aws_iam_user\n cross join jsonb_array_elements_text(attached_policy_arns)\ - \ as attachments\nwhere\n split_part(attachments, '/', 2) = 'AdministratorAccess';" + QueryToExecute: | + SELECT + name AS user_name, + SPLIT_PART(attachments, '/', 2) AS attached_policies + FROM + aws_iam_user + CROSS JOIN + jsonb_array_elements_text(attached_policy_arns) AS attachments + WHERE + SPLIT_PART(attachments, '/', 2) = 'AdministratorAccess'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM Users with Specific Policies + - IAM +Title: Find all AWS IAM Users with Specific Policies \ No newline at end of file diff --git a/queries/aws_iam_user_4.yaml b/queries/aws_iam_user_4.yaml old mode 100755 new mode 100644 index a91122eff..cd2beb0b1 --- a/queries/aws_iam_user_4.yaml +++ b/queries/aws_iam_user_4.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n user_id,\n mfa_enabled\nfrom\n aws_iam_user\n\ - where\n not mfa_enabled;" + QueryToExecute: | + SELECT + name, + user_id, + mfa_enabled + FROM + aws_iam_user + WHERE + NOT mfa_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all non-MFA enabled AWS IAM Users with SQL + - IAM +Title: Find all non-MFA enabled AWS IAM Users with SQL \ No newline at end of file diff --git a/queries/aws_iam_user_5.yaml b/queries/aws_iam_user_5.yaml old mode 100755 new mode 100644 index 58dce14ae..b2e5a0793 --- a/queries/aws_iam_user_5.yaml +++ b/queries/aws_iam_user_5.yaml @@ -1,26 +1,29 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as user_name,\n split_part(attachments, '/', 2)\ - \ as attached_policies\nfrom\n aws_iam_user\n cross join jsonb_array_elements_text(attached_policy_arns)\ - \ as attachments;" + QueryToExecute: | + SELECT + name AS user_name, + SPLIT_PART(attachments, '/', 2) AS attached_policies + FROM + aws_iam_user + CROSS JOIN + jsonb_array_elements_text(attached_policy_arns) AS attachments; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find all AWS IAM User Data for Audits and Troubleshooting + - IAM +Title: Find all AWS IAM User Data for Audits and Troubleshooting \ No newline at end of file diff --git a/queries/aws_iam_user_6.yaml b/queries/aws_iam_user_6.yaml old mode 100755 new mode 100644 index 6e6e93c9d..d8ef88d75 --- a/queries/aws_iam_user_6.yaml +++ b/queries/aws_iam_user_6.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS IAM User data, providing details such as user - ID, name, path, creation date, and more. This table is useful for security audits, - policy enforcement, and operational troubleshooting. +Description: Allows users to query AWS IAM User data, providing details such as user ID, name, path, creation date, and more. This table is useful for security audits, policy enforcement, and operational troubleshooting. ID: aws_iam_user_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as user_name,\n inline_policies\nfrom\n aws_iam_user\n\ - where\n inline_policies is not null;" + QueryToExecute: | + SELECT + name AS user_name, + inline_policies + FROM + aws_iam_user + WHERE + inline_policies IS NOT NULL; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IAM -Title: Find AWS IAM Users with Inline Policies + - IAM +Title: Find AWS IAM Users with Inline Policies \ No newline at end of file diff --git a/queries/aws_iam_virtual_mfa_device_1.yaml b/queries/aws_iam_virtual_mfa_device_1.yaml old mode 100755 new mode 100644 index edb3d2f13..20d4f4136 --- a/queries/aws_iam_virtual_mfa_device_1.yaml +++ b/queries/aws_iam_virtual_mfa_device_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query Virtual MFA Devices in AWS Identity and Access - Management (IAM). +Description: Allows users to query Virtual MFA Devices in AWS Identity and Access Management (IAM). ID: aws_iam_virtual_mfa_device_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n serial_number,\n enable_date,\n user_name\nfrom\n \ - \ aws_iam_virtual_mfa_device;" + QueryToExecute: | + SELECT + serial_number, + enable_date, + user_name + FROM + aws_iam_virtual_mfa_device; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find all AWS IAM Virtual MFA Devices + - Identity and Access Management +Title: Find all AWS IAM Virtual MFA Devices \ No newline at end of file diff --git a/queries/aws_iam_virtual_mfa_device_2.yaml b/queries/aws_iam_virtual_mfa_device_2.yaml old mode 100755 new mode 100644 index 5fcf8bb48..ac57a9463 --- a/queries/aws_iam_virtual_mfa_device_2.yaml +++ b/queries/aws_iam_virtual_mfa_device_2.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query Virtual MFA Devices in AWS Identity and Access - Management (IAM). +Description: Allows users to query Virtual MFA Devices in AWS Identity and Access Management (IAM). ID: aws_iam_virtual_mfa_device_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n u.user_id,\n mfa.serial_number,\n path,\n\ - \ create_date,\n password_last_used\nfrom\n aws_iam_user u\n inner join aws_iam_virtual_mfa_device\ - \ mfa on u.name = mfa.user_name;" + QueryToExecute: | + SELECT + name, + u.user_id, + mfa.serial_number, + path, + create_date, + password_last_used + FROM + aws_iam_user u + INNER JOIN + aws_iam_virtual_mfa_device mfa + ON + u.name = mfa.user_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity and Access Management -Title: Find all AWS IAM Virtual MFA Devices + - Identity and Access Management +Title: Find all AWS IAM Virtual MFA Devices \ No newline at end of file diff --git a/queries/aws_identitystore_group_1.yaml b/queries/aws_identitystore_group_1.yaml old mode 100755 new mode 100644 index 56d61c8dd..fd3d9057d --- a/queries/aws_identitystore_group_1.yaml +++ b/queries/aws_identitystore_group_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Identity Store Groups to obtain information - about the identity and attributes of groups in AWS. +Description: Allows users to query AWS Identity Store Groups to obtain information about the identity and attributes of groups in AWS. ID: aws_identitystore_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name\nfrom\n aws_identitystore_group\nwhere identity_store_id\ - \ = 'd-1234567890' and id = '1234567890-12345678-abcd-abcd-abcd-1234567890ab';" + QueryToExecute: | + SELECT + id, + name + FROM + aws_identitystore_group + WHERE + identity_store_id = 'd-1234567890' + AND id = '1234567890-12345678-abcd-abcd-abcd-1234567890ab'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity Store -Title: Find AWS Identity Store Groups Information + - Identity Store +Title: Find AWS Identity Store Groups Information \ No newline at end of file diff --git a/queries/aws_identitystore_group_2.yaml b/queries/aws_identitystore_group_2.yaml old mode 100755 new mode 100644 index 10bf6d41f..0859111a3 --- a/queries/aws_identitystore_group_2.yaml +++ b/queries/aws_identitystore_group_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Identity Store Groups to obtain information - about the identity and attributes of groups in AWS. +Description: Allows users to query AWS Identity Store Groups to obtain information about the identity and attributes of groups in AWS. ID: aws_identitystore_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name\nfrom\n aws_identitystore_group\nwhere identity_store_id\ - \ = 'd-1234567890' and name = 'test';" + QueryToExecute: | + SELECT + id, + name + FROM + aws_identitystore_group + WHERE + identity_store_id = 'd-1234567890' + AND name = 'test'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity Store -Title: Find AWS Identity Store Groups Information + - Identity Store +Title: Find AWS Identity Store Groups Information \ No newline at end of file diff --git a/queries/aws_identitystore_group_membership_1.yaml b/queries/aws_identitystore_group_membership_1.yaml old mode 100755 new mode 100644 index 53b069413..f4fa07601 --- a/queries/aws_identitystore_group_membership_1.yaml +++ b/queries/aws_identitystore_group_membership_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Identity Store Group Memberships, providing - information about AWS users'' membership status within various identity groups. +Description: Allows users to query AWS Identity Store Group Memberships, providing information about AWS users' membership status within various identity groups. ID: aws_identitystore_group_membership_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity_store_id,\n group_id,\n membership_id,\n \ - \ member_id\nfrom\n aws_identitystore_group_membership\nwhere \n identity_store_id\ - \ = 'd-1234567890';" + QueryToExecute: | + SELECT + identity_store_id, + group_id, + membership_id, + member_id + FROM + aws_identitystore_group_membership + WHERE + identity_store_id = 'd-1234567890'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Identity Store -Title: Find All AWS Identity Store Group Memberships + - AWS Identity Store +Title: Find All AWS Identity Store Group Memberships \ No newline at end of file diff --git a/queries/aws_identitystore_group_membership_2.yaml b/queries/aws_identitystore_group_membership_2.yaml old mode 100755 new mode 100644 index 26ab0607e..0acfc51f4 --- a/queries/aws_identitystore_group_membership_2.yaml +++ b/queries/aws_identitystore_group_membership_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Identity Store Group Memberships, providing - information about AWS users'' membership status within various identity groups. +Description: Allows users to query AWS Identity Store Group Memberships, providing information about AWS users' membership status within various identity groups. ID: aws_identitystore_group_membership_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n m.membership_id,\n m.group_id,\n m.identity_store_id,\n\ - \ u.name as user_name \nfrom\n aws_identitystore_group_membership as m,\n aws_identitystore_user\ - \ as u \nwhere\n m.identity_store_id = 'd-1234567890' \n and u.identity_store_id\ - \ = m.identity_store_id \n and u.id = m.member_id;" + QueryToExecute: | + SELECT + m.membership_id, + m.group_id, + m.identity_store_id, + u.name AS user_name + FROM + aws_identitystore_group_membership AS m, + aws_identitystore_user AS u + WHERE + m.identity_store_id = 'd-1234567890' + AND u.identity_store_id = m.identity_store_id + AND u.id = m.member_id; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity Store -Title: Find AWS Identity Store Group Memberships + - Identity Store +Title: Find AWS Identity Store Group Memberships \ No newline at end of file diff --git a/queries/aws_identitystore_group_membership_3.yaml b/queries/aws_identitystore_group_membership_3.yaml old mode 100755 new mode 100644 index 31a1ecb86..12305f309 --- a/queries/aws_identitystore_group_membership_3.yaml +++ b/queries/aws_identitystore_group_membership_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Identity Store Group Memberships, providing - information about AWS users'' membership status within various identity groups. +Description: Allows users to query AWS Identity Store Group Memberships, providing information about AWS users' membership status within various identity groups. ID: aws_identitystore_group_membership_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n m.membership_id,\n m.group_id,\n m.identity_store_id,\n\ - \ g.name as group_name\nfrom\n aws_identitystore_group_membership as m,\n aws_identitystore_group\ - \ as g\nwhere\n m.identity_store_id = 'd-1234567890'\n and g.identity_store_id\ - \ = m.identity_store_id\n and g.id = m.group_id;" + QueryToExecute: | + SELECT + m.membership_id, + m.group_id, + m.identity_store_id, + g.name AS group_name + FROM + aws_identitystore_group_membership AS m, + aws_identitystore_group AS g + WHERE + m.identity_store_id = 'd-1234567890' + AND g.identity_store_id = m.identity_store_id + AND g.id = m.group_id; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity Store -Title: Find AWS Identity Store Group Membership Details + - Identity Store +Title: Find AWS Identity Store Group Membership Details \ No newline at end of file diff --git a/queries/aws_identitystore_user_1.yaml b/queries/aws_identitystore_user_1.yaml old mode 100755 new mode 100644 index 5e591fc8a..e754378f8 --- a/queries/aws_identitystore_user_1.yaml +++ b/queries/aws_identitystore_user_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Identity Store User data, providing details - such as user ID, username, and ARN. This table is essential for managing and auditing - user information within the AWS Identity Store. +Description: Allows users to query AWS Identity Store User data, providing details such as user ID, username, and ARN. This table is essential for managing and auditing user information within the AWS Identity Store. ID: aws_identitystore_user_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name\nfrom\n aws_identitystore_user\nwhere identity_store_id\ - \ = 'd-1234567890' and id = '1234567890-12345678-abcd-abcd-abcd-1234567890ab';" + QueryToExecute: | + SELECT + id, + name + FROM + aws_identitystore_user + WHERE + identity_store_id = 'd-1234567890' + AND id = '1234567890-12345678-abcd-abcd-abcd-1234567890ab'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Identity Store -Title: List AWS Identity Store User Details by ID and Identity Store ID + - Identity Store +Title: List AWS Identity Store User Details by ID and Identity Store ID \ No newline at end of file diff --git a/queries/aws_identitystore_user_2.yaml b/queries/aws_identitystore_user_2.yaml old mode 100755 new mode 100644 index ed63615bb..213c94346 --- a/queries/aws_identitystore_user_2.yaml +++ b/queries/aws_identitystore_user_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Identity Store User data, providing details - such as user ID, username, and ARN. This table is essential for managing and auditing - user information within the AWS Identity Store. +Description: Allows users to query AWS Identity Store User data, providing details such as user ID, username, and ARN. This table is essential for managing and auditing user information within the AWS Identity Store. ID: aws_identitystore_user_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name\nfrom\n aws_identitystore_user\nwhere identity_store_id\ - \ = 'd-1234567890' and name = 'test';" + QueryToExecute: | + SELECT + id, + name + FROM + aws_identitystore_user + WHERE + identity_store_id = 'd-1234567890' + AND name = 'test'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Identity Store -Title: Query AWS Identity Store User Data in AWS Identity Store + - AWS Identity Store +Title: Query AWS Identity Store User Data in AWS Identity Store \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_1.yaml b/queries/aws_inspector2_coverage_1.yaml old mode 100755 new mode 100644 index 0746eecb6..a982f6e34 --- a/queries/aws_inspector2_coverage_1.yaml +++ b/queries/aws_inspector2_coverage_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n resource_id,\n resource_type,\n\ - \ scan_type,\n scan_status_reason,\n scan_status_code\nfrom\n aws_inspector2_coverage;" + QueryToExecute: | + SELECT + source_account_id, + resource_id, + resource_type, + scan_type, + scan_status_reason, + scan_status_code + FROM + aws_inspector2_coverage; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Coverage Assessment Targets & Templates + - AWS Inspector +Title: List AWS Inspector Coverage Assessment Targets & Templates \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_2.yaml b/queries/aws_inspector2_coverage_2.yaml old mode 100755 new mode 100644 index 37335e7ed..74c44f1c9 --- a/queries/aws_inspector2_coverage_2.yaml +++ b/queries/aws_inspector2_coverage_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n resource_id,\n resource_type,\n\ - \ scan_status_code\nfrom\n aws_inspector2_coverage\nwhere\n scan_status_code\ - \ = 'INACTIVE';" + QueryToExecute: | + SELECT + source_account_id, + resource_id, + resource_type, + scan_status_code + FROM + aws_inspector2_coverage + WHERE + scan_status_code = 'INACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector Coverage Details + - AWS Inspector +Title: Find all AWS Inspector Coverage Details \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_3.yaml b/queries/aws_inspector2_coverage_3.yaml old mode 100755 new mode 100644 index 7ccd246d2..dfc19afd1 --- a/queries/aws_inspector2_coverage_3.yaml +++ b/queries/aws_inspector2_coverage_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n scan_type,\n resource_id as ec2_instance_id,\n\ - \ resource_type,\n ec2_ami_id,\n ec2_platform\nfrom\n aws_inspector2_coverage\n\ - where\n resource_type = `aws_EC2_INSTANCE';" + QueryToExecute: | + SELECT + source_account_id, + scan_type, + resource_id AS ec2_instance_id, + resource_type, + ec2_ami_id, + ec2_platform + FROM + aws_inspector2_coverage + WHERE + resource_type = 'aws_EC2_INSTANCE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Coverage and Assessment Templates + - AWS Inspector +Title: Find AWS Inspector Coverage and Assessment Templates \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_4.yaml b/queries/aws_inspector2_coverage_4.yaml old mode 100755 new mode 100644 index cf86df542..b20195db8 --- a/queries/aws_inspector2_coverage_4.yaml +++ b/queries/aws_inspector2_coverage_4.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n scan_type,\n resource_id as ec2_instance_id,\n\ - \ resource_type,\n ec2_ami_id,\n ec2_platform,\n ec2_instance_tags\nfrom\n\ - \ aws_inspector2_coverage\nwhere\n ec2_instance_tags = '{\"foo\": \"bar\", \"\ - foo1\": \"bar1\"}';" + QueryToExecute: | + SELECT + source_account_id, + scan_type, + resource_id AS ec2_instance_id, + resource_type, + ec2_ami_id, + ec2_platform, + ec2_instance_tags + FROM + aws_inspector2_coverage + WHERE + ec2_instance_tags = '{"foo": "bar", "foo1": "bar1"}'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Coverage Data on Assessment Targets + - AWS Inspector +Title: List AWS Inspector Coverage Data on Assessment Targets \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_5.yaml b/queries/aws_inspector2_coverage_5.yaml old mode 100755 new mode 100644 index d6685fa52..d08fc7d55 --- a/queries/aws_inspector2_coverage_5.yaml +++ b/queries/aws_inspector2_coverage_5.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n scan_type,\n resource_id as ec2_instance_id,\n\ - \ resource_type,\n lambda_function_name,\n lambda_function_runtime,\n lambda_function_tags\n\ - from\n aws_inspector2_coverage\nwhere\n lambda_function_tags = '{\"foo\": \"\ - bar\", \"foo1\": \"bar1\"}';" + QueryToExecute: | + SELECT + source_account_id, + scan_type, + resource_id AS ec2_instance_id, + resource_type, + lambda_function_name, + lambda_function_runtime, + lambda_function_tags + FROM + aws_inspector2_coverage + WHERE + lambda_function_tags = '{"foo": "bar", "foo1": "bar1"}'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Coverage Data on Assessment Targets + - AWS Inspector +Title: List AWS Inspector Coverage Data on Assessment Targets \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_6.yaml b/queries/aws_inspector2_coverage_6.yaml old mode 100755 new mode 100644 index 375890b25..cd23369fa --- a/queries/aws_inspector2_coverage_6.yaml +++ b/queries/aws_inspector2_coverage_6.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n resource_id,\n resource_type,\n\ - \ scan_type\nfrom\n aws_inspector2_coverage\nwhere\n scan_type = 'PACKAGE';" + QueryToExecute: | + SELECT + source_account_id, + resource_id, + resource_type, + scan_type + FROM + aws_inspector2_coverage + WHERE + scan_type = 'PACKAGE'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Coverage Data for Assessment Targets + - AWS Inspector +Title: Find AWS Inspector Coverage Data for Assessment Targets \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_7.yaml b/queries/aws_inspector2_coverage_7.yaml old mode 100755 new mode 100644 index 22888d496..04d10f47c --- a/queries/aws_inspector2_coverage_7.yaml +++ b/queries/aws_inspector2_coverage_7.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.resource_id,\n c.resource_type,\n c.ecr_repository_name,\n\ - \ r.registry_id,\n r.repository_uri,\n r.encryption_configuration\nfrom\n \ - \ aws_inspector2_coverage as c,\n aws_ecr_repository as r\nwhere\n r.repository_name\ - \ = c.ecr_repository_name\nand\n c.resource_type = `AWS_ECR_REPOSITORY';" + QueryToExecute: | + SELECT + c.resource_id, + c.resource_type, + c.ecr_repository_name, + r.registry_id, + r.repository_uri, + r.encryption_configuration + FROM + aws_inspector2_coverage AS c, + aws_ecr_repository AS r + WHERE + r.repository_name = c.ecr_repository_name + AND + c.resource_type = 'AWS_ECR_REPOSITORY' Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List all AWS Inspector Coverage Data Details + - AWS Inspector +Title: List all AWS Inspector Coverage Data Details \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_8.yaml b/queries/aws_inspector2_coverage_8.yaml old mode 100755 new mode 100644 index 56aede4bc..fe100b3a0 --- a/queries/aws_inspector2_coverage_8.yaml +++ b/queries/aws_inspector2_coverage_8.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.resource_id,\n c.resource_type,\n c.lambda_function_name,\n\ - \ f.arn as lambda_function_arn,\n c.lambda_function_runtime,\n f.code_sha_256,\n\ - \ f.code_size,\n f.kms_key_arn,\n f.package_type\nfrom\n aws_inspector2_coverage\ - \ as c,\n aws_lambda_function as f\nwhere\n f.name = c.lambda_function_name;" + QueryToExecute: | + SELECT + c.resource_id, + c.resource_type, + c.lambda_function_name, + f.arn AS lambda_function_arn, + c.lambda_function_runtime, + f.code_sha_256, + f.code_size, + f.kms_key_arn, + f.package_type + FROM + aws_inspector2_coverage AS c, + aws_lambda_function AS f + WHERE + f.name = c.lambda_function_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Coverage Data on Assessment Targets + - AWS Inspector +Title: Find AWS Inspector Coverage Data on Assessment Targets \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_9.yaml b/queries/aws_inspector2_coverage_9.yaml old mode 100755 new mode 100644 index e816bfed0..fe12e2d65 --- a/queries/aws_inspector2_coverage_9.yaml +++ b/queries/aws_inspector2_coverage_9.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query AWS Inspector Coverage data that provides details - on the assessment targets and the assessment templates that are associated with - the AWS Inspector service. +Description: Allows users to query AWS Inspector Coverage data that provides details on the assessment targets and the assessment templates that are associated with the AWS Inspector service. ID: aws_inspector2_coverage_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.resource_id as ec2_instance_id,\n c.resource_type,\n\ - \ c.ec2_ami_id,\n i.instance_type,\n i.instance_state,\n i.disable_api_termination,\n\ - \ i.ebs_optimized\nfrom\n aws_inspector2_coverage as c,\n aws_ec2_instance\ - \ as i\nwhere\n i.instance_id = c.resource_id\nand\n c.resource_type = `AWS_EC2_INSTANCE';" + QueryToExecute: | + SELECT + c.resource_id AS ec2_instance_id, + c.resource_type, + c.ec2_ami_id, + i.instance_type, + i.instance_state, + i.disable_api_termination, + i.ebs_optimized + FROM + aws_inspector2_coverage AS c, + aws_ec2_instance AS i + WHERE + i.instance_id = c.resource_id + AND + c.resource_type = 'AWS_EC2_INSTANCE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: Find AWS Inspector Coverage Data for EC2 Instances + - Inspector +Title: Find AWS Inspector Coverage Data for EC2 Instances \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_statistics_1.yaml b/queries/aws_inspector2_coverage_statistics_1.yaml old mode 100755 new mode 100644 index 32c8848de..45a1bfe0b --- a/queries/aws_inspector2_coverage_statistics_1.yaml +++ b/queries/aws_inspector2_coverage_statistics_1.yaml @@ -1,19 +1,23 @@ -Description: Allows users to query AWS Inspector2 Coverage Statistics to obtain detailed - information about the assessment targets and the number of instances they cover. +Description: Allows users to query AWS Inspector2 Coverage Statistics to obtain detailed information about the assessment targets and the number of instances they cover. ID: aws_inspector2_coverage_statistics_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n total_counts,\n counts_by_group\nfrom\n aws_inspector2_coverage_statistics;" + QueryToExecute: | + SELECT + total_counts, + counts_by_group + FROM + aws_inspector2_coverage_statistics; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector2 -Title: Find Detailed AWS Inspector2 Coverage Statistics + - AWS Inspector2 +Title: Find Detailed AWS Inspector2 Coverage Statistics \ No newline at end of file diff --git a/queries/aws_inspector2_coverage_statistics_2.yaml b/queries/aws_inspector2_coverage_statistics_2.yaml old mode 100755 new mode 100644 index d7e417407..81bbd20cb --- a/queries/aws_inspector2_coverage_statistics_2.yaml +++ b/queries/aws_inspector2_coverage_statistics_2.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Inspector2 Coverage Statistics to obtain detailed - information about the assessment targets and the number of instances they cover. +Description: Allows users to query AWS Inspector2 Coverage Statistics to obtain detailed information about the assessment targets and the number of instances they cover. ID: aws_inspector2_coverage_statistics_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n g ->> 'Count' as count,\n g ->> 'GroupKey' as group_key\n\ - from\n aws_inspector2_coverage_statistics,\n jsonb_array_elements(counts_by_group)\ - \ as g;" + QueryToExecute: | + SELECT + g ->> 'Count' AS count, + g ->> 'GroupKey' AS group_key + FROM + aws_inspector2_coverage_statistics, + jsonb_array_elements(counts_by_group) AS g; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector2 -Title: Find AWS Inspector2 Coverage Statistics Details + - AWS Inspector2 +Title: Find AWS Inspector2 Coverage Statistics Details \ No newline at end of file diff --git a/queries/aws_inspector2_finding_1.yaml b/queries/aws_inspector2_finding_1.yaml old mode 100755 new mode 100644 index afc4f435d..4757f5df6 --- a/queries/aws_inspector2_finding_1.yaml +++ b/queries/aws_inspector2_finding_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n description,\n fix_available,\n inspector_score,\n\ - \ severity,\n finding_account_id\nfrom\n aws_inspector2_finding;" + QueryToExecute: | + SELECT + arn, + description, + fix_available, + inspector_score, + severity, + finding_account_id + FROM + aws_inspector2_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Findings and Insights Using SQL + - AWS Inspector +Title: Find AWS Inspector Findings and Insights Using SQL \ No newline at end of file diff --git a/queries/aws_inspector2_finding_10.yaml b/queries/aws_inspector2_finding_10.yaml old mode 100755 new mode 100644 index 9762bdeb6..7253ffa92 --- a/queries/aws_inspector2_finding_10.yaml +++ b/queries/aws_inspector2_finding_10.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_account_id,\n first_observed_at,\n \ - \ fix_available,\n exploit_available\nfrom\n aws_inspector2_finding\nwhere\n\ - \ fix_available = 'YES';" + QueryToExecute: | + SELECT + arn, + finding_account_id, + first_observed_at, + fix_available, + exploit_available + FROM + aws_inspector2_finding + WHERE + fix_available = 'YES'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector findings with fix available + - AWS Inspector +Title: Find all AWS Inspector findings with fix available \ No newline at end of file diff --git a/queries/aws_inspector2_finding_11.yaml b/queries/aws_inspector2_finding_11.yaml old mode 100755 new mode 100644 index 8b082ad9b..fc3638392 --- a/queries/aws_inspector2_finding_11.yaml +++ b/queries/aws_inspector2_finding_11.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n inspector_score,\n first_observed_at,\n last_observed_at\n\ - \ inspector_score_details\nfrom\n aws_inspector2_finding\norder by\n inspector_score\ - \ desc;" + QueryToExecute: | + SELECT + arn, + inspector_score, + first_observed_at, + last_observed_at, + inspector_score_details + FROM + aws_inspector2_finding + ORDER BY + inspector_score DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector findings and security issues + - AWS Inspector +Title: Find AWS Inspector findings and security issues \ No newline at end of file diff --git a/queries/aws_inspector2_finding_12.yaml b/queries/aws_inspector2_finding_12.yaml old mode 100755 new mode 100644 index 4dc032c71..804f327ec --- a/queries/aws_inspector2_finding_12.yaml +++ b/queries/aws_inspector2_finding_12.yaml @@ -1,32 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n inspector_score_details -> 'AdjustedCvss' ->>\ - \ 'Score' as adjusted_cvss_score,\n inspector_score_details -> 'AdjustedCvss'\ - \ ->> 'ScScoreSourceore' as adjusted_cvss_source_score,\n inspector_score_details\ - \ -> 'AdjustedCvss' ->> 'ScoScoringVectorre' as adjusted_cvss_scoring_vector,\n\ - \ inspector_score_details -> 'AdjustedCvss' ->> 'Version' as adjusted_cvss_version,\n\ - \ inspector_score_details -> 'AdjustedCvss' -> 'Adjustments' as adjusted_cvss_adjustments,\n\ - \ inspector_score_details -> 'AdjustedCvss' ->> 'CvssSource' as adjusted_cvss_cvss_source\n\ - from\n aws_inspector2_finding;" + QueryToExecute: | + SELECT + arn, + inspector_score_details -> 'AdjustedCvss' ->> 'Score' AS adjusted_cvss_score, + inspector_score_details -> 'AdjustedCvss' ->> 'ScScoreSourceore' AS adjusted_cvss_source_score, + inspector_score_details -> 'AdjustedCvss' ->> 'ScoScoringVectorre' AS adjusted_cvss_scoring_vector, + inspector_score_details -> 'AdjustedCvss' ->> 'Version' AS adjusted_cvss_version, + inspector_score_details -> 'AdjustedCvss' -> 'Adjustments' AS adjusted_cvss_adjustments, + inspector_score_details -> 'AdjustedCvss' ->> 'CvssSource' AS adjusted_cvss_cvss_source + FROM + aws_inspector2_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector findings and security issues + - AWS Inspector +Title: Find AWS Inspector findings and security issues \ No newline at end of file diff --git a/queries/aws_inspector2_finding_13.yaml b/queries/aws_inspector2_finding_13.yaml old mode 100755 new mode 100644 index 8ccc105ac..7dc239e94 --- a/queries/aws_inspector2_finding_13.yaml +++ b/queries/aws_inspector2_finding_13.yaml @@ -1,27 +1,28 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_13 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n network_reachability_details -> 'NetworkPath'\ - \ -> 'Steps' as network_pathsteps,\n network_reachability_details -> 'OpenPortRange'\ - \ ->> 'Begin' as open_port_range_begin,\n network_reachability_details -> 'OpenPortRange'\ - \ ->> 'End' as open_port_range_end,\n network_reachability_details -> 'Protocol'\ - \ as protocol\nfrom\n aws_inspector2_finding;" + QueryToExecute: | + SELECT + arn, + network_reachability_details -> 'NetworkPath' -> 'Steps' AS network_pathsteps, + network_reachability_details -> 'OpenPortRange' ->> 'Begin' AS open_port_range_begin, + network_reachability_details -> 'OpenPortRange' ->> 'End' AS open_port_range_end, + network_reachability_details -> 'Protocol' AS protocol + FROM + aws_inspector2_finding; Tags: cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector findings for security insights + - AWS Inspector +Title: Find all AWS Inspector findings for security insights \ No newline at end of file diff --git a/queries/aws_inspector2_finding_14.yaml b/queries/aws_inspector2_finding_14.yaml old mode 100755 new mode 100644 index 4d95edcfb..7ec44e542 --- a/queries/aws_inspector2_finding_14.yaml +++ b/queries/aws_inspector2_finding_14.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_14 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_account_id,\n first_observed_at,\n \ - \ fix_available,\n exploit_available,\n resource_tags\nfrom\n aws_inspector2_finding\n\ - where\n resource_tags = '[{\"key\": \"Name\", \"value\": \"Dev\"}, {\"key\":\ - \ \"Name\", \"value\": \"Prod\"}]';" + QueryToExecute: | + SELECT + arn, + finding_account_id, + first_observed_at, + fix_available, + exploit_available, + resource_tags + FROM + aws_inspector2_finding + WHERE + resource_tags = '[{"key": "Name", "value": "Dev"}, {"key": "Name", "value": "Prod"}]'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Findings with Severity and Status + - AWS Inspector +Title: List AWS Inspector Findings with Severity and Status \ No newline at end of file diff --git a/queries/aws_inspector2_finding_15.yaml b/queries/aws_inspector2_finding_15.yaml old mode 100755 new mode 100644 index 450fc54cf..3bba3a08a --- a/queries/aws_inspector2_finding_15.yaml +++ b/queries/aws_inspector2_finding_15.yaml @@ -1,28 +1,31 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_15 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_account_id,\n first_observed_at,\n \ - \ fix_available,\n exploit_available,\n vulnerable_package\nfrom\n aws_inspector2_finding\n\ - where\n vulnerable_package = '[{\"architecture\": \"arc\", \"epoch\": \"231321\"\ - , \"name\": \"myVulere\", \"release\": \"v0.2.0\", \"sourceLambdaLayerArn\": \"\ - arn:aws:lambda:us-west-2:123456789012:layer:my-layer:1\", \"sourceLayerHash\"\ - : \"dbasjkhda872\", \"version\": \"v0.1.0\"}]';" + QueryToExecute: | + SELECT + arn, + finding_account_id, + first_observed_at, + fix_available, + exploit_available, + vulnerable_package + FROM + aws_inspector2_finding + WHERE + vulnerable_package = '[{"architecture": "arc", "epoch": "231321", "name": "myVulere", "release": "v0.2.0", "sourceLambdaLayerArn": "arn:aws:lambda:us-west-2:123456789012:layer:my-layer:1", "sourceLayerHash": "dbasjkhda872", "version": "v0.1.0"}]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Findings and Security Issues + - AWS Inspector +Title: Find AWS Inspector Findings and Security Issues \ No newline at end of file diff --git a/queries/aws_inspector2_finding_2.yaml b/queries/aws_inspector2_finding_2.yaml old mode 100755 new mode 100644 index 3e012b43d..af7024cac --- a/queries/aws_inspector2_finding_2.yaml +++ b/queries/aws_inspector2_finding_2.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n source,\n vendor_severity,\n status,\n severity\n\ - from\n aws_inspector2_finding\nwhere\n severity = 'HIGH';" + QueryToExecute: | + SELECT + arn, + source, + vendor_severity, + status, + severity + FROM + aws_inspector2_finding + WHERE + severity = 'HIGH'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Findings with High Severity + - AWS Inspector +Title: Find AWS Inspector Findings with High Severity \ No newline at end of file diff --git a/queries/aws_inspector2_finding_3.yaml b/queries/aws_inspector2_finding_3.yaml old mode 100755 new mode 100644 index e81c376fe..641bd287c --- a/queries/aws_inspector2_finding_3.yaml +++ b/queries/aws_inspector2_finding_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n severity,\n count(severity)\nfrom\n aws_inspector2_finding\n\ - group by\n severity\norder by\n severity;" + QueryToExecute: | + SELECT + severity, + COUNT(severity) + FROM + aws_inspector2_finding + GROUP BY + severity + ORDER BY + severity; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find Insights into AWS Inspector Security Issues + - AWS Inspector +Title: Find Insights into AWS Inspector Security Issues \ No newline at end of file diff --git a/queries/aws_inspector2_finding_4.yaml b/queries/aws_inspector2_finding_4.yaml old mode 100755 new mode 100644 index 84f5dfd15..e24960282 --- a/queries/aws_inspector2_finding_4.yaml +++ b/queries/aws_inspector2_finding_4.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n arn,\n severity\nfrom\n aws_inspector2_finding\n\ - where\n last_observed_at >= now() - interval '10' day;" + QueryToExecute: | + SELECT + title, + arn, + severity + FROM + aws_inspector2_finding + WHERE + last_observed_at >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector findings with details + - AWS Inspector +Title: Find all AWS Inspector findings with details \ No newline at end of file diff --git a/queries/aws_inspector2_finding_5.yaml b/queries/aws_inspector2_finding_5.yaml old mode 100755 new mode 100644 index d1074c77d..496236222 --- a/queries/aws_inspector2_finding_5.yaml +++ b/queries/aws_inspector2_finding_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n type,\n resources,\n vulnerable_packages\n\ - from\n aws_inspector2_finding\nwhere\n status = 'SUPPRESSED';" + QueryToExecute: | + SELECT + arn, + status, + type, + resources, + vulnerable_packages + FROM + aws_inspector2_finding + WHERE + status = 'SUPPRESSED'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector suppressed findings + - AWS Inspector +Title: Find AWS Inspector suppressed findings \ No newline at end of file diff --git a/queries/aws_inspector2_finding_6.yaml b/queries/aws_inspector2_finding_6.yaml old mode 100755 new mode 100644 index 7808ef9fe..e43421b53 --- a/queries/aws_inspector2_finding_6.yaml +++ b/queries/aws_inspector2_finding_6.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n status,\n type,\n resources,\n vulnerable_packages\n\ - from\n aws_inspector2_finding\nwhere\n type = 'PACKAGE_VULNERABILITY';" + QueryToExecute: | + SELECT + arn, + status, + type, + resources, + vulnerable_packages + FROM + aws_inspector2_finding + WHERE + type = 'PACKAGE_VULNERABILITY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector findings to identify vulnerabilities + - AWS Inspector +Title: Find AWS Inspector findings to identify vulnerabilities \ No newline at end of file diff --git a/queries/aws_inspector2_finding_7.yaml b/queries/aws_inspector2_finding_7.yaml old mode 100755 new mode 100644 index aec49c5f4..fce7d3873 --- a/queries/aws_inspector2_finding_7.yaml +++ b/queries/aws_inspector2_finding_7.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.arn as finding_arn,\n r ->> 'Id' as resource_id,\n\ - \ r ->> 'Type' as resource_type,\n r ->> 'Details' as resource_details,\n r\ - \ ->> 'Partition' as partition,\n r ->> 'Tags' as resource_tags\nfrom\n aws_inspector2_finding\ - \ as f,\n jsonb_array_elements(resources) as r;" + QueryToExecute: | + SELECT + f.arn AS finding_arn, + r ->> 'Id' AS resource_id, + r ->> 'Type' AS resource_type, + r ->> 'Details' AS resource_details, + r ->> 'Partition' AS partition, + r ->> 'Tags' AS resource_tags + FROM + aws_inspector2_finding AS f, + jsonb_array_elements(resources) AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Query AWS Inspector findings for security insights + - AWS Inspector +Title: Query AWS Inspector findings for security insights \ No newline at end of file diff --git a/queries/aws_inspector2_finding_8.yaml b/queries/aws_inspector2_finding_8.yaml old mode 100755 new mode 100644 index 9430b1215..75c300bad --- a/queries/aws_inspector2_finding_8.yaml +++ b/queries/aws_inspector2_finding_8.yaml @@ -1,31 +1,37 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.arn,\n f.vulnerability_id,\n v ->> 'Name' as vulnerability_package_name,\n\ - \ v ->> 'Version' as vulnerability_package_version,\n v ->> 'Arch' as vulnerability_package_arch,\n\ - \ v ->> 'Epoch' as vulnerability_package_epoch,\n v ->> 'FilePath' as vulnerability_package_file_path,\n\ - \ v ->> 'FixedInVersion' as vulnerability_package_fixed_in_version,\n v ->>\ - \ 'PackageManager' as vulnerability_package_package_manager,\n v ->> 'Release'\ - \ as vulnerability_package_release,\n v ->> 'Remediation' as vulnerability_package_remediation,\n\ - \ v ->> 'SourceLambdaLayerArn' as source_lambda_layer_arn,\n v ->> 'Name' as\ - \ source_layer_hash\nfrom\n aws_inspector2_finding as f,\n jsonb_array_elements(vulnerable_packages)\ - \ as v;" + QueryToExecute: | + SELECT + f.arn, + f.vulnerability_id, + v ->> 'Name' AS vulnerability_package_name, + v ->> 'Version' AS vulnerability_package_version, + v ->> 'Arch' AS vulnerability_package_arch, + v ->> 'Epoch' AS vulnerability_package_epoch, + v ->> 'FilePath' AS vulnerability_package_file_path, + v ->> 'FixedInVersion' AS vulnerability_package_fixed_in_version, + v ->> 'PackageManager' AS vulnerability_package_package_manager, + v ->> 'Release' AS vulnerability_package_release, + v ->> 'Remediation' AS vulnerability_package_remediation, + v ->> 'SourceLambdaLayerArn' AS source_lambda_layer_arn, + v ->> 'Name' AS source_layer_hash + FROM + aws_inspector2_finding AS f, + JSONB_ARRAY_ELEMENTS(vulnerable_packages) AS v; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector findings and vulnerabilities via SQL + - AWS Inspector +Title: Find AWS Inspector findings and vulnerabilities via SQL \ No newline at end of file diff --git a/queries/aws_inspector2_finding_9.yaml b/queries/aws_inspector2_finding_9.yaml old mode 100755 new mode 100644 index d2c28228f..725291d31 --- a/queries/aws_inspector2_finding_9.yaml +++ b/queries/aws_inspector2_finding_9.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS Inspector findings to gain insights into potential - security issues and vulnerabilities within their AWS resources. The table provides - detailed information about each finding, including its severity, status, and associated - resources. +Description: Allows users to query AWS Inspector findings to gain insights into potential security issues and vulnerabilities within their AWS resources. The table provides detailed information about each finding, including its severity, status, and associated resources. ID: aws_inspector2_finding_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_account_id,\n first_observed_at,\n \ - \ fix_available,\n exploit_available\nfrom\n aws_inspector2_finding\nwhere\n\ - \ exploit_available = 'YES';" + QueryToExecute: | + SELECT + arn, + finding_account_id, + first_observed_at, + fix_available, + exploit_available + FROM + aws_inspector2_finding + WHERE + exploit_available = 'YES'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find and Query Insights into AWS Inspector Findings + - AWS Inspector +Title: Find and Query Insights into AWS Inspector Findings \ No newline at end of file diff --git a/queries/aws_inspector2_member_1.yaml b/queries/aws_inspector2_member_1.yaml old mode 100755 new mode 100644 index 037c4a57c..afbb91c27 --- a/queries/aws_inspector2_member_1.yaml +++ b/queries/aws_inspector2_member_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Inspector Members to retrieve detailed information - about the member accounts within an AWS Inspector assessment target. +Description: Allows users to query AWS Inspector Members to retrieve detailed information about the member accounts within an AWS Inspector assessment target. ID: aws_inspector2_member_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n delegated_admin_account_id,\n \ - \ relationship_status,\n updated_at\nfrom\n aws_inspector2_member;" + QueryToExecute: | + SELECT + member_account_id, + delegated_admin_account_id, + relationship_status, + updated_at + FROM + aws_inspector2_member; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector Members and Their Details + - AWS Inspector +Title: Find all AWS Inspector Members and Their Details \ No newline at end of file diff --git a/queries/aws_inspector2_member_2.yaml b/queries/aws_inspector2_member_2.yaml old mode 100755 new mode 100644 index d1d832c78..d6da5e684 --- a/queries/aws_inspector2_member_2.yaml +++ b/queries/aws_inspector2_member_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Inspector Members to retrieve detailed information - about the member accounts within an AWS Inspector assessment target. +Description: Allows users to query AWS Inspector Members to retrieve detailed information about the member accounts within an AWS Inspector assessment target. ID: aws_inspector2_member_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n delegated_admin_account_id,\n \ - \ relationship_status,\n updated_at\nfrom\n aws_inspector2_member\nwhere\n \ - \ updated_at >= now() - interval '30' day;" + QueryToExecute: | + SELECT + member_account_id, + delegated_admin_account_id, + relationship_status, + updated_at + FROM + aws_inspector2_member + WHERE + updated_at >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Members Information + - AWS Inspector +Title: Find AWS Inspector Members Information \ No newline at end of file diff --git a/queries/aws_inspector2_member_3.yaml b/queries/aws_inspector2_member_3.yaml old mode 100755 new mode 100644 index 4a1d02698..60350cd9d --- a/queries/aws_inspector2_member_3.yaml +++ b/queries/aws_inspector2_member_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Inspector Members to retrieve detailed information - about the member accounts within an AWS Inspector assessment target. +Description: Allows users to query AWS Inspector Members to retrieve detailed information about the member accounts within an AWS Inspector assessment target. ID: aws_inspector2_member_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n delegated_admin_account_id,\n \ - \ relationship_status\nfrom\n aws_inspector2_member\nwhere\n relationship_status\ - \ = 'INVITED';" + QueryToExecute: | + SELECT + member_account_id, + delegated_admin_account_id, + relationship_status + FROM + aws_inspector2_member + WHERE + relationship_status = 'INVITED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: Find all AWS Inspector Member Accounts Information + - Inspector +Title: Find all AWS Inspector Member Accounts Information \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_1.yaml b/queries/aws_inspector_assessment_run_1.yaml old mode 100755 new mode 100644 index acc5a2132..a64019bb7 --- a/queries/aws_inspector_assessment_run_1.yaml +++ b/queries/aws_inspector_assessment_run_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_template_arn,\n created_at,\n\ - \ state,\n region\nfrom\n aws_inspector_assessment_run;" + QueryToExecute: | + SELECT + name, + arn, + assessment_template_arn, + created_at, + state, + region + FROM + aws_inspector_assessment_run; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List all AWS Inspector Assessment Runs and Details + - AWS Inspector +Title: List all AWS Inspector Assessment Runs and Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_2.yaml b/queries/aws_inspector_assessment_run_2.yaml old mode 100755 new mode 100644 index b890445cd..cc2d11279 --- a/queries/aws_inspector_assessment_run_2.yaml +++ b/queries/aws_inspector_assessment_run_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n finding_counts ->> 'High' as high,\n finding_counts\ - \ ->> 'Low' as low,\n finding_counts ->> 'Medium' as medium,\n finding_counts\ - \ ->> 'Informational' as informational,\n state\nfrom\n aws_inspector_assessment_run;" + QueryToExecute: | + SELECT + name, + finding_counts ->> 'High' AS high, + finding_counts ->> 'Low' AS low, + finding_counts ->> 'Medium' AS medium, + finding_counts ->> 'Informational' AS informational, + state + FROM + aws_inspector_assessment_run; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Assessment Runs with Details + - AWS Inspector +Title: Find AWS Inspector Assessment Runs with Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_3.yaml b/queries/aws_inspector_assessment_run_3.yaml old mode 100755 new mode 100644 index 355d86518..e8323bf7f --- a/queries/aws_inspector_assessment_run_3.yaml +++ b/queries/aws_inspector_assessment_run_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n t.name as assessment_template_name,\n r.name as assessment_run_name,\n\ - \ r.created_at as assessment_run_created_at,\n r.state,\n r.region\nfrom\n\ - \ aws_inspector_assessment_run as r,\n aws_inspector_assessment_template as\ - \ t\nwhere\n r.assessment_template_arn = t.arn;" + QueryToExecute: | + SELECT + t.name AS assessment_template_name, + r.name AS assessment_run_name, + r.created_at AS assessment_run_created_at, + r.state, + r.region + FROM + aws_inspector_assessment_run AS r, + aws_inspector_assessment_template AS t + WHERE + r.assessment_template_arn = t.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: List all AWS Inspector Assessment Runs and Their Details + - Inspector +Title: List all AWS Inspector Assessment Runs and Their Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_4.yaml b/queries/aws_inspector_assessment_run_4.yaml old mode 100755 new mode 100644 index e5939eab9..e7d870f6a --- a/queries/aws_inspector_assessment_run_4.yaml +++ b/queries/aws_inspector_assessment_run_4.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_template_arn,\n created_at,\n\ - \ state,\n region\nfrom\n aws_inspector_assessment_run\nwhere\n state <> 'COMPLETED';" + QueryToExecute: | + SELECT + name, + arn, + assessment_template_arn, + created_at, + state, + region + FROM + aws_inspector_assessment_run + WHERE + state <> 'COMPLETED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List all AWS Inspector Assessment Runs and their details + - AWS Inspector +Title: List all AWS Inspector Assessment Runs and their details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_5.yaml b/queries/aws_inspector_assessment_run_5.yaml old mode 100755 new mode 100644 index aa8394575..f434ddda2 --- a/queries/aws_inspector_assessment_run_5.yaml +++ b/queries/aws_inspector_assessment_run_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state,\n jsonb_pretty(state_changes)\ - \ as state_changes\nfrom\n aws_inspector_assessment_run;" + QueryToExecute: | + SELECT + name, + arn, + state, + JSONB_PRETTY(state_changes) AS state_changes + FROM + aws_inspector_assessment_run; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Query AWS Inspector Assessment Run Details + - AWS Inspector +Title: Query AWS Inspector Assessment Run Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_run_6.yaml b/queries/aws_inspector_assessment_run_6.yaml old mode 100755 new mode 100644 index 80938783c..fd1067b8b --- a/queries/aws_inspector_assessment_run_6.yaml +++ b/queries/aws_inspector_assessment_run_6.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Inspector Assessment Runs to get detailed information - about each assessment run, including its state, duration, findings, and more. +Description: Allows users to query AWS Inspector Assessment Runs to get detailed information about each assessment run, including its state, duration, findings, and more. ID: aws_inspector_assessment_run_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_template_arn,\n created_at,\n\ - \ state,\n region\nfrom\n aws_inspector_assessment_run\nwhere\n created_at\ - \ >= (now() - interval '7' day);" + QueryToExecute: | + SELECT + name, + arn, + assessment_template_arn, + created_at, + state, + region + FROM + aws_inspector_assessment_run + WHERE + created_at >= (NOW() - INTERVAL '7' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List all AWS Inspector Assessment Runs in Last Week + - AWS Inspector +Title: List all AWS Inspector Assessment Runs in Last Week \ No newline at end of file diff --git a/queries/aws_inspector_assessment_target_1.yaml b/queries/aws_inspector_assessment_target_1.yaml old mode 100755 new mode 100644 index d4f743f30..c50d87158 --- a/queries/aws_inspector_assessment_target_1.yaml +++ b/queries/aws_inspector_assessment_target_1.yaml @@ -1,27 +1,29 @@ -Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` - table in Steampipe provides information about assessment targets within AWS Inspector. - This table allows DevOps engineers to query target-specific details, including ARN, - name, and associated resource group ARN. Users can utilize this table to gather - insights on assessment targets, such as their creation time, last updated time, - and more. The schema outlines the various attributes of the assessment target, including - the target ARN, creation date, and associated tags. +Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` table in Steampipe provides information about assessment targets within AWS Inspector. This table allows DevOps engineers to query target-specific details, including ARN, name, and associated resource group ARN. Users can utilize this table to gather insights on assessment targets, such as their creation time, last updated time, and more. The schema outlines the various attributes of the assessment target, including the target ARN, creation date, and associated tags. ID: aws_inspector_assessment_target_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n resource_group_arn,\n created_at,\n\ - \ updated_at,\n region\nfrom\n aws_inspector_assessment_target;" + QueryToExecute: | + SELECT + name, + arn, + resource_group_arn, + created_at, + updated_at, + region + FROM + aws_inspector_assessment_target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: List AWS Inspector Assessment Targets with Details + - Inspector +Title: List AWS Inspector Assessment Targets with Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_target_2.yaml b/queries/aws_inspector_assessment_target_2.yaml old mode 100755 new mode 100644 index 351fb7645..774d101c6 --- a/queries/aws_inspector_assessment_target_2.yaml +++ b/queries/aws_inspector_assessment_target_2.yaml @@ -1,28 +1,31 @@ -Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` - table in Steampipe provides information about assessment targets within AWS Inspector. - This table allows DevOps engineers to query target-specific details, including ARN, - name, and associated resource group ARN. Users can utilize this table to gather - insights on assessment targets, such as their creation time, last updated time, - and more. The schema outlines the various attributes of the assessment target, including - the target ARN, creation date, and associated tags. +Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` table in Steampipe provides information about assessment targets within AWS Inspector. This table allows DevOps engineers to query target-specific details, including ARN, name, and associated resource group ARN. Users can utilize this table to gather insights on assessment targets, such as their creation time, last updated time, and more. The schema outlines the various attributes of the assessment target, including the target ARN, creation date, and associated tags. ID: aws_inspector_assessment_target_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n resource_group_arn,\n created_at,\n\ - \ updated_at,\n region\nfrom\n aws_inspector_assessment_target\nwhere\n created_at\ - \ > (current_date - interval '7' day);" + QueryToExecute: | + SELECT + name, + arn, + resource_group_arn, + created_at, + updated_at, + region + FROM + aws_inspector_assessment_target + WHERE + created_at > (CURRENT_DATE - INTERVAL '7' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Assessment Targets Created in Last 7 Days + - AWS Inspector +Title: Find AWS Inspector Assessment Targets Created in Last 7 Days \ No newline at end of file diff --git a/queries/aws_inspector_assessment_target_3.yaml b/queries/aws_inspector_assessment_target_3.yaml old mode 100755 new mode 100644 index 114db8a03..9ac2b57e7 --- a/queries/aws_inspector_assessment_target_3.yaml +++ b/queries/aws_inspector_assessment_target_3.yaml @@ -1,28 +1,31 @@ -Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` - table in Steampipe provides information about assessment targets within AWS Inspector. - This table allows DevOps engineers to query target-specific details, including ARN, - name, and associated resource group ARN. Users can utilize this table to gather - insights on assessment targets, such as their creation time, last updated time, - and more. The schema outlines the various attributes of the assessment target, including - the target ARN, creation date, and associated tags. +Description: Allows users to query AWS Inspector Assessment Targets. The `aws_inspector_assessment_target` table in Steampipe provides information about assessment targets within AWS Inspector. This table allows DevOps engineers to query target-specific details, including ARN, name, and associated resource group ARN. Users can utilize this table to gather insights on assessment targets, such as their creation time, last updated time, and more. The schema outlines the various attributes of the assessment target, including the target ARN, creation date, and associated tags. ID: aws_inspector_assessment_target_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n resource_group_arn,\n created_at,\n\ - \ updated_at,\n region\nfrom\n aws_inspector_assessment_target\nwhere\n created_at\ - \ != updated_at;" + QueryToExecute: | + SELECT + name, + arn, + resource_group_arn, + created_at, + updated_at, + region + FROM + aws_inspector_assessment_target + WHERE + created_at != updated_at; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Assessment Targets Details + - AWS Inspector +Title: List AWS Inspector Assessment Targets Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_1.yaml b/queries/aws_inspector_assessment_template_1.yaml old mode 100755 new mode 100644 index f072c3aad..d1ebe9e44 --- a/queries/aws_inspector_assessment_template_1.yaml +++ b/queries/aws_inspector_assessment_template_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n region\nfrom\n aws_inspector_assessment_template;" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + region + FROM + aws_inspector_assessment_template; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Assessment Templates + - AWS Inspector +Title: Find AWS Inspector Assessment Templates \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_2.yaml b/queries/aws_inspector_assessment_template_2.yaml old mode 100755 new mode 100644 index 188f047ee..f9fd54f40 --- a/queries/aws_inspector_assessment_template_2.yaml +++ b/queries/aws_inspector_assessment_template_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n user_attributes_for_findings,\n region\nfrom\n \ - \ aws_inspector_assessment_template\nwhere\n user_attributes_for_findings = '[]';" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + user_attributes_for_findings, + region + FROM + aws_inspector_assessment_template + WHERE + user_attributes_for_findings = '[]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: List AWS Inspector Assessment Template Configurations + - Inspector +Title: List AWS Inspector Assessment Template Configurations \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_3.yaml b/queries/aws_inspector_assessment_template_3.yaml old mode 100755 new mode 100644 index 3c09b3724..f64af0c8d --- a/queries/aws_inspector_assessment_template_3.yaml +++ b/queries/aws_inspector_assessment_template_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n user_attributes_for_findings,\n region\nfrom\n \ - \ aws_inspector_assessment_template\nwhere\n assessment_run_count = 0;" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + user_attributes_for_findings, + region + FROM + aws_inspector_assessment_template + WHERE + assessment_run_count = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Assessment Templates with 0 Runs + - AWS Inspector +Title: Find AWS Inspector Assessment Templates with 0 Runs \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_4.yaml b/queries/aws_inspector_assessment_template_4.yaml old mode 100755 new mode 100644 index c98f904be..aab213dcb --- a/queries/aws_inspector_assessment_template_4.yaml +++ b/queries/aws_inspector_assessment_template_4.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n duration_in_seconds,\n region\nfrom\n aws_inspector_assessment_template\n\ - where\n duration_in_seconds < 3600;" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + duration_in_seconds, + region + FROM + aws_inspector_assessment_template + WHERE + duration_in_seconds < 3600; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Assessment Template Details + - AWS Inspector +Title: List AWS Inspector Assessment Template Details \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_5.yaml b/queries/aws_inspector_assessment_template_5.yaml old mode 100755 new mode 100644 index f3c2fa7b3..6c5235d8d --- a/queries/aws_inspector_assessment_template_5.yaml +++ b/queries/aws_inspector_assessment_template_5.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n user_attributes_for_findings,\n region\nfrom\n \ - \ aws_inspector_assessment_template\nwhere\n assessment_run_count = 0;" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + user_attributes_for_findings, + region + FROM + aws_inspector_assessment_template + WHERE + assessment_run_count = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all AWS Inspector Assessment Templates with No Runs + - AWS Inspector +Title: Find all AWS Inspector Assessment Templates with No Runs \ No newline at end of file diff --git a/queries/aws_inspector_assessment_template_6.yaml b/queries/aws_inspector_assessment_template_6.yaml old mode 100755 new mode 100644 index 01ed07629..42a998347 --- a/queries/aws_inspector_assessment_template_6.yaml +++ b/queries/aws_inspector_assessment_template_6.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Inspector Assessment Templates to gain insights - into each template''s configuration, including ARN, duration, rules package ARNs, - and user attributes for findings. +Description: Allows users to query AWS Inspector Assessment Templates to gain insights into each template's configuration, including ARN, duration, rules package ARNs, and user attributes for findings. ID: aws_inspector_assessment_template_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n assessment_run_count,\n created_at,\n\ - \ assessment_target_arn,\n duration_in_seconds,\n region\nfrom\n aws_inspector_assessment_template\n\ - where\n duration_in_seconds < 3600;" + QueryToExecute: | + SELECT + name, + arn, + assessment_run_count, + created_at, + assessment_target_arn, + duration_in_seconds, + region + FROM + aws_inspector_assessment_template + WHERE + duration_in_seconds < 3600; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Assessment Templates by Duration + - AWS Inspector +Title: Find AWS Inspector Assessment Templates by Duration \ No newline at end of file diff --git a/queries/aws_inspector_exclusion_1.yaml b/queries/aws_inspector_exclusion_1.yaml old mode 100755 new mode 100644 index 9e5eb98ed..4d408535f --- a/queries/aws_inspector_exclusion_1.yaml +++ b/queries/aws_inspector_exclusion_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Inspector Exclusions and retrieve data about - AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. +Description: Allows users to query AWS Inspector Exclusions and retrieve data about AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. ID: aws_inspector_exclusion_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n attributes,\n description,\n title,\n region\n\ - from\n aws_inspector_exclusion;" + QueryToExecute: | + SELECT + arn, + attributes, + description, + title, + region + FROM + aws_inspector_exclusion; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List all AWS Inspector Exclusions with Descriptions + - AWS Inspector +Title: List all AWS Inspector Exclusions with Descriptions \ No newline at end of file diff --git a/queries/aws_inspector_exclusion_2.yaml b/queries/aws_inspector_exclusion_2.yaml old mode 100755 new mode 100644 index 49f78a270..050198769 --- a/queries/aws_inspector_exclusion_2.yaml +++ b/queries/aws_inspector_exclusion_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Inspector Exclusions and retrieve data about - AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. +Description: Allows users to query AWS Inspector Exclusions and retrieve data about AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. ID: aws_inspector_exclusion_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n attributes,\n description,\n title,\n region\n\ - from\n aws_inspector_exclusion\nwhere\n assessment_run_arn = 'arn:aws:inspector:us-east-1:012345678912:target/0-ywdTAdRg/template/0-rY1J4B4f/run/0-LRRwpQFz';" + QueryToExecute: | + SELECT + arn, + attributes, + description, + title, + region + FROM + aws_inspector_exclusion + WHERE + assessment_run_arn = 'arn:aws:inspector:us-east-1:012345678912:target/0-ywdTAdRg/template/0-rY1J4B4f/run/0-LRRwpQFz'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find AWS Inspector Exclusions including ARNs and Descriptions + - AWS Inspector +Title: Find AWS Inspector Exclusions including ARNs and Descriptions \ No newline at end of file diff --git a/queries/aws_inspector_exclusion_3.yaml b/queries/aws_inspector_exclusion_3.yaml old mode 100755 new mode 100644 index cc8ee4b2e..cfdc933d9 --- a/queries/aws_inspector_exclusion_3.yaml +++ b/queries/aws_inspector_exclusion_3.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Inspector Exclusions and retrieve data about - AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. +Description: Allows users to query AWS Inspector Exclusions and retrieve data about AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. ID: aws_inspector_exclusion_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n jsonb_pretty(attributes) as attributes,\n jsonb_pretty(scopes)\ - \ as scopes\nfrom\n aws_inspector_exclusion;" + QueryToExecute: | + SELECT + arn, + JSONB_PRETTY(attributes) AS attributes, + JSONB_PRETTY(scopes) AS scopes + FROM + aws_inspector_exclusion; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: List AWS Inspector Exclusions with Details + - Inspector +Title: List AWS Inspector Exclusions with Details \ No newline at end of file diff --git a/queries/aws_inspector_exclusion_4.yaml b/queries/aws_inspector_exclusion_4.yaml old mode 100755 new mode 100644 index 845606d3c..7bbdb5d60 --- a/queries/aws_inspector_exclusion_4.yaml +++ b/queries/aws_inspector_exclusion_4.yaml @@ -1,20 +1,31 @@ -Description: Allows users to query AWS Inspector Exclusions and retrieve data about - AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. +Description: Allows users to query AWS Inspector Exclusions and retrieve data about AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. ID: aws_inspector_exclusion_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n title,\n count(arn)\nfrom\n aws_inspector_exclusion\n\ - group by\n arn,\n region,\n title\norder by\n count desc;" + QueryToExecute: | + SELECT + arn, + region, + title, + COUNT(arn) + FROM + aws_inspector_exclusion + GROUP BY + arn, + region, + title + ORDER BY + COUNT DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: List all AWS Inspector Exclusions with Details + - Inspector +Title: List all AWS Inspector Exclusions with Details \ No newline at end of file diff --git a/queries/aws_inspector_exclusion_5.yaml b/queries/aws_inspector_exclusion_5.yaml old mode 100755 new mode 100644 index 2d23f389b..9d215227d --- a/queries/aws_inspector_exclusion_5.yaml +++ b/queries/aws_inspector_exclusion_5.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Inspector Exclusions and retrieve data about - AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. +Description: Allows users to query AWS Inspector Exclusions and retrieve data about AWS Inspector Exclusions, including their ARNs, descriptions, and recommendations. ID: aws_inspector_exclusion_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n e.arn, \n e.title, \n jsonb_pretty(e.attributes) as\ - \ attributes, \n e.recommendation \nfrom \n aws_inspector_exclusion e, \n aws_inspector_assessment_run\ - \ r, \n aws_inspector_assessment_template t \nwhere \n e.assessment_run_arn\ - \ = r.arn \nand \n r.assessment_template_arn = t.arn;" + QueryToExecute: | + SELECT + e.arn, + e.title, + jsonb_pretty(e.attributes) AS attributes, + e.recommendation + FROM + aws_inspector_exclusion e, + aws_inspector_assessment_run r, + aws_inspector_assessment_template t + WHERE + e.assessment_run_arn = r.arn + AND + r.assessment_template_arn = t.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: List AWS Inspector Exclusions with ARNs and Recommendations + - AWS Inspector +Title: List AWS Inspector Exclusions with ARNs and Recommendations \ No newline at end of file diff --git a/queries/aws_inspector_finding_1.yaml b/queries/aws_inspector_finding_1.yaml old mode 100755 new mode 100644 index 5e7f8f08c..f3b4aeb60 --- a/queries/aws_inspector_finding_1.yaml +++ b/queries/aws_inspector_finding_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n agent_id as instance_id,\n asset_type,\n\ - \ confidence,\n severity\nfrom\n aws_inspector_finding;" + QueryToExecute: | + SELECT + id, + arn, + agent_id AS instance_id, + asset_type, + confidence, + severity + FROM + aws_inspector_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: Find all AWS Inspector Findings details + - Amazon Inspector +Title: Find all AWS Inspector Findings details \ No newline at end of file diff --git a/queries/aws_inspector_finding_10.yaml b/queries/aws_inspector_finding_10.yaml old mode 100755 new mode 100644 index 9427ae76d..db4a09846 --- a/queries/aws_inspector_finding_10.yaml +++ b/queries/aws_inspector_finding_10.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n agent_id as instance_id,\n asset_type,\n\ - \ confidence,\n severity\nfrom\n aws_inspector_finding\norder by\n confidence;" + QueryToExecute: | + SELECT + id, + arn, + agent_id AS instance_id, + asset_type, + confidence, + severity + FROM + aws_inspector_finding + ORDER BY + confidence; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: List all AWS Inspector Findings with Details + - Amazon Inspector +Title: List all AWS Inspector Findings with Details \ No newline at end of file diff --git a/queries/aws_inspector_finding_2.yaml b/queries/aws_inspector_finding_2.yaml old mode 100755 new mode 100644 index cc4b4f0bf..85f98d976 --- a/queries/aws_inspector_finding_2.yaml +++ b/queries/aws_inspector_finding_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n agent_id as instance_id,\n asset_type,\n\ - \ confidence,\n severity\nfrom\n aws_inspector_finding\nwhere\n severity =\ - \ 'High';" + QueryToExecute: | + SELECT + id, + arn, + agent_id AS instance_id, + asset_type, + confidence, + severity + FROM + aws_inspector_finding + WHERE + severity = 'High'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: List High Severity Findings from AWS Inspector + - Amazon Inspector +Title: List High Severity Findings from AWS Inspector \ No newline at end of file diff --git a/queries/aws_inspector_finding_3.yaml b/queries/aws_inspector_finding_3.yaml old mode 100755 new mode 100644 index b0ed417db..583eef709 --- a/queries/aws_inspector_finding_3.yaml +++ b/queries/aws_inspector_finding_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n severity,\n count(severity)\nfrom\n aws_inspector_finding\n\ - group by\n severity\norder by\n severity;" + QueryToExecute: | + SELECT + severity, + COUNT(severity) + FROM + aws_inspector_finding + GROUP BY + severity + ORDER BY + severity; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Inspector -Title: Find AWS Inspector Findings by Severity + - Inspector +Title: Find AWS Inspector Findings by Severity \ No newline at end of file diff --git a/queries/aws_inspector_finding_4.yaml b/queries/aws_inspector_finding_4.yaml old mode 100755 new mode 100644 index 52d7c3044..ad8bebfac --- a/queries/aws_inspector_finding_4.yaml +++ b/queries/aws_inspector_finding_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n confidence,\n severity\nfrom\n aws_inspector_finding\n\ - where\n created_at >= now() - interval '10' day;" + QueryToExecute: | + SELECT + title, + id, + confidence, + severity + FROM + aws_inspector_finding + WHERE + created_at >= NOW() - INTERVAL '10' DAY; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: List AWS Inspector Findings from the Past 10 Days + - Amazon Inspector +Title: List AWS Inspector Findings from the Past 10 Days \ No newline at end of file diff --git a/queries/aws_inspector_finding_5.yaml b/queries/aws_inspector_finding_5.yaml old mode 100755 new mode 100644 index 2330661c2..7dfafc4d5 --- a/queries/aws_inspector_finding_5.yaml +++ b/queries/aws_inspector_finding_5.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id, \n jsonb_pretty(attributes) as attributes\n\ - from\n aws_inspector_finding;" + QueryToExecute: | + SELECT + title, + id, + jsonb_pretty(attributes) AS attributes + FROM + aws_inspector_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: List all AWS Inspector Findings with Detailed Information + - Amazon Inspector +Title: List all AWS Inspector Findings with Detailed Information \ No newline at end of file diff --git a/queries/aws_inspector_finding_6.yaml b/queries/aws_inspector_finding_6.yaml old mode 100755 new mode 100644 index 4d0a6369c..9ce1f7ceb --- a/queries/aws_inspector_finding_6.yaml +++ b/queries/aws_inspector_finding_6.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n title,\n asset_attributes ->> 'AgentId' as agent_id,\n\ - \ asset_attributes ->> 'AmiId' as ami_id,\n asset_attributes ->> 'Hostname'\ - \ as hostname,\n asset_attributes ->> 'Tags' as tags\nfrom\n aws_inspector_finding;" + QueryToExecute: | + SELECT + id, + title, + asset_attributes ->> 'AgentId' AS agent_id, + asset_attributes ->> 'AmiId' AS ami_id, + asset_attributes ->> 'Hostname' AS hostname, + asset_attributes ->> 'Tags' AS tags + FROM + aws_inspector_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: Find AWS Inspector Findings with Detailed Information + - Amazon Inspector +Title: Find AWS Inspector Findings with Detailed Information \ No newline at end of file diff --git a/queries/aws_inspector_finding_7.yaml b/queries/aws_inspector_finding_7.yaml old mode 100755 new mode 100644 index 7590b13bc..141d2ebd0 --- a/queries/aws_inspector_finding_7.yaml +++ b/queries/aws_inspector_finding_7.yaml @@ -1,27 +1,37 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct i.instance_id,\n i.instance_state,\n i.instance_type,\n\ - \ f.title,\n f.service,\n f.severity,\n f.confidence\nfrom\n aws_ec2_instance\ - \ as i,\n aws_inspector_finding as f\nwhere\n severity = 'High'\nand\n i.instance_id\ - \ = f.agent_id;" + QueryToExecute: | + SELECT DISTINCT + i.instance_id, + i.instance_state, + i.instance_type, + f.title, + f.service, + f.severity, + f.confidence + FROM + aws_ec2_instance AS i, + aws_inspector_finding AS f + WHERE + severity = 'High' + AND + i.instance_id = f.agent_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: List all High Severity AWS Inspector Findings + - Amazon Inspector +Title: List all High Severity AWS Inspector Findings \ No newline at end of file diff --git a/queries/aws_inspector_finding_8.yaml b/queries/aws_inspector_finding_8.yaml old mode 100755 new mode 100644 index 5e5f92811..5ed8b908a --- a/queries/aws_inspector_finding_8.yaml +++ b/queries/aws_inspector_finding_8.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n title,\n service_attributes ->> 'AssessmentRunArn'\ - \ as assessment_run_arn,\n service_attributes ->> 'RulesPackageArn' as rules_package_arn,\n\ - \ service_attributes ->> 'SchemaVersion' as schema_version,\nfrom\n aws_inspector_finding;" + QueryToExecute: | + SELECT + id, + title, + service_attributes ->> 'AssessmentRunArn' AS assessment_run_arn, + service_attributes ->> 'RulesPackageArn' AS rules_package_arn, + service_attributes ->> 'SchemaVersion' AS schema_version + FROM + aws_inspector_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Inspector -Title: Find all Detailed Information on AWS Inspector Findings + - AWS Inspector +Title: Find all Detailed Information on AWS Inspector Findings \ No newline at end of file diff --git a/queries/aws_inspector_finding_9.yaml b/queries/aws_inspector_finding_9.yaml old mode 100755 new mode 100644 index 387d7e7e3..6f11470c2 --- a/queries/aws_inspector_finding_9.yaml +++ b/queries/aws_inspector_finding_9.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS Inspector Findings to obtain detailed information - about the Amazon Inspector findings that are generated during the assessment of - the target applications. +Description: Allows users to query AWS Inspector Findings to obtain detailed information about the Amazon Inspector findings that are generated during the assessment of the target applications. ID: aws_inspector_finding_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.id,\n r.title,\n f.service_attributes ->> 'AssessmentRunArn'\ - \ as assessment_run_arn,\n r.assessment_template_arn,\n r.finding_counts\nfrom\n\ - \ aws_inspector_finding as f,\n aws_inspector_assessment_run as r\nwhere\n \ - \ f.service_attributes ->> 'AssessmentRunArn' = r.arn;" + QueryToExecute: | + SELECT + f.id, + r.title, + f.service_attributes ->> 'AssessmentRunArn' AS assessment_run_arn, + r.assessment_template_arn, + r.finding_counts + FROM + aws_inspector_finding AS f, + aws_inspector_assessment_run AS r + WHERE + f.service_attributes ->> 'AssessmentRunArn' = r.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Inspector -Title: Find AWS Inspector Findings with Detailed Information + - Amazon Inspector +Title: Find AWS Inspector Findings with Detailed Information \ No newline at end of file diff --git a/queries/aws_iot_fleet_metric_1.yaml b/queries/aws_iot_fleet_metric_1.yaml old mode 100755 new mode 100644 index aeb8eedd0..29ca890ae --- a/queries/aws_iot_fleet_metric_1.yaml +++ b/queries/aws_iot_fleet_metric_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each - fleet metric''s configuration, including ARN, creation date, and aggregation information. +Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each fleet metric's configuration, including ARN, creation date, and aggregation information. ID: aws_iot_fleet_metric_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n arn,\n index_name,\n creation_date,\n\ - \ last_modified_date\nfrom\n aws_iot_fleet_metric;" + QueryToExecute: | + SELECT + metric_name, + arn, + index_name, + creation_date, + last_modified_date + FROM + aws_iot_fleet_metric; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT Fleet Metrics -Title: List all AWS IoT Fleet Metrics with details + - IoT Fleet Metrics +Title: List all AWS IoT Fleet Metrics with details \ No newline at end of file diff --git a/queries/aws_iot_fleet_metric_2.yaml b/queries/aws_iot_fleet_metric_2.yaml old mode 100755 new mode 100644 index e1771cade..0b5ce3db0 --- a/queries/aws_iot_fleet_metric_2.yaml +++ b/queries/aws_iot_fleet_metric_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each - fleet metric''s configuration, including ARN, creation date, and aggregation information. +Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each fleet metric's configuration, including ARN, creation date, and aggregation information. ID: aws_iot_fleet_metric_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n aggregation_field,\n creation_date,\n\ - \ aggregation_type_name,\n query_string\nfrom\n aws_iot_fleet_metric\ngroup\ - \ by\n aggregation_type_name;" + QueryToExecute: | + SELECT + metric_name, + aggregation_field, + creation_date, + aggregation_type_name, + query_string + FROM + aws_iot_fleet_metric + GROUP BY + aggregation_type_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT Fleet Metrics -Title: List all AWS IoT Fleet Metrics Configuration and Aggregation + - IoT Fleet Metrics +Title: List all AWS IoT Fleet Metrics Configuration and Aggregation \ No newline at end of file diff --git a/queries/aws_iot_fleet_metric_3.yaml b/queries/aws_iot_fleet_metric_3.yaml old mode 100755 new mode 100644 index f1a95b58d..d614e834a --- a/queries/aws_iot_fleet_metric_3.yaml +++ b/queries/aws_iot_fleet_metric_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each - fleet metric''s configuration, including ARN, creation date, and aggregation information. +Description: Allows users to query AWS IoT Fleet Metrics to gain insights into each fleet metric's configuration, including ARN, creation date, and aggregation information. ID: aws_iot_fleet_metric_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n metric_name,\n index_name,\n creation_date,\n last_modified_date,\n\ - \ query_version,\n version\nfrom\n aws_iot_fleet_metric\nwhere\n last_modified_date\ - \ >= now() - interval '30 days';" + QueryToExecute: | + SELECT + metric_name, + index_name, + creation_date, + last_modified_date, + query_version, + version + FROM + aws_iot_fleet_metric + WHERE + last_modified_date >= NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS IoT Fleet Metrics -Title: List all AWS IoT Fleet Metrics with Details from Last 30 Days + - AWS IoT Fleet Metrics +Title: List all AWS IoT Fleet Metrics with Details from Last 30 Days \ No newline at end of file diff --git a/queries/aws_iot_thing_1.yaml b/queries/aws_iot_thing_1.yaml old mode 100755 new mode 100644 index 631035112..4f077c510 --- a/queries/aws_iot_thing_1.yaml +++ b/queries/aws_iot_thing_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Internet of Things to retrieve detailed information - about the the virtual model of a physical device with in an AWS account. +Description: Allows users to query AWS Internet of Things to retrieve detailed information about the virtual model of a physical device within an AWS account. ID: aws_iot_thing_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_name,\n thing_id,\n arn,\n thing_type_name,\n\ - \ version\nfrom\n aws_iot_thing;" + QueryToExecute: | + SELECT + thing_name, + thing_id, + arn, + thing_type_name, + version + FROM + aws_iot_thing; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Internet of Things -Title: List all IoT Things with Details from AWS Account + - Internet of Things +Title: List all IoT Things with Details from AWS Account \ No newline at end of file diff --git a/queries/aws_iot_thing_2.yaml b/queries/aws_iot_thing_2.yaml old mode 100755 new mode 100644 index 992799e3d..9515fb1c8 --- a/queries/aws_iot_thing_2.yaml +++ b/queries/aws_iot_thing_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Internet of Things to retrieve detailed information - about the the virtual model of a physical device with in an AWS account. +Description: Allows users to query AWS Internet of Things to retrieve detailed information about the virtual model of a physical device within an AWS account. ID: aws_iot_thing_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_name,\n thing_id,\n arn,\n thing_type_name,\n\ - \ version\nfrom\n aws_iot_thing\nwhere\n attribute_name = 'foo';" + QueryToExecute: | + SELECT + thing_name, + thing_id, + arn, + thing_type_name, + version + FROM + aws_iot_thing + WHERE + attribute_name = 'foo'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS IoT -Title: Find AWS IoT details for virtual device models + - AWS IoT +Title: Find AWS IoT details for virtual device models \ No newline at end of file diff --git a/queries/aws_iot_thing_3.yaml b/queries/aws_iot_thing_3.yaml old mode 100755 new mode 100644 index c5ee4149a..8c3d115b3 --- a/queries/aws_iot_thing_3.yaml +++ b/queries/aws_iot_thing_3.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Internet of Things to retrieve detailed information - about the the virtual model of a physical device with in an AWS account. +Description: Allows users to query AWS Internet of Things to retrieve detailed information about the virtual model of a physical device within an AWS account. ID: aws_iot_thing_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_name,\n arn,\n thing_id,\n thing_type_name,\n\ - \ attribute_value\nfrom\n aws_iot_thing\nwhere\n thing_type_name = 'foo';" + QueryToExecute: | + SELECT + thing_name, + arn, + thing_id, + thing_type_name, + attribute_value + FROM + aws_iot_thing + WHERE + thing_type_name = 'foo'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Internet of Things -Title: List all AWS IoT things and attribute value details + - Internet of Things +Title: List all AWS IoT things and attribute value details \ No newline at end of file diff --git a/queries/aws_iot_thing_group_1.yaml b/queries/aws_iot_thing_group_1.yaml old mode 100755 new mode 100644 index 893c3f235..76e4a3e3c --- a/queries/aws_iot_thing_group_1.yaml +++ b/queries/aws_iot_thing_group_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS IoT Thing Group to gain insights into each - group''s configuration, including ARN, creation date, version of the group, and - parent of the groups. +Description: Allows users to query AWS IoT Thing Group to gain insights into each group's configuration, including ARN, creation date, version of the group, and parent of the groups. ID: aws_iot_thing_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n thing_group_id,\n thing_group_description,\n\ - \ arn,\n creation_date,\n parent_group_name\nfrom\n aws_iot_thing_group;" + QueryToExecute: | + SELECT + group_name, + thing_group_id, + thing_group_description, + arn, + creation_date, + parent_group_name + FROM + aws_iot_thing_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT -Title: List insights into AWS IoT Thing Group configuration + - IoT +Title: List insights into AWS IoT Thing Group configuration \ No newline at end of file diff --git a/queries/aws_iot_thing_group_2.yaml b/queries/aws_iot_thing_group_2.yaml old mode 100755 new mode 100644 index d1fd4e23e..91517e07b --- a/queries/aws_iot_thing_group_2.yaml +++ b/queries/aws_iot_thing_group_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS IoT Thing Group to gain insights into each - group''s configuration, including ARN, creation date, version of the group, and - parent of the groups. +Description: Allows users to query AWS IoT Thing Group to gain insights into each group's configuration, including ARN, creation date, version of the group, and parent of the groups. ID: aws_iot_thing_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n thing_group_id,\n creation_date,\n parent_group_name,\n\ - \ version\nfrom\n aws_iot_thing_group\nwhere\n parent_group_name = 'foo';" + QueryToExecute: | + SELECT + group_name, + thing_group_id, + creation_date, + parent_group_name, + version + FROM + aws_iot_thing_group + WHERE + parent_group_name = 'foo'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS IoT -Title: List all AWS IoT Thing Group Configurations + - AWS IoT +Title: List all AWS IoT Thing Group Configurations \ No newline at end of file diff --git a/queries/aws_iot_thing_group_3.yaml b/queries/aws_iot_thing_group_3.yaml old mode 100755 new mode 100644 index 8eb929cdd..27920df6c --- a/queries/aws_iot_thing_group_3.yaml +++ b/queries/aws_iot_thing_group_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS IoT Thing Group to gain insights into each - group''s configuration, including ARN, creation date, version of the group, and - parent of the groups. +Description: Allows users to query AWS IoT Thing Group to gain insights into each group's configuration, including ARN, creation date, version of the group, and parent of the groups. ID: aws_iot_thing_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n thing_group_id,\n parent_group_name,\n\ - \ creation_date,\n status\nfrom\n aws_iot_thing_group\nwhere\n creation_date\ - \ >= now() - interval '30 days';" + QueryToExecute: | + SELECT + group_name, + thing_group_id, + parent_group_name, + creation_date, + status + FROM + aws_iot_thing_group + WHERE + creation_date >= NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT -Title: List all AWS IoT Thing Group Configurations + - IoT +Title: List all AWS IoT Thing Group Configurations \ No newline at end of file diff --git a/queries/aws_iot_thing_group_4.yaml b/queries/aws_iot_thing_group_4.yaml old mode 100755 new mode 100644 index 0f09dbb5a..ad82eddc3 --- a/queries/aws_iot_thing_group_4.yaml +++ b/queries/aws_iot_thing_group_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS IoT Thing Group to gain insights into each - group''s configuration, including ARN, creation date, version of the group, and - parent of the groups. +Description: Allows users to query AWS IoT Thing Group to gain insights into each group's configuration, including ARN, creation date, version of the group, and parent of the groups. ID: aws_iot_thing_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n thing_group_id,\n query_string,\n query_version,\n\ - \ status\nfrom\n aws_iot_thing_group\nwhere\n status = 'ACTIVE';" + QueryToExecute: | + SELECT + group_name, + thing_group_id, + query_string, + query_version, + status + FROM + aws_iot_thing_group + WHERE + status = 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS IoT Thing Group -Title: Find AWS IoT Thing Group Configurations and Details + - AWS IoT Thing Group +Title: Find AWS IoT Thing Group Configurations and Details \ No newline at end of file diff --git a/queries/aws_iot_thing_type_1.yaml b/queries/aws_iot_thing_type_1.yaml old mode 100755 new mode 100644 index 652de1b7c..7faba346b --- a/queries/aws_iot_thing_type_1.yaml +++ b/queries/aws_iot_thing_type_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS IoT Thing Type to gain insights into each thing - type''s configuration, including ARN, name, creation date, and deprecation status. +Description: Allows users to query AWS IoT Thing Type to gain insights into each thing type's configuration, including ARN, name, creation date, and deprecation status. ID: aws_iot_thing_type_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_type_name,\n arn,\n thing_type_id,\n thing_type_description,\n\ - \ creation_date\nfrom\n aws_iot_thing_type;" + QueryToExecute: | + SELECT + thing_type_name, + arn, + thing_type_id, + thing_type_description, + creation_date + FROM + aws_iot_thing_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT -Title: Find all AWS IoT Thing Types and Configurations + - IoT +Title: Find all AWS IoT Thing Types and Configurations \ No newline at end of file diff --git a/queries/aws_iot_thing_type_2.yaml b/queries/aws_iot_thing_type_2.yaml old mode 100755 new mode 100644 index 1a3883018..c8f388ad1 --- a/queries/aws_iot_thing_type_2.yaml +++ b/queries/aws_iot_thing_type_2.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS IoT Thing Type to gain insights into each thing - type''s configuration, including ARN, name, creation date, and deprecation status. +Description: Allows users to query AWS IoT Thing Type to gain insights into each thing type's configuration, including ARN, name, creation date, and deprecation status. ID: aws_iot_thing_type_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_type_name,\n arn,\n thing_type_id,\n thing_type_description,\n\ - \ creation_date,\n deprecated\nfrom\n aws_iot_thing_type\nwhere\n deprecated;" + QueryToExecute: | + SELECT + thing_type_name, + arn, + thing_type_id, + thing_type_description, + creation_date, + deprecated + FROM + aws_iot_thing_type + WHERE + deprecated; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS IoT Thing Type -Title: List AWS IoT Thing Types and Their Configurations + - AWS IoT Thing Type +Title: List AWS IoT Thing Types and Their Configurations \ No newline at end of file diff --git a/queries/aws_iot_thing_type_3.yaml b/queries/aws_iot_thing_type_3.yaml old mode 100755 new mode 100644 index 385e606a2..3d9d32bf0 --- a/queries/aws_iot_thing_type_3.yaml +++ b/queries/aws_iot_thing_type_3.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS IoT Thing Type to gain insights into each thing - type''s configuration, including ARN, name, creation date, and deprecation status. +Description: Allows users to query AWS IoT Thing Type to gain insights into each thing type's configuration, including ARN, name, creation date, and deprecation status. ID: aws_iot_thing_type_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_type_name,\n arn,\n thing_type_id,\n thing_type_description,\n\ - \ creation_date,\n deprecated,\n searchable_attributes\nfrom\n aws_iot_thing_type\n\ - where\n creation_date >= now() - interval '30 days';" + QueryToExecute: | + SELECT + thing_type_name, + arn, + thing_type_id, + thing_type_description, + creation_date, + deprecated, + searchable_attributes + FROM + aws_iot_thing_type + WHERE + creation_date >= NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT -Title: List all AWS IoT Thing Types with Configuration Details + - IoT +Title: List all AWS IoT Thing Types with Configuration Details \ No newline at end of file diff --git a/queries/aws_iot_thing_type_4.yaml b/queries/aws_iot_thing_type_4.yaml old mode 100755 new mode 100644 index bf64a9ed0..27936f8fd --- a/queries/aws_iot_thing_type_4.yaml +++ b/queries/aws_iot_thing_type_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS IoT Thing Type to gain insights into each thing - type''s configuration, including ARN, name, creation date, and deprecation status. +Description: Allows users to query AWS IoT Thing Type to gain insights into each thing type's configuration, including ARN, name, creation date, and deprecation status. ID: aws_iot_thing_type_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n thing_type_name,\n arn,\n thing_type_id,\n creation_date,\n\ - \ tags,\n deprecation_date\nfrom\n aws_iot_thing_type\nwhere\n deprecation_date\ - \ <= now() - interval '30 days';" + QueryToExecute: | + SELECT + thing_type_name, + arn, + thing_type_id, + creation_date, + tags, + deprecation_date + FROM + aws_iot_thing_type + WHERE + deprecation_date <= NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - IoT -Title: Find All AWS IoT Thing Types with Configuration Insights + - IoT +Title: Find All AWS IoT Thing Types with Configuration Insights \ No newline at end of file diff --git a/queries/aws_kinesis_consumer_1.yaml b/queries/aws_kinesis_consumer_1.yaml old mode 100755 new mode 100644 index d57bc96ad..011a28395 --- a/queries/aws_kinesis_consumer_1.yaml +++ b/queries/aws_kinesis_consumer_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Kinesis Consumers. This table provides information - about Kinesis Consumers within AWS Kinesis Data Streams. It enables users to gather - insights on consumers such as consumer ARN, creation timestamp, stream ARN and more. +Description: Allows users to query AWS Kinesis Consumers. This table provides information about Kinesis Consumers within AWS Kinesis Data Streams. It enables users to gather insights on consumers such as consumer ARN, creation timestamp, stream ARN and more. ID: aws_kinesis_consumer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n consumer_name,\n consumer_arn,\n consumer_status,\n\ - \ stream_arn\nfrom\n aws_kinesis_consumer;" + QueryToExecute: | + SELECT + consumer_name, + consumer_arn, + consumer_status, + stream_arn + FROM + aws_kinesis_consumer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Data Streams -Title: List All AWS Kinesis Consumers and Their Details + - Kinesis Data Streams +Title: List All AWS Kinesis Consumers and Their Details \ No newline at end of file diff --git a/queries/aws_kinesis_consumer_2.yaml b/queries/aws_kinesis_consumer_2.yaml old mode 100755 new mode 100644 index 4aa37bab4..3f0959ec4 --- a/queries/aws_kinesis_consumer_2.yaml +++ b/queries/aws_kinesis_consumer_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Kinesis Consumers. This table provides information - about Kinesis Consumers within AWS Kinesis Data Streams. It enables users to gather - insights on consumers such as consumer ARN, creation timestamp, stream ARN and more. +Description: Allows users to query AWS Kinesis Consumers. This table provides information about Kinesis Consumers within AWS Kinesis Data Streams. It enables users to gather insights on consumers such as consumer ARN, creation timestamp, stream ARN and more. ID: aws_kinesis_consumer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n consumer_name,\n consumer_status,\n consumer_arn\n\ - from\n aws_kinesis_consumer\nwhere\n consumer_status != 'ACTIVE'" + QueryToExecute: | + SELECT + consumer_name, + consumer_status, + consumer_arn + FROM + aws_kinesis_consumer + WHERE + consumer_status != 'ACTIVE' Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Data Streams -Title: List all AWS Kinesis Consumers and their Status + - Kinesis Data Streams +Title: List all AWS Kinesis Consumers and their Status \ No newline at end of file diff --git a/queries/aws_kinesis_firehose_delivery_stream_1.yaml b/queries/aws_kinesis_firehose_delivery_stream_1.yaml old mode 100755 new mode 100644 index e7ccc15d2..b668569c5 --- a/queries/aws_kinesis_firehose_delivery_stream_1.yaml +++ b/queries/aws_kinesis_firehose_delivery_stream_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing - detailed information about each delivery stream in the AWS account. +Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing detailed information about each delivery stream in the AWS account. ID: aws_kinesis_firehose_delivery_stream_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n delivery_stream_name,\n arn,\n create_timestamp,\n\ - \ delivery_stream_type\nfrom\n aws_kinesis_firehose_delivery_stream;" + QueryToExecute: | + SELECT + delivery_stream_name, + arn, + create_timestamp, + delivery_stream_type + FROM + aws_kinesis_firehose_delivery_stream; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Firehose -Title: List all AWS Kinesis Firehose Delivery Stream Details + - Kinesis Firehose +Title: List all AWS Kinesis Firehose Delivery Stream Details \ No newline at end of file diff --git a/queries/aws_kinesis_firehose_delivery_stream_2.yaml b/queries/aws_kinesis_firehose_delivery_stream_2.yaml old mode 100755 new mode 100644 index 64a790f56..4d83c6636 --- a/queries/aws_kinesis_firehose_delivery_stream_2.yaml +++ b/queries/aws_kinesis_firehose_delivery_stream_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing - detailed information about each delivery stream in the AWS account. +Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing detailed information about each delivery stream in the AWS account. ID: aws_kinesis_firehose_delivery_stream_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n delivery_stream_name,\n arn,\n delivery_stream_status,\n\ - \ create_timestamp,\n delivery_stream_type\nfrom\n aws_kinesis_firehose_delivery_stream\n\ - where\n delivery_stream_status != 'ACTIVE';" + QueryToExecute: | + SELECT + delivery_stream_name, + arn, + delivery_stream_status, + create_timestamp, + delivery_stream_type + FROM + aws_kinesis_firehose_delivery_stream + WHERE + delivery_stream_status != 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Firehose -Title: List Delivery Streams for AWS Kinesis Firehose + - Kinesis Firehose +Title: List Delivery Streams for AWS Kinesis Firehose \ No newline at end of file diff --git a/queries/aws_kinesis_firehose_delivery_stream_3.yaml b/queries/aws_kinesis_firehose_delivery_stream_3.yaml old mode 100755 new mode 100644 index 6855d8f84..a629d4f9e --- a/queries/aws_kinesis_firehose_delivery_stream_3.yaml +++ b/queries/aws_kinesis_firehose_delivery_stream_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing - detailed information about each delivery stream in the AWS account. +Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing detailed information about each delivery stream in the AWS account. ID: aws_kinesis_firehose_delivery_stream_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n delivery_stream_name,\n arn,\n delivery_stream_status,\n\ - \ create_timestamp,\n delivery_stream_type,\n delivery_stream_encryption_configuration\ - \ ->> 'Status' as encryption_status\nfrom\n aws_kinesis_firehose_delivery_stream\n\ - where\n delivery_stream_encryption_configuration ->> 'Status' = 'DISABLED';" + QueryToExecute: | + SELECT + delivery_stream_name, + arn, + delivery_stream_status, + create_timestamp, + delivery_stream_type, + delivery_stream_encryption_configuration ->> 'Status' AS encryption_status + FROM + aws_kinesis_firehose_delivery_stream + WHERE + delivery_stream_encryption_configuration ->> 'Status' = 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Firehose -Title: List all AWS Kinesis Firehose Delivery Stream details + - Kinesis Firehose +Title: List all AWS Kinesis Firehose Delivery Stream details \ No newline at end of file diff --git a/queries/aws_kinesis_firehose_delivery_stream_4.yaml b/queries/aws_kinesis_firehose_delivery_stream_4.yaml old mode 100755 new mode 100644 index 66a46df1b..16db869d5 --- a/queries/aws_kinesis_firehose_delivery_stream_4.yaml +++ b/queries/aws_kinesis_firehose_delivery_stream_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing - detailed information about each delivery stream in the AWS account. +Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing detailed information about each delivery stream in the AWS account. ID: aws_kinesis_firehose_delivery_stream_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n delivery_stream_name,\n arn,\n delivery_stream_status,\n\ - \ create_timestamp,\n delivery_stream_type\nfrom\n aws_kinesis_firehose_delivery_stream\n\ - where\n delivery_stream_type = 'DirectPut';" + QueryToExecute: | + SELECT + delivery_stream_name, + arn, + delivery_stream_status, + create_timestamp, + delivery_stream_type + FROM + aws_kinesis_firehose_delivery_stream + WHERE + delivery_stream_type = 'DirectPut'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Firehose -Title: List all AWS Kinesis Firehose Delivery Stream details + - Kinesis Firehose +Title: List all AWS Kinesis Firehose Delivery Stream details \ No newline at end of file diff --git a/queries/aws_kinesis_firehose_delivery_stream_5.yaml b/queries/aws_kinesis_firehose_delivery_stream_5.yaml old mode 100755 new mode 100644 index 67c91cc80..6ee6c3882 --- a/queries/aws_kinesis_firehose_delivery_stream_5.yaml +++ b/queries/aws_kinesis_firehose_delivery_stream_5.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing - detailed information about each delivery stream in the AWS account. +Description: Allows users to query AWS Kinesis Firehose Delivery Stream data, providing detailed information about each delivery stream in the AWS account. ID: aws_kinesis_firehose_delivery_stream_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n delivery_stream_name,\n arn,\n delivery_stream_status,\n\ - \ delivery_stream_type,\n failure_description\nfrom\n aws_kinesis_firehose_delivery_stream\n\ - where\n failure_description is not null;" + QueryToExecute: | + SELECT + delivery_stream_name, + arn, + delivery_stream_status, + delivery_stream_type, + failure_description + FROM + aws_kinesis_firehose_delivery_stream + WHERE + failure_description IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Firehose -Title: List all AWS Kinesis Firehose Delivery Stream details + - Kinesis Firehose +Title: List all AWS Kinesis Firehose Delivery Stream details \ No newline at end of file diff --git a/queries/aws_kinesis_stream_1.yaml b/queries/aws_kinesis_stream_1.yaml old mode 100755 new mode 100644 index f7ffaeb71..739041543 --- a/queries/aws_kinesis_stream_1.yaml +++ b/queries/aws_kinesis_stream_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Kinesis Stream data, including stream name, - status, creation time, and associated tags. +Description: Allows users to query AWS Kinesis Stream data, including stream name, status, creation time, and associated tags. ID: aws_kinesis_stream_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n stream_status,\n consumer_count,\n\ - \ stream_creation_timestamp,\n region\nfrom\n aws_kinesis_stream;" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + stream_status, + consumer_count, + stream_creation_timestamp, + region + FROM + aws_kinesis_stream; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Stream -Title: List all AWS Kinesis Stream data and its details + - Kinesis Stream +Title: List all AWS Kinesis Stream data and its details \ No newline at end of file diff --git a/queries/aws_kinesis_stream_2.yaml b/queries/aws_kinesis_stream_2.yaml old mode 100755 new mode 100644 index 993794e2d..6f9c7a937 --- a/queries/aws_kinesis_stream_2.yaml +++ b/queries/aws_kinesis_stream_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Kinesis Stream data, including stream name, - status, creation time, and associated tags. +Description: Allows users to query AWS Kinesis Stream data, including stream name, status, creation time, and associated tags. ID: aws_kinesis_stream_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n stream_status,\n consumer_count,\n\ - \ stream_creation_timestamp,\n region\nfrom\n aws_kinesis_stream\nwhere\n \ - \ stream_status != 'ACTIVE';" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + stream_status, + consumer_count, + stream_creation_timestamp, + region + FROM + aws_kinesis_stream + WHERE + stream_status != 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Stream -Title: List Attributes of AWS Kinesis Streams Excluding Active Status + - Kinesis Stream +Title: List Attributes of AWS Kinesis Streams Excluding Active Status \ No newline at end of file diff --git a/queries/aws_kinesis_stream_3.yaml b/queries/aws_kinesis_stream_3.yaml old mode 100755 new mode 100644 index 78c87e16a..1ef55f05a --- a/queries/aws_kinesis_stream_3.yaml +++ b/queries/aws_kinesis_stream_3.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Kinesis Stream data, including stream name, - status, creation time, and associated tags. +Description: Allows users to query AWS Kinesis Stream data, including stream name, status, creation time, and associated tags. ID: aws_kinesis_stream_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n stream_status,\n consumer_count,\n\ - \ stream_creation_timestamp,\n region\nfrom\n aws_kinesis_stream\nwhere\n \ - \ consumer_count = 0;" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + stream_status, + consumer_count, + stream_creation_timestamp, + region + FROM + aws_kinesis_stream + WHERE + consumer_count = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Stream -Title: List all AWS Kinesis Streams with Consumer Count Zero + - Kinesis Stream +Title: List all AWS Kinesis Streams with Consumer Count Zero \ No newline at end of file diff --git a/queries/aws_kinesis_stream_4.yaml b/queries/aws_kinesis_stream_4.yaml old mode 100755 new mode 100644 index d7bb0cef1..6381be1ef --- a/queries/aws_kinesis_stream_4.yaml +++ b/queries/aws_kinesis_stream_4.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Kinesis Stream data, including stream name, - status, creation time, and associated tags. +Description: Allows users to query AWS Kinesis Stream data, including stream name, status, creation time, and associated tags. ID: aws_kinesis_stream_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n encryption_type,\n key_id,\n\ - \ stream_creation_timestamp,\n region\nfrom\n aws_kinesis_stream\nwhere\n \ - \ encryption_type = 'NONE';" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + encryption_type, + key_id, + stream_creation_timestamp, + region + FROM + aws_kinesis_stream + WHERE + encryption_type = 'NONE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Stream -Title: List AWS Kinesis Stream details including name, status, and tags + - Kinesis Stream +Title: List AWS Kinesis Stream details including name, status, and tags \ No newline at end of file diff --git a/queries/aws_kinesis_stream_5.yaml b/queries/aws_kinesis_stream_5.yaml old mode 100755 new mode 100644 index 202857328..fe8132355 --- a/queries/aws_kinesis_stream_5.yaml +++ b/queries/aws_kinesis_stream_5.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Kinesis Stream data, including stream name, - status, creation time, and associated tags. +Description: Allows users to query AWS Kinesis Stream data, including stream name, status, creation time, and associated tags. ID: aws_kinesis_stream_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n encryption_type,\n key_id,\n\ - \ stream_creation_timestamp,\n region\nfrom\n aws_kinesis_stream\nwhere\n \ - \ encryption_type != 'NONE'\n and key_id = 'alias/aws/kinesis';" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + encryption_type, + key_id, + stream_creation_timestamp, + region + FROM + aws_kinesis_stream + WHERE + encryption_type != 'NONE' + AND key_id = 'alias/aws/kinesis'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Stream -Title: List all AWS Kinesis Stream Data Including Creation Time + - Kinesis Stream +Title: List all AWS Kinesis Stream Data Including Creation Time \ No newline at end of file diff --git a/queries/aws_kinesis_video_stream_1.yaml b/queries/aws_kinesis_video_stream_1.yaml old mode 100755 new mode 100644 index fb12b300e..8c918f4d7 --- a/queries/aws_kinesis_video_stream_1.yaml +++ b/queries/aws_kinesis_video_stream_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Kinesis Video Streams to obtain metadata about - each stream, including the stream''s ARN, creation time, status, and other information. +Description: Allows users to query Kinesis Video Streams to obtain metadata about each stream, including the stream's ARN, creation time, status, and other information. ID: aws_kinesis_video_stream_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n status,\n creation_time,\n\ - \ region\nfrom\n aws_kinesis_video_stream;" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + status, + creation_time, + region + FROM + aws_kinesis_video_stream; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Video Streams -Title: List metadata for AWS Kinesis Video Streams + - Kinesis Video Streams +Title: List metadata for AWS Kinesis Video Streams \ No newline at end of file diff --git a/queries/aws_kinesis_video_stream_2.yaml b/queries/aws_kinesis_video_stream_2.yaml old mode 100755 new mode 100644 index e52596869..1f977d93c --- a/queries/aws_kinesis_video_stream_2.yaml +++ b/queries/aws_kinesis_video_stream_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query Kinesis Video Streams to obtain metadata about - each stream, including the stream''s ARN, creation time, status, and other information. +Description: Allows users to query Kinesis Video Streams to obtain metadata about each stream, including the stream's ARN, creation time, status, and other information. ID: aws_kinesis_video_stream_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n status,\n creation_time,\n\ - \ region\nfrom\n aws_kinesis_video_stream\nwhere\n status != 'ACTIVE';" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + status, + creation_time, + region + FROM + aws_kinesis_video_stream + WHERE + status != 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Video Streams -Title: List All Metadata of AWS Kinesis Video Streams + - Kinesis Video Streams +Title: List All Metadata of AWS Kinesis Video Streams \ No newline at end of file diff --git a/queries/aws_kinesis_video_stream_3.yaml b/queries/aws_kinesis_video_stream_3.yaml old mode 100755 new mode 100644 index f9ca540db..89f5abe4a --- a/queries/aws_kinesis_video_stream_3.yaml +++ b/queries/aws_kinesis_video_stream_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query Kinesis Video Streams to obtain metadata about - each stream, including the stream''s ARN, creation time, status, and other information. +Description: Allows users to query Kinesis Video Streams to obtain metadata about each stream, including the stream's ARN, creation time, status, and other information. ID: aws_kinesis_video_stream_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n status,\n kms_key_id,\n\ - \ creation_time,\n region\nfrom\n aws_kinesis_video_stream\nwhere\n split_part(kms_key_id,\ - \ ':', 6) = 'alias/aws/kinesisvideo';" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + status, + kms_key_id, + creation_time, + region + FROM + aws_kinesis_video_stream + WHERE + split_part(kms_key_id, ':', 6) = 'alias/aws/kinesisvideo'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Video Streams -Title: List all AWS Kinesis Video Streams with metadata + - Kinesis Video Streams +Title: List all AWS Kinesis Video Streams with metadata \ No newline at end of file diff --git a/queries/aws_kinesis_video_stream_4.yaml b/queries/aws_kinesis_video_stream_4.yaml old mode 100755 new mode 100644 index b2b225b9f..13500b965 --- a/queries/aws_kinesis_video_stream_4.yaml +++ b/queries/aws_kinesis_video_stream_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query Kinesis Video Streams to obtain metadata about - each stream, including the stream''s ARN, creation time, status, and other information. +Description: Allows users to query Kinesis Video Streams to obtain metadata about each stream, including the stream's ARN, creation time, status, and other information. ID: aws_kinesis_video_stream_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n stream_name,\n stream_arn,\n status,\n creation_time,\n\ - \ data_retention_in_hours,\n region\nfrom\n aws_kinesis_video_stream\nwhere\n\ - \ data_retention_in_hours < 168;" + QueryToExecute: | + SELECT + stream_name, + stream_arn, + status, + creation_time, + data_retention_in_hours, + region + FROM + aws_kinesis_video_stream + WHERE + data_retention_in_hours < 168; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Video Stream -Title: List All Kinesis Video Streams Metadata from AWS + - Kinesis Video Stream +Title: List All Kinesis Video Streams Metadata from AWS \ No newline at end of file diff --git a/queries/aws_kinesisanalyticsv2_application_1.yaml b/queries/aws_kinesisanalyticsv2_application_1.yaml old mode 100755 new mode 100644 index e6f744b0e..9d3b5f3db --- a/queries/aws_kinesisanalyticsv2_application_1.yaml +++ b/queries/aws_kinesisanalyticsv2_application_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Kinesis Analytics Applications to retrieve - detailed information about each application, including the name, ARN, description, - status, runtime environment, and more. +Description: Allows users to query AWS Kinesis Analytics Applications to retrieve detailed information about each application, including the name, ARN, description, status, runtime environment, and more. ID: aws_kinesisanalyticsv2_application_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_arn,\n application_version_id,\n\ - \ application_status,\n application_description,\n service_execution_role,\n\ - \ runtime_environment\nfrom\n aws_kinesisanalyticsv2_application;" + QueryToExecute: | + SELECT + application_name, + application_arn, + application_version_id, + application_status, + application_description, + service_execution_role, + runtime_environment + FROM + aws_kinesisanalyticsv2_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Analytics -Title: List AWS Kinesis Analytics Applications with Details + - Kinesis Analytics +Title: List AWS Kinesis Analytics Applications with Details \ No newline at end of file diff --git a/queries/aws_kinesisanalyticsv2_application_2.yaml b/queries/aws_kinesisanalyticsv2_application_2.yaml old mode 100755 new mode 100644 index 26651d265..839aa9a1e --- a/queries/aws_kinesisanalyticsv2_application_2.yaml +++ b/queries/aws_kinesisanalyticsv2_application_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Kinesis Analytics Applications to retrieve - detailed information about each application, including the name, ARN, description, - status, runtime environment, and more. +Description: Allows users to query AWS Kinesis Analytics Applications to retrieve detailed information about each application, including the name, ARN, description, status, runtime environment, and more. ID: aws_kinesisanalyticsv2_application_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n application_version_id,\n application_arn,\n\ - \ application_status\nfrom\n aws_kinesisanalyticsv2_application\nwhere\n application_version_id\ - \ > 1;" + QueryToExecute: | + SELECT + application_name, + application_version_id, + application_arn, + application_status + FROM + aws_kinesisanalyticsv2_application + WHERE + application_version_id > 1; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Analytics -Title: Find AWS Kinesis Analytics Applications and Details + - Kinesis Analytics +Title: Find AWS Kinesis Analytics Applications and Details \ No newline at end of file diff --git a/queries/aws_kinesisanalyticsv2_application_3.yaml b/queries/aws_kinesisanalyticsv2_application_3.yaml old mode 100755 new mode 100644 index 991e02b1e..87a554e14 --- a/queries/aws_kinesisanalyticsv2_application_3.yaml +++ b/queries/aws_kinesisanalyticsv2_application_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Kinesis Analytics Applications to retrieve - detailed information about each application, including the name, ARN, description, - status, runtime environment, and more. +Description: Allows users to query AWS Kinesis Analytics Applications to retrieve detailed information about each application, including the name, ARN, description, status, runtime environment, and more. ID: aws_kinesisanalyticsv2_application_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n application_name,\n runtime_environment,\n application_arn,\n\ - \ application_status\nfrom\n aws_kinesisanalyticsv2_application\nwhere\n runtime_environment\ - \ = 'SQL-1_0';" + QueryToExecute: | + SELECT + application_name, + runtime_environment, + application_arn, + application_status + FROM + aws_kinesisanalyticsv2_application + WHERE + runtime_environment = 'SQL-1_0'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Kinesis Analytics -Title: Find AWS Kinesis Analytics Applications and Details + - Kinesis Analytics +Title: Find AWS Kinesis Analytics Applications and Details \ No newline at end of file diff --git a/queries/aws_kms_alias_1.yaml b/queries/aws_kms_alias_1.yaml old mode 100755 new mode 100644 index a40770b9f..ce09b4958 --- a/queries/aws_kms_alias_1.yaml +++ b/queries/aws_kms_alias_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS KMS aliases and retrieve information about - their associated keys, including the key ID, alias name, and alias ARN. +Description: Allows users to query AWS KMS aliases and retrieve information about their associated keys, including the key ID, alias name, and alias ARN. ID: aws_kms_alias_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n alias_name,\n title,\n arn,\n target_key_id,\n creation_date\n\ - from\n aws_kms_alias;" + QueryToExecute: | + SELECT + alias_name, + title, + arn, + target_key_id, + creation_date + FROM + aws_kms_alias; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Key Management Service (KMS) -Title: Find all AWS KMS alias details including keys + - Key Management Service (KMS) +Title: Find all AWS KMS alias details including keys \ No newline at end of file diff --git a/queries/aws_kms_alias_2.yaml b/queries/aws_kms_alias_2.yaml old mode 100755 new mode 100644 index 70a2cf1cf..65f306a99 --- a/queries/aws_kms_alias_2.yaml +++ b/queries/aws_kms_alias_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS KMS aliases and retrieve information about - their associated keys, including the key ID, alias name, and alias ARN. +Description: Allows users to query AWS KMS aliases and retrieve information about their associated keys, including the key ID, alias name, and alias ARN. ID: aws_kms_alias_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n k.id as key_id,\n k.key_rotation_enabled as key_rotation_enabled,\n\ - \ a.alias_name as alias_name,\n a.arn as alias_arn\nfrom\n aws_kms_key as k,\n\ - \ aws_kms_alias as a\nwhere\n k.id = a.target_key_id and not key_rotation_enabled;" + QueryToExecute: | + SELECT + k.id AS key_id, + k.key_rotation_enabled AS key_rotation_enabled, + a.alias_name AS alias_name, + a.arn AS alias_arn + FROM + aws_kms_key AS k, + aws_kms_alias AS a + WHERE + k.id = a.target_key_id + AND NOT key_rotation_enabled; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Key Management Service -Title: Find AWS KMS Alias and Associated Keys with SQL + - Key Management Service +Title: Find AWS KMS Alias and Associated Keys with SQL \ No newline at end of file diff --git a/queries/aws_kms_alias_3.yaml b/queries/aws_kms_alias_3.yaml old mode 100755 new mode 100644 index edda4d897..812a9f068 --- a/queries/aws_kms_alias_3.yaml +++ b/queries/aws_kms_alias_3.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS KMS aliases and retrieve information about - their associated keys, including the key ID, alias name, and alias ARN. +Description: Allows users to query AWS KMS aliases and retrieve information about their associated keys, including the key ID, alias name, and alias ARN. ID: aws_kms_alias_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.alias_name as alias_name,\n k.id as key_id,\n k.key_state\ - \ as key_state,\n k.deletion_date as key_deletion_date\nfrom\n aws_kms_key as\ - \ k,\n aws_kms_alias as a\nwhere\n k.id = a.target_key_id and key_state = 'PendingDeletion';" + QueryToExecute: | + SELECT + a.alias_name AS alias_name, + k.id AS key_id, + k.key_state AS key_state, + k.deletion_date AS key_deletion_date + FROM + aws_kms_key AS k, + aws_kms_alias AS a + WHERE + k.id = a.target_key_id + AND k.key_state = 'PendingDeletion'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Key Management Service -Title: List all AWS KMS aliases with key state pending deletion + - Key Management Service +Title: List all AWS KMS aliases with key state pending deletion \ No newline at end of file diff --git a/queries/aws_kms_alias_4.yaml b/queries/aws_kms_alias_4.yaml old mode 100755 new mode 100644 index 46eb8332d..18610f362 --- a/queries/aws_kms_alias_4.yaml +++ b/queries/aws_kms_alias_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS KMS aliases and retrieve information about - their associated keys, including the key ID, alias name, and alias ARN. +Description: Allows users to query AWS KMS aliases and retrieve information about their associated keys, including the key ID, alias name, and alias ARN. ID: aws_kms_alias_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n k.id as key_id,\n count(a.alias_name) as count\nfrom\n\ - \ aws_kms_key as k\n left join aws_kms_alias as a\n on k.id = a.target_key_id\n\ - group by\n key_id;" + QueryToExecute: | + SELECT + k.id AS key_id, + COUNT(a.alias_name) AS count + FROM + aws_kms_key AS k + LEFT JOIN aws_kms_alias AS a + ON k.id = a.target_key_id + GROUP BY + key_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: List all AWS KMS aliases and their associated keys + - KMS +Title: List all AWS KMS aliases and their associated keys \ No newline at end of file diff --git a/queries/aws_kms_key_1.yaml b/queries/aws_kms_key_1.yaml old mode 100755 new mode 100644 index 096fc9bf0..fb8ee45a0 --- a/queries/aws_kms_key_1.yaml +++ b/queries/aws_kms_key_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS KMS Key data including cryptographic details, - key usage, key state, and associated metadata. +Description: Allows users to query AWS KMS Key data including cryptographic details, key usage, key state, and associated metadata. ID: aws_kms_key_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n title,\n arn,\n key_manager,\n creation_date\n\ - from\n aws_kms_key;" + QueryToExecute: | + SELECT + id, + title, + arn, + key_manager, + creation_date + FROM + aws_kms_key; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS KMS -Title: List all AWS KMS Keys and their metadata + - AWS KMS +Title: List all AWS KMS Keys and their metadata \ No newline at end of file diff --git a/queries/aws_kms_key_2.yaml b/queries/aws_kms_key_2.yaml old mode 100755 new mode 100644 index fbc5e0c49..28ec9e44a --- a/queries/aws_kms_key_2.yaml +++ b/queries/aws_kms_key_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS KMS Key data including cryptographic details, - key usage, key state, and associated metadata. +Description: Allows users to query AWS KMS Key data including cryptographic details, key usage, key state, and associated metadata. ID: aws_kms_key_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n key_rotation_enabled\nfrom\n aws_kms_key\nwhere\n\ - \ not key_rotation_enabled;" + QueryToExecute: | + SELECT + id, + key_rotation_enabled + FROM + aws_kms_key + WHERE + NOT key_rotation_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: Find AWS KMS Key Data with Metadata & Key Usage + - KMS +Title: Find AWS KMS Key Data with Metadata & Key Usage \ No newline at end of file diff --git a/queries/aws_kms_key_3.yaml b/queries/aws_kms_key_3.yaml old mode 100755 new mode 100644 index 641702d43..c41a8c4d5 --- a/queries/aws_kms_key_3.yaml +++ b/queries/aws_kms_key_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS KMS Key data including cryptographic details, - key usage, key state, and associated metadata. +Description: Allows users to query AWS KMS Key data including cryptographic details, key usage, key state, and associated metadata. ID: aws_kms_key_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n key_state,\n deletion_date\nfrom\n aws_kms_key\n\ - where\n key_state = 'PendingDeletion';" + QueryToExecute: | + SELECT + id, + key_state, + deletion_date + FROM + aws_kms_key + WHERE + key_state = 'PendingDeletion'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS Key -Title: List AWS KMS Key data including cryptographic details + - KMS Key +Title: List AWS KMS Key data including cryptographic details \ No newline at end of file diff --git a/queries/aws_kms_key_4.yaml b/queries/aws_kms_key_4.yaml old mode 100755 new mode 100644 index dee6a7fb7..8801d3423 --- a/queries/aws_kms_key_4.yaml +++ b/queries/aws_kms_key_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS KMS Key data including cryptographic details, - key usage, key state, and associated metadata. +Description: Allows users to query AWS KMS Key data including cryptographic details, key usage, key state, and associated metadata. ID: aws_kms_key_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n enabled as key_enabled\nfrom\n aws_kms_key\n\ - where\n not enabled;" + QueryToExecute: | + SELECT + id, + enabled AS key_enabled + FROM + aws_kms_key + WHERE + NOT enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: List all AWS KMS Key data including key state and usage + - KMS +Title: List all AWS KMS Key data including key state and usage \ No newline at end of file diff --git a/queries/aws_kms_key_5.yaml b/queries/aws_kms_key_5.yaml old mode 100755 new mode 100644 index 324fe1c7b..9e4238182 --- a/queries/aws_kms_key_5.yaml +++ b/queries/aws_kms_key_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS KMS Key data including cryptographic details, - key usage, key state, and associated metadata. +Description: Allows users to query AWS KMS Key data including cryptographic details, key usage, key state, and associated metadata. ID: aws_kms_key_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key_manager,\n count(key_manager) as count\nfrom\n \ - \ aws_kms_key\ngroup by\n key_manager;" + QueryToExecute: | + SELECT + key_manager, + COUNT(key_manager) AS count + FROM + aws_kms_key + GROUP BY + key_manager; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: List all AWS KMS Key data with cryptographic details + - KMS +Title: List all AWS KMS Key data with cryptographic details \ No newline at end of file diff --git a/queries/aws_kms_key_rotation_1.yaml b/queries/aws_kms_key_rotation_1.yaml old mode 100755 new mode 100644 index ba778aa78..b1161fef3 --- a/queries/aws_kms_key_rotation_1.yaml +++ b/queries/aws_kms_key_rotation_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS KMS Key Rotation data including the rotation - schedule, type, and associated key details. +Description: Allows users to query AWS KMS Key Rotation data including the rotation schedule, type, and associated key details. ID: aws_kms_key_rotation_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key_id,\n key_arn,\n rotation_date,\n rotation_type\n\ - from\n aws_kms_key_rotation;" + QueryToExecute: | + SELECT + key_id, + key_arn, + rotation_date, + rotation_type + FROM + aws_kms_key_rotation; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: Find AWS KMS Key Rotation Schedule and Details + - KMS +Title: Find AWS KMS Key Rotation Schedule and Details \ No newline at end of file diff --git a/queries/aws_kms_key_rotation_2.yaml b/queries/aws_kms_key_rotation_2.yaml old mode 100755 new mode 100644 index ee200eb46..4f2eec753 --- a/queries/aws_kms_key_rotation_2.yaml +++ b/queries/aws_kms_key_rotation_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS KMS Key Rotation data including the rotation - schedule, type, and associated key details. +Description: Allows users to query AWS KMS Key Rotation data including the rotation schedule, type, and associated key details. ID: aws_kms_key_rotation_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key_id,\n key_arn,\n rotation_date\nfrom\n aws_kms_key_rotation\n\ - where\n rotation_date >= current_date - interval '30 days';" + QueryToExecute: | + SELECT + key_id, + key_arn, + rotation_date + FROM + aws_kms_key_rotation + WHERE + rotation_date >= CURRENT_DATE - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS KMS -Title: List all AWS KMS Key Rotation Data + - AWS KMS +Title: List all AWS KMS Key Rotation Data \ No newline at end of file diff --git a/queries/aws_kms_key_rotation_3.yaml b/queries/aws_kms_key_rotation_3.yaml old mode 100755 new mode 100644 index c2a55463e..84ffc333a --- a/queries/aws_kms_key_rotation_3.yaml +++ b/queries/aws_kms_key_rotation_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS KMS Key Rotation data including the rotation - schedule, type, and associated key details. +Description: Allows users to query AWS KMS Key Rotation data including the rotation schedule, type, and associated key details. ID: aws_kms_key_rotation_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n akr.key_id,\n ak.title,\n akr.rotation_date,\n akr.rotation_type,\n\ - \ ak.key_manager\nfrom\n aws_kms_key_rotation akr\njoin\n aws_kms_key ak\n\ - on\n akr.key_id = ak.id;" + QueryToExecute: | + SELECT + akr.key_id, + ak.title, + akr.rotation_date, + akr.rotation_type, + ak.key_manager + FROM + aws_kms_key_rotation akr + JOIN + aws_kms_key ak + ON + akr.key_id = ak.id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: List AWS KMS Key Rotation Details and Schedule + - KMS +Title: List AWS KMS Key Rotation Details and Schedule \ No newline at end of file diff --git a/queries/aws_kms_key_rotation_4.yaml b/queries/aws_kms_key_rotation_4.yaml old mode 100755 new mode 100644 index 613296802..85bb32a31 --- a/queries/aws_kms_key_rotation_4.yaml +++ b/queries/aws_kms_key_rotation_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS KMS Key Rotation data including the rotation - schedule, type, and associated key details. +Description: Allows users to query AWS KMS Key Rotation data including the rotation schedule, type, and associated key details. ID: aws_kms_key_rotation_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rotation_type,\n count(key_id) as count\nfrom\n aws_kms_key_rotation\n\ - group by\n rotation_type;" + QueryToExecute: | + SELECT + rotation_type, + COUNT(key_id) AS count + FROM + aws_kms_key_rotation + GROUP BY + rotation_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - KMS -Title: List AWS KMS Key Rotation Schedules and Types + - KMS +Title: List AWS KMS Key Rotation Schedules and Types \ No newline at end of file diff --git a/queries/aws_lambda_alias_1.yaml b/queries/aws_lambda_alias_1.yaml old mode 100755 new mode 100644 index ba7566988..dcd13cc37 --- a/queries/aws_lambda_alias_1.yaml +++ b/queries/aws_lambda_alias_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Lambda Alias, providing detailed information - about each alias associated with AWS Lambda functions. +Description: Allows users to query AWS Lambda Alias, providing detailed information about each alias associated with AWS Lambda functions. ID: aws_lambda_alias_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n function_name,\n function_version\nfrom\n \ - \ aws_lambda_alias;" + QueryToExecute: | + SELECT + name, + function_name, + function_version + FROM + aws_lambda_alias; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: List AWS Lambda Alias with detailed information + - AWS Lambda +Title: List AWS Lambda Alias with detailed information \ No newline at end of file diff --git a/queries/aws_lambda_alias_2.yaml b/queries/aws_lambda_alias_2.yaml old mode 100755 new mode 100644 index 32ee54841..1a2fd3f7d --- a/queries/aws_lambda_alias_2.yaml +++ b/queries/aws_lambda_alias_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Lambda Alias, providing detailed information - about each alias associated with AWS Lambda functions. +Description: Allows users to query AWS Lambda Alias, providing detailed information about each alias associated with AWS Lambda functions. ID: aws_lambda_alias_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n count(function_name) count\nfrom\n\ - \ aws_lambda_alias\ngroup by\n function_name;" + QueryToExecute: | + SELECT + function_name, + COUNT(function_name) AS count + FROM + aws_lambda_alias + GROUP BY + function_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: List all AWS Lambda Aliases with Detailed Information + - AWS Lambda +Title: List all AWS Lambda Aliases with Detailed Information \ No newline at end of file diff --git a/queries/aws_lambda_alias_3.yaml b/queries/aws_lambda_alias_3.yaml old mode 100755 new mode 100644 index e51d34ee5..e4211b613 --- a/queries/aws_lambda_alias_3.yaml +++ b/queries/aws_lambda_alias_3.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS Lambda Alias, providing detailed information - about each alias associated with AWS Lambda functions. +Description: Allows users to query AWS Lambda Alias, providing detailed information about each alias associated with AWS Lambda functions. ID: aws_lambda_alias_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_lambda_alias;" + QueryToExecute: | + SELECT + JSONB_PRETTY(policy) AS policy, + JSONB_PRETTY(policy_std) AS policy_std + FROM + aws_lambda_alias; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List all AWS Lambda Alias with detailed information + - Lambda +Title: List all AWS Lambda Alias with detailed information \ No newline at end of file diff --git a/queries/aws_lambda_alias_4.yaml b/queries/aws_lambda_alias_4.yaml old mode 100755 new mode 100644 index 29b6ee2ac..69a504686 --- a/queries/aws_lambda_alias_4.yaml +++ b/queries/aws_lambda_alias_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Lambda Alias, providing detailed information - about each alias associated with AWS Lambda functions. +Description: Allows users to query AWS Lambda Alias, providing detailed information about each alias associated with AWS Lambda functions. ID: aws_lambda_alias_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n function_name,\n jsonb_pretty(url_config) as\ - \ url_config\nfrom\n aws_lambda_alias;" + QueryToExecute: | + SELECT + name, + function_name, + JSONB_PRETTY(url_config) AS url_config + FROM + aws_lambda_alias; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: List all AWS Lambda Aliases and Configuration + - AWS Lambda +Title: List all AWS Lambda Aliases and Configuration \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_1.yaml b/queries/aws_lambda_event_source_mapping_1.yaml old mode 100755 new mode 100644 index 3fb7ab23d..9f3724db7 --- a/queries/aws_lambda_event_source_mapping_1.yaml +++ b/queries/aws_lambda_event_source_mapping_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n function_arn,\n function_name,\n last_processing_result,\n\ - \ parallelization_factor,\n state,\n destination_config\nfrom\n aws_lambda_event_source_mapping;" + QueryToExecute: | + SELECT + arn, + function_arn, + function_name, + last_processing_result, + parallelization_factor, + state, + destination_config + FROM + aws_lambda_event_source_mapping; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List AWS Lambda Event Source Mappings with Config Details + - Lambda +Title: List AWS Lambda Event Source Mappings with Config Details \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_2.yaml b/queries/aws_lambda_event_source_mapping_2.yaml old mode 100755 new mode 100644 index 55c0c0fd5..8e4e49fc8 --- a/queries/aws_lambda_event_source_mapping_2.yaml +++ b/queries/aws_lambda_event_source_mapping_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n state,\n last_modified,\n state_transition_reason\n\ - from\n aws_lambda_event_source_mapping\nwhere\n state = 'Disabled';" + QueryToExecute: | + SELECT + function_name, + state, + last_modified, + state_transition_reason + FROM + aws_lambda_event_source_mapping + WHERE + state = 'Disabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Event Source Mappings with SQL + - Lambda +Title: Find AWS Lambda Event Source Mappings with SQL \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_3.yaml b/queries/aws_lambda_event_source_mapping_3.yaml old mode 100755 new mode 100644 index 53217f925..b2e377d65 --- a/queries/aws_lambda_event_source_mapping_3.yaml +++ b/queries/aws_lambda_event_source_mapping_3.yaml @@ -1,20 +1,23 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n jsonb_array_elements_text(jsonb_extract_path(self_managed_event_source,\ - \ 'Endpoints', 'KAFKA_BOOTSTRAP_SERVERS'))\nfrom\n aws_lambda_event_source_mapping;" + QueryToExecute: | + SELECT + function_name, + jsonb_array_elements_text(jsonb_extract_path(self_managed_event_source, 'Endpoints', 'KAFKA_BOOTSTRAP_SERVERS')) + FROM + aws_lambda_event_source_mapping; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Event Source Mappings with SQL + - Lambda +Title: Find AWS Lambda Event Source Mappings with SQL \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_4.yaml b/queries/aws_lambda_event_source_mapping_4.yaml old mode 100755 new mode 100644 index fdbbb7575..1602d98c3 --- a/queries/aws_lambda_event_source_mapping_4.yaml +++ b/queries/aws_lambda_event_source_mapping_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n uuid,\n arn,\n a ->> 'Type' as source_access_type,\n\ - \ a ->> 'URL' as source_access_url\nfrom\n aws_lambda_event_source_mapping,\n\ - \ jsonb_array_elements(source_access_configurations) as a;" + QueryToExecute: | + SELECT + uuid, + arn, + a ->> 'Type' AS source_access_type, + a ->> 'URL' AS source_access_url + FROM + aws_lambda_event_source_mapping, + jsonb_array_elements(source_access_configurations) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Event Source Mappings and Configurations + - Lambda +Title: Find AWS Lambda Event Source Mappings and Configurations \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_5.yaml b/queries/aws_lambda_event_source_mapping_5.yaml old mode 100755 new mode 100644 index da23c0f52..f518226f4 --- a/queries/aws_lambda_event_source_mapping_5.yaml +++ b/queries/aws_lambda_event_source_mapping_5.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n uuid,\n arn,\n scaling_config ->> 'MaximumConcurrency'\ - \ as maximum_concurrency\nfrom\n aws_lambda_event_source_mapping;" + QueryToExecute: | + SELECT + uuid, + arn, + scaling_config ->> 'MaximumConcurrency' AS maximum_concurrency + FROM + aws_lambda_event_source_mapping; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List all AWS Lambda Event Source Mappings with Details + - Lambda +Title: List all AWS Lambda Event Source Mappings with Details \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_6.yaml b/queries/aws_lambda_event_source_mapping_6.yaml old mode 100755 new mode 100644 index 6628fd577..fd38baf13 --- a/queries/aws_lambda_event_source_mapping_6.yaml +++ b/queries/aws_lambda_event_source_mapping_6.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n uuid,\n function_name,\n destination_config ->> 'OnFailure'\ - \ as on_failure,\n destination_config ->> 'OnSuccess' as on_success\nfrom\n \ - \ aws_lambda_event_source_mapping;" + QueryToExecute: | + SELECT + uuid, + function_name, + destination_config ->> 'OnFailure' AS on_failure, + destination_config ->> 'OnSuccess' AS on_success + FROM + aws_lambda_event_source_mapping; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List all AWS Lambda Event Source Mappings and Configs + - Lambda +Title: List all AWS Lambda Event Source Mappings and Configs \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_7.yaml b/queries/aws_lambda_event_source_mapping_7.yaml old mode 100755 new mode 100644 index 970a63097..61cbad450 --- a/queries/aws_lambda_event_source_mapping_7.yaml +++ b/queries/aws_lambda_event_source_mapping_7.yaml @@ -1,5 +1,4 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_7 IntegrationType: - aws_cloud_account @@ -9,22 +8,22 @@ Query: Parameters: [] PrimaryTable: null QueryToExecute: | - select + SELECT uuid, arn, function_arn, state, - filter ->> 'Pattern' as filter_criteria_pattern - from + filter ->> 'Pattern' AS filter_criteria_pattern + FROM aws_lambda_event_source_mapping, - jsonb_array_elements(filter_criteria -> 'Filters') as filter - where - filter ->> 'Pattern' like '{ "Metadata" : [ 1, 2 ]}'; + jsonb_array_elements(filter_criteria -> 'Filters') AS filter + WHERE + filter ->> 'Pattern' LIKE '{ "Metadata" : [ 1, 2 ] }'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - aws cloud_service: - AWS Lambda -Title: Find AWS Lambda Event Source Mappings Configurations +Title: Find AWS Lambda Event Source Mappings Configurations \ No newline at end of file diff --git a/queries/aws_lambda_event_source_mapping_8.yaml b/queries/aws_lambda_event_source_mapping_8.yaml old mode 100755 new mode 100644 index cdb5554a3..6ebb4f451 --- a/queries/aws_lambda_event_source_mapping_8.yaml +++ b/queries/aws_lambda_event_source_mapping_8.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed - view of each mapping configuration. +Description: Allows users to query AWS Lambda Event Source Mappings, providing a detailed view of each mapping configuration. ID: aws_lambda_event_source_mapping_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n m.arn,\n m.function_arn,\n f.runtime,\n f.handler,\n\ - \ f.architectures\nfrom\n aws_lambda_event_source_mapping as m,\n aws_lambda_function\ - \ as f\nwhere\n f.name = m.function_name;" + QueryToExecute: | + SELECT + m.arn, + m.function_arn, + f.runtime, + f.handler, + f.architectures + FROM + aws_lambda_event_source_mapping AS m, + aws_lambda_function AS f + WHERE + f.name = m.function_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Event Source Mappings Configuration + - Lambda +Title: Find AWS Lambda Event Source Mappings Configuration \ No newline at end of file diff --git a/queries/aws_lambda_function_1.yaml b/queries/aws_lambda_function_1.yaml old mode 100755 new mode 100644 index 2bfd4ad90..37d6fb688 --- a/queries/aws_lambda_function_1.yaml +++ b/queries/aws_lambda_function_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n handler,\n kms_key_arn\nfrom\n aws_lambda_function;" + QueryToExecute: | + SELECT + name, + arn, + handler, + kms_key_arn + FROM + aws_lambda_function; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List AWS Lambda Function Configurations via SQL + - Lambda +Title: List AWS Lambda Function Configurations via SQL \ No newline at end of file diff --git a/queries/aws_lambda_function_10.yaml b/queries/aws_lambda_function_10.yaml old mode 100755 new mode 100644 index 305e3bd88..7082dd42a --- a/queries/aws_lambda_function_10.yaml +++ b/queries/aws_lambda_function_10.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n jsonb_pretty(tracing_config) as tracing_config\n\ - from\n aws_lambda_function\nwhere\n tracing_config ->> 'Mode' = 'PassThrough';" + QueryToExecute: | + SELECT + name, + arn, + JSONB_PRETTY(tracing_config) AS tracing_config + FROM + aws_lambda_function + WHERE + tracing_config ->> 'Mode' = 'PassThrough'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Functions with Specific Tracing Config + - Lambda +Title: Find AWS Lambda Functions with Specific Tracing Config \ No newline at end of file diff --git a/queries/aws_lambda_function_2.yaml b/queries/aws_lambda_function_2.yaml old mode 100755 new mode 100644 index b60ae95bc..6edcf5722 --- a/queries/aws_lambda_function_2.yaml +++ b/queries/aws_lambda_function_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n kms_key_arn\nfrom\n aws_lambda_function\nwhere\n\ - \ kms_key_arn is null;" + QueryToExecute: | + SELECT + name, + kms_key_arn + FROM + aws_lambda_function + WHERE + kms_key_arn IS NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda Functions -Title: Find AWS Lambda Functions Without KMS Key ARN + - Lambda Functions +Title: Find AWS Lambda Functions Without KMS Key ARN \ No newline at end of file diff --git a/queries/aws_lambda_function_3.yaml b/queries/aws_lambda_function_3.yaml old mode 100755 new mode 100644 index 23a2a0243..70f4eeb78 --- a/queries/aws_lambda_function_3.yaml +++ b/queries/aws_lambda_function_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n runtime,\n count(*)\nfrom\n aws_lambda_function\ngroup\ - \ by\n runtime;" + QueryToExecute: | + SELECT + runtime, + COUNT(*) + FROM + aws_lambda_function + GROUP BY + runtime; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List all AWS Lambda Functions with Runtime Details + - Lambda +Title: List all AWS Lambda Functions with Runtime Details \ No newline at end of file diff --git a/queries/aws_lambda_function_4.yaml b/queries/aws_lambda_function_4.yaml old mode 100755 new mode 100644 index e43396d12..6232bed2f --- a/queries/aws_lambda_function_4.yaml +++ b/queries/aws_lambda_function_4.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n fn.name,\n lg.name,\n lg.retention_in_days\nfrom\n\ - \ aws_lambda_function as fn\n inner join aws_cloudwatch_log_group as lg on (\n\ - \ (lg.name = '/aws/lambda/')\n or (lg.name = fn.name)\n )\nwhere\n lg.retention_in_days\ - \ < 30;" + QueryToExecute: | + SELECT + fn.name, + lg.name, + lg.retention_in_days + FROM + aws_lambda_function AS fn + INNER JOIN aws_cloudwatch_log_group AS lg + ON ( + lg.name = '/aws/lambda/' + OR lg.name = fn.name + ) + WHERE + lg.retention_in_days < 30; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: List AWS Lambda Functions with Logs Retention Less Than 30 Days + - AWS Lambda +Title: List AWS Lambda Functions with Logs Retention Less Than 30 Days \ No newline at end of file diff --git a/queries/aws_lambda_function_5.yaml b/queries/aws_lambda_function_5.yaml old mode 100755 new mode 100644 index bb9e1e7b8..1daa58da8 --- a/queries/aws_lambda_function_5.yaml +++ b/queries/aws_lambda_function_5.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n fn.name,\n fn.region,\n count (availability_zone) as\ - \ zone_count\nfrom\n aws_lambda_function as fn\n cross join jsonb_array_elements_text(vpc_subnet_ids)\ - \ as vpc_subnet\n join aws_vpc_subnet as sub on sub.subnet_id = vpc_subnet\n\ - group by\n fn.name,\n fn.region\norder by\n zone_count;" + QueryToExecute: | + SELECT + fn.name, + fn.region, + COUNT(availability_zone) AS zone_count + FROM + aws_lambda_function AS fn + CROSS JOIN jsonb_array_elements_text(vpc_subnet_ids) AS vpc_subnet + JOIN aws_vpc_subnet AS sub ON sub.subnet_id = vpc_subnet + GROUP BY + fn.name, + fn.region + ORDER BY + zone_count; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda Function -Title: List all AWS Lambda Functions with Configuration Details + - Lambda Function +Title: List all AWS Lambda Functions with Configuration Details \ No newline at end of file diff --git a/queries/aws_lambda_function_6.yaml b/queries/aws_lambda_function_6.yaml old mode 100755 new mode 100644 index 6312db921..44cc6ef16 --- a/queries/aws_lambda_function_6.yaml +++ b/queries/aws_lambda_function_6.yaml @@ -1,28 +1,40 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.name,\n f.role,\n a.action,\n a.access_level,\n\ - \ a.description\nfrom\n aws_lambda_function as f,\n aws_iam_role as r,\n jsonb_array_elements_text(r.attached_policy_arns)\ - \ as pol_arn,\n aws_iam_policy as p,\n jsonb_array_elements(p.policy_std ->\ - \ 'Statement') as stmt,\n jsonb_array_elements_text(stmt -> 'Action') as action_glob,\n\ - \ glob(action_glob) as action_regex\n join aws_iam_action a ON a.action LIKE\ - \ action_regex\nwhere\n f.role = r.arn\n and pol_arn = p.arn\n and stmt ->>\ - \ 'Effect' = 'Allow'\n and f.name = 'hellopython';" + QueryToExecute: | + SELECT + f.name, + f.role, + a.action, + a.access_level, + a.description + FROM + aws_lambda_function AS f, + aws_iam_role AS r, + JSONB_ARRAY_ELEMENTS_TEXT(r.attached_policy_arns) AS pol_arn, + aws_iam_policy AS p, + JSONB_ARRAY_ELEMENTS(p.policy_std -> 'Statement') AS stmt, + JSONB_ARRAY_ELEMENTS_TEXT(stmt -> 'Action') AS action_glob, + GLOB(action_glob) AS action_regex + JOIN aws_iam_action a ON a.action LIKE action_regex + WHERE + f.role = r.arn + AND pol_arn = p.arn + AND stmt ->> 'Effect' = 'Allow' + AND f.name = 'hellopython'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda Function -Title: Find AWS Lambda Functions and IAM Actions + - Lambda Function +Title: Find AWS Lambda Functions and IAM Actions \ No newline at end of file diff --git a/queries/aws_lambda_function_7.yaml b/queries/aws_lambda_function_7.yaml old mode 100755 new mode 100644 index 478ef97ec..8de2d8e08 --- a/queries/aws_lambda_function_7.yaml +++ b/queries/aws_lambda_function_7.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n dead_letter_config_target_arn\nfrom\n aws_lambda_function\n\ - where\n dead_letter_config_target_arn is null;" + QueryToExecute: | + SELECT + arn, + dead_letter_config_target_arn + FROM + aws_lambda_function + WHERE + dead_letter_config_target_arn IS NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: Find all AWS Lambda Functions with Missing DLQ + - AWS Lambda +Title: Find all AWS Lambda Functions with Missing DLQ \ No newline at end of file diff --git a/queries/aws_lambda_function_8.yaml b/queries/aws_lambda_function_8.yaml old mode 100755 new mode 100644 index b540eae99..a43a9edec --- a/queries/aws_lambda_function_8.yaml +++ b/queries/aws_lambda_function_8.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n runtime,\n handler,\n architectures\nfrom\n\ - \ aws_lambda_function;" + QueryToExecute: | + SELECT + name, + runtime, + handler, + architectures + FROM + aws_lambda_function; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: Find AWS Lambda Function Configuration and Details + - AWS Lambda +Title: Find AWS Lambda Function Configuration and Details \ No newline at end of file diff --git a/queries/aws_lambda_function_9.yaml b/queries/aws_lambda_function_9.yaml old mode 100755 new mode 100644 index 2cf4c7509..67af04ffa --- a/queries/aws_lambda_function_9.yaml +++ b/queries/aws_lambda_function_9.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Lambda Functions, providing information about - each function''s configuration, including runtime, code size, timeout, and associated - tags. +Description: Allows users to query AWS Lambda Functions, providing information about each function's configuration, including runtime, code size, timeout, and associated tags. ID: aws_lambda_function_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n jsonb_pretty(url_config) as url_config\n\ - from\n aws_lambda_function;" + QueryToExecute: | + SELECT + name, + arn, + JSONB_PRETTY(url_config) AS url_config + FROM + aws_lambda_function; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda Function -Title: List all AWS Lambda Function Configurations + - Lambda Function +Title: List all AWS Lambda Function Configurations \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_duration_daily_1.yaml b/queries/aws_lambda_function_metric_duration_daily_1.yaml old mode 100755 new mode 100644 index d1563952f..eb38205ae --- a/queries/aws_lambda_function_metric_duration_daily_1.yaml +++ b/queries/aws_lambda_function_metric_duration_daily_1.yaml @@ -1,20 +1,30 @@ Description: Allows users to query AWS Lambda Function daily duration metrics. ID: aws_lambda_function_metric_duration_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sample_count\nfrom\n aws_lambda_function_metric_duration_daily\norder by\n\ - \ name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_lambda_function_metric_duration_daily + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: Find AWS Lambda Function Daily Duration Metrics + - AWS Lambda +Title: Find AWS Lambda Function Daily Duration Metrics \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_duration_daily_2.yaml b/queries/aws_lambda_function_metric_duration_daily_2.yaml old mode 100755 new mode 100644 index 4e0c337ed..ea16b957d --- a/queries/aws_lambda_function_metric_duration_daily_2.yaml +++ b/queries/aws_lambda_function_metric_duration_daily_2.yaml @@ -1,21 +1,32 @@ Description: Allows users to query AWS Lambda Function daily duration metrics. ID: aws_lambda_function_metric_duration_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n round(minimum::numeric,2) as min_duration,\n\ - \ round(maximum::numeric,2) as max_duration,\n round(average::numeric,2) as\ - \ avg_duration,\n sample_count\nfrom\n aws_lambda_function_metric_duration_daily\n\ - where maximum > 100\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_duration, + ROUND(MAXIMUM::NUMERIC, 2) AS max_duration, + ROUND(AVERAGE::NUMERIC, 2) AS avg_duration, + sample_count + FROM + aws_lambda_function_metric_duration_daily + WHERE + MAXIMUM > 100 + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: Find AWS Lambda Function Daily Duration Metrics + - AWS Lambda +Title: Find AWS Lambda Function Daily Duration Metrics \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_duration_daily_3.yaml b/queries/aws_lambda_function_metric_duration_daily_3.yaml old mode 100755 new mode 100644 index d82852e6a..8f39e5655 --- a/queries/aws_lambda_function_metric_duration_daily_3.yaml +++ b/queries/aws_lambda_function_metric_duration_daily_3.yaml @@ -1,21 +1,32 @@ Description: Allows users to query AWS Lambda Function daily duration metrics. ID: aws_lambda_function_metric_duration_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n round(minimum::numeric,2) as min_duration,\n\ - \ round(maximum::numeric,2) as max_duration,\n round(average::numeric,2) as\ - \ avg_duration,\n sample_count\nfrom\n aws_lambda_function_metric_duration_daily\n\ - where average < 5\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + ROUND(minimum::NUMERIC, 2) AS min_duration, + ROUND(maximum::NUMERIC, 2) AS max_duration, + ROUND(average::NUMERIC, 2) AS avg_duration, + sample_count + FROM + aws_lambda_function_metric_duration_daily + WHERE + average < 5 + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Function Daily Duration Metrics + - Lambda +Title: Find AWS Lambda Function Daily Duration Metrics \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_errors_daily_1.yaml b/queries/aws_lambda_function_metric_errors_daily_1.yaml old mode 100755 new mode 100644 index 83a7dff7a..aa859650e --- a/queries/aws_lambda_function_metric_errors_daily_1.yaml +++ b/queries/aws_lambda_function_metric_errors_daily_1.yaml @@ -1,20 +1,30 @@ Description: Allows users to query AWS Lambda Function error metrics on a daily basis. ID: aws_lambda_function_metric_errors_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n minimum,\n maximum,\n average,\n\ - \ sample_count\nfrom\n aws_lambda_function_metric_errors_daily\norder by\n \ - \ name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_lambda_function_metric_errors_daily + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List AWS Lambda Function Daily Error Metrics + - Lambda +Title: List AWS Lambda Function Daily Error Metrics \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_errors_daily_2.yaml b/queries/aws_lambda_function_metric_errors_daily_2.yaml old mode 100755 new mode 100644 index 4099e8d00..a6b347b87 --- a/queries/aws_lambda_function_metric_errors_daily_2.yaml +++ b/queries/aws_lambda_function_metric_errors_daily_2.yaml @@ -1,21 +1,32 @@ Description: Allows users to query AWS Lambda Function error metrics on a daily basis. ID: aws_lambda_function_metric_errors_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n round(minimum::numeric,2) as min_error,\n\ - \ round(maximum::numeric,2) as max_error,\n round(average::numeric,2) as avg_error,\n\ - \ sample_count\nfrom\n aws_lambda_function_metric_errors_daily\nwhere average\ - \ < 1\norder by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_error, + ROUND(MAXIMUM::NUMERIC, 2) AS max_error, + ROUND(AVERAGE::NUMERIC, 2) AS avg_error, + sample_count + FROM + aws_lambda_function_metric_errors_daily + WHERE + AVERAGE < 1 + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List All AWS Lambda Function Errors Metrics Daily + - Lambda +Title: List All AWS Lambda Function Errors Metrics Daily \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_invocations_daily_1.yaml b/queries/aws_lambda_function_metric_invocations_daily_1.yaml old mode 100755 new mode 100644 index e228d990e..d704fa4c3 --- a/queries/aws_lambda_function_metric_invocations_daily_1.yaml +++ b/queries/aws_lambda_function_metric_invocations_daily_1.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Lambda Function Metrics on a daily basis. ID: aws_lambda_function_metric_invocations_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n sum\nfrom\n aws_lambda_function_metric_invocations_daily\n\ - order by\n name,\n timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + SUM + FROM + aws_lambda_function_metric_invocations_daily + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda Function -Title: Find All Daily AWS Lambda Function Metrics Using SQL + - AWS Lambda Function +Title: Find All Daily AWS Lambda Function Metrics Using SQL \ No newline at end of file diff --git a/queries/aws_lambda_function_metric_invocations_daily_2.yaml b/queries/aws_lambda_function_metric_invocations_daily_2.yaml old mode 100755 new mode 100644 index b17504d9c..056f08ba7 --- a/queries/aws_lambda_function_metric_invocations_daily_2.yaml +++ b/queries/aws_lambda_function_metric_invocations_daily_2.yaml @@ -1,21 +1,31 @@ Description: Allows users to query AWS Lambda Function Metrics on a daily basis. ID: aws_lambda_function_metric_invocations_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n timestamp,\n round(sum::numeric,2) as sum_invocations,\n\ - \ sample_count\nfrom\n aws_lambda_function_metric_invocations_daily\nwhere \n\ - \ date_part('day', now() - timestamp) <=3\nand sum > 10\norder by\n name,\n\ - \ timestamp;" + QueryToExecute: | + SELECT + name, + timestamp, + ROUND(SUM::NUMERIC, 2) AS sum_invocations, + sample_count + FROM + aws_lambda_function_metric_invocations_daily + WHERE + DATE_PART('day', NOW() - timestamp) <= 3 + AND SUM > 10 + ORDER BY + name, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda Function Metrics -Title: Find AWS Lambda Function Metrics on a Daily Basis + - Lambda Function Metrics +Title: Find AWS Lambda Function Metrics on a Daily Basis \ No newline at end of file diff --git a/queries/aws_lambda_layer_1.yaml b/queries/aws_lambda_layer_1.yaml old mode 100755 new mode 100644 index 3183b969b..7a73b1733 --- a/queries/aws_lambda_layer_1.yaml +++ b/queries/aws_lambda_layer_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Lambda Layers and retrieve information including - layer ARNs, layer versions, compatible runtimes, and more. +Description: Allows users to query AWS Lambda Layers and retrieve information including layer ARNs, layer versions, compatible runtimes, and more. ID: aws_lambda_layer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n layer_arn,\n layer_name,\n layer_version_arn,\n created_date,\n\ - \ jsonb_pretty(compatible_runtimes) as compatible_runtimes,\n jsonb_pretty(compatible_architectures)\ - \ as compatible_architectures,\n version\nfrom\n aws_lambda_layer;" + QueryToExecute: | + SELECT + layer_arn, + layer_name, + layer_version_arn, + created_date, + JSONB_PRETTY(compatible_runtimes) AS compatible_runtimes, + JSONB_PRETTY(compatible_architectures) AS compatible_architectures, + version + FROM + aws_lambda_layer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lambda -Title: Find all AWS Lambda Layer Details + - AWS Lambda +Title: Find all AWS Lambda Layer Details \ No newline at end of file diff --git a/queries/aws_lambda_layer_version_1.yaml b/queries/aws_lambda_layer_version_1.yaml old mode 100755 new mode 100644 index 14c45ca61..cb190c4b7 --- a/queries/aws_lambda_layer_version_1.yaml +++ b/queries/aws_lambda_layer_version_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Lambda Layer Versions, providing detailed information - about each layer version, including its ARN, description, license info, compatible - runtimes, created date, and more. +Description: Allows users to query AWS Lambda Layer Versions, providing detailed information about each layer version, including its ARN, description, license info, compatible runtimes, created date, and more. ID: aws_lambda_layer_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n layer_arn,\n layer_name,\n layer_version_arn,\n created_date,\n\ - \ jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std) as policy_std,\n\ - \ version\nfrom\n aws_lambda_layer_version;" + QueryToExecute: | + SELECT + layer_arn, + layer_name, + layer_version_arn, + created_date, + JSONB_PRETTY(policy) AS policy, + JSONB_PRETTY(policy_std) AS policy_std, + version + FROM + aws_lambda_layer_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Layer Version Details + - Lambda +Title: Find AWS Lambda Layer Version Details \ No newline at end of file diff --git a/queries/aws_lambda_version_1.yaml b/queries/aws_lambda_version_1.yaml old mode 100755 new mode 100644 index 616e62d5a..3625bed8a --- a/queries/aws_lambda_version_1.yaml +++ b/queries/aws_lambda_version_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Lambda Versions to fetch detailed information - about each version of a specific AWS Lambda function. +Description: Allows users to query AWS Lambda Versions to fetch detailed information about each version of a specific AWS Lambda function. ID: aws_lambda_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n version,\n runtime,\n handler\nfrom\n\ - \ aws_lambda_version;" + QueryToExecute: | + SELECT + function_name, + version, + runtime, + handler + FROM + aws_lambda_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find AWS Lambda Versions and Details + - Lambda +Title: Find AWS Lambda Versions and Details \ No newline at end of file diff --git a/queries/aws_lambda_version_2.yaml b/queries/aws_lambda_version_2.yaml old mode 100755 new mode 100644 index c0ed2b748..f41f3e830 --- a/queries/aws_lambda_version_2.yaml +++ b/queries/aws_lambda_version_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Lambda Versions to fetch detailed information - about each version of a specific AWS Lambda function. +Description: Allows users to query AWS Lambda Versions to fetch detailed information about each version of a specific AWS Lambda function. ID: aws_lambda_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n version,\n timeout\nfrom\n aws_lambda_version\n\ - where\n timeout :: int > 120;" + QueryToExecute: | + SELECT + function_name, + version, + timeout + FROM + aws_lambda_version + WHERE + timeout::int > 120; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: List AWS Lambda Versions to Fetch Detailed Information + - Lambda +Title: List AWS Lambda Versions to Fetch Detailed Information \ No newline at end of file diff --git a/queries/aws_lambda_version_3.yaml b/queries/aws_lambda_version_3.yaml old mode 100755 new mode 100644 index c9254210a..2050cac09 --- a/queries/aws_lambda_version_3.yaml +++ b/queries/aws_lambda_version_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Lambda Versions to fetch detailed information - about each version of a specific AWS Lambda function. +Description: Allows users to query AWS Lambda Versions to fetch detailed information about each version of a specific AWS Lambda function. ID: aws_lambda_version_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n function_name,\n version,\n vpc_id,\n vpc_security_group_ids,\n\ - \ vpc_subnet_ids\nfrom\n aws_lambda_version;" + QueryToExecute: | + SELECT + function_name, + version, + vpc_id, + vpc_security_group_ids, + vpc_subnet_ids + FROM + aws_lambda_version; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Find all Versions of a Specific AWS Lambda Function + - Lambda +Title: Find all Versions of a Specific AWS Lambda Function \ No newline at end of file diff --git a/queries/aws_lambda_version_4.yaml b/queries/aws_lambda_version_4.yaml old mode 100755 new mode 100644 index 1a865f7af..6836700b2 --- a/queries/aws_lambda_version_4.yaml +++ b/queries/aws_lambda_version_4.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS Lambda Versions to fetch detailed information - about each version of a specific AWS Lambda function. +Description: Allows users to query AWS Lambda Versions to fetch detailed information about each version of a specific AWS Lambda function. ID: aws_lambda_version_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_lambda_version;" + QueryToExecute: | + SELECT + jsonb_pretty(policy) AS policy, + jsonb_pretty(policy_std) AS policy_std + FROM + aws_lambda_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lambda -Title: Query AWS Lambda Versions for Detailed Information + - Lambda +Title: Query AWS Lambda Versions for Detailed Information \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_1.yaml b/queries/aws_lightsail_bucket_1.yaml old mode 100755 new mode 100644 index f681e6dc9..74ea9961b --- a/queries/aws_lightsail_bucket_1.yaml +++ b/queries/aws_lightsail_bucket_1.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n state_code,\n created_at\nfrom\n aws_lightsail_bucket;" + QueryToExecute: | + SELECT + name, + arn, + state_code, + created_at + FROM + aws_lightsail_bucket; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail Buckets -Title: Find AWS Lightsail Buckets and Retrieve Detailed Information + - Lightsail Buckets +Title: Find AWS Lightsail Buckets and Retrieve Detailed Information \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_2.yaml b/queries/aws_lightsail_bucket_2.yaml old mode 100755 new mode 100644 index 6748469b9..e42fd9709 --- a/queries/aws_lightsail_bucket_2.yaml +++ b/queries/aws_lightsail_bucket_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n region,\n count(*) as bucket_count\nfrom\n aws_lightsail_bucket\n\ - group by\n region;" + QueryToExecute: | + SELECT + region, + COUNT(*) AS bucket_count + FROM + aws_lightsail_bucket + GROUP BY + region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: List all AWS Lightsail Buckets and Configurations + - Lightsail +Title: List all AWS Lightsail Buckets and Configurations \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_3.yaml b/queries/aws_lightsail_bucket_3.yaml old mode 100755 new mode 100644 index 725ac9c1f..284342892 --- a/queries/aws_lightsail_bucket_3.yaml +++ b/queries/aws_lightsail_bucket_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n region,\n access_rules ->> 'GetObject' as public_access\n\ - from\n aws_lightsail_bucket\nwhere\n access_rules ->> 'GetObject' = 'public';" + QueryToExecute: | + SELECT + name, + region, + access_rules ->> 'GetObject' AS public_access + FROM + aws_lightsail_bucket + WHERE + access_rules ->> 'GetObject' = 'public'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: List all AWS Lightsail Buckets with Public Access + - Lightsail +Title: List all AWS Lightsail Buckets with Public Access \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_4.yaml b/queries/aws_lightsail_bucket_4.yaml old mode 100755 new mode 100644 index 8fc22663a..f49522f59 --- a/queries/aws_lightsail_bucket_4.yaml +++ b/queries/aws_lightsail_bucket_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_at\nfrom\n aws_lightsail_bucket\nwhere\n\ - \ created_at >= (current_date - interval '30' day);" + QueryToExecute: | + SELECT + name, + created_at + FROM + aws_lightsail_bucket + WHERE + created_at >= (CURRENT_DATE - INTERVAL '30' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: Find AWS Lightsail Buckets with Configuration Details + - Lightsail +Title: Find AWS Lightsail Buckets with Configuration Details \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_5.yaml b/queries/aws_lightsail_bucket_5.yaml old mode 100755 new mode 100644 index 7ba484037..fe9b5c802 --- a/queries/aws_lightsail_bucket_5.yaml +++ b/queries/aws_lightsail_bucket_5.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tags\nfrom\n aws_lightsail_bucket\nwhere\n\ - \ tags is null or tags = '[]';" + QueryToExecute: | + SELECT + name, + tags + FROM + aws_lightsail_bucket + WHERE + tags IS NULL + OR tags = '[]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: Find all AWS Lightsail Buckets without tags + - Lightsail +Title: Find all AWS Lightsail Buckets without tags \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_6.yaml b/queries/aws_lightsail_bucket_6.yaml old mode 100755 new mode 100644 index 22b6ab424..299e5fe64 --- a/queries/aws_lightsail_bucket_6.yaml +++ b/queries/aws_lightsail_bucket_6.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n object_versioning\nfrom\n aws_lightsail_bucket\n\ - where\n object_versioning = 'Enabled';" + QueryToExecute: | + SELECT + name, + object_versioning + FROM + aws_lightsail_bucket + WHERE + object_versioning = 'Enabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: Find AWS Lightsail Buckets with Enabled Versioning + - Lightsail +Title: Find AWS Lightsail Buckets with Enabled Versioning \ No newline at end of file diff --git a/queries/aws_lightsail_bucket_7.yaml b/queries/aws_lightsail_bucket_7.yaml old mode 100755 new mode 100644 index 2001b971e..4a65fbde9 --- a/queries/aws_lightsail_bucket_7.yaml +++ b/queries/aws_lightsail_bucket_7.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information - such as bucket configuration, access rules, tags, and more. +Description: Allows users to query AWS Lightsail Buckets and retrieve detailed information such as bucket configuration, access rules, tags, and more. ID: aws_lightsail_bucket_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_log_config ->> 'Enabled' as access_log_enabled,\n\ - \ access_log_config ->> 'Destination' as access_log_destination,\n access_log_config\ - \ ->> 'Prefix' as access_log_prefix\nfrom\n aws_lightsail_bucket;" + QueryToExecute: | + SELECT + name, + access_log_config ->> 'Enabled' AS access_log_enabled, + access_log_config ->> 'Destination' AS access_log_destination, + access_log_config ->> 'Prefix' AS access_log_prefix + FROM + aws_lightsail_bucket; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: Find AWS Lightsail Bucket Configuration and Access Rules + - Lightsail +Title: Find AWS Lightsail Bucket Configuration and Access Rules \ No newline at end of file diff --git a/queries/aws_lightsail_instance_1.yaml b/queries/aws_lightsail_instance_1.yaml old mode 100755 new mode 100644 index 56f241b17..e191994f2 --- a/queries/aws_lightsail_instance_1.yaml +++ b/queries/aws_lightsail_instance_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Lightsail Instances and retrieve detailed information - about each instance such as instance state, type, associated bundles, and more. +Description: Allows users to query AWS Lightsail Instances and retrieve detailed information about each instance such as instance state, type, associated bundles, and more. ID: aws_lightsail_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n availability_zone as az,\n bundle_id,\n count(*)\n\ - from\n aws_lightsail_instance\ngroup by\n availability_zone,\n bundle_id;" + QueryToExecute: | + SELECT + availability_zone AS az, + bundle_id, + COUNT(*) + FROM + aws_lightsail_instance + GROUP BY + availability_zone, + bundle_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: List all AWS Lightsail instances with details + - Lightsail +Title: List all AWS Lightsail instances with details \ No newline at end of file diff --git a/queries/aws_lightsail_instance_2.yaml b/queries/aws_lightsail_instance_2.yaml old mode 100755 new mode 100644 index 71fa6ed39..9cc6d7440 --- a/queries/aws_lightsail_instance_2.yaml +++ b/queries/aws_lightsail_instance_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Lightsail Instances and retrieve detailed information - about each instance such as instance state, type, associated bundles, and more. +Description: Allows users to query AWS Lightsail Instances and retrieve detailed information about each instance such as instance state, type, associated bundles, and more. ID: aws_lightsail_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state_name\nfrom\n aws_lightsail_instance\n\ - where\n state_name = 'stopped'\n and created_at <= (current_date - interval\ - \ '30' day);" + QueryToExecute: | + SELECT + name, + state_name + FROM + aws_lightsail_instance + WHERE + state_name = 'stopped' + AND created_at <= (CURRENT_DATE - INTERVAL '30' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: List all AWS Lightsail Instances with Stopped State + - Lightsail +Title: List all AWS Lightsail Instances with Stopped State \ No newline at end of file diff --git a/queries/aws_lightsail_instance_3.yaml b/queries/aws_lightsail_instance_3.yaml old mode 100755 new mode 100644 index 0fdf65988..ae518c36e --- a/queries/aws_lightsail_instance_3.yaml +++ b/queries/aws_lightsail_instance_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Lightsail Instances and retrieve detailed information - about each instance such as instance state, type, associated bundles, and more. +Description: Allows users to query AWS Lightsail Instances and retrieve detailed information about each instance such as instance state, type, associated bundles, and more. ID: aws_lightsail_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n state_name,\n bundle_id,\n region\nfrom\n\ - \ aws_lightsail_instance\nwhere\n public_ip_address is not null;" + QueryToExecute: | + SELECT + name, + state_name, + bundle_id, + region + FROM + aws_lightsail_instance + WHERE + public_ip_address IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: List AWS Lightsail Instances with State and Details + - Lightsail +Title: List AWS Lightsail Instances with State and Details \ No newline at end of file diff --git a/queries/aws_lightsail_instance_4.yaml b/queries/aws_lightsail_instance_4.yaml old mode 100755 new mode 100644 index f2ab6d053..95a9856ca --- a/queries/aws_lightsail_instance_4.yaml +++ b/queries/aws_lightsail_instance_4.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Lightsail Instances and retrieve detailed information - about each instance such as instance state, type, associated bundles, and more. +Description: Allows users to query AWS Lightsail Instances and retrieve detailed information about each instance such as instance state, type, associated bundles, and more. ID: aws_lightsail_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tags\nfrom\n aws_lightsail_instance\nwhere\n\ - \ not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + name, + tags + FROM + aws_lightsail_instance + WHERE + NOT tags::JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Lightsail -Title: List all AWS Lightsail Instances and Their Details + - AWS Lightsail +Title: List all AWS Lightsail Instances and Their Details \ No newline at end of file diff --git a/queries/aws_lightsail_instance_5.yaml b/queries/aws_lightsail_instance_5.yaml old mode 100755 new mode 100644 index bc63b26ce..bfb73b932 --- a/queries/aws_lightsail_instance_5.yaml +++ b/queries/aws_lightsail_instance_5.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Lightsail Instances and retrieve detailed information - about each instance such as instance state, type, associated bundles, and more. +Description: Allows users to query AWS Lightsail Instances and retrieve detailed information about each instance such as instance state, type, associated bundles, and more. ID: aws_lightsail_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n hardware ->> 'CpuCount' as \"CPU Count\",\n\ - \ hardware ->> 'RamSizeInGb' as \"RAM Size (in GB)\"\nfrom\n aws_lightsail_instance;" + QueryToExecute: | + SELECT + name, + hardware ->> 'CpuCount' AS "CPU Count", + hardware ->> 'RamSizeInGb' AS "RAM Size (in GB)" + FROM + aws_lightsail_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lightsail -Title: Find AWS Lightsail Instances with Details + - Lightsail +Title: Find AWS Lightsail Instances with Details \ No newline at end of file diff --git a/queries/aws_macie2_classification_job_1.yaml b/queries/aws_macie2_classification_job_1.yaml old mode 100755 new mode 100644 index 40bc6dcfa..782ae408c --- a/queries/aws_macie2_classification_job_1.yaml +++ b/queries/aws_macie2_classification_job_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed - information about each job''s settings, status, and results. +Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed information about each job's settings, status, and results. ID: aws_macie2_classification_job_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n arn,\n name,\n job_status,\n region\nfrom\n\ - \ aws_macie2_classification_job;" + QueryToExecute: | + SELECT + job_id, + arn, + name, + job_status, + region + FROM + aws_macie2_classification_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Macie2 -Title: List all AWS Macie2 Classification Jobs and Status + - Macie2 +Title: List all AWS Macie2 Classification Jobs and Status \ No newline at end of file diff --git a/queries/aws_macie2_classification_job_2.yaml b/queries/aws_macie2_classification_job_2.yaml old mode 100755 new mode 100644 index 4f8094747..b26bb2f2d --- a/queries/aws_macie2_classification_job_2.yaml +++ b/queries/aws_macie2_classification_job_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed - information about each job''s settings, status, and results. +Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed information about each job's settings, status, and results. ID: aws_macie2_classification_job_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n detail -> 'AccountId' as account_id,\n detail\ - \ -> 'Buckets' as buckets\nfrom\n aws_macie2_classification_job,\n jsonb_array_elements(s3_job_definition\ - \ -> 'BucketDefinitions') as detail;" + QueryToExecute: | + SELECT + job_id, + detail -> 'AccountId' AS account_id, + detail -> 'Buckets' AS buckets + FROM + aws_macie2_classification_job, + JSONB_ARRAY_ELEMENTS(s3_job_definition -> 'BucketDefinitions') AS detail; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Macie2 -Title: List AWS Macie2 Classification Jobs and Details + - Macie2 +Title: List AWS Macie2 Classification Jobs and Details \ No newline at end of file diff --git a/queries/aws_macie2_classification_job_3.yaml b/queries/aws_macie2_classification_job_3.yaml old mode 100755 new mode 100644 index bdd9d19af..41e6ae278 --- a/queries/aws_macie2_classification_job_3.yaml +++ b/queries/aws_macie2_classification_job_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed - information about each job''s settings, status, and results. +Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed information about each job's settings, status, and results. ID: aws_macie2_classification_job_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n arn,\n name,\n job_status as status\nfrom\n\ - \ aws_macie2_classification_job\nwhere\n job_status = 'CANCELLED'\n or job_status\ - \ = 'PAUSED';" + QueryToExecute: | + SELECT + job_id, + arn, + name, + job_status AS status + FROM + aws_macie2_classification_job + WHERE + job_status = 'CANCELLED' + OR job_status = 'PAUSED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Macie2 -Title: Find AWS Macie2 Classification Jobs with Cancelled or Paused Status + - Macie2 +Title: Find AWS Macie2 Classification Jobs with Cancelled or Paused Status \ No newline at end of file diff --git a/queries/aws_macie2_classification_job_4.yaml b/queries/aws_macie2_classification_job_4.yaml old mode 100755 new mode 100644 index ec7910138..fef736dbe --- a/queries/aws_macie2_classification_job_4.yaml +++ b/queries/aws_macie2_classification_job_4.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed - information about each job''s settings, status, and results. +Description: Allows users to query AWS Macie2 Classification Jobs and retrieve detailed information about each job's settings, status, and results. ID: aws_macie2_classification_job_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n job_id,\n arn,\n statistics ->> 'ApproximateNumberOfObjectsToProcess'\ - \ as approximate_number_of_objects_to_process,\n statistics ->> 'NumberOfRuns'\ - \ as number_of_runs\nfrom\n aws_macie2_classification_job;" + QueryToExecute: | + SELECT + job_id, + arn, + statistics ->> 'ApproximateNumberOfObjectsToProcess' AS approximate_number_of_objects_to_process, + statistics ->> 'NumberOfRuns' AS number_of_runs + FROM + aws_macie2_classification_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Macie2 -Title: List AWS Macie2 Classification Jobs and Details + - Macie2 +Title: List AWS Macie2 Classification Jobs and Details \ No newline at end of file diff --git a/queries/aws_media_store_container_1.yaml b/queries/aws_media_store_container_1.yaml old mode 100755 new mode 100644 index 5cab6963a..917b58ec0 --- a/queries/aws_media_store_container_1.yaml +++ b/queries/aws_media_store_container_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS MediaStore Container information, including - ARN, creation time, status, and access logging details. +Description: Allows users to query AWS MediaStore Container information, including ARN, creation time, status, and access logging details. ID: aws_media_store_container_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n access_logging_enabled,\n\ - \ creation_time,\n endpoint\nfrom\n aws_media_store_container;" + QueryToExecute: | + SELECT + name, + arn, + status, + access_logging_enabled, + creation_time, + endpoint + FROM + aws_media_store_container; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MediaStore -Title: List AWS MediaStore Container Details + - MediaStore +Title: List AWS MediaStore Container Details \ No newline at end of file diff --git a/queries/aws_media_store_container_2.yaml b/queries/aws_media_store_container_2.yaml old mode 100755 new mode 100644 index 3a47d1ccd..8bbd49a7c --- a/queries/aws_media_store_container_2.yaml +++ b/queries/aws_media_store_container_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS MediaStore Container information, including - ARN, creation time, status, and access logging details. +Description: Allows users to query AWS MediaStore Container information, including ARN, creation time, status, and access logging details. ID: aws_media_store_container_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n access_logging_enabled,\n\ - \ creation_time,\n endpoint\nfrom\n aws_media_store_container\nwhere\n status\ - \ = 'CREATING';" + QueryToExecute: | + SELECT + name, + arn, + status, + access_logging_enabled, + creation_time, + endpoint + FROM + aws_media_store_container + WHERE + status = 'CREATING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MediaStore -Title: List all AWS MediaStore Containers with details + - MediaStore +Title: List all AWS MediaStore Containers with details \ No newline at end of file diff --git a/queries/aws_media_store_container_3.yaml b/queries/aws_media_store_container_3.yaml old mode 100755 new mode 100644 index 81c078fcc..175ae14bc --- a/queries/aws_media_store_container_3.yaml +++ b/queries/aws_media_store_container_3.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS MediaStore Container information, including - ARN, creation time, status, and access logging details. +Description: Allows users to query AWS MediaStore Container information, including ARN, creation time, status, and access logging details. ID: aws_media_store_container_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_media_store_container;" + QueryToExecute: | + SELECT + name, + jsonb_pretty(policy) AS policy, + jsonb_pretty(policy_std) AS policy_std + FROM + aws_media_store_container; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MediaStore -Title: List AWS MediaStore Container Info with ARN and Status + - MediaStore +Title: List AWS MediaStore Container Info with ARN and Status \ No newline at end of file diff --git a/queries/aws_media_store_container_4.yaml b/queries/aws_media_store_container_4.yaml old mode 100755 new mode 100644 index 12bd9833b..f071e82a9 --- a/queries/aws_media_store_container_4.yaml +++ b/queries/aws_media_store_container_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS MediaStore Container information, including - ARN, creation time, status, and access logging details. +Description: Allows users to query AWS MediaStore Container information, including ARN, creation time, status, and access logging details. ID: aws_media_store_container_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n access_logging_enabled\nfrom\n aws_media_store_container\n\ - where\n access_logging_enabled;" + QueryToExecute: | + SELECT + name, + arn, + access_logging_enabled + FROM + aws_media_store_container + WHERE + access_logging_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MediaStore -Title: Find AWS MediaStore Container Info with Access Logging + - MediaStore +Title: Find AWS MediaStore Container Info with Access Logging \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_1.yaml b/queries/aws_memorydb_cluster_1.yaml old mode 100755 new mode 100644 index 7873bf183..c93779afc --- a/queries/aws_memorydb_cluster_1.yaml +++ b/queries/aws_memorydb_cluster_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n node_type,\n engine_version,\n\ - \ region\nfrom\n aws_memorydb_cluster;" + QueryToExecute: | + SELECT + name, + arn, + status, + node_type, + engine_version, + region + FROM + aws_memorydb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: List all AWS MemoryDB Clusters and Configurations + - MemoryDB +Title: List all AWS MemoryDB Clusters and Configurations \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_2.yaml b/queries/aws_memorydb_cluster_2.yaml old mode 100755 new mode 100644 index 5e224f6c1..7e2472e69 --- a/queries/aws_memorydb_cluster_2.yaml +++ b/queries/aws_memorydb_cluster_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n auto_minor_version_upgrade\nfrom\n \ - \ aws_memorydb_cluster\nwhere\n auto_minor_version_upgrade = true;" + QueryToExecute: | + SELECT + name, + arn, + auto_minor_version_upgrade + FROM + aws_memorydb_cluster + WHERE + auto_minor_version_upgrade = TRUE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: List all AWS MemoryDB Clusters with SQL + - MemoryDB +Title: List all AWS MemoryDB Clusters with SQL \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_3.yaml b/queries/aws_memorydb_cluster_3.yaml old mode 100755 new mode 100644 index c069844b8..42e9b2d88 --- a/queries/aws_memorydb_cluster_3.yaml +++ b/queries/aws_memorydb_cluster_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n availability_mode\nfrom\n aws_memorydb_cluster\n\ - where\n availability_mode = 'multiaz';" + QueryToExecute: | + SELECT + name, + arn, + availability_mode + FROM + aws_memorydb_cluster + WHERE + availability_mode = 'multiaz'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: List all AWS MemoryDB clusters and their configurations + - MemoryDB +Title: List all AWS MemoryDB clusters and their configurations \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_4.yaml b/queries/aws_memorydb_cluster_4.yaml old mode 100755 new mode 100644 index 2b24caf9a..852edaf31 --- a/queries/aws_memorydb_cluster_4.yaml +++ b/queries/aws_memorydb_cluster_4.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n tls_enabled\nfrom\n aws_memorydb_cluster\n\ - where\n tls_enabled = false;" + QueryToExecute: | + SELECT + name, + arn, + tls_enabled + FROM + aws_memorydb_cluster + WHERE + tls_enabled = FALSE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: Find All AWS MemoryDB Clusters Without TLS Encryption + - MemoryDB +Title: Find All AWS MemoryDB Clusters Without TLS Encryption \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_5.yaml b/queries/aws_memorydb_cluster_5.yaml old mode 100755 new mode 100644 index 86661207a..d70edc595 --- a/queries/aws_memorydb_cluster_5.yaml +++ b/queries/aws_memorydb_cluster_5.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n maintenance_window\nfrom\n aws_memorydb_cluster;" + QueryToExecute: | + SELECT + name, + arn, + maintenance_window + FROM + aws_memorydb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: List All AWS MemoryDB Cluster Configurations and Statuses + - MemoryDB +Title: List All AWS MemoryDB Cluster Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_6.yaml b/queries/aws_memorydb_cluster_6.yaml old mode 100755 new mode 100644 index 2fdc0824a..6bf345521 --- a/queries/aws_memorydb_cluster_6.yaml +++ b/queries/aws_memorydb_cluster_6.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n node_type\nfrom\n aws_memorydb_cluster\n\ - where\n node_type = 'db.r6gd.xlarge';" + QueryToExecute: | + SELECT + name, + arn, + node_type + FROM + aws_memorydb_cluster + WHERE + node_type = 'db.r6gd.xlarge'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: Find AWS MemoryDB Cluster Configurations and Statuses + - MemoryDB +Title: Find AWS MemoryDB Cluster Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_7.yaml b/queries/aws_memorydb_cluster_7.yaml old mode 100755 new mode 100644 index f3e548355..91c12fdb7 --- a/queries/aws_memorydb_cluster_7.yaml +++ b/queries/aws_memorydb_cluster_7.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n number_of_shards,\n shards\nfrom\n\ - \ aws_memorydb_cluster;" + QueryToExecute: | + SELECT + name, + arn, + number_of_shards, + shards + FROM + aws_memorydb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: Find all AWS MemoryDB Cluster Configurations and Statuses + - MemoryDB +Title: Find all AWS MemoryDB Cluster Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_8.yaml b/queries/aws_memorydb_cluster_8.yaml old mode 100755 new mode 100644 index 616a2b4fb..50280c514 --- a/queries/aws_memorydb_cluster_8.yaml +++ b/queries/aws_memorydb_cluster_8.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n pending_updates\nfrom\n aws_memorydb_cluster\n\ - where\n jsonb_array_length(pending_updates) > 0;" + QueryToExecute: | + SELECT + name, + arn, + pending_updates + FROM + aws_memorydb_cluster + WHERE + jsonb_array_length(pending_updates) > 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: Find AWS MemoryDB Clusters with Pending Updates + - MemoryDB +Title: Find AWS MemoryDB Clusters with Pending Updates \ No newline at end of file diff --git a/queries/aws_memorydb_cluster_9.yaml b/queries/aws_memorydb_cluster_9.yaml old mode 100755 new mode 100644 index bcde4c775..6568edd9f --- a/queries/aws_memorydb_cluster_9.yaml +++ b/queries/aws_memorydb_cluster_9.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS MemoryDB clusters, providing detailed information - on cluster configurations and statuses. +Description: Allows users to query AWS MemoryDB clusters, providing detailed information on cluster configurations and statuses. ID: aws_memorydb_cluster_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n snapshot_retention_limit,\n snapshot_window\n\ - from\n aws_memorydb_cluster;" + QueryToExecute: | + SELECT + name, + arn, + snapshot_retention_limit, + snapshot_window + FROM + aws_memorydb_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MemoryDB -Title: Find all AWS MemoryDB Clusters and their configurations + - MemoryDB +Title: Find all AWS MemoryDB Clusters and their configurations \ No newline at end of file diff --git a/queries/aws_mgn_application_1.yaml b/queries/aws_mgn_application_1.yaml old mode 100755 new mode 100644 index 1d41bbfe2..593dac0f1 --- a/queries/aws_mgn_application_1.yaml +++ b/queries/aws_mgn_application_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Migration Service Applications to retrieve - detailed information about each application. +Description: Allows users to query AWS Migration Service Applications to retrieve detailed information about each application. ID: aws_mgn_application_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n application_id,\n creation_date_time,\n\ - \ is_archived,\n wave_id,\n tags\nfrom\n aws_mgn_application;" + QueryToExecute: | + SELECT + name, + arn, + application_id, + creation_date_time, + is_archived, + wave_id, + tags + FROM + aws_mgn_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Migration Service -Title: List all AWS Migration Service Applications with Details + - AWS Migration Service +Title: List all AWS Migration Service Applications with Details \ No newline at end of file diff --git a/queries/aws_mgn_application_2.yaml b/queries/aws_mgn_application_2.yaml old mode 100755 new mode 100644 index 2d269a890..0d69eed7a --- a/queries/aws_mgn_application_2.yaml +++ b/queries/aws_mgn_application_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Migration Service Applications to retrieve - detailed information about each application. +Description: Allows users to query AWS Migration Service Applications to retrieve detailed information about each application. ID: aws_mgn_application_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n application_id,\n creation_date_time,\n\ - \ is_archived\nfrom\n aws_mgn_application\nwhere\n is_archived;" + QueryToExecute: | + SELECT + name, + arn, + application_id, + creation_date_time, + is_archived + FROM + aws_mgn_application + WHERE + is_archived; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Migration Service -Title: List AWS Migration Service Applications with Details + - AWS Migration Service +Title: List AWS Migration Service Applications with Details \ No newline at end of file diff --git a/queries/aws_mgn_application_3.yaml b/queries/aws_mgn_application_3.yaml old mode 100755 new mode 100644 index 0ffc60600..f4ad88f3e --- a/queries/aws_mgn_application_3.yaml +++ b/queries/aws_mgn_application_3.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Migration Service Applications to retrieve - detailed information about each application. +Description: Allows users to query AWS Migration Service Applications to retrieve detailed information about each application. ID: aws_mgn_application_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n application_id,\n application_aggregated_status\ - \ ->> 'HealthStatus' as health_status,\n application_aggregated_status ->> 'ProgressStatus'\ - \ as progress_status,\n application_aggregated_status ->> 'TotalSourceServers'\ - \ as total_source_servers\nfrom\n aws_mgn_application;" + QueryToExecute: | + SELECT + name, + application_id, + application_aggregated_status ->> 'HealthStatus' AS health_status, + application_aggregated_status ->> 'ProgressStatus' AS progress_status, + application_aggregated_status ->> 'TotalSourceServers' AS total_source_servers + FROM + aws_mgn_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Migration Service -Title: List All AWS Migration Service Applications Details + - Migration Service +Title: List All AWS Migration Service Applications Details \ No newline at end of file diff --git a/queries/aws_mgn_application_4.yaml b/queries/aws_mgn_application_4.yaml old mode 100755 new mode 100644 index 7bc3aa70d..8aa953625 --- a/queries/aws_mgn_application_4.yaml +++ b/queries/aws_mgn_application_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Migration Service Applications to retrieve - detailed information about each application. +Description: Allows users to query AWS Migration Service Applications to retrieve detailed information about each application. ID: aws_mgn_application_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n application_id,\n creation_date_time,\n is_archived,\n\ - \ wave_id\nfrom\n aws_mgn_application\nwhere\n creation_date_time >= now()\ - \ - interval '30' day;" + QueryToExecute: | + SELECT + name, + application_id, + creation_date_time, + is_archived, + wave_id + FROM + aws_mgn_application + WHERE + creation_date_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Migration Service -Title: List AWS Migration Service Applications with Details + - Migration Service +Title: List AWS Migration Service Applications with Details \ No newline at end of file diff --git a/queries/aws_mq_broker_1.yaml b/queries/aws_mq_broker_1.yaml old mode 100755 new mode 100644 index 54061e384..ca98eb1ac --- a/queries/aws_mq_broker_1.yaml +++ b/queries/aws_mq_broker_1.yaml @@ -1,22 +1,32 @@ Description: Allows users to query AWS MQ Brokers. ID: aws_mq_broker_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n broker_name,\n broker_state,\n deployment_mode,\n\ - \ created,\n host_instance_type,\n engine_type,\n engine_version\n tags\n\ - from\n aws_mq_broker;" + QueryToExecute: | + SELECT + arn, + broker_name, + broker_state, + deployment_mode, + created, + host_instance_type, + engine_type, + engine_version, + tags + FROM + aws_mq_broker; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MQ -Title: List all AWS MQ Brokers with Key Details + - MQ +Title: List all AWS MQ Brokers with Key Details \ No newline at end of file diff --git a/queries/aws_mq_broker_2.yaml b/queries/aws_mq_broker_2.yaml old mode 100755 new mode 100644 index e056cd373..ce57a10f7 --- a/queries/aws_mq_broker_2.yaml +++ b/queries/aws_mq_broker_2.yaml @@ -1,21 +1,31 @@ Description: Allows users to query AWS MQ Brokers. ID: aws_mq_broker_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n broker_name,\n broker_state,\n created\n data_replication_mode,\n\ - \ authentication_strategy\nfrom\n aws_mq_broker\nwhere\n broker_state = 'REBOOT_IN_PROGRESS';" + QueryToExecute: | + SELECT + arn, + broker_name, + broker_state, + created, + data_replication_mode, + authentication_strategy + FROM + aws_mq_broker + WHERE + broker_state = 'REBOOT_IN_PROGRESS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MQ Brokers -Title: Find AWS MQ Brokers with Reboot In Progress State + - MQ Brokers +Title: Find AWS MQ Brokers with Reboot In Progress State \ No newline at end of file diff --git a/queries/aws_mq_broker_3.yaml b/queries/aws_mq_broker_3.yaml old mode 100755 new mode 100644 index 98040a5de..896530726 --- a/queries/aws_mq_broker_3.yaml +++ b/queries/aws_mq_broker_3.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS MQ Brokers. ID: aws_mq_broker_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n broker_name,\n broker_state,\n created\nfrom\n\ - \ aws_mq_broker\nwhere\n publicly_accessible;" + QueryToExecute: | + SELECT + arn, + broker_name, + broker_state, + created + FROM + aws_mq_broker + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MQ Brokers -Title: List all AWS MQ Brokers with SQL Queries + - MQ Brokers +Title: List all AWS MQ Brokers with SQL Queries \ No newline at end of file diff --git a/queries/aws_mq_broker_4.yaml b/queries/aws_mq_broker_4.yaml old mode 100755 new mode 100644 index a69a2eaa8..058bc3c81 --- a/queries/aws_mq_broker_4.yaml +++ b/queries/aws_mq_broker_4.yaml @@ -1,20 +1,27 @@ Description: Allows users to query AWS MQ Brokers. ID: aws_mq_broker_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n broker_name,\n encryption_options ->> 'UseAwsOwnedKey'\ - \ as use_aws_owned_key,\n created\nfrom\n aws_mq_broker\nwhere\n encryption_options\ - \ ->> 'UseAwsOwnedKey' = 'false';" + QueryToExecute: | + SELECT + arn, + broker_name, + encryption_options ->> 'UseAwsOwnedKey' AS use_aws_owned_key, + created + FROM + aws_mq_broker + WHERE + encryption_options ->> 'UseAwsOwnedKey' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MQ Broker -Title: Find all AWS MQ Brokers using SQL + - MQ Broker +Title: Find all AWS MQ Brokers using SQL \ No newline at end of file diff --git a/queries/aws_mq_broker_5.yaml b/queries/aws_mq_broker_5.yaml old mode 100755 new mode 100644 index f8344bf21..96bb3801e --- a/queries/aws_mq_broker_5.yaml +++ b/queries/aws_mq_broker_5.yaml @@ -1,21 +1,26 @@ Description: Allows users to query AWS MQ Brokers. ID: aws_mq_broker_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n broker_name,\n maintenance_window_start_time\ - \ -> 'DayOfWeek' as day_of_week,\n maintenance_window_start_time -> 'TimeOfDay'\ - \ as time_of_day,\n maintenance_window_start_time -> 'TimeZone' as time_zone\n\ - from\n aws_mq_broker;" + QueryToExecute: | + SELECT + arn, + broker_name, + maintenance_window_start_time -> 'DayOfWeek' AS day_of_week, + maintenance_window_start_time -> 'TimeOfDay' AS time_of_day, + maintenance_window_start_time -> 'TimeZone' AS time_zone + FROM + aws_mq_broker; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MQ -Title: Find all AWS MQ Brokers with Maintenance Window Info + - MQ +Title: Find all AWS MQ Brokers with Maintenance Window Info \ No newline at end of file diff --git a/queries/aws_msk_cluster_1.yaml b/queries/aws_msk_cluster_1.yaml old mode 100755 new mode 100644 index ff7deb9dd..0ef61b2e3 --- a/queries/aws_msk_cluster_1.yaml +++ b/queries/aws_msk_cluster_1.yaml @@ -1,19 +1,29 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n cluster_type,\n creation_time,\n\ - \ current_version,\n region,\n tags\nfrom\n aws_msk_cluster;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + cluster_type, + creation_time, + current_version, + region, + tags + FROM + aws_msk_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka -Title: Find AWS MSK Clusters using SQL with Steampipe Table + - Managed Streaming for Apache Kafka +Title: Find AWS MSK Clusters using SQL with Steampipe Table \ No newline at end of file diff --git a/queries/aws_msk_cluster_2.yaml b/queries/aws_msk_cluster_2.yaml old mode 100755 new mode 100644 index f274896d2..b22e0a469 --- a/queries/aws_msk_cluster_2.yaml +++ b/queries/aws_msk_cluster_2.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_cluster\nwhere\n state <> 'ACTIVE';" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_cluster + WHERE + state <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka -Title: List all AWS MSK Clusters and Their States + - Managed Streaming for Apache Kafka +Title: List all AWS MSK Clusters and Their States \ No newline at end of file diff --git a/queries/aws_msk_cluster_3.yaml b/queries/aws_msk_cluster_3.yaml old mode 100755 new mode 100644 index 7c533e6f1..0eedac491 --- a/queries/aws_msk_cluster_3.yaml +++ b/queries/aws_msk_cluster_3.yaml @@ -1,22 +1,29 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_cluster\nwhere\n provisioned -> 'BrokerNodeGroupInfo' -> 'ConnectivityInfo'\ - \ -> 'PublicAccess' ->> 'Type' <> 'DISABLED';" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_cluster + WHERE + provisioned -> 'BrokerNodeGroupInfo' -> 'ConnectivityInfo' -> 'PublicAccess' ->> 'Type' <> 'DISABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka (MSK) -Title: Find AWS MSK Clusters and Their Details + - Managed Streaming for Apache Kafka (MSK) +Title: Find AWS MSK Clusters and Their Details \ No newline at end of file diff --git a/queries/aws_msk_cluster_4.yaml b/queries/aws_msk_cluster_4.yaml old mode 100755 new mode 100644 index 5a075a319..dc4ceb840 --- a/queries/aws_msk_cluster_4.yaml +++ b/queries/aws_msk_cluster_4.yaml @@ -1,22 +1,29 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_cluster\nwhere\n provisioned -> 'EncryptionInfo' -> 'EncryptionAtRest'\ - \ is null;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_cluster + WHERE + provisioned -> 'EncryptionInfo' -> 'EncryptionAtRest' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka (MSK) -Title: List all AWS MSK Clusters with Unencrypted Data + - Managed Streaming for Apache Kafka (MSK) +Title: List all AWS MSK Clusters with Unencrypted Data \ No newline at end of file diff --git a/queries/aws_msk_cluster_5.yaml b/queries/aws_msk_cluster_5.yaml old mode 100755 new mode 100644 index 8f94f3e1c..3140981a5 --- a/queries/aws_msk_cluster_5.yaml +++ b/queries/aws_msk_cluster_5.yaml @@ -1,20 +1,27 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_cluster\nwhere\n provisioned -> 'EncryptionInfo' -> 'EncryptionInTransit'\ - \ is null;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_cluster + WHERE + provisioned -> 'EncryptionInfo' -> 'EncryptionInTransit' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka -Title: List All AWS MSK Clusters with Specific Encryption State + - Managed Streaming for Apache Kafka +Title: List All AWS MSK Clusters with Specific Encryption State \ No newline at end of file diff --git a/queries/aws_msk_cluster_6.yaml b/queries/aws_msk_cluster_6.yaml old mode 100755 new mode 100644 index bceac3fc1..34f640452 --- a/queries/aws_msk_cluster_6.yaml +++ b/queries/aws_msk_cluster_6.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_cluster\nwhere\n provisioned -> 'LoggingInfo' is null;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_cluster + WHERE + provisioned -> 'LoggingInfo' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka -Title: List all AWS MSK Clusters with Missing Logging Info + - Managed Streaming for Apache Kafka +Title: List all AWS MSK Clusters with Missing Logging Info \ No newline at end of file diff --git a/queries/aws_msk_cluster_7.yaml b/queries/aws_msk_cluster_7.yaml old mode 100755 new mode 100644 index 4898cff32..a12dfadde --- a/queries/aws_msk_cluster_7.yaml +++ b/queries/aws_msk_cluster_7.yaml @@ -1,19 +1,22 @@ Description: Allows users to query AWS Managed Streaming for Apache Kafka (MSK) clusters. ID: aws_msk_cluster_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n sum((provisioned -> 'BrokerNodeGroupInfo' -> 'StorageInfo'\ - \ -> 'EbsStorageInfo' ->> 'VolumeSize')::int) as total_storage\nfrom\n aws_msk_cluster;" + QueryToExecute: | + SELECT + SUM((provisioned -> 'BrokerNodeGroupInfo' -> 'StorageInfo' -> 'EbsStorageInfo' ->> 'VolumeSize')::int) AS total_storage + FROM + aws_msk_cluster; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Apache Kafka -Title: Find Total Storage of AWS MSK Clusters + - Managed Streaming for Apache Kafka +Title: Find Total Storage of AWS MSK Clusters \ No newline at end of file diff --git a/queries/aws_msk_serverless_cluster_1.yaml b/queries/aws_msk_serverless_cluster_1.yaml old mode 100755 new mode 100644 index 54b239d2a..546c234b3 --- a/queries/aws_msk_serverless_cluster_1.yaml +++ b/queries/aws_msk_serverless_cluster_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed - information about each cluster. +Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed information about each cluster. ID: aws_msk_serverless_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n cluster_type,\n creation_time,\n\ - \ current_version,\n region,\n tags\nfrom\n aws_msk_serverless_cluster;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + cluster_type, + creation_time, + current_version, + region, + tags + FROM + aws_msk_serverless_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Kafka (MSK) -Title: List AWS MSK Serverless Clusters with Detailed Info + - Managed Streaming for Kafka (MSK) +Title: List AWS MSK Serverless Clusters with Detailed Info \ No newline at end of file diff --git a/queries/aws_msk_serverless_cluster_2.yaml b/queries/aws_msk_serverless_cluster_2.yaml old mode 100755 new mode 100644 index 7a090219a..e75d83ba6 --- a/queries/aws_msk_serverless_cluster_2.yaml +++ b/queries/aws_msk_serverless_cluster_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed - information about each cluster. +Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed information about each cluster. ID: aws_msk_serverless_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_serverless_cluster\nwhere\n state <> 'ACTIVE';" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_serverless_cluster + WHERE + state <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - MSK -Title: List all AWS MSK Serverless Clusters Using SQL + - MSK +Title: List all AWS MSK Serverless Clusters Using SQL \ No newline at end of file diff --git a/queries/aws_msk_serverless_cluster_3.yaml b/queries/aws_msk_serverless_cluster_3.yaml old mode 100755 new mode 100644 index aea06997c..5df2e6171 --- a/queries/aws_msk_serverless_cluster_3.yaml +++ b/queries/aws_msk_serverless_cluster_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed - information about each cluster. +Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed information about each cluster. ID: aws_msk_serverless_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n creation_time\nfrom\n\ - \ aws_msk_serverless_cluster\nwhere\n creation_time >= (current_date - interval\ - \ '90' day)\norder by\n creation_time;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + creation_time + FROM + aws_msk_serverless_cluster + WHERE + creation_time >= (CURRENT_DATE - INTERVAL '90' DAY) + ORDER BY + creation_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon MSK -Title: List all AWS MSK Serverless Clusters with Details + - Amazon MSK +Title: List all AWS MSK Serverless Clusters with Details \ No newline at end of file diff --git a/queries/aws_msk_serverless_cluster_4.yaml b/queries/aws_msk_serverless_cluster_4.yaml old mode 100755 new mode 100644 index 197a5a782..cbb0e6cee --- a/queries/aws_msk_serverless_cluster_4.yaml +++ b/queries/aws_msk_serverless_cluster_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed - information about each cluster. +Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed information about each cluster. ID: aws_msk_serverless_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n vpc ->> 'SubnetIds'\ - \ as subnet_ids,\n vpc ->> 'SecurityGroupIds' as security_group_ids\nfrom\n \ - \ aws_msk_serverless_cluster,\n jsonb_array_elements(serverless -> 'VpcConfigs')\ - \ as vpc" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + vpc ->> 'SubnetIds' AS subnet_ids, + vpc ->> 'SecurityGroupIds' AS security_group_ids + FROM + aws_msk_serverless_cluster, + jsonb_array_elements(serverless -> 'VpcConfigs') AS vpc Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Kafka (MSK) Serverless -Title: Find all AWS MSK Serverless Cluster details + - Managed Streaming for Kafka (MSK) Serverless +Title: Find all AWS MSK Serverless Cluster details \ No newline at end of file diff --git a/queries/aws_msk_serverless_cluster_5.yaml b/queries/aws_msk_serverless_cluster_5.yaml old mode 100755 new mode 100644 index 184560110..9d933a53d --- a/queries/aws_msk_serverless_cluster_5.yaml +++ b/queries/aws_msk_serverless_cluster_5.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed - information about each cluster. +Description: Allows users to query AWS MSK Serverless Clusters to retrieve detailed information about each cluster. ID: aws_msk_serverless_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n cluster_name,\n state,\n serverless -> 'ClientAuthentication'\ - \ as client_authentication\nfrom\n aws_msk_serverless_cluster\nwhere\n (serverless\ - \ -> 'ClientAuthentication' -> 'Sasl' -> 'Iam' ->> 'Enabled')::boolean = false;" + QueryToExecute: | + SELECT + arn, + cluster_name, + state, + serverless -> 'ClientAuthentication' AS client_authentication + FROM + aws_msk_serverless_cluster + WHERE + (serverless -> 'ClientAuthentication' -> 'Sasl' -> 'Iam' ->> 'Enabled')::boolean = FALSE; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Streaming for Kafka (MSK) -Title: Find AWS MSK Serverless Clusters with Specific Client Auth + - Managed Streaming for Kafka (MSK) +Title: Find AWS MSK Serverless Clusters with Specific Client Auth \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_1.yaml b/queries/aws_neptune_db_cluster_1.yaml old mode 100755 new mode 100644 index 5096d2456..046a88251 --- a/queries/aws_neptune_db_cluster_1.yaml +++ b/queries/aws_neptune_db_cluster_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Amazon Neptune DB clusters for comprehensive information - about their configuration, status, and other relevant details. +Description: Allows users to query Amazon Neptune DB clusters for comprehensive information about their configuration, status, and other relevant details. ID: aws_neptune_db_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n allocated_storage,\n kms_key_id\n\ - from\n aws_neptune_db_cluster\nwhere\n kms_key_id is null;" + QueryToExecute: | + SELECT + db_cluster_identifier, + allocated_storage, + kms_key_id + FROM + aws_neptune_db_cluster + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Neptune -Title: List all configurations and status of Neptune DB Clusters + - Amazon Neptune +Title: List all configurations and status of Neptune DB Clusters \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_2.yaml b/queries/aws_neptune_db_cluster_2.yaml old mode 100755 new mode 100644 index 4db2b5727..b64d434eb --- a/queries/aws_neptune_db_cluster_2.yaml +++ b/queries/aws_neptune_db_cluster_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Amazon Neptune DB clusters for comprehensive information - about their configuration, status, and other relevant details. +Description: Allows users to query Amazon Neptune DB clusters for comprehensive information about their configuration, status, and other relevant details. ID: aws_neptune_db_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n backup_retention_period\nfrom\n\ - \ aws_neptune_db_cluster\nwhere\n backup_retention_period > 7;" + QueryToExecute: | + SELECT + db_cluster_identifier, + backup_retention_period + FROM + aws_neptune_db_cluster + WHERE + backup_retention_period > 7; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Neptune -Title: List all Amazon Neptune DB clusters and their configurations + - Amazon Neptune +Title: List all Amazon Neptune DB clusters and their configurations \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_3.yaml b/queries/aws_neptune_db_cluster_3.yaml old mode 100755 new mode 100644 index 5ec9f3962..241016610 --- a/queries/aws_neptune_db_cluster_3.yaml +++ b/queries/aws_neptune_db_cluster_3.yaml @@ -1,20 +1,23 @@ -Description: Allows users to query Amazon Neptune DB clusters for comprehensive information - about their configuration, status, and other relevant details. +Description: Allows users to query Amazon Neptune DB clusters for comprehensive information about their configuration, status, and other relevant details. ID: aws_neptune_db_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n jsonb_array_length(availability_zones)\ - \ availability_zones_count\nfrom\n aws_neptune_db_cluster;" + QueryToExecute: | + SELECT + db_cluster_identifier, + JSONB_ARRAY_LENGTH(availability_zones) AS availability_zones_count + FROM + aws_neptune_db_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Neptune -Title: List all Amazon Neptune DB Clusters and Their Details + - Amazon Neptune +Title: List all Amazon Neptune DB Clusters and Their Details \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_4.yaml b/queries/aws_neptune_db_cluster_4.yaml old mode 100755 new mode 100644 index e6d1541e8..f1877ee60 --- a/queries/aws_neptune_db_cluster_4.yaml +++ b/queries/aws_neptune_db_cluster_4.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query Amazon Neptune DB clusters for comprehensive information - about their configuration, status, and other relevant details. +Description: Allows users to query Amazon Neptune DB clusters for comprehensive information about their configuration, status, and other relevant details. ID: aws_neptune_db_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n member ->> 'DBClusterParameterGroupStatus'\ - \ as db_cluster_parameter_group_status,\n member ->> 'DBInstanceIdentifier' as\ - \ db_instance_identifier,\n member ->> 'IsClusterWriter' as is_cluster_writer,\n\ - \ member ->> 'PromotionTier' as promotion_tier\nfrom\n aws_neptune_db_cluster\n\ - \ cross join jsonb_array_elements(db_cluster_members) as member;" + QueryToExecute: | + SELECT + db_cluster_identifier, + member ->> 'DBClusterParameterGroupStatus' AS db_cluster_parameter_group_status, + member ->> 'DBInstanceIdentifier' AS db_instance_identifier, + member ->> 'IsClusterWriter' AS is_cluster_writer, + member ->> 'PromotionTier' AS promotion_tier + FROM + aws_neptune_db_cluster + CROSS JOIN + jsonb_array_elements(db_cluster_members) AS member; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Neptune DB -Title: Find Amazon Neptune DB Clusters including configuration & status + - Amazon Neptune DB +Title: Find Amazon Neptune DB Clusters including configuration & status \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_snapshot_1.yaml b/queries/aws_neptune_db_cluster_snapshot_1.yaml old mode 100755 new mode 100644 index 4452411d7..20e5f8e54 --- a/queries/aws_neptune_db_cluster_snapshot_1.yaml +++ b/queries/aws_neptune_db_cluster_snapshot_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive - details about their configurations, status, and associated metadata. +Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive details about their configurations, status, and associated metadata. ID: aws_neptune_db_cluster_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n snapshot_type,\n \ - \ storage_encrypted\nfrom\n aws_neptune_db_cluster_snapshot\nwhere\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + snapshot_type, + storage_encrypted + FROM + aws_neptune_db_cluster_snapshot + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Neptune -Title: List all AWS Neptune DB Cluster Snapshots for metadata + - Neptune +Title: List all AWS Neptune DB Cluster Snapshots for metadata \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_snapshot_2.yaml b/queries/aws_neptune_db_cluster_snapshot_2.yaml old mode 100755 new mode 100644 index 89a3f3dba..1edda9d55 --- a/queries/aws_neptune_db_cluster_snapshot_2.yaml +++ b/queries/aws_neptune_db_cluster_snapshot_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive - details about their configurations, status, and associated metadata. +Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive details about their configurations, status, and associated metadata. ID: aws_neptune_db_cluster_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n cluster_create_time,\n\ - \ engine,\n engine_version,\n license_model\nfrom\n aws_neptune_db_cluster_snapshot;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + cluster_create_time, + engine, + engine_version, + license_model + FROM + aws_neptune_db_cluster_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Neptune -Title: Find all AWS Neptune DB Cluster Snapshots with metadata + - Neptune +Title: Find all AWS Neptune DB Cluster Snapshots with metadata \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_snapshot_3.yaml b/queries/aws_neptune_db_cluster_snapshot_3.yaml old mode 100755 new mode 100644 index 51091d112..04633473c --- a/queries/aws_neptune_db_cluster_snapshot_3.yaml +++ b/queries/aws_neptune_db_cluster_snapshot_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive - details about their configurations, status, and associated metadata. +Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive details about their configurations, status, and associated metadata. ID: aws_neptune_db_cluster_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n count(db_cluster_snapshot_identifier)\ - \ snapshot_count\nfrom\n aws_neptune_db_cluster_snapshot\ngroup by\n db_cluster_identifier;" + QueryToExecute: | + SELECT + db_cluster_identifier, + COUNT(db_cluster_snapshot_identifier) AS snapshot_count + FROM + aws_neptune_db_cluster_snapshot + GROUP BY + db_cluster_identifier; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Neptune -Title: List all AWS Neptune DB Cluster Snapshots and Counts + - Neptune +Title: List all AWS Neptune DB Cluster Snapshots and Counts \ No newline at end of file diff --git a/queries/aws_neptune_db_cluster_snapshot_4.yaml b/queries/aws_neptune_db_cluster_snapshot_4.yaml old mode 100755 new mode 100644 index 457ac8d7e..00bfca6d0 --- a/queries/aws_neptune_db_cluster_snapshot_4.yaml +++ b/queries/aws_neptune_db_cluster_snapshot_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive - details about their configurations, status, and associated metadata. +Description: Allows users to query AWS Neptune DB Cluster Snapshots for comprehensive details about their configurations, status, and associated metadata. ID: aws_neptune_db_cluster_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n engine,\n snapshot_type\n\ - from\n aws_neptune_db_cluster_snapshot,\n jsonb_array_elements(db_cluster_snapshot_attributes)\ - \ as cluster_snapshot\nwhere\n cluster_snapshot -> 'AttributeValues' = '[\"all\"\ - ]';" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + engine, + snapshot_type + FROM + aws_neptune_db_cluster_snapshot, + jsonb_array_elements(db_cluster_snapshot_attributes) AS cluster_snapshot + WHERE + cluster_snapshot -> 'AttributeValues' = '["all"]' Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Neptune DB -Title: Find all AWS Neptune DB Cluster Snapshot details + - Neptune DB +Title: Find all AWS Neptune DB Cluster Snapshot details \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_1.yaml b/queries/aws_networkfirewall_firewall_1.yaml old mode 100755 new mode 100644 index 8120402a0..c86e26b2e --- a/queries/aws_networkfirewall_firewall_1.yaml +++ b/queries/aws_networkfirewall_firewall_1.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n vpc_id,\n policy_arn,\n\ - \ region,\n tags\nfrom\n aws_networkfirewall_firewall;" + QueryToExecute: | + SELECT + arn, + name, + description, + vpc_id, + policy_arn, + region, + tags + FROM + aws_networkfirewall_firewall; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find all AWS Network Firewall properties and settings + - Network Firewall +Title: Find all AWS Network Firewall properties and settings \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_2.yaml b/queries/aws_networkfirewall_firewall_2.yaml old mode 100755 new mode 100644 index 91ed9d58c..b46e399be --- a/queries/aws_networkfirewall_firewall_2.yaml +++ b/queries/aws_networkfirewall_firewall_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n encryption_configuration\n\ - from\n aws_networkfirewall_firewall\nwhere\n encryption_configuration ->> 'Type'\ - \ = `AWS_OWNED_KMS_KEY';" + QueryToExecute: | + SELECT + arn, + name, + description, + encryption_configuration + FROM + aws_networkfirewall_firewall + WHERE + encryption_configuration ->> 'Type' = 'AWS_OWNED_KMS_KEY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find AWS Network Firewall details including encryption + - Network Firewall +Title: Find AWS Network Firewall details including encryption \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_3.yaml b/queries/aws_networkfirewall_firewall_3.yaml old mode 100755 new mode 100644 index 0340574c4..8d275f031 --- a/queries/aws_networkfirewall_firewall_3.yaml +++ b/queries/aws_networkfirewall_firewall_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n vpc_id\nfrom\n aws_networkfirewall_firewall\n\ - where\n not delete_protection;" + QueryToExecute: | + SELECT + arn, + name, + description, + vpc_id + FROM + aws_networkfirewall_firewall + WHERE + NOT delete_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Network Firewall -Title: Find AWS Network Firewalls for Properties and Settings + - AWS Network Firewall +Title: Find AWS Network Firewalls for Properties and Settings \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_4.yaml b/queries/aws_networkfirewall_firewall_4.yaml old mode 100755 new mode 100644 index 09573c02a..7fcd0402f --- a/queries/aws_networkfirewall_firewall_4.yaml +++ b/queries/aws_networkfirewall_firewall_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n vpc_id\nfrom\n aws_networkfirewall_firewall\n\ - where\n not policy_change_protection;" + QueryToExecute: | + SELECT + arn, + name, + description, + vpc_id + FROM + aws_networkfirewall_firewall + WHERE + NOT policy_change_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewalls -Title: Find All AWS Network Firewalls with Details + - Network Firewalls +Title: Find All AWS Network Firewalls with Details \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_5.yaml b/queries/aws_networkfirewall_firewall_5.yaml old mode 100755 new mode 100644 index 71f4a1c24..4c3c9455f --- a/queries/aws_networkfirewall_firewall_5.yaml +++ b/queries/aws_networkfirewall_firewall_5.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n vpc_id\nfrom\n aws_networkfirewall_firewall\n\ - where\n not subnet_change_protection;" + QueryToExecute: | + SELECT + arn, + name, + description, + vpc_id + FROM + aws_networkfirewall_firewall + WHERE + NOT subnet_change_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find AWS Network Firewall Properties and Settings + - Network Firewall +Title: Find AWS Network Firewall Properties and Settings \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_6.yaml b/queries/aws_networkfirewall_firewall_6.yaml old mode 100755 new mode 100644 index 55b3da26c..a87699da0 --- a/queries/aws_networkfirewall_firewall_6.yaml +++ b/queries/aws_networkfirewall_firewall_6.yaml @@ -1,26 +1,36 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.arn,\n f.name,\n f.vpc_id,\n s ->> 'SubnetId' as\ - \ subnet_id,\n cidr_block,\n availability_zone,\n default_for_az\nfrom\n aws_networkfirewall_firewall\ - \ f,\n jsonb_array_elements(subnet_mappings) s,\n aws_vpc_subnet vs\nwhere\n\ - \ vs.subnet_id = s ->> 'SubnetId';" + QueryToExecute: | + SELECT + f.arn, + f.name, + f.vpc_id, + s ->> 'SubnetId' AS subnet_id, + cidr_block, + availability_zone, + default_for_az + FROM + aws_networkfirewall_firewall f, + JSONB_ARRAY_ELEMENTS(subnet_mappings) s, + aws_vpc_subnet vs + WHERE + vs.subnet_id = s ->> 'SubnetId'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: List AWS Network Firewall properties and settings + - Network Firewall +Title: List AWS Network Firewall properties and settings \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_7.yaml b/queries/aws_networkfirewall_firewall_7.yaml old mode 100755 new mode 100644 index 5cc869618..f3877e370 --- a/queries/aws_networkfirewall_firewall_7.yaml +++ b/queries/aws_networkfirewall_firewall_7.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n f.arn,\n f.name,\n f.vpc_id,\n k.arn as key_arn,\n\ - \ key_rotation_enabled\nfrom\n aws_networkfirewall_firewall f,\n aws_kms_key\ - \ k\nwhere\n k.id = encryption_configuration ->> 'KeyId'\n and not f.encryption_configuration\ - \ ->> 'Type' = `AWS_OWNED_KMS_KEY';" + QueryToExecute: | + SELECT + f.arn, + f.name, + f.vpc_id, + k.arn AS key_arn, + key_rotation_enabled + FROM + aws_networkfirewall_firewall f, + aws_kms_key k + WHERE + k.id = encryption_configuration ->> 'KeyId' + AND NOT f.encryption_configuration ->> 'Type' = 'AWS_OWNED_KMS_KEY'; Tags: cloud_data_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find details of AWS Network Firewalls properties and settings + - Network Firewall +Title: Find details of AWS Network Firewalls properties and settings \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_8.yaml b/queries/aws_networkfirewall_firewall_8.yaml old mode 100755 new mode 100644 index 13509a21b..303aca74a --- a/queries/aws_networkfirewall_firewall_8.yaml +++ b/queries/aws_networkfirewall_firewall_8.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Network Firewalls for detailed information - about each firewall''s properties and settings. +Description: Allows users to query AWS Network Firewalls for detailed information about each firewall's properties and settings. ID: aws_networkfirewall_firewall_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n l -> 'LogDestination' as log_destination,\n\ - \ l ->> 'LogDestinationType' as log_destination_type,\n l ->> 'LogType' as log_type\n\ - from\n aws_networkfirewall_firewall,\n jsonb_array_elements(logging_configuration)\ - \ as l;" + QueryToExecute: | + SELECT + name, + arn, + l -> 'LogDestination' AS log_destination, + l ->> 'LogDestinationType' AS log_destination_type, + l ->> 'LogType' AS log_type + FROM + aws_networkfirewall_firewall, + jsonb_array_elements(logging_configuration) AS l; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: List all AWS Network Firewalls and Logging configurations + - Network Firewall +Title: List all AWS Network Firewalls and Logging configurations \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_policy_1.yaml b/queries/aws_networkfirewall_firewall_policy_1.yaml old mode 100755 new mode 100644 index 4a2a3bcba..79fc2556b --- a/queries/aws_networkfirewall_firewall_policy_1.yaml +++ b/queries/aws_networkfirewall_firewall_policy_1.yaml @@ -1,21 +1,29 @@ -Description: '' +Description: "Retrieves detailed information on AWS Network Firewall policies, including status, region, and associated tags, to help manage and secure network firewall configurations." ID: aws_networkfirewall_firewall_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n firewall_policy_status,\n\ - \ region,\n tags\nfrom\n aws_networkfirewall_firewall_policy;" + QueryToExecute: | + SELECT + arn, + name, + description, + firewall_policy_status, + region, + tags + FROM + aws_networkfirewall_firewall_policy; Tags: cloud_asset_management: - - 'true' + - 'true' cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: '' + - Network Firewall +Title: "AWS Network Firewall Policies Overview" \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_policy_2.yaml b/queries/aws_networkfirewall_firewall_policy_2.yaml old mode 100755 new mode 100644 index e435a3938..1c05cb7b1 --- a/queries/aws_networkfirewall_firewall_policy_2.yaml +++ b/queries/aws_networkfirewall_firewall_policy_2.yaml @@ -1,20 +1,28 @@ -Description: '' +Description: "Fetches AWS Network Firewall policies with AWS-owned KMS encryption configurations, including policy status and encryption details, to aid in security and compliance checks." ID: aws_networkfirewall_firewall_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n firewall_policy_status,\n\ - \ encryption_configuration\nfrom\n aws_networkfirewall_firewall_policy\nwhere\ - \ \n encryption_configuration ->> 'Type' = `aws_OWNED_KMS_KEY';" + QueryToExecute: | + SELECT + arn, + name, + description, + firewall_policy_status, + encryption_configuration + FROM + aws_networkfirewall_firewall_policy + WHERE + encryption_configuration ->> 'Type' = 'aws_OWNED_KMS_KEY'; Tags: cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: '' + - Network Firewall +Title: "AWS Network Firewall Policies with AWS-Owned KMS Encryption" \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_policy_3.yaml b/queries/aws_networkfirewall_firewall_policy_3.yaml old mode 100755 new mode 100644 index d1e717bf6..34bacbc72 --- a/queries/aws_networkfirewall_firewall_policy_3.yaml +++ b/queries/aws_networkfirewall_firewall_policy_3.yaml @@ -1,20 +1,29 @@ -Description: '' +Description: "Retrieves AWS Network Firewall policies that are not in an 'ACTIVE' status, providing details to help monitor and troubleshoot firewall configurations." ID: aws_networkfirewall_firewall_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name,\n description,\n firewall_policy_status,\n\ - \ region,\n tags\nfrom\n aws_networkfirewall_firewall_policy\nwhere\n firewall_policy_status\ - \ != 'ACTIVE';" + QueryToExecute: | + SELECT + arn, + name, + description, + firewall_policy_status, + region, + tags + FROM + aws_networkfirewall_firewall_policy + WHERE + firewall_policy_status != 'ACTIVE'; Tags: cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: '' + - Network Firewall +Title: "Non-Active AWS Network Firewall Policies" \ No newline at end of file diff --git a/queries/aws_networkfirewall_firewall_policy_4.yaml b/queries/aws_networkfirewall_firewall_policy_4.yaml old mode 100755 new mode 100644 index 9441ff31f..e75772755 --- a/queries/aws_networkfirewall_firewall_policy_4.yaml +++ b/queries/aws_networkfirewall_firewall_policy_4.yaml @@ -1,23 +1,28 @@ -Description: '' +Description: "Fetches details of AWS Network Firewall policies, including stateful default actions and rule group references, to assist in managing and reviewing firewall configurations." ID: aws_networkfirewall_firewall_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name as firewall_policy_name,\n firewall_policy_status,\n\ - \ firewall_policy -> 'StatefulDefaultActions' as stateful_default_actions,\n\ - \ firewall_policy -> 'StatefulRuleGroupReferences' as stateful_rule_group_references\n\ - from\n aws_networkfirewall_firewall_policy;" + QueryToExecute: | + SELECT + arn, + name AS firewall_policy_name, + firewall_policy_status, + firewall_policy -> 'StatefulDefaultActions' AS stateful_default_actions, + firewall_policy -> 'StatefulRuleGroupReferences' AS stateful_rule_group_references + FROM + aws_networkfirewall_firewall_policy; Tags: cloud_asset_management: - - 'true' + - 'true' cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: '' + - Network Firewall +Title: "AWS Network Firewall Policy Details with Stateful Actions" diff --git a/queries/aws_networkfirewall_firewall_policy_5.yaml b/queries/aws_networkfirewall_firewall_policy_5.yaml old mode 100755 new mode 100644 index d221a6146..02def16f7 --- a/queries/aws_networkfirewall_firewall_policy_5.yaml +++ b/queries/aws_networkfirewall_firewall_policy_5.yaml @@ -1,23 +1,28 @@ -Description: '' +Description: "Retrieves AWS Network Firewall policies with details on stateless default actions and rule group references, aiding in configuration management and security reviews." ID: aws_networkfirewall_firewall_policy_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name as firewall_policy_name,\n firewall_policy_status,\n\ - \ firewall_policy -> 'StatelessDefaultActions' as stateless_default_actions,\n\ - \ firewall_policy -> 'StatelessRuleGroupReferences' as stateless_rule_group_references\n\ - from\n aws_networkfirewall_firewall_policy;" + QueryToExecute: | + SELECT + arn, + name AS firewall_policy_name, + firewall_policy_status, + firewall_policy -> 'StatelessDefaultActions' AS stateless_default_actions, + firewall_policy -> 'StatelessRuleGroupReferences' AS stateless_rule_group_references + FROM + aws_networkfirewall_firewall_policy; Tags: cloud_asset_management: - - 'true' + - 'true' cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - NetworkFirewall -Title: '' + - Network Firewall +Title: "AWS Network Firewall Policy with Stateless Actions" diff --git a/queries/aws_networkfirewall_firewall_policy_6.yaml b/queries/aws_networkfirewall_firewall_policy_6.yaml old mode 100755 new mode 100644 index 75f65ef7d..ae6259c4a --- a/queries/aws_networkfirewall_firewall_policy_6.yaml +++ b/queries/aws_networkfirewall_firewall_policy_6.yaml @@ -1,21 +1,26 @@ -Description: '' +Description: "Fetches AWS Network Firewall policies with details on stateless fragment default actions and rule group references, supporting security management and firewall configuration review." ID: aws_networkfirewall_firewall_policy_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name as firewall_policy_name,\n firewall_policy_status,\n\ - \ firewall_policy -> 'StatelessFragmentDefaultActions' as stateless_default_actions,\n\ - \ firewall_policy -> 'StatelessRuleGroupReferences' as stateless_rule_group_references\n\ - from\n aws_networkfirewall_firewall_policy;" + QueryToExecute: | + SELECT + arn, + name AS firewall_policy_name, + firewall_policy_status, + firewall_policy -> 'StatelessFragmentDefaultActions' AS stateless_default_actions, + firewall_policy -> 'StatelessRuleGroupReferences' AS stateless_rule_group_references + FROM + aws_networkfirewall_firewall_policy; Tags: cloud_asset_management: - - 'true' + - 'true' cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws -Title: '' + - aws +Title: "AWS Network Firewall Policies with Stateless Fragment Actions" diff --git a/queries/aws_networkfirewall_firewall_policy_7.yaml b/queries/aws_networkfirewall_firewall_policy_7.yaml old mode 100755 new mode 100644 index f59bf9fb0..118ac104f --- a/queries/aws_networkfirewall_firewall_policy_7.yaml +++ b/queries/aws_networkfirewall_firewall_policy_7.yaml @@ -1,21 +1,26 @@ -Description: '' +Description: "Retrieves AWS Network Firewall policies with details on custom actions within stateless rule group references, including action names and definitions, to support detailed firewall policy configuration review." ID: aws_networkfirewall_firewall_policy_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n name as firewall_policy_name,\n firewall_policy_status,\n\ - \ firewall_policy -> 'StatelessRuleGroupReferences' ->> 'ActionName' as custom_action_name,\n\ - \ firewall_policy -> 'StatelessRuleGroupReferences' ->> 'ActionDefinition' as\ - \ custom_action_definition\nfrom\n aws_networkfirewall_firewall_policy;" + QueryToExecute: | + SELECT + arn, + name AS firewall_policy_name, + firewall_policy_status, + firewall_policy -> 'StatelessRuleGroupReferences' ->> 'ActionName' AS custom_action_name, + firewall_policy -> 'StatelessRuleGroupReferences' ->> 'ActionDefinition' AS custom_action_definition + FROM + aws_networkfirewall_firewall_policy; Tags: cloud_network_security: - - 'true' + - 'true' cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: '' + - Network Firewall +Title: "AWS Network Firewall Policies with Custom Stateless Actions" diff --git a/queries/aws_networkfirewall_rule_group_1.yaml b/queries/aws_networkfirewall_rule_group_1.yaml old mode 100755 new mode 100644 index 41def50b0..c69ed88e7 --- a/queries/aws_networkfirewall_rule_group_1.yaml +++ b/queries/aws_networkfirewall_rule_group_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Network Firewall Rule Group details, including - rule group ARN, capacity, rule group name, and associated tags. +Description: Allows users to query AWS Network Firewall Rule Group details, including rule group ARN, capacity, rule group name, and associated tags. ID: aws_networkfirewall_rule_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_group_name,\n rule_group_status,\n type,\n jsonb_pretty(rules_source)\ - \ as rules_source\nfrom\n aws_networkfirewall_rule_group;" + QueryToExecute: | + SELECT + rule_group_name, + rule_group_status, + type, + jsonb_pretty(rules_source) AS rules_source + FROM + aws_networkfirewall_rule_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find AWS Network Firewall Rule Group Details + - Network Firewall +Title: Find AWS Network Firewall Rule Group Details \ No newline at end of file diff --git a/queries/aws_networkfirewall_rule_group_2.yaml b/queries/aws_networkfirewall_rule_group_2.yaml old mode 100755 new mode 100644 index 13a684a4e..3adbd3f37 --- a/queries/aws_networkfirewall_rule_group_2.yaml +++ b/queries/aws_networkfirewall_rule_group_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Network Firewall Rule Group details, including - rule group ARN, capacity, rule group name, and associated tags. +Description: Allows users to query AWS Network Firewall Rule Group details, including rule group ARN, capacity, rule group name, and associated tags. ID: aws_networkfirewall_rule_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_group_name,\n rule_group_status\nfrom\n aws_networkfirewall_rule_group\n\ - where\n number_of_associations = 0;" + QueryToExecute: | + SELECT + rule_group_name, + rule_group_status + FROM + aws_networkfirewall_rule_group + WHERE + number_of_associations = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find AWS Network Firewall Rule Group Details + - Network Firewall +Title: Find AWS Network Firewall Rule Group Details \ No newline at end of file diff --git a/queries/aws_networkfirewall_rule_group_3.yaml b/queries/aws_networkfirewall_rule_group_3.yaml old mode 100755 new mode 100644 index 24ed1b66e..f40f75304 --- a/queries/aws_networkfirewall_rule_group_3.yaml +++ b/queries/aws_networkfirewall_rule_group_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Network Firewall Rule Group details, including - rule group ARN, capacity, rule group name, and associated tags. +Description: Allows users to query AWS Network Firewall Rule Group details, including rule group ARN, capacity, rule group name, and associated tags. ID: aws_networkfirewall_rule_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_group_name,\n rule_group_status,\n jsonb_pretty(rules_source\ - \ -> 'StatefulRules') as stateful_rules,\n jsonb_pretty(rule_variables) as rule_variables,\n\ - \ stateful_rule_options\nfrom\n aws_networkfirewall_rule_group\nwhere\n type\ - \ = 'STATEFUL';" + QueryToExecute: | + SELECT + rule_group_name, + rule_group_status, + JSONB_PRETTY(rules_source -> 'StatefulRules') AS stateful_rules, + JSONB_PRETTY(rule_variables) AS rule_variables, + stateful_rule_options + FROM + aws_networkfirewall_rule_group + WHERE + type = 'STATEFUL'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: Find AWS Network Firewall Rule Group Details + - Network Firewall +Title: Find AWS Network Firewall Rule Group Details \ No newline at end of file diff --git a/queries/aws_networkfirewall_rule_group_4.yaml b/queries/aws_networkfirewall_rule_group_4.yaml old mode 100755 new mode 100644 index 55b3877fd..2251c234d --- a/queries/aws_networkfirewall_rule_group_4.yaml +++ b/queries/aws_networkfirewall_rule_group_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Network Firewall Rule Group details, including - rule group ARN, capacity, rule group name, and associated tags. +Description: Allows users to query AWS Network Firewall Rule Group details, including rule group ARN, capacity, rule group name, and associated tags. ID: aws_networkfirewall_rule_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_group_name,\n rule_group_status,\n jsonb_pretty(rules_source\ - \ -> 'StatelessRulesAndCustomActions' -> 'StatelessRules') as stateless_rules,\n\ - \ jsonb_pretty(rules_source -> 'StatelessRulesAndCustomActions' -> 'CustomActions')\ - \ as custom_actions\nfrom\n aws_networkfirewall_rule_group\nwhere\n type = 'STATELESS';" + QueryToExecute: | + SELECT + rule_group_name, + rule_group_status, + jsonb_pretty(rules_source -> 'StatelessRulesAndCustomActions' -> 'StatelessRules') AS stateless_rules, + jsonb_pretty(rules_source -> 'StatelessRulesAndCustomActions' -> 'CustomActions') AS custom_actions + FROM + aws_networkfirewall_rule_group + WHERE + type = 'STATELESS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: List all AWS Network Firewall Rule Group Details + - Network Firewall +Title: List all AWS Network Firewall Rule Group Details \ No newline at end of file diff --git a/queries/aws_networkfirewall_rule_group_5.yaml b/queries/aws_networkfirewall_rule_group_5.yaml old mode 100755 new mode 100644 index c3ea2ba09..bee6c57c4 --- a/queries/aws_networkfirewall_rule_group_5.yaml +++ b/queries/aws_networkfirewall_rule_group_5.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Network Firewall Rule Group details, including - rule group ARN, capacity, rule group name, and associated tags. +Description: Allows users to query AWS Network Firewall Rule Group details, including rule group ARN, capacity, rule group name, and associated tags. ID: aws_networkfirewall_rule_group_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n rule_group_name,\n rule_group_status,\n number_of_associations\n\ - from\n aws_networkfirewall_rule_group\nwhere\n type = 'STATELESS' and jsonb_array_length(rules_source\ - \ -> 'StatelessRulesAndCustomActions' -> 'StatelessRules') = 0\n or type = 'STATEFUL'\ - \ and jsonb_array_length(rules_source -> 'StatefulRules') = 0;" + QueryToExecute: | + SELECT + rule_group_name, + rule_group_status, + number_of_associations + FROM + aws_networkfirewall_rule_group + WHERE + type = 'STATELESS' + AND jsonb_array_length(rules_source -> 'StatelessRulesAndCustomActions' -> 'StatelessRules') = 0 + OR type = 'STATEFUL' + AND jsonb_array_length(rules_source -> 'StatefulRules') = 0; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Network Firewall -Title: List AWS Network Firewall Rule Group Details + - Network Firewall +Title: List AWS Network Firewall Rule Group Details \ No newline at end of file diff --git a/queries/aws_oam_link_1.yaml b/queries/aws_oam_link_1.yaml old mode 100755 new mode 100644 index a5d987829..6865ce4b6 --- a/queries/aws_oam_link_1.yaml +++ b/queries/aws_oam_link_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS OAM Links to gather information about the link - between an AWS resource and an AWS OAM resource. +Description: Allows users to query AWS OAM Links to gather information about the link between an AWS resource and an AWS OAM resource. ID: aws_oam_link_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n sink_arn,\n label,\n resource_types\n\ - from\n aws_oam_link;" + QueryToExecute: | + SELECT + id, + arn, + sink_arn, + label, + resource_types + FROM + aws_oam_link; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OAM -Title: List all AWS OAM resource links + - OAM +Title: List all AWS OAM resource links \ No newline at end of file diff --git a/queries/aws_oam_link_2.yaml b/queries/aws_oam_link_2.yaml old mode 100755 new mode 100644 index cc3c5012e..695f73e18 --- a/queries/aws_oam_link_2.yaml +++ b/queries/aws_oam_link_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS OAM Links to gather information about the link - between an AWS resource and an AWS OAM resource. +Description: Allows users to query AWS OAM Links to gather information about the link between an AWS resource and an AWS OAM resource. ID: aws_oam_link_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n l.id,\n l.arn,\n s.name as sink_name,\n l.sink_arn\n\ - from\n aws_oam_link as l,\n aws_oam_sink as s;" + QueryToExecute: | + SELECT + l.id, + l.arn, + s.name AS sink_name, + l.sink_arn + FROM + aws_oam_link AS l, + aws_oam_sink AS s; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OAM -Title: List all AWS OAM Links and Their Associated Sinks + - OAM +Title: List all AWS OAM Links and Their Associated Sinks \ No newline at end of file diff --git a/queries/aws_oam_link_3.yaml b/queries/aws_oam_link_3.yaml old mode 100755 new mode 100644 index dbc6beabb..c00ee485a --- a/queries/aws_oam_link_3.yaml +++ b/queries/aws_oam_link_3.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS OAM Links to gather information about the link - between an AWS resource and an AWS OAM resource. +Description: Allows users to query AWS OAM Links to gather information about the link between an AWS resource and an AWS OAM resource. ID: aws_oam_link_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n l.id,\n l.arn,\n l.label,\n l.label_template,\n r\ - \ as resource_type\nfrom\n aws_oam_link as l,\n jsonb_array_elements_text(resource_types)\ - \ as r\nwhere\n r = 'AWS::Logs::LogGroup';" + QueryToExecute: | + SELECT + l.id, + l.arn, + l.label, + l.label_template, + r AS resource_type + FROM + aws_oam_link AS l, + jsonb_array_elements_text(resource_types) AS r + WHERE + r = 'AWS::Logs::LogGroup'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OAM -Title: Find AWS OAM Links Between Resources + - OAM +Title: Find AWS OAM Links Between Resources \ No newline at end of file diff --git a/queries/aws_oam_sink_1.yaml b/queries/aws_oam_sink_1.yaml old mode 100755 new mode 100644 index 84bbea942..c82302d88 --- a/queries/aws_oam_sink_1.yaml +++ b/queries/aws_oam_sink_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS OAM Sink data, providing detailed information - about each AWS OAM Sink in your AWS account. +Description: Allows users to query AWS OAM Sink data, providing detailed information about each AWS OAM Sink in your AWS account. ID: aws_oam_sink_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n tags,\n title\nfrom\n aws_oam_sink;" + QueryToExecute: | + SELECT + name, + id, + arn, + tags, + title + FROM + aws_oam_sink; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OAM Sink -Title: Find AWS OAM Sink data for detailed information + - OAM Sink +Title: Find AWS OAM Sink data for detailed information \ No newline at end of file diff --git a/queries/aws_oam_sink_2.yaml b/queries/aws_oam_sink_2.yaml old mode 100755 new mode 100644 index 9cc194bc8..42ad06ca5 --- a/queries/aws_oam_sink_2.yaml +++ b/queries/aws_oam_sink_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS OAM Sink data, providing detailed information - about each AWS OAM Sink in your AWS account. +Description: Allows users to query AWS OAM Sink data, providing detailed information about each AWS OAM Sink in your AWS account. ID: aws_oam_sink_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn\nfrom\n aws_oam_sink\nwhere\n id\ - \ = 'hfj44c81-7bdf-3847-r7i3-5dfc61b17483';" + QueryToExecute: | + SELECT + name, + id, + arn + FROM + aws_oam_sink + WHERE + id = 'hfj44c81-7bdf-3847-r7i3-5dfc61b17483'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS OAM Sink -Title: Find AWS OAM Sink Data with Detailed Information + - AWS OAM Sink +Title: Find AWS OAM Sink Data with Detailed Information \ No newline at end of file diff --git a/queries/aws_opensearch_domain_1.yaml b/queries/aws_opensearch_domain_1.yaml old mode 100755 new mode 100644 index 6a20ce173..937455c0d --- a/queries/aws_opensearch_domain_1.yaml +++ b/queries/aws_opensearch_domain_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n arn,\n engine_version,\n\ - \ created\nfrom\n aws_opensearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + arn, + engine_version, + created + FROM + aws_opensearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: Find AWS OpenSearch Service Domains Configuration + - OpenSearch Service +Title: Find AWS OpenSearch Service Domains Configuration \ No newline at end of file diff --git a/queries/aws_opensearch_domain_2.yaml b/queries/aws_opensearch_domain_2.yaml old mode 100755 new mode 100644 index 903f81fe4..9044285a4 --- a/queries/aws_opensearch_domain_2.yaml +++ b/queries/aws_opensearch_domain_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n encryption_at_rest_options\ - \ ->> 'Enabled' as enabled,\n encryption_at_rest_options ->> 'KmsKeyId' as kms_key_id\n\ - from\n aws_opensearch_domain\nwhere\n encryption_at_rest_options ->> 'Enabled'\ - \ = 'false';" + QueryToExecute: | + SELECT + domain_name, + domain_id, + encryption_at_rest_options ->> 'Enabled' AS enabled, + encryption_at_rest_options ->> 'KmsKeyId' AS kms_key_id + FROM + aws_opensearch_domain + WHERE + encryption_at_rest_options ->> 'Enabled' = 'false'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: Find All AWS OpenSearch Service Domains and Their Details + - OpenSearch Service +Title: Find All AWS OpenSearch Service Domains and Their Details \ No newline at end of file diff --git a/queries/aws_opensearch_domain_3.yaml b/queries/aws_opensearch_domain_3.yaml old mode 100755 new mode 100644 index 1d6d381d1..b84d7877f --- a/queries/aws_opensearch_domain_3.yaml +++ b/queries/aws_opensearch_domain_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n ebs_options ->> 'VolumeSize'\ - \ as volume_size,\n ebs_options ->> 'VolumeType' as volume_type,\n ebs_options\ - \ ->> 'EBSEnabled' as ebs_enabled\nfrom\n aws_opensearch_domain\nwhere\n ebs_options\ - \ ->> 'EBSEnabled' = 'true';" + QueryToExecute: | + SELECT + domain_name, + domain_id, + ebs_options ->> 'VolumeSize' AS volume_size, + ebs_options ->> 'VolumeType' AS volume_type, + ebs_options ->> 'EBSEnabled' AS ebs_enabled + FROM + aws_opensearch_domain + WHERE + ebs_options ->> 'EBSEnabled' = 'true'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: List all AWS OpenSearch Service Domains with SQL + - OpenSearch Service +Title: List all AWS OpenSearch Service Domains with SQL \ No newline at end of file diff --git a/queries/aws_opensearch_domain_4.yaml b/queries/aws_opensearch_domain_4.yaml old mode 100755 new mode 100644 index 974027839..3feb88bde --- a/queries/aws_opensearch_domain_4.yaml +++ b/queries/aws_opensearch_domain_4.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n vpc_options ->> 'AvailabilityZones' as\ - \ availability_zones,\n vpc_options ->> 'SecurityGroupIds' as security_group_ids,\n\ - \ vpc_options ->> 'SubnetIds' as subnet_ids,\n vpc_options ->> 'VPCId' as vpc_id\n\ - from\n aws_opensearch_domain\nwhere\n vpc_options ->> 'AvailabilityZones' is\ - \ not null;" + QueryToExecute: | + SELECT + domain_name, + vpc_options ->> 'AvailabilityZones' AS availability_zones, + vpc_options ->> 'SecurityGroupIds' AS security_group_ids, + vpc_options ->> 'SubnetIds' AS subnet_ids, + vpc_options ->> 'VPCId' AS vpc_id + FROM + aws_opensearch_domain + WHERE + vpc_options ->> 'AvailabilityZones' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: List AWS OpenSearch Service Domains and Configurations + - OpenSearch Service +Title: List AWS OpenSearch Service Domains and Configurations \ No newline at end of file diff --git a/queries/aws_opensearch_domain_5.yaml b/queries/aws_opensearch_domain_5.yaml old mode 100755 new mode 100644 index 4cbc2a470..82c00e826 --- a/queries/aws_opensearch_domain_5.yaml +++ b/queries/aws_opensearch_domain_5.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n cluster_config ->> 'InstanceType'\ - \ as instance_type,\n cluster_config ->> 'InstanceCount' as instance_count\n\ - from\n aws_opensearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + cluster_config ->> 'InstanceType' AS instance_type, + cluster_config ->> 'InstanceCount' AS instance_count + FROM + aws_opensearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: List all AWS OpenSearch Service Domains and Configurations + - OpenSearch Service +Title: List all AWS OpenSearch Service Domains and Configurations \ No newline at end of file diff --git a/queries/aws_opensearch_domain_6.yaml b/queries/aws_opensearch_domain_6.yaml old mode 100755 new mode 100644 index e7939d29e..3de12fa65 --- a/queries/aws_opensearch_domain_6.yaml +++ b/queries/aws_opensearch_domain_6.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n arn,\n engine_version,\n\ - \ created\nfrom\n aws_opensearch_domain\nwhere\n vpc_options is null;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + arn, + engine_version, + created + FROM + aws_opensearch_domain + WHERE + vpc_options IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: Find all AWS OpenSearch Service Domains and their details + - OpenSearch Service +Title: Find all AWS OpenSearch Service Domains and their details \ No newline at end of file diff --git a/queries/aws_opensearch_domain_7.yaml b/queries/aws_opensearch_domain_7.yaml old mode 100755 new mode 100644 index fbc18563f..50a3df38e --- a/queries/aws_opensearch_domain_7.yaml +++ b/queries/aws_opensearch_domain_7.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n log_publishing_options\n\ - from\n aws_opensearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + log_publishing_options + FROM + aws_opensearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: Find AWS OpenSearch Service Domains Configuration + - OpenSearch Service +Title: Find AWS OpenSearch Service Domains Configuration \ No newline at end of file diff --git a/queries/aws_opensearch_domain_8.yaml b/queries/aws_opensearch_domain_8.yaml old mode 100755 new mode 100644 index 04de93f2c..0c1a539c5 --- a/queries/aws_opensearch_domain_8.yaml +++ b/queries/aws_opensearch_domain_8.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS OpenSearch Service Domains for detailed information - on their configuration, status, and associated resources. +Description: Allows users to query AWS OpenSearch Service Domains for detailed information on their configuration, status, and associated resources. ID: aws_opensearch_domain_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n domain_id,\n log_publishing_options\ - \ -> 'SEARCH_SLOW_LOGS' -> 'Enabled' as enabled,\n log_publishing_options ->\ - \ 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' as cloud_watch_logs_log_group_arn\n\ - from\n aws_opensearch_domain;" + QueryToExecute: | + SELECT + domain_name, + domain_id, + log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' AS enabled, + log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' AS cloud_watch_logs_log_group_arn + FROM + aws_opensearch_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - OpenSearch Service -Title: List all AWS OpenSearch Service Domain Configurations + - OpenSearch Service +Title: List all AWS OpenSearch Service Domain Configurations \ No newline at end of file diff --git a/queries/aws_organizations_account_1.yaml b/queries/aws_organizations_account_1.yaml old mode 100755 new mode 100644 index c0221af56..52c194381 --- a/queries/aws_organizations_account_1.yaml +++ b/queries/aws_organizations_account_1.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS Organizations Account and provides information - about each AWS account that is a member of an organization in AWS Organizations. +Description: Allows users to query AWS Organizations Account and provides information about each AWS account that is a member of an organization in AWS Organizations. ID: aws_organizations_account_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n arn,\n email,\n joined_method,\n joined_timestamp,\n\ - \ name,\n status,\n tags\nfrom\n aws_organizations_account;" + QueryToExecute: | + SELECT + id, + arn, + email, + joined_method, + joined_timestamp, + name, + status, + tags + FROM + aws_organizations_account; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Organizations -Title: List all AWS Organizations Accounts with Details + - AWS Organizations +Title: List all AWS Organizations Accounts with Details \ No newline at end of file diff --git a/queries/aws_organizations_account_2.yaml b/queries/aws_organizations_account_2.yaml old mode 100755 new mode 100644 index 542d773a8..ff93bb44e --- a/queries/aws_organizations_account_2.yaml +++ b/queries/aws_organizations_account_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Organizations Account and provides information - about each AWS account that is a member of an organization in AWS Organizations. +Description: Allows users to query AWS Organizations Account and provides information about each AWS account that is a member of an organization in AWS Organizations. ID: aws_organizations_account_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n email,\n joined_method,\n joined_timestamp,\n\ - \ status\nfrom\n aws_organizations_account\nwhere\n status = 'SUSPENDED';" + QueryToExecute: | + SELECT + id, + name, + arn, + email, + joined_method, + joined_timestamp, + status + FROM + aws_organizations_account + WHERE + status = 'SUSPENDED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Organizations -Title: List all AWS Organizations Account in Suspended Status + - AWS Organizations +Title: List all AWS Organizations Account in Suspended Status \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_1.yaml b/queries/aws_organizations_organizational_unit_1.yaml old mode 100755 new mode 100644 index 01ca1535e..65ff44206 --- a/queries/aws_organizations_organizational_unit_1.yaml +++ b/queries/aws_organizations_organizational_unit_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n parent_id,\n title,\n akas\n\ - from\n aws_organizations_organizational_unit;" + QueryToExecute: | + SELECT + name, + id, + arn, + parent_id, + title, + akas + FROM + aws_organizations_organizational_unit; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List all AWS Organization Units with Details + - Organizations +Title: List all AWS Organization Units with Details \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_2.yaml b/queries/aws_organizations_organizational_unit_2.yaml old mode 100755 new mode 100644 index 1cb03bb4b..77c92cf6f --- a/queries/aws_organizations_organizational_unit_2.yaml +++ b/queries/aws_organizations_organizational_unit_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n parent_id,\n path\nfrom\n aws_organizations_organizational_unit\n\ - where\n path <@ 'r_wxnb.ou_wxnb_m8l8t123';" + QueryToExecute: | + SELECT + name, + id, + parent_id, + path + FROM + aws_organizations_organizational_unit + WHERE + path <@ 'r_wxnb.ou_wxnb_m8l8t123'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List AWS Organizations Organizational Units + - Organizations +Title: List AWS Organizations Organizational Units \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_3.yaml b/queries/aws_organizations_organizational_unit_3.yaml old mode 100755 new mode 100644 index 91f747888..c57abcc25 --- a/queries/aws_organizations_organizational_unit_3.yaml +++ b/queries/aws_organizations_organizational_unit_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n parent_id,\n path\nfrom\n aws_organizations_organizational_unit\n\ - where\n nlevel(path) = 3;" + QueryToExecute: | + SELECT + name, + id, + parent_id, + path + FROM + aws_organizations_organizational_unit + WHERE + nlevel(path) = 3; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find AWS Organizations Organizational Units using SQL + - Organizations +Title: Find AWS Organizations Organizational Units using SQL \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_4.yaml b/queries/aws_organizations_organizational_unit_4.yaml old mode 100755 new mode 100644 index cb8aeeba8..19370d490 --- a/queries/aws_organizations_organizational_unit_4.yaml +++ b/queries/aws_organizations_organizational_unit_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n parent_id,\n path\nfrom\n aws_organizations_organizational_unit\n\ - where\n 'r_wxnb.ou_wxnb_m8l123aq.ou_wxnb_5gri123b' @> path;" + QueryToExecute: | + SELECT + name, + id, + parent_id, + path + FROM + aws_organizations_organizational_unit + WHERE + 'r_wxnb.ou_wxnb_m8l123aq.ou_wxnb_5gri123b' @> path; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find all AWS Organizations Organizational Units + - Organizations +Title: Find all AWS Organizations Organizational Units \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_5.yaml b/queries/aws_organizations_organizational_unit_5.yaml old mode 100755 new mode 100644 index 9337c7941..54b4cc532 --- a/queries/aws_organizations_organizational_unit_5.yaml +++ b/queries/aws_organizations_organizational_unit_5.yaml @@ -1,21 +1,35 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n parent_id,\n path\nfrom\n aws_organizations_organizational_unit\n\ - where\n parent_id =\n (\n select\n parent_id\n from\n aws_organizations_organizational_unit\n\ - \ where\n name = 'Punisher'\n );" + QueryToExecute: | + SELECT + name, + id, + parent_id, + path + FROM + aws_organizations_organizational_unit + WHERE + parent_id = + ( + SELECT + parent_id + FROM + aws_organizations_organizational_unit + WHERE + name = 'Punisher' + ); Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find all AWS Organizations Organizational Units + - Organizations +Title: Find all AWS Organizations Organizational Units \ No newline at end of file diff --git a/queries/aws_organizations_organizational_unit_6.yaml b/queries/aws_organizations_organizational_unit_6.yaml old mode 100755 new mode 100644 index 2f413cce8..0f715be14 --- a/queries/aws_organizations_organizational_unit_6.yaml +++ b/queries/aws_organizations_organizational_unit_6.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Organizations Organizational Units and provides - information about each OU. +Description: Allows users to query AWS Organizations Organizational Units and provides information about each OU. ID: aws_organizations_organizational_unit_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n parent_id,\n path\nfrom\n aws_organizations_organizational_unit\n\ - where\n path ~ 'r_wxnb.*.ou_wxnb_m81234aq.*';" + QueryToExecute: | + SELECT + name, + id, + parent_id, + path + FROM + aws_organizations_organizational_unit + WHERE + path ~ 'r_wxnb.*.ou_wxnb_m81234aq.*'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List AWS Organizations Organizational Units + - Organizations +Title: List AWS Organizations Organizational Units \ No newline at end of file diff --git a/queries/aws_organizations_policy_1.yaml b/queries/aws_organizations_policy_1.yaml old mode 100755 new mode 100644 index fa7ae952a..e6d9887e0 --- a/queries/aws_organizations_policy_1.yaml +++ b/queries/aws_organizations_policy_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Organizations Policy to retrieve detailed information - on policies within AWS Organizations. This table can be utilized to gain insights - on policy-specific details, such as policy type, content, and associated metadata. +Description: Allows users to query AWS Organizations Policy to retrieve detailed information on policies within AWS Organizations. This table can be utilized to gain insights on policy-specific details, such as policy type, content, and associated metadata. ID: aws_organizations_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n aws_managed\nfrom\n\ - \ aws_organizations_policy\nwhere\n type = 'SERVICE_CONTROL_POLICY';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + aws_managed + FROM + aws_organizations_policy + WHERE + type = 'SERVICE_CONTROL_POLICY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations Policy -Title: Find AWS Organizations Policy Details with SQL + - Organizations Policy +Title: Find AWS Organizations Policy Details with SQL \ No newline at end of file diff --git a/queries/aws_organizations_policy_2.yaml b/queries/aws_organizations_policy_2.yaml old mode 100755 new mode 100644 index e45bc968c..b27c9b288 --- a/queries/aws_organizations_policy_2.yaml +++ b/queries/aws_organizations_policy_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Organizations Policy to retrieve detailed information - on policies within AWS Organizations. This table can be utilized to gain insights - on policy-specific details, such as policy type, content, and associated metadata. +Description: Allows users to query AWS Organizations Policy to retrieve detailed information on policies within AWS Organizations. This table can be utilized to gain insights on policy-specific details, such as policy type, content, and associated metadata. ID: aws_organizations_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n type,\n aws_managed\nfrom\n\ - \ aws_organizations_policy\nwhere\n not aws_managed\n and type = 'TAG_POLICY';" + QueryToExecute: | + SELECT + id, + name, + arn, + type, + aws_managed + FROM + aws_organizations_policy + WHERE + NOT aws_managed + AND type = 'TAG_POLICY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List all Tag Policies in AWS Organizations + - Organizations +Title: List all Tag Policies in AWS Organizations \ No newline at end of file diff --git a/queries/aws_organizations_policy_3.yaml b/queries/aws_organizations_policy_3.yaml old mode 100755 new mode 100644 index 46c1cc40f..edad6098c --- a/queries/aws_organizations_policy_3.yaml +++ b/queries/aws_organizations_policy_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Organizations Policy to retrieve detailed information - on policies within AWS Organizations. This table can be utilized to gain insights - on policy-specific details, such as policy type, content, and associated metadata. +Description: Allows users to query AWS Organizations Policy to retrieve detailed information on policies within AWS Organizations. This table can be utilized to gain insights on policy-specific details, such as policy type, content, and associated metadata. ID: aws_organizations_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n type,\n aws_managed\nfrom\n\ - \ aws_organizations_policy\nwhere\n type = 'BACKUP_POLICY';" + QueryToExecute: | + SELECT + id, + name, + arn, + type, + aws_managed + FROM + aws_organizations_policy + WHERE + type = 'BACKUP_POLICY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find all AWS Organizations Backup Policies + - Organizations +Title: Find all AWS Organizations Backup Policies \ No newline at end of file diff --git a/queries/aws_organizations_policy_4.yaml b/queries/aws_organizations_policy_4.yaml old mode 100755 new mode 100644 index 88fdbbd33..e6b4a4851 --- a/queries/aws_organizations_policy_4.yaml +++ b/queries/aws_organizations_policy_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Organizations Policy to retrieve detailed information - on policies within AWS Organizations. This table can be utilized to gain insights - on policy-specific details, such as policy type, content, and associated metadata. +Description: Allows users to query AWS Organizations Policy to retrieve detailed information on policies within AWS Organizations. This table can be utilized to gain insights on policy-specific details, such as policy type, content, and associated metadata. ID: aws_organizations_policy_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n content ->> 'Version' as policy_version,\n\ - \ content ->> 'Statement' as policy_statement\nfrom\n aws_organizations_policy\n\ - where\n type = 'SERVICE_CONTROL_POLICY';" + QueryToExecute: | + SELECT + name, + id, + content ->> 'Version' AS policy_version, + content ->> 'Statement' AS policy_statement + FROM + aws_organizations_policy + WHERE + type = 'SERVICE_CONTROL_POLICY'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find AWS Organizations Policy Details + - Organizations +Title: Find AWS Organizations Policy Details \ No newline at end of file diff --git a/queries/aws_organizations_policy_target_1.yaml b/queries/aws_organizations_policy_target_1.yaml old mode 100755 new mode 100644 index 25cd1a8e4..a3229f0f9 --- a/queries/aws_organizations_policy_target_1.yaml +++ b/queries/aws_organizations_policy_target_1.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed - information about the application of policies to roots, organizational units (OUs), - and accounts. +Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed information about the application of policies to roots, organizational units (OUs), and accounts. ID: aws_organizations_policy_target_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n aws_managed \nfrom\n\ - \ aws_organizations_policy_target \nwhere\n type = 'SERVICE_CONTROL_POLICY'\ - \ \n and target_id = '123456789098';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + aws_managed + FROM + aws_organizations_policy_target + WHERE + type = 'SERVICE_CONTROL_POLICY' + AND target_id = '123456789098'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List all AWS Organizations Policy Targets and Their Details + - Organizations +Title: List all AWS Organizations Policy Targets and Their Details \ No newline at end of file diff --git a/queries/aws_organizations_policy_target_2.yaml b/queries/aws_organizations_policy_target_2.yaml old mode 100755 new mode 100644 index 5ca46868c..bee0932e9 --- a/queries/aws_organizations_policy_target_2.yaml +++ b/queries/aws_organizations_policy_target_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed - information about the application of policies to roots, organizational units (OUs), - and accounts. +Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed information about the application of policies to roots, organizational units (OUs), and accounts. ID: aws_organizations_policy_target_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n type,\n aws_managed \nfrom\n\ - \ aws_organizations_policy_target \nwhere\n not aws_managed \n and type = 'TAG_POLICY'\ - \ \n and target_id = 'ou-jsdhkek';" + QueryToExecute: | + SELECT + id, + name, + arn, + type, + aws_managed + FROM + aws_organizations_policy_target + WHERE + NOT aws_managed + AND type = 'TAG_POLICY' + AND target_id = 'ou-jsdhkek'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: List AWS Organizations Policy Targets with SQL Query + - Organizations +Title: List AWS Organizations Policy Targets with SQL Query \ No newline at end of file diff --git a/queries/aws_organizations_policy_target_3.yaml b/queries/aws_organizations_policy_target_3.yaml old mode 100755 new mode 100644 index 9a1ab5ef2..769560676 --- a/queries/aws_organizations_policy_target_3.yaml +++ b/queries/aws_organizations_policy_target_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed - information about the application of policies to roots, organizational units (OUs), - and accounts. +Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed information about the application of policies to roots, organizational units (OUs), and accounts. ID: aws_organizations_policy_target_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n type,\n aws_managed\nfrom\n\ - \ aws_organizations_policy_target\nwhere\n type = 'BACKUP_POLICY'\n and target_id\ - \ = '123456789098';" + QueryToExecute: | + SELECT + id, + name, + arn, + type, + aws_managed + FROM + aws_organizations_policy_target + WHERE + type = 'BACKUP_POLICY' + AND target_id = '123456789098'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Organizations -Title: Find AWS Organizations Policy Targets with SQL + - AWS Organizations +Title: Find AWS Organizations Policy Targets with SQL \ No newline at end of file diff --git a/queries/aws_organizations_policy_target_4.yaml b/queries/aws_organizations_policy_target_4.yaml old mode 100755 new mode 100644 index 35c9afb00..71581ff44 --- a/queries/aws_organizations_policy_target_4.yaml +++ b/queries/aws_organizations_policy_target_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed - information about the application of policies to roots, organizational units (OUs), - and accounts. +Description: Allows users to query AWS Organizations Policy Targets to retrieve detailed information about the application of policies to roots, organizational units (OUs), and accounts. ID: aws_organizations_policy_target_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n content ->> 'Version' as policy_version,\n\ - \ content ->> 'Statement' as policy_statement\nfrom\n aws_organizations_policy_target\n\ - where\n type = 'SERVICE_CONTROL_POLICY'\n and target_id = 'r-9ijkl7';" + QueryToExecute: | + SELECT + name, + id, + content ->> 'Version' AS policy_version, + content ->> 'Statement' AS policy_statement + FROM + aws_organizations_policy_target + WHERE + type = 'SERVICE_CONTROL_POLICY' + AND target_id = 'r-9ijkl7'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find AWS Organizations Policy Targets Information + - Organizations +Title: Find AWS Organizations Policy Targets Information \ No newline at end of file diff --git a/queries/aws_organizations_root_1.yaml b/queries/aws_organizations_root_1.yaml old mode 100755 new mode 100644 index 0cbf652f4..27045fb12 --- a/queries/aws_organizations_root_1.yaml +++ b/queries/aws_organizations_root_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Organizations Root to retrieve detailed information - on AWS Organizations Root account. This table can be utilized to gain insights on - organizations root account. +Description: Allows users to query AWS Organizations Root to retrieve detailed information on AWS Organizations Root account. This table can be utilized to gain insights on organizations root account. ID: aws_organizations_root_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn\nfrom\n aws_organizations_root;" + QueryToExecute: | + SELECT + name, + id, + arn + FROM + aws_organizations_root; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find AWS Organization Root Account Detailed Info + - Organizations +Title: Find AWS Organization Root Account Detailed Info \ No newline at end of file diff --git a/queries/aws_organizations_root_2.yaml b/queries/aws_organizations_root_2.yaml old mode 100755 new mode 100644 index 7d5dbf42e..6dd9e47c9 --- a/queries/aws_organizations_root_2.yaml +++ b/queries/aws_organizations_root_2.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Organizations Root to retrieve detailed information - on AWS Organizations Root account. This table can be utilized to gain insights on - organizations root account. +Description: Allows users to query AWS Organizations Root to retrieve detailed information on AWS Organizations Root account. This table can be utilized to gain insights on organizations root account. ID: aws_organizations_root_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n p ->> 'Status' as policy_status,\n p\ - \ ->> 'Type' as policy_type\nfrom\n aws_organizations_root,\n jsonb_array_elements(policy_types)\ - \ as p;" + QueryToExecute: | + SELECT + id, + name, + p ->> 'Status' AS policy_status, + p ->> 'Type' AS policy_type + FROM + aws_organizations_root, + jsonb_array_elements(policy_types) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Organizations -Title: Find AWS Organizations Root and Policy Details + - Organizations +Title: Find AWS Organizations Root and Policy Details \ No newline at end of file diff --git a/queries/aws_pinpoint_app_1.yaml b/queries/aws_pinpoint_app_1.yaml old mode 100755 new mode 100644 index 6f2a71b39..424019a37 --- a/queries/aws_pinpoint_app_1.yaml +++ b/queries/aws_pinpoint_app_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Pinpoint Applications to gather information - about the applications, such as application ID, name, and creation date. The table - also provides details about the application''s settings and limits. +Description: Allows users to query AWS Pinpoint Applications to gather information about the applications, such as application ID, name, and creation date. The table also provides details about the application's settings and limits. ID: aws_pinpoint_app_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n arn,\n limits\nfrom\n aws_pinpoint_app;" + QueryToExecute: | + SELECT + id, + name, + arn, + limits + FROM + aws_pinpoint_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pinpoint -Title: Find all details of AWS Pinpoint Applications + - AWS Pinpoint +Title: Find all details of AWS Pinpoint Applications \ No newline at end of file diff --git a/queries/aws_pinpoint_app_2.yaml b/queries/aws_pinpoint_app_2.yaml old mode 100755 new mode 100644 index ed1eb4b6d..57d33c1e9 --- a/queries/aws_pinpoint_app_2.yaml +++ b/queries/aws_pinpoint_app_2.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Pinpoint Applications to gather information - about the applications, such as application ID, name, and creation date. The table - also provides details about the application''s settings and limits. +Description: Allows users to query AWS Pinpoint Applications to gather information about the applications, such as application ID, name, and creation date. The table also provides details about the application's settings and limits. ID: aws_pinpoint_app_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n quiet_time -> 'Start' as start_time,\n quiet_time\ - \ -> 'End' as end_time\nfrom\n aws_pinpoint_app;" + QueryToExecute: | + SELECT + id, + quiet_time -> 'Start' AS start_time, + quiet_time -> 'End' AS end_time + FROM + aws_pinpoint_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Pinpoint -Title: Find AWS Pinpoint Applications and Details + - Pinpoint +Title: Find AWS Pinpoint Applications and Details \ No newline at end of file diff --git a/queries/aws_pinpoint_app_3.yaml b/queries/aws_pinpoint_app_3.yaml old mode 100755 new mode 100644 index 700126c9a..2b268d8dc --- a/queries/aws_pinpoint_app_3.yaml +++ b/queries/aws_pinpoint_app_3.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS Pinpoint Applications to gather information - about the applications, such as application ID, name, and creation date. The table - also provides details about the application''s settings and limits. +Description: Allows users to query AWS Pinpoint Applications to gather information about the applications, such as application ID, name, and creation date. The table also provides details about the application's settings and limits. ID: aws_pinpoint_app_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n campaign_hook -> 'LambdaFunctionName' as lambda_function_name,\n\ - \ campaign_hook -> 'Mode' as mode,\n campaign_hook -> 'WebUrl' as web_url\n\ - from\n aws_pinpoint_app;" + QueryToExecute: | + SELECT + id, + campaign_hook -> 'LambdaFunctionName' AS lambda_function_name, + campaign_hook -> 'Mode' AS mode, + campaign_hook -> 'WebUrl' AS web_url + FROM + aws_pinpoint_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Pinpoint -Title: Find all AWS Pinpoint App details and settings + - Pinpoint +Title: Find all AWS Pinpoint App details and settings \ No newline at end of file diff --git a/queries/aws_pinpoint_app_4.yaml b/queries/aws_pinpoint_app_4.yaml old mode 100755 new mode 100644 index e6343404f..2a109ae96 --- a/queries/aws_pinpoint_app_4.yaml +++ b/queries/aws_pinpoint_app_4.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Pinpoint Applications to gather information - about the applications, such as application ID, name, and creation date. The table - also provides details about the application''s settings and limits. +Description: Allows users to query AWS Pinpoint Applications to gather information about the applications, such as application ID, name, and creation date. The table also provides details about the application's settings and limits. ID: aws_pinpoint_app_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n limits -> 'Daily' as daily,\n limits -> 'Total'\ - \ as total,\n limits -> 'Session' as session,\n limits -> 'MaximumDuration'\ - \ as maximum_duration,\n limits -> 'MessagesPerSecond' as messages_per_second\n\ - from\n aws_pinpoint_app;" + QueryToExecute: | + SELECT + id, + limits -> 'Daily' AS daily, + limits -> 'Total' AS total, + limits -> 'Session' AS session, + limits -> 'MaximumDuration' AS maximum_duration, + limits -> 'MessagesPerSecond' AS messages_per_second + FROM + aws_pinpoint_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Pinpoint -Title: List AWS Pinpoint Application Details and Limits + - Pinpoint +Title: List AWS Pinpoint Application Details and Limits \ No newline at end of file diff --git a/queries/aws_pipes_pipe_1.yaml b/queries/aws_pipes_pipe_1.yaml old mode 100755 new mode 100644 index ff76bb372..830ed47c6 --- a/queries/aws_pipes_pipe_1.yaml +++ b/queries/aws_pipes_pipe_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n current_state,\n creation_time,\n \ - \ role_arn\nfrom\n aws_pipes_pipe;" + QueryToExecute: | + SELECT + name, + arn, + current_state, + creation_time, + role_arn + FROM + aws_pipes_pipe; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Pipes -Title: Find AWS Pipe Details via SQL Query + - Pipes +Title: Find AWS Pipe Details via SQL Query \ No newline at end of file diff --git a/queries/aws_pipes_pipe_2.yaml b/queries/aws_pipes_pipe_2.yaml old mode 100755 new mode 100644 index 2f768daa4..96d2d8c56 --- a/queries/aws_pipes_pipe_2.yaml +++ b/queries/aws_pipes_pipe_2.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n description,\n creation_time,\n current_state,\n\ - \ desired_state\nfrom\n aws_pipes_pipe\nwhere\n desired_state <> current_state;" + QueryToExecute: | + SELECT + name, + arn, + description, + creation_time, + current_state, + desired_state + FROM + aws_pipes_pipe + WHERE + desired_state <> current_state; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pipes -Title: List all AWS Pipes with State Details + - AWS Pipes +Title: List all AWS Pipes with State Details \ No newline at end of file diff --git a/queries/aws_pipes_pipe_3.yaml b/queries/aws_pipes_pipe_3.yaml old mode 100755 new mode 100644 index 60f87ad16..ca3e0c9ee --- a/queries/aws_pipes_pipe_3.yaml +++ b/queries/aws_pipes_pipe_3.yaml @@ -1,31 +1,34 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n target_parameters ->> 'BatchJobParameters' as\ - \ batch_job_parameters,\n target_parameters ->> 'CloudWatchLogsParameters' as\ - \ cloudwatch_logs_parameters,\n target_parameters ->> 'EcsTaskParameters' as\ - \ ecs_task_parameters,\n target_parameters ->> 'EventBridgeEventBusParameters'\ - \ as eventbridge_event_bus_parameters,\n target_parameters ->> 'HttpParameters'\ - \ as http_parameters,\n target_parameters ->> 'InputTemplate' as input_template,\n\ - \ target_parameters ->> 'KinesisStreamParameters' as kinesis_stream_parameters,\n\ - \ target_parameters ->> 'LambdaFunctionParameters' as lambda_function_parameters,\n\ - \ target_parameters ->> 'RedshiftDataParameters' as redshift_data_parameters,\n\ - \ target_parameters ->> 'SageMakerPipelineParameters' as sage_maker_pipeline_parameters,\n\ - \ target_parameters ->> 'SqsQueueParameters' as sqs_queue_parameters,\n target_parameters\ - \ ->> 'StepFunctionStateMachineParameters' as step_function_state_machine_parameters\n\ - from\n aws_pipes_pipe;" + QueryToExecute: | + SELECT + name, + target_parameters ->> 'BatchJobParameters' AS batch_job_parameters, + target_parameters ->> 'CloudWatchLogsParameters' AS cloudwatch_logs_parameters, + target_parameters ->> 'EcsTaskParameters' AS ecs_task_parameters, + target_parameters ->> 'EventBridgeEventBusParameters' AS eventbridge_event_bus_parameters, + target_parameters ->> 'HttpParameters' AS http_parameters, + target_parameters ->> 'InputTemplate' AS input_template, + target_parameters ->> 'KinesisStreamParameters' AS kinesis_stream_parameters, + target_parameters ->> 'LambdaFunctionParameters' AS lambda_function_parameters, + target_parameters ->> 'RedshiftDataParameters' AS redshift_data_parameters, + target_parameters ->> 'SageMakerPipelineParameters' AS sage_maker_pipeline_parameters, + target_parameters ->> 'SqsQueueParameters' AS sqs_queue_parameters, + target_parameters ->> 'StepFunctionStateMachineParameters' AS step_function_state_machine_parameters + FROM + aws_pipes_pipe; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Pipes -Title: List all AWS Pipes with Detailed Parameters + - Pipes +Title: List all AWS Pipes with Detailed Parameters \ No newline at end of file diff --git a/queries/aws_pipes_pipe_4.yaml b/queries/aws_pipes_pipe_4.yaml old mode 100755 new mode 100644 index a1645d5ba..d3f6103a6 --- a/queries/aws_pipes_pipe_4.yaml +++ b/queries/aws_pipes_pipe_4.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n enrichment_parameters ->> 'HttpParameters' as\ - \ http_parameters,\n enrichment_parameters ->> 'InputTemplate' as input_template\n\ - from\n aws_pipes_pipe;" + QueryToExecute: | + SELECT + name, + enrichment_parameters ->> 'HttpParameters' AS http_parameters, + enrichment_parameters ->> 'InputTemplate' AS input_template + FROM + aws_pipes_pipe; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pipes -Title: List All AWS Pipes and Their Details + - AWS Pipes +Title: List All AWS Pipes and Their Details \ No newline at end of file diff --git a/queries/aws_pipes_pipe_5.yaml b/queries/aws_pipes_pipe_5.yaml old mode 100755 new mode 100644 index 5fbb99e97..3b42e5a6c --- a/queries/aws_pipes_pipe_5.yaml +++ b/queries/aws_pipes_pipe_5.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n creation_time,\n current_state,\n desired_state,\n\ - \ enrichment,\n target\nfrom\n aws_pipes_pipe\nwhere\n creation_time >= now()\ - \ - interval '30' day;" + QueryToExecute: | + SELECT + name, + creation_time, + current_state, + desired_state, + enrichment, + target + FROM + aws_pipes_pipe + WHERE + creation_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pipes -Title: List AWS Pipes and Their Details Using SQL + - AWS Pipes +Title: List AWS Pipes and Their Details Using SQL \ No newline at end of file diff --git a/queries/aws_pipes_pipe_6.yaml b/queries/aws_pipes_pipe_6.yaml old mode 100755 new mode 100644 index b6d916e17..5d14dcfa0 --- a/queries/aws_pipes_pipe_6.yaml +++ b/queries/aws_pipes_pipe_6.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS Pipes to obtain detailed information about - individual pipes. +Description: Allows users to query AWS Pipes to obtain detailed information about individual pipes. ID: aws_pipes_pipe_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n p.name,\n r.arn as role_arn,\n r.role_id,\n r.permissions_boundary_arn,\n\ - \ r.role_last_used_region,\n r.inline_policies,\n r.assume_role_policy\nfrom\n\ - \ aws_pipes_pipe as p,\n aws_iam_role as r\nwhere\n p.role_arn = r.arn;" + QueryToExecute: | + SELECT + p.name, + r.arn AS role_arn, + r.role_id, + r.permissions_boundary_arn, + r.role_last_used_region, + r.inline_policies, + r.assume_role_policy + FROM + aws_pipes_pipe AS p, + aws_iam_role AS r + WHERE + p.role_arn = r.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pipes -Title: List AWS Pipes and Their Associated IAM Roles + - AWS Pipes +Title: List AWS Pipes and Their Associated IAM Roles \ No newline at end of file diff --git a/queries/aws_pricing_product_1.yaml b/queries/aws_pricing_product_1.yaml old mode 100755 new mode 100644 index 86e693c8c..dc7d78d32 --- a/queries/aws_pricing_product_1.yaml +++ b/queries/aws_pricing_product_1.yaml @@ -1,27 +1,47 @@ -Description: Allows users to query AWS Pricing Product details such as the product''s - description, pricing details, and associated attributes. +Description: Allows users to query AWS Pricing Product details such as the product's description, pricing details, and associated attributes. ID: aws_pricing_product_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n term,\n purchase_option,\n lease_contract_length,\n\ - \ unit,\n price_per_unit::numeric::money,\n currency,\n begin_range,\n end_range,\n\ - \ effective_date,\n description,\n attributes ->> 'instanceType',\n attributes\ - \ ->> 'vcpu',\n attributes ->> 'memory',\n attributes ->> 'operatingSystem',\n\ - \ attributes ->> 'preInstalledSw'\nfrom\n aws_pricing_product\nwhere\n service_code\ - \ = 'AmazonEC2'\n and filters = '{\n \"regionCode\": \"eu-west-3\",\n \"locationType\"\ - : \"AWS Region\",\n \"instanceType\": \"c5.2xlarge\",\n \"operatingSystem\"\ - : \"Linux\",\n \"tenancy\": \"Shared\",\n \"preInstalledSw\": \"NA\",\n \"\ - capacityStatus\": \"Used\" }'::jsonb;" + QueryToExecute: | + SELECT + term, + purchase_option, + lease_contract_length, + unit, + price_per_unit::numeric::money, + currency, + begin_range, + end_range, + effective_date, + description, + attributes ->> 'instanceType', + attributes ->> 'vcpu', + attributes ->> 'memory', + attributes ->> 'operatingSystem', + attributes ->> 'preInstalledSw' + FROM + aws_pricing_product + WHERE + service_code = 'AmazonEC2' + AND filters = '{ + "regionCode": "eu-west-3", + "locationType": "AWS Region", + "instanceType": "c5.2xlarge", + "operatingSystem": "Linux", + "tenancy": "Shared", + "preInstalledSw": "NA", + "capacityStatus": "Used" + }'::jsonb; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing -Title: Find AWS Pricing Product Details with Attributes + - AWS Pricing +Title: Find AWS Pricing Product Details with Attributes \ No newline at end of file diff --git a/queries/aws_pricing_product_2.yaml b/queries/aws_pricing_product_2.yaml old mode 100755 new mode 100644 index a202886b6..a879ff2bf --- a/queries/aws_pricing_product_2.yaml +++ b/queries/aws_pricing_product_2.yaml @@ -1,25 +1,41 @@ -Description: Allows users to query AWS Pricing Product details such as the product''s - description, pricing details, and associated attributes. +Description: Allows users to query AWS Pricing Product details such as the product's description, pricing details, and associated attributes. ID: aws_pricing_product_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n term,\n purchase_option,\n lease_contract_length,\n\ - \ unit,\n price_per_unit::numeric::money,\n currency,\n attributes ->> 'instanceType',\n\ - \ attributes ->> 'vcpu',\n attributes ->> 'memory',\n attributes ->> 'databaseEngine',\n\ - \ attributes ->> 'deploymentOption'\nfrom\n aws_pricing_product\nwhere\n service_code\ - \ = 'AmazonRDS'\n and filters = '{\n \"regionCode\": \"eu-west-3\",\n \"locationType\"\ - : \"AWS Region\",\n \"instanceType\": \"db.m5.xlarge\",\n \"databaseEngine\"\ - : \"MySQL\",\n \"deploymentOption\": \"Single-AZ\" }'::jsonb;" + QueryToExecute: | + SELECT + term, + purchase_option, + lease_contract_length, + unit, + price_per_unit::numeric::money, + currency, + attributes ->> 'instanceType', + attributes ->> 'vcpu', + attributes ->> 'memory', + attributes ->> 'databaseEngine', + attributes ->> 'deploymentOption' + FROM + aws_pricing_product + WHERE + service_code = 'AmazonRDS' + AND filters = '{ + "regionCode": "eu-west-3", + "locationType": "AWS Region", + "instanceType": "db.m5.xlarge", + "databaseEngine": "MySQL", + "deploymentOption": "Single-AZ" + }'::jsonb; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing Product -Title: List AWS Pricing Product Details by Service Code and Filters + - AWS Pricing Product +Title: List AWS Pricing Product Details by Service Code and Filters \ No newline at end of file diff --git a/queries/aws_pricing_product_3.yaml b/queries/aws_pricing_product_3.yaml old mode 100755 new mode 100644 index e1d202773..ada183f19 --- a/queries/aws_pricing_product_3.yaml +++ b/queries/aws_pricing_product_3.yaml @@ -1,26 +1,40 @@ -Description: Allows users to query AWS Pricing Product details such as the product''s - description, pricing details, and associated attributes. +Description: Allows users to query AWS Pricing Product details such as the product's description, pricing details, and associated attributes. ID: aws_pricing_product_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n term,\n purchase_option,\n lease_contract_length,\n\ - \ unit,\n price_per_unit::numeric::money,\n currency,\n attributes ->> 'instanceType',\n\ - \ attributes ->> 'vcpu',\n attributes ->> 'memory',\n attributes ->> 'cacheEngine'\n\ - from\n aws_pricing_product\nwhere\n service_code = 'AmazonElastiCache'\n and\ - \ filters = '{\n \"regionCode\": \"eu-west-3\",\n \"locationType\": \"AWS Region\"\ - ,\n \"instanceType\": \"cache.m5.xlarge\",\n \"cacheEngine\": \"Redis\" }'::jsonb;" + QueryToExecute: | + SELECT + term, + purchase_option, + lease_contract_length, + unit, + price_per_unit::numeric::money, + currency, + attributes ->> 'instanceType' AS instance_type, + attributes ->> 'vcpu' AS vcpu, + attributes ->> 'memory' AS memory, + attributes ->> 'cacheEngine' AS cache_engine + FROM + aws_pricing_product + WHERE + service_code = 'AmazonElastiCache' + AND filters = '{ + "regionCode": "eu-west-3", + "locationType": "AWS Region", + "instanceType": "cache.m5.xlarge", + "cacheEngine": "Redis" }'::jsonb; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing Product -Title: Find AWS ElastiCache Pricing Product with Specific Attributes + - AWS Pricing Product +Title: Find AWS ElastiCache Pricing Product with Specific Attributes \ No newline at end of file diff --git a/queries/aws_pricing_service_attribute_1.yaml b/queries/aws_pricing_service_attribute_1.yaml old mode 100755 new mode 100644 index 1fae84ea9..e625e41cb --- a/queries/aws_pricing_service_attribute_1.yaml +++ b/queries/aws_pricing_service_attribute_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Pricing Service Attributes to gain insights - into product attributes and their respective prices. +Description: Allows users to query AWS Pricing Service Attributes to gain insights into product attributes and their respective prices. ID: aws_pricing_service_attribute_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_code,\n attribute_name,\n attribute_values\n\ - from\n aws_pricing_service_attribute;" + QueryToExecute: | + SELECT + service_code, + attribute_name, + attribute_values + FROM + aws_pricing_service_attribute; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing Service -Title: List all AWS Pricing Service Attributes and Prices + - AWS Pricing Service +Title: List all AWS Pricing Service Attributes and Prices \ No newline at end of file diff --git a/queries/aws_pricing_service_attribute_2.yaml b/queries/aws_pricing_service_attribute_2.yaml old mode 100755 new mode 100644 index 751c8961b..fe83c16e6 --- a/queries/aws_pricing_service_attribute_2.yaml +++ b/queries/aws_pricing_service_attribute_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Pricing Service Attributes to gain insights - into product attributes and their respective prices. +Description: Allows users to query AWS Pricing Service Attributes to gain insights into product attributes and their respective prices. ID: aws_pricing_service_attribute_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_code,\n attribute_name,\n attribute_values\n\ - from\n aws_pricing_service_attribute\nwhere\n service_code = 'AWSBackup';" + QueryToExecute: | + SELECT + service_code, + attribute_name, + attribute_values + FROM + aws_pricing_service_attribute + WHERE + service_code = 'AWSBackup'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing Service -Title: List all AWS Pricing Service Attributes + - AWS Pricing Service +Title: List all AWS Pricing Service Attributes \ No newline at end of file diff --git a/queries/aws_pricing_service_attribute_3.yaml b/queries/aws_pricing_service_attribute_3.yaml old mode 100755 new mode 100644 index 3e6c0dfce..34467bc5f --- a/queries/aws_pricing_service_attribute_3.yaml +++ b/queries/aws_pricing_service_attribute_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Pricing Service Attributes to gain insights - into product attributes and their respective prices. +Description: Allows users to query AWS Pricing Service Attributes to gain insights into product attributes and their respective prices. ID: aws_pricing_service_attribute_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_code,\n attribute_name,\n attribute_values\n\ - from\n aws_pricing_service_attribute\nwhere\n service_code = 'AWSBackup' and\ - \ attribute_name = 'termType';" + QueryToExecute: | + SELECT + service_code, + attribute_name, + attribute_values + FROM + aws_pricing_service_attribute + WHERE + service_code = 'AWSBackup' + AND attribute_name = 'termType'; Tags: cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Pricing Service -Title: Find AWS Pricing Service Attributes for AWSBackup and termType + - AWS Pricing Service +Title: Find AWS Pricing Service Attributes for AWSBackup and termType \ No newline at end of file diff --git a/queries/aws_ram_principal_association_1.yaml b/queries/aws_ram_principal_association_1.yaml old mode 100755 new mode 100644 index 0e75b45c6..5b0fe5e6e --- a/queries/aws_ram_principal_association_1.yaml +++ b/queries/aws_ram_principal_association_1.yaml @@ -1,28 +1,27 @@ -Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` - table in Steampipe provides information about principal associations within AWS - Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific - details, including resource share ARN, principal ARN, creation time, and associated - tags. Users can utilize this table to gather insights on principal associations, - such as their status, external status, and more. The schema outlines the various - attributes of the principal association, including the resource share ARN, principal - ARN, creation time, and associated tags. +Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` table in Steampipe provides information about principal associations within AWS Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific details, including resource share ARN, principal ARN, creation time, and associated tags. Users can utilize this table to gather insights on principal associations, such as their status, external status, and more. The schema outlines the various attributes of the principal association, including the resource share ARN, principal ARN, creation time, and associated tags. ID: aws_ram_principal_association_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ status\nfrom\n aws_ram_principal_association;" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + status + FROM + aws_ram_principal_association; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Access Manager -Title: List AWS RAM Principal Associations with SQL + - Resource Access Manager +Title: List AWS RAM Principal Associations with SQL \ No newline at end of file diff --git a/queries/aws_ram_principal_association_2.yaml b/queries/aws_ram_principal_association_2.yaml old mode 100755 new mode 100644 index bc0627dae..ae0fb032c --- a/queries/aws_ram_principal_association_2.yaml +++ b/queries/aws_ram_principal_association_2.yaml @@ -1,30 +1,29 @@ -Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` - table in Steampipe provides information about principal associations within AWS - Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific - details, including resource share ARN, principal ARN, creation time, and associated - tags. Users can utilize this table to gather insights on principal associations, - such as their status, external status, and more. The schema outlines the various - attributes of the principal association, including the resource share ARN, principal - ARN, creation time, and associated tags. +Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` table in Steampipe provides information about principal associations within AWS Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific details, including resource share ARN, principal ARN, creation time, and associated tags. Users can utilize this table to gather insights on principal associations, such as their status, external status, and more. The schema outlines the various attributes of the principal association, including the resource share ARN, principal ARN, creation time, and associated tags. ID: aws_ram_principal_association_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ p ->> 'Arn' as resource_share_permission_arn,\n p ->> 'Status' as resource_share_permission_status\n\ - from\n aws_ram_principal_association,\n jsonb_array_elements(resource_share_permission)\ - \ p;" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + p ->> 'Arn' AS resource_share_permission_arn, + p ->> 'Status' AS resource_share_permission_status + FROM + aws_ram_principal_association, + JSONB_ARRAY_ELEMENTS(resource_share_permission) p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Access Manager -Title: List all AWS RAM Principal Associations by SQL Query + - Resource Access Manager +Title: List all AWS RAM Principal Associations by SQL Query \ No newline at end of file diff --git a/queries/aws_ram_principal_association_3.yaml b/queries/aws_ram_principal_association_3.yaml old mode 100755 new mode 100644 index 388233def..aff24d278 --- a/queries/aws_ram_principal_association_3.yaml +++ b/queries/aws_ram_principal_association_3.yaml @@ -1,26 +1,27 @@ -Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` - table in Steampipe provides information about principal associations within AWS - Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific - details, including resource share ARN, principal ARN, creation time, and associated - tags. Users can utilize this table to gather insights on principal associations, - such as their status, external status, and more. The schema outlines the various - attributes of the principal association, including the resource share ARN, principal - ARN, creation time, and associated tags. +Description: Allows users to query AWS RAM Principal Associations. The `aws_ram_principal_association` table in Steampipe provides information about principal associations within AWS Resource Access Manager (RAM). This table allows DevOps engineers to query principal-specific details, including resource share ARN, principal ARN, creation time, and associated tags. Users can utilize this table to gather insights on principal associations, such as their status, external status, and more. The schema outlines the various attributes of the principal association, including the resource share ARN, principal ARN, creation time, and associated tags. ID: aws_ram_principal_association_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ status\nfrom\n aws_ram_principal_association\nwhere\n status = 'FAILED';" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + status + FROM + aws_ram_principal_association + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Access Manager -Title: List all AWS RAM Principal Associations with Failed Status + - Resource Access Manager +Title: List all AWS RAM Principal Associations with Failed Status \ No newline at end of file diff --git a/queries/aws_ram_resource_association_1.yaml b/queries/aws_ram_resource_association_1.yaml old mode 100755 new mode 100644 index a1ce5077e..da004663c --- a/queries/aws_ram_resource_association_1.yaml +++ b/queries/aws_ram_resource_association_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS RAM Resource Associations to retrieve information - about the associations between resources and resource shares. +Description: Allows users to query AWS RAM Resource Associations to retrieve information about the associations between resources and resource shares. ID: aws_ram_resource_association_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ status\nfrom\n aws_ram_resource_association;" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + status + FROM + aws_ram_resource_association; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RAM -Title: List all AWS RAM Resource Associations with SQL + - AWS RAM +Title: List all AWS RAM Resource Associations with SQL \ No newline at end of file diff --git a/queries/aws_ram_resource_association_2.yaml b/queries/aws_ram_resource_association_2.yaml old mode 100755 new mode 100644 index 08a1ed713..6732ecffb --- a/queries/aws_ram_resource_association_2.yaml +++ b/queries/aws_ram_resource_association_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS RAM Resource Associations to retrieve information - about the associations between resources and resource shares. +Description: Allows users to query AWS RAM Resource Associations to retrieve information about the associations between resources and resource shares. ID: aws_ram_resource_association_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ p ->> 'Arn' as resource_share_permission_arn,\n p ->> 'Status' as resource_share_permission_status\n\ - from\n aws_ram_resource_association,\n jsonb_array_elements(resource_share_permission)\ - \ p;" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + p ->> 'Arn' AS resource_share_permission_arn, + p ->> 'Status' AS resource_share_permission_status + FROM + aws_ram_resource_association, + jsonb_array_elements(resource_share_permission) p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RAM Resource Association -Title: List AWS RAM Resource Associations and Permissions + - AWS RAM Resource Association +Title: List AWS RAM Resource Associations and Permissions \ No newline at end of file diff --git a/queries/aws_ram_resource_association_3.yaml b/queries/aws_ram_resource_association_3.yaml old mode 100755 new mode 100644 index 0cb918ad1..dfc2ea5a8 --- a/queries/aws_ram_resource_association_3.yaml +++ b/queries/aws_ram_resource_association_3.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS RAM Resource Associations to retrieve information - about the associations between resources and resource shares. +Description: Allows users to query AWS RAM Resource Associations to retrieve information about the associations between resources and resource shares. ID: aws_ram_resource_association_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n resource_share_name,\n resource_share_arn,\n associated_entity,\n\ - \ status\nfrom\n aws_ram_resource_association\nwhere\n status = 'FAILED';" + QueryToExecute: | + SELECT + resource_share_name, + resource_share_arn, + associated_entity, + status + FROM + aws_ram_resource_association + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RAM -Title: Find AWS RAM Resource Associations with SQL Query + - RAM +Title: Find AWS RAM Resource Associations with SQL Query \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_1.yaml b/queries/aws_rds_db_cluster_1.yaml old mode 100755 new mode 100644 index 64c476290..42252fb0f --- a/queries/aws_rds_db_cluster_1.yaml +++ b/queries/aws_rds_db_cluster_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information - about the status, configuration, and security settings of each DB cluster. +Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information about the status, configuration, and security settings of each DB cluster. ID: aws_rds_db_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n allocated_storage,\n kms_key_id\n\ - from\n aws_rds_db_cluster\nwhere\n kms_key_id is null;" + QueryToExecute: | + SELECT + db_cluster_identifier, + allocated_storage, + kms_key_id + FROM + aws_rds_db_cluster + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS DB Cluster -Title: 'Find all AWS RDS DB Clusters: Status & Security Details' + - RDS DB Cluster +Title: 'Find all AWS RDS DB Clusters: Status & Security Details' \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_2.yaml b/queries/aws_rds_db_cluster_2.yaml old mode 100755 new mode 100644 index 2a3ba6c51..1f1ab01ae --- a/queries/aws_rds_db_cluster_2.yaml +++ b/queries/aws_rds_db_cluster_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information - about the status, configuration, and security settings of each DB cluster. +Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information about the status, configuration, and security settings of each DB cluster. ID: aws_rds_db_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n backup_retention_period\nfrom\n\ - \ aws_rds_db_cluster\nwhere\n backup_retention_period > 7;" + QueryToExecute: | + SELECT + db_cluster_identifier, + backup_retention_period + FROM + aws_rds_db_cluster + WHERE + backup_retention_period > 7; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS DB Clusters Status and Configurations + - RDS +Title: List AWS RDS DB Clusters Status and Configurations \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_3.yaml b/queries/aws_rds_db_cluster_3.yaml old mode 100755 new mode 100644 index 68c6c9f80..d8a262f8e --- a/queries/aws_rds_db_cluster_3.yaml +++ b/queries/aws_rds_db_cluster_3.yaml @@ -1,20 +1,23 @@ -Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information - about the status, configuration, and security settings of each DB cluster. +Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information about the status, configuration, and security settings of each DB cluster. ID: aws_rds_db_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n jsonb_array_length(availability_zones)\ - \ availability_zones_count\nfrom\n aws_rds_db_cluster;" + QueryToExecute: | + SELECT + db_cluster_identifier, + JSONB_ARRAY_LENGTH(availability_zones) AS availability_zones_count + FROM + aws_rds_db_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RDS -Title: Query AWS RDS DB Clusters for Status and Config Details + - AWS RDS +Title: Query AWS RDS DB Clusters for Status and Config Details \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_4.yaml b/queries/aws_rds_db_cluster_4.yaml old mode 100755 new mode 100644 index d201d08fe..0e469e254 --- a/queries/aws_rds_db_cluster_4.yaml +++ b/queries/aws_rds_db_cluster_4.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information - about the status, configuration, and security settings of each DB cluster. +Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information about the status, configuration, and security settings of each DB cluster. ID: aws_rds_db_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n member ->> 'DBClusterParameterGroupStatus'\ - \ as db_cluster_parameter_group_status,\n member ->> 'DBInstanceIdentifier' as\ - \ db_instance_identifier,\n member ->> 'IsClusterWriter' as is_cluster_writer,\n\ - \ member ->> 'PromotionTier' as promotion_tier\nfrom\n aws_rds_db_cluster\n\ - \ cross join jsonb_array_elements(members) as member;" + QueryToExecute: | + SELECT + db_cluster_identifier, + member ->> 'DBClusterParameterGroupStatus' AS db_cluster_parameter_group_status, + member ->> 'DBInstanceIdentifier' AS db_instance_identifier, + member ->> 'IsClusterWriter' AS is_cluster_writer, + member ->> 'PromotionTier' AS promotion_tier + FROM + aws_rds_db_cluster + CROSS JOIN + jsonb_array_elements(members) AS member; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Clusters status and settings + - RDS +Title: List all AWS RDS DB Clusters status and settings \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_5.yaml b/queries/aws_rds_db_cluster_5.yaml old mode 100755 new mode 100644 index a01e90f9b..6e7491f97 --- a/queries/aws_rds_db_cluster_5.yaml +++ b/queries/aws_rds_db_cluster_5.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information - about the status, configuration, and security settings of each DB cluster. +Description: Allows users to query AWS RDS DB Clusters and retrieve valuable information about the status, configuration, and security settings of each DB cluster. ID: aws_rds_db_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n actions ->> 'ResourceIdentifier' as db_cluster_identifier,\n\ - \ details ->> 'Action' as action,\n details ->> 'OptInStatus' as opt_in_status,\n\ - \ details ->> 'ForcedApplyDate' as forced_apply_date,\n details ->> 'CurrentApplyDate'\ - \ as current_apply_date,\n details ->> 'AutoAppliedAfterDate' as auto_applied_after_date\n\ - from\n aws_rds_db_cluster,\n jsonb_array_elements(pending_maintenance_actions)\ - \ as actions,\n jsonb_array_elements(actions -> 'PendingMaintenanceActionDetails')\ - \ as details;" + QueryToExecute: | + SELECT + actions ->> 'ResourceIdentifier' AS db_cluster_identifier, + details ->> 'Action' AS action, + details ->> 'OptInStatus' AS opt_in_status, + details ->> 'ForcedApplyDate' AS forced_apply_date, + details ->> 'CurrentApplyDate' AS current_apply_date, + details ->> 'AutoAppliedAfterDate' AS auto_applied_after_date + FROM + aws_rds_db_cluster, + jsonb_array_elements(pending_maintenance_actions) AS actions, + jsonb_array_elements(actions -> 'PendingMaintenanceActionDetails') AS details; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Clusters Status and Configuration + - RDS +Title: Find AWS RDS DB Clusters Status and Configuration \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_parameter_group_1.yaml b/queries/aws_rds_db_cluster_parameter_group_1.yaml old mode 100755 new mode 100644 index 9ce2fc460..b97b846de --- a/queries/aws_rds_db_cluster_parameter_group_1.yaml +++ b/queries/aws_rds_db_cluster_parameter_group_1.yaml @@ -1,25 +1,26 @@ -Description: Allows users to query AWS RDS DB Cluster Parameter Groups, providing - detailed information about each parameter group''s configuration, including its - name, family, description, and ARN. This table can be used to identify unused or - misconfigured parameter groups and to ensure they comply with security and operational - best practices. +Description: Allows users to query AWS RDS DB Cluster Parameter Groups, providing detailed information about each parameter group's configuration, including its name, family, description, and ARN. This table can be used to identify unused or misconfigured parameter groups and to ensure they comply with security and operational best practices. ID: aws_rds_db_cluster_parameter_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n db_parameter_group_family\n\ - from\n aws_rds_db_cluster_parameter_group;" + QueryToExecute: | + SELECT + name, + description, + db_parameter_group_family + FROM + aws_rds_db_cluster_parameter_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Cluster Parameter Groups Configuration + - RDS +Title: Find AWS RDS DB Cluster Parameter Groups Configuration \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_parameter_group_2.yaml b/queries/aws_rds_db_cluster_parameter_group_2.yaml old mode 100755 new mode 100644 index 8406bfc1b..0a7133912 --- a/queries/aws_rds_db_cluster_parameter_group_2.yaml +++ b/queries/aws_rds_db_cluster_parameter_group_2.yaml @@ -1,30 +1,35 @@ -Description: Allows users to query AWS RDS DB Cluster Parameter Groups, providing - detailed information about each parameter group''s configuration, including its - name, family, description, and ARN. This table can be used to identify unused or - misconfigured parameter groups and to ensure they comply with security and operational - best practices. +Description: Allows users to query AWS RDS DB Cluster Parameter Groups, providing detailed information about each parameter group's configuration, including its name, family, description, and ARN. This table can be used to identify unused or misconfigured parameter groups and to ensure they comply with security and operational best practices. ID: aws_rds_db_cluster_parameter_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n db_parameter_group_family,\n pg ->> 'ParameterName'\ - \ as parameter_name,\n pg ->> 'ParameterValue' as parameter_value,\n pg ->>\ - \ 'AllowedValues' as allowed_values,\n pg ->> 'ApplyType' as apply_type,\n pg\ - \ ->> 'IsModifiable' as is_modifiable,\n pg ->> 'DataType' as data_type,\n pg\ - \ ->> 'Description' as description,\n pg ->> 'MinimumEngineVersion' as minimum_engine_version\n\ - from\n aws_rds_db_cluster_parameter_group\n cross join jsonb_array_elements(parameters)\ - \ as pg;" + QueryToExecute: | + SELECT + name, + db_parameter_group_family, + pg ->> 'ParameterName' AS parameter_name, + pg ->> 'ParameterValue' AS parameter_value, + pg ->> 'AllowedValues' AS allowed_values, + pg ->> 'ApplyType' AS apply_type, + pg ->> 'IsModifiable' AS is_modifiable, + pg ->> 'DataType' AS data_type, + pg ->> 'Description' AS description, + pg ->> 'MinimumEngineVersion' AS minimum_engine_version + FROM + aws_rds_db_cluster_parameter_group + CROSS JOIN + jsonb_array_elements(parameters) AS pg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Cluster Parameter Groups with Details + - RDS +Title: List all AWS RDS DB Cluster Parameter Groups with Details \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_snapshot_1.yaml b/queries/aws_rds_db_cluster_snapshot_1.yaml old mode 100755 new mode 100644 index 027c3b6f7..2feabe883 --- a/queries/aws_rds_db_cluster_snapshot_1.yaml +++ b/queries/aws_rds_db_cluster_snapshot_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information - on each snapshot, such as the snapshot identifier, creation time, status, and more. +Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information on each snapshot, such as the snapshot identifier, creation time, status, and more. ID: aws_rds_db_cluster_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n type,\n storage_encrypted,\n\ - \ split_part(kms_key_id, '/', 1) kms_key_id\nfrom\n aws_rds_db_cluster_snapshot\n\ - where\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + type, + storage_encrypted, + SPLIT_PART(kms_key_id, '/', 1) AS kms_key_id + FROM + aws_rds_db_cluster_snapshot + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Cluster Snapshot Details + - RDS +Title: Find AWS RDS DB Cluster Snapshot Details \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_snapshot_2.yaml b/queries/aws_rds_db_cluster_snapshot_2.yaml old mode 100755 new mode 100644 index 6e4f70df6..3fde8ff4e --- a/queries/aws_rds_db_cluster_snapshot_2.yaml +++ b/queries/aws_rds_db_cluster_snapshot_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information - on each snapshot, such as the snapshot identifier, creation time, status, and more. +Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information on each snapshot, such as the snapshot identifier, creation time, status, and more. ID: aws_rds_db_cluster_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n cluster_create_time,\n\ - \ engine,\n engine_version,\n license_model\nfrom\n aws_rds_db_cluster_snapshot;" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + cluster_create_time, + engine, + engine_version, + license_model + FROM + aws_rds_db_cluster_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Cluster Snapshots Detailed Information + - RDS +Title: Find AWS RDS DB Cluster Snapshots Detailed Information \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_snapshot_3.yaml b/queries/aws_rds_db_cluster_snapshot_3.yaml old mode 100755 new mode 100644 index 6c8948f34..239de3b0f --- a/queries/aws_rds_db_cluster_snapshot_3.yaml +++ b/queries/aws_rds_db_cluster_snapshot_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information - on each snapshot, such as the snapshot identifier, creation time, status, and more. +Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information on each snapshot, such as the snapshot identifier, creation time, status, and more. ID: aws_rds_db_cluster_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_identifier,\n count(db_cluster_snapshot_identifier)\ - \ snapshot_count\nfrom\n aws_rds_db_cluster_snapshot\ngroup by\n db_cluster_identifier;" + QueryToExecute: | + SELECT + db_cluster_identifier, + COUNT(db_cluster_snapshot_identifier) AS snapshot_count + FROM + aws_rds_db_cluster_snapshot + GROUP BY + db_cluster_identifier; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Cluster Snapshots with Details + - RDS +Title: List all AWS RDS DB Cluster Snapshots with Details \ No newline at end of file diff --git a/queries/aws_rds_db_cluster_snapshot_4.yaml b/queries/aws_rds_db_cluster_snapshot_4.yaml old mode 100755 new mode 100644 index 2250658a3..d8dc8adcc --- a/queries/aws_rds_db_cluster_snapshot_4.yaml +++ b/queries/aws_rds_db_cluster_snapshot_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information - on each snapshot, such as the snapshot identifier, creation time, status, and more. +Description: Allows users to query AWS RDS DB Cluster Snapshots for detailed information on each snapshot, such as the snapshot identifier, creation time, status, and more. ID: aws_rds_db_cluster_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_cluster_snapshot_identifier,\n engine,\n type\n\ - from\n aws_rds_db_cluster_snapshot\nwhere\n type = 'manual';" + QueryToExecute: | + SELECT + db_cluster_snapshot_identifier, + engine, + type + FROM + aws_rds_db_cluster_snapshot + WHERE + type = 'manual'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Cluster Snapshots with Details + - RDS +Title: List all AWS RDS DB Cluster Snapshots with Details \ No newline at end of file diff --git a/queries/aws_rds_db_engine_version_1.yaml b/queries/aws_rds_db_engine_version_1.yaml old mode 100755 new mode 100644 index 3a34802be..d8e96fb9a --- a/queries/aws_rds_db_engine_version_1.yaml +++ b/queries/aws_rds_db_engine_version_1.yaml @@ -1,20 +1,26 @@ -Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed - information on various database engine versions supported by Amazon RDS. +Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed information on various database engine versions supported by Amazon RDS. ID: aws_rds_db_engine_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n engine,\n engine_version,\n db_engine_version_description,\n\ - \ status,\n major_engine_version\nfrom\n aws_rds_db_engine_version;" + QueryToExecute: | + SELECT + engine, + engine_version, + db_engine_version_description, + status, + major_engine_version + FROM + aws_rds_db_engine_version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find all AWS RDS DB Engine Versions with SQL + - Amazon RDS +Title: Find all AWS RDS DB Engine Versions with SQL \ No newline at end of file diff --git a/queries/aws_rds_db_engine_version_2.yaml b/queries/aws_rds_db_engine_version_2.yaml old mode 100755 new mode 100644 index d0d1997c6..5ebc1ea62 --- a/queries/aws_rds_db_engine_version_2.yaml +++ b/queries/aws_rds_db_engine_version_2.yaml @@ -1,20 +1,26 @@ -Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed - information on various database engine versions supported by Amazon RDS. +Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed information on various database engine versions supported by Amazon RDS. ID: aws_rds_db_engine_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n engine,\n engine_version,\n supports_read_replica\n\ - from\n aws_rds_db_engine_version\nwhere\n supports_read_replica;" + QueryToExecute: | + SELECT + engine, + engine_version, + supports_read_replica + FROM + aws_rds_db_engine_version + WHERE + supports_read_replica; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Engine Versions Supporting Read Replicas + - RDS +Title: List all AWS RDS DB Engine Versions Supporting Read Replicas \ No newline at end of file diff --git a/queries/aws_rds_db_engine_version_3.yaml b/queries/aws_rds_db_engine_version_3.yaml old mode 100755 new mode 100644 index 5ed94f578..9f42437ba --- a/queries/aws_rds_db_engine_version_3.yaml +++ b/queries/aws_rds_db_engine_version_3.yaml @@ -1,22 +1,28 @@ -Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed - information on various database engine versions supported by Amazon RDS. +Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed information on various database engine versions supported by Amazon RDS. ID: aws_rds_db_engine_version_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n engine,\n engine_version,\n status\nfrom\n aws_rds_db_engine_version\n\ - where\n status = 'deprecated';" + QueryToExecute: | + SELECT + engine, + engine_version, + status + FROM + aws_rds_db_engine_version + WHERE + status = 'deprecated'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Engine Versions with Deprecated Status + - RDS +Title: List all AWS RDS DB Engine Versions with Deprecated Status \ No newline at end of file diff --git a/queries/aws_rds_db_engine_version_4.yaml b/queries/aws_rds_db_engine_version_4.yaml old mode 100755 new mode 100644 index dcbdb27d8..62844eb98 --- a/queries/aws_rds_db_engine_version_4.yaml +++ b/queries/aws_rds_db_engine_version_4.yaml @@ -1,20 +1,26 @@ -Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed - information on various database engine versions supported by Amazon RDS. +Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed information on various database engine versions supported by Amazon RDS. ID: aws_rds_db_engine_version_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n engine,\n engine_version,\n supported_feature_names\n\ - from\n aws_rds_db_engine_version\nwhere\n engine_version = 'specific_engine_version';" + QueryToExecute: | + SELECT + engine, + engine_version, + supported_feature_names + FROM + aws_rds_db_engine_version + WHERE + engine_version = 'specific_engine_version'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find AWS RDS DB Engine Versions with Detailed Information + - Amazon RDS +Title: Find AWS RDS DB Engine Versions with Detailed Information \ No newline at end of file diff --git a/queries/aws_rds_db_engine_version_5.yaml b/queries/aws_rds_db_engine_version_5.yaml old mode 100755 new mode 100644 index a0ca279bb..ca5f8141f --- a/queries/aws_rds_db_engine_version_5.yaml +++ b/queries/aws_rds_db_engine_version_5.yaml @@ -1,23 +1,31 @@ -Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed - information on various database engine versions supported by Amazon RDS. +Description: Enables users to query AWS RDS DB Engine Versions to retrieve detailed information on various database engine versions supported by Amazon RDS. ID: aws_rds_db_engine_version_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n engine,\n engine_version,\n create_time,\n status,\n\ - \ db_engine_media_type,\n default_only\nfrom\n aws_rds_db_engine_version\n\ - where\n default_only;" + QueryToExecute: | + SELECT + engine, + engine_version, + create_time, + status, + db_engine_media_type, + default_only + FROM + aws_rds_db_engine_version + WHERE + default_only; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List AWS RDS DB Engine Versions with Details + - Amazon RDS +Title: List AWS RDS DB Engine Versions with Details \ No newline at end of file diff --git a/queries/aws_rds_db_event_subscription_1.yaml b/queries/aws_rds_db_event_subscription_1.yaml old mode 100755 new mode 100644 index e7b850539..28f383578 --- a/queries/aws_rds_db_event_subscription_1.yaml +++ b/queries/aws_rds_db_event_subscription_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS RDS DB Event Subscriptions to retrieve information - about all event subscriptions for RDS DB instances. +Description: Allows users to query AWS RDS DB Event Subscriptions to retrieve information about all event subscriptions for RDS DB instances. ID: aws_rds_db_event_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cust_subscription_id,\n customer_aws_id,\n arn,\n \ - \ status,\n enabled\nfrom\n aws_rds_db_event_subscription;" + QueryToExecute: | + SELECT + cust_subscription_id, + customer_aws_id, + arn, + status, + enabled + FROM + aws_rds_db_event_subscription; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Event Subscriptions Information + - RDS +Title: List all AWS RDS DB Event Subscriptions Information \ No newline at end of file diff --git a/queries/aws_rds_db_event_subscription_2.yaml b/queries/aws_rds_db_event_subscription_2.yaml old mode 100755 new mode 100644 index 7b5adbb98..f1c1c6bb5 --- a/queries/aws_rds_db_event_subscription_2.yaml +++ b/queries/aws_rds_db_event_subscription_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS RDS DB Event Subscriptions to retrieve information - about all event subscriptions for RDS DB instances. +Description: Allows users to query AWS RDS DB Event Subscriptions to retrieve information about all event subscriptions for RDS DB instances. ID: aws_rds_db_event_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cust_subscription_id,\n enabled\nfrom\n aws_rds_db_event_subscription\n\ - where\n enabled;" + QueryToExecute: | + SELECT + cust_subscription_id, + enabled + FROM + aws_rds_db_event_subscription + WHERE + enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find all AWS RDS DB Event Subscriptions + - RDS +Title: Find all AWS RDS DB Event Subscriptions \ No newline at end of file diff --git a/queries/aws_rds_db_instance_1.yaml b/queries/aws_rds_db_instance_1.yaml old mode 100755 new mode 100644 index 6e7601be6..06047ff33 --- a/queries/aws_rds_db_instance_1.yaml +++ b/queries/aws_rds_db_instance_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n class,\n engine,\n engine_version,\n\ - \ publicly_accessible\nfrom\n aws_rds_db_instance" + QueryToExecute: | + SELECT + db_instance_identifier, + class, + engine, + engine_version, + publicly_accessible + FROM + aws_rds_db_instance Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find all AWS RDS DB Instances Configuration Status + - RDS +Title: Find all AWS RDS DB Instances Configuration Status \ No newline at end of file diff --git a/queries/aws_rds_db_instance_10.yaml b/queries/aws_rds_db_instance_10.yaml old mode 100755 new mode 100644 index 1885c1e67..c090517e0 --- a/queries/aws_rds_db_instance_10.yaml +++ b/queries/aws_rds_db_instance_10.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n certificate ->> 'CertificateArn' as certificate_arn,\n\ - \ certificate ->> 'CertificateType' as certificate_type,\n certificate ->> 'ValidFrom'\ - \ as valid_from,\n certificate ->> 'ValidTill' as valid_till\nfrom\n aws_rds_db_instance;" + QueryToExecute: | + SELECT + arn, + certificate ->> 'CertificateArn' AS certificate_arn, + certificate ->> 'CertificateType' AS certificate_type, + certificate ->> 'ValidFrom' AS valid_from, + certificate ->> 'ValidTill' AS valid_till + FROM + aws_rds_db_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instances Configuration and Status + - RDS +Title: Find AWS RDS DB Instances Configuration and Status \ No newline at end of file diff --git a/queries/aws_rds_db_instance_11.yaml b/queries/aws_rds_db_instance_11.yaml old mode 100755 new mode 100644 index f99178c90..d3649f311 --- a/queries/aws_rds_db_instance_11.yaml +++ b/queries/aws_rds_db_instance_11.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n certificate ->> 'CertificateArn' as certificate_arn,\n\ - \ certificate ->> 'CertificateType' as certificate_type,\n certificate ->> 'ValidFrom'\ - \ as valid_from,\n certificate ->> 'ValidTill' as valid_till\nfrom\n aws_rds_db_instance\n\ - where\n (certificate ->> 'ValidTill')::timestamp <= (current_date - interval\ - \ '90' day);" + QueryToExecute: | + SELECT + arn, + certificate ->> 'CertificateArn' AS certificate_arn, + certificate ->> 'CertificateType' AS certificate_type, + certificate ->> 'ValidFrom' AS valid_from, + certificate ->> 'ValidTill' AS valid_till + FROM + aws_rds_db_instance + WHERE + (certificate ->> 'ValidTill')::timestamp <= (CURRENT_DATE - INTERVAL '90' DAY); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Query AWS RDS DB Instances for Configuration and Status + - RDS +Title: Query AWS RDS DB Instances for Configuration and Status \ No newline at end of file diff --git a/queries/aws_rds_db_instance_12.yaml b/queries/aws_rds_db_instance_12.yaml old mode 100755 new mode 100644 index 605fad966..9d554a7bd --- a/queries/aws_rds_db_instance_12.yaml +++ b/queries/aws_rds_db_instance_12.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n class,\n engine,\n engine_version,\n\ - \ kms_key_id,\n processor_features\nfrom\n aws_rds_db_instance\nwhere\n processor_features\ - \ not null;" + QueryToExecute: | + SELECT + db_instance_identifier, + class, + engine, + engine_version, + kms_key_id, + processor_features + FROM + aws_rds_db_instance + WHERE + processor_features IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find Detailed Info on AWS RDS DB Instances + - RDS +Title: Find Detailed Info on AWS RDS DB Instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_2.yaml b/queries/aws_rds_db_instance_2.yaml old mode 100755 new mode 100644 index 63fdd7559..7428dd53d --- a/queries/aws_rds_db_instance_2.yaml +++ b/queries/aws_rds_db_instance_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n publicly_accessible\nfrom\n\ - \ aws_rds_db_instance\nwhere\n publicly_accessible;" + QueryToExecute: | + SELECT + db_instance_identifier, + publicly_accessible + FROM + aws_rds_db_instance + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Detailed Information + - RDS +Title: List all AWS RDS DB Instances with Detailed Information \ No newline at end of file diff --git a/queries/aws_rds_db_instance_3.yaml b/queries/aws_rds_db_instance_3.yaml old mode 100755 new mode 100644 index 5bb673224..d0321f2ca --- a/queries/aws_rds_db_instance_3.yaml +++ b/queries/aws_rds_db_instance_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n iam_database_authentication_enabled\n\ - from\n aws_rds_db_instance\nwhere\n not iam_database_authentication_enabled;" + QueryToExecute: | + SELECT + db_instance_identifier, + iam_database_authentication_enabled + FROM + aws_rds_db_instance + WHERE + NOT iam_database_authentication_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find all AWS RDS DB Instances without IAM Auth + - RDS +Title: Find all AWS RDS DB Instances without IAM Auth \ No newline at end of file diff --git a/queries/aws_rds_db_instance_4.yaml b/queries/aws_rds_db_instance_4.yaml old mode 100755 new mode 100644 index e3b25f790..71c42266e --- a/queries/aws_rds_db_instance_4.yaml +++ b/queries/aws_rds_db_instance_4.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier as attached_vpc,\n vsg ->> 'VpcSecurityGroupId'\ - \ as vpc_security_group_id,\n vsg ->> 'Status' as status,\n sub -> 'SubnetAvailabilityZone'\ - \ ->> 'Name' as subnet_availability_zone,\n sub ->> 'SubnetIdentifier' as subnet_identifier,\n\ - \ sub -> 'SubnetOutpost' ->> 'Arn' as subnet_outpost,\n sub ->> 'SubnetStatus'\ - \ as subnet_status\nfrom\n aws_rds_db_instance\n cross join jsonb_array_elements(vpc_security_groups)\ - \ as vsg\n cross join jsonb_array_elements(subnets) as sub;" + QueryToExecute: | + SELECT + db_instance_identifier AS attached_vpc, + vsg ->> 'VpcSecurityGroupId' AS vpc_security_group_id, + vsg ->> 'Status' AS status, + sub -> 'SubnetAvailabilityZone' ->> 'Name' AS subnet_availability_zone, + sub ->> 'SubnetIdentifier' AS subnet_identifier, + sub -> 'SubnetOutpost' ->> 'Arn' AS subnet_outpost, + sub ->> 'SubnetStatus' AS subnet_status + FROM + aws_rds_db_instance + CROSS JOIN jsonb_array_elements(vpc_security_groups) AS vsg + CROSS JOIN jsonb_array_elements(subnets) AS sub; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RDS -Title: List detailed configuration and status of AWS RDS DB Instances + - AWS RDS +Title: List detailed configuration and status of AWS RDS DB Instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_5.yaml b/queries/aws_rds_db_instance_5.yaml old mode 100755 new mode 100644 index 1a250fda5..95cf4d140 --- a/queries/aws_rds_db_instance_5.yaml +++ b/queries/aws_rds_db_instance_5.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n class,\n engine,\n engine_version,\n\ - \ deletion_protection\nfrom\n aws_rds_db_instance\nwhere\n not deletion_protection;" + QueryToExecute: | + SELECT + db_instance_identifier, + class, + engine, + engine_version, + deletion_protection + FROM + aws_rds_db_instance + WHERE + NOT deletion_protection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances and their metadata + - RDS +Title: List all AWS RDS DB Instances and their metadata \ No newline at end of file diff --git a/queries/aws_rds_db_instance_6.yaml b/queries/aws_rds_db_instance_6.yaml old mode 100755 new mode 100644 index 2250ba6dd..50ac06e55 --- a/queries/aws_rds_db_instance_6.yaml +++ b/queries/aws_rds_db_instance_6.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n class,\n allocated_storage,\n\ - \ deletion_protection\nfrom\n aws_rds_db_instance\nwhere\n not storage_encrypted;" + QueryToExecute: | + SELECT + db_instance_identifier, + class, + allocated_storage, + deletion_protection + FROM + aws_rds_db_instance + WHERE + NOT storage_encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Configuration Data + - RDS +Title: List all AWS RDS DB Instances with Configuration Data \ No newline at end of file diff --git a/queries/aws_rds_db_instance_7.yaml b/queries/aws_rds_db_instance_7.yaml old mode 100755 new mode 100644 index 3f749de0e..c85aa09f9 --- a/queries/aws_rds_db_instance_7.yaml +++ b/queries/aws_rds_db_instance_7.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n endpoint_address,\n endpoint_hosted_zone_id,\n\ - \ endpoint_port\nfrom\n aws_rds_db_instance;" + QueryToExecute: | + SELECT + db_instance_identifier, + endpoint_address, + endpoint_hosted_zone_id, + endpoint_port + FROM + aws_rds_db_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find Info on AWS RDS DB Instances' Configuration and Status + - RDS +Title: Find Info on AWS RDS DB Instances' Configuration and Status \ No newline at end of file diff --git a/queries/aws_rds_db_instance_8.yaml b/queries/aws_rds_db_instance_8.yaml old mode 100755 new mode 100644 index a88073a81..b70138f0d --- a/queries/aws_rds_db_instance_8.yaml +++ b/queries/aws_rds_db_instance_8.yaml @@ -1,33 +1,56 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with db_parameter_group as (\n select\n name as db_parameter_group_name,\n\ - \ pg ->> 'ParameterName' as parameter_name,\n pg ->> 'ParameterValue' as\ - \ parameter_value\n from\n aws_rds_db_parameter_group,\n jsonb_array_elements(parameters)\ - \ as pg\n where\n -- The example is limited to SQL Server, this may change\ - \ based on DB engine\n pg ->> 'ParameterName' like 'rds.force_ssl'\n and\ - \ name not like 'default.%'\n),\n rds_associated_parameter_group as (\n select\n\ - \ db_instance_identifier as db_instance_identifier,\n arn,\n pg ->> 'DBParameterGroupName'\ - \ as DBParameterGroupName\n from\n aws_rds_db_instance,\n jsonb_array_elements(db_parameter_groups)\ - \ as pg\n where\n engine like 'sqlserve%'\n)\nselect\n rds.db_instance_identifier\ - \ as name,\n rds.DBParameterGroupName,\n parameter_name,\n parameter_value\n\ - from\n rds_associated_parameter_group as rds\n left join db_parameter_group\ - \ d on rds.DBParameterGroupName = d.db_parameter_group_name\nwhere\n parameter_value\ - \ = '0'" + QueryToExecute: | + WITH db_parameter_group AS ( + SELECT + name AS db_parameter_group_name, + pg ->> 'ParameterName' AS parameter_name, + pg ->> 'ParameterValue' AS parameter_value + FROM + aws_rds_db_parameter_group, + jsonb_array_elements(parameters) AS pg + WHERE + pg ->> 'ParameterName' LIKE 'rds.force_ssl' + AND name NOT LIKE 'default.%' + ), + rds_associated_parameter_group AS ( + SELECT + db_instance_identifier AS db_instance_identifier, + arn, + pg ->> 'DBParameterGroupName' AS DBParameterGroupName + FROM + aws_rds_db_instance, + jsonb_array_elements(db_parameter_groups) AS pg + WHERE + engine LIKE 'sqlserve%' + ) + SELECT + rds.db_instance_identifier AS name, + rds.DBParameterGroupName, + parameter_name, + parameter_value + FROM + rds_associated_parameter_group AS rds + LEFT JOIN + db_parameter_group d + ON + rds.DBParameterGroupName = d.db_parameter_group_name + WHERE + parameter_value = '0' Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List All AWS RDS DB Instances with SSL Parameter Details + - RDS +Title: List All AWS RDS DB Instances with SSL Parameter Details \ No newline at end of file diff --git a/queries/aws_rds_db_instance_9.yaml b/queries/aws_rds_db_instance_9.yaml old mode 100755 new mode 100644 index 95930b734..f9ebad92a --- a/queries/aws_rds_db_instance_9.yaml +++ b/queries/aws_rds_db_instance_9.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS RDS DB Instances for detailed information about - the configuration, status, and other metadata associated with each database instance. +Description: Allows users to query AWS RDS DB Instances for detailed information about the configuration, status, and other metadata associated with each database instance. ID: aws_rds_db_instance_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n actions ->> 'ResourceIdentifier' as db_instance_identifier,\n\ - \ details ->> 'Action' as action,\n details ->> 'OptInStatus' as opt_in_status,\n\ - \ details ->> 'ForcedApplyDate' as forced_apply_date,\n details ->> 'CurrentApplyDate'\ - \ as current_apply_date,\n details ->> 'AutoAppliedAfterDate' as auto_applied_after_date\n\ - from\n aws_rds_db_instance,\n jsonb_array_elements(pending_maintenance_actions)\ - \ as actions,\n jsonb_array_elements(actions -> 'PendingMaintenanceActionDetails')\ - \ as details;" + QueryToExecute: | + SELECT + actions ->> 'ResourceIdentifier' AS db_instance_identifier, + details ->> 'Action' AS action, + details ->> 'OptInStatus' AS opt_in_status, + details ->> 'ForcedApplyDate' AS forced_apply_date, + details ->> 'CurrentApplyDate' AS current_apply_date, + details ->> 'AutoAppliedAfterDate' AS auto_applied_after_date + FROM + aws_rds_db_instance, + jsonb_array_elements(pending_maintenance_actions) AS actions, + jsonb_array_elements(actions -> 'PendingMaintenanceActionDetails') AS details; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Detailed Information + - RDS +Title: List all AWS RDS DB Instances with Detailed Information \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_1.yaml b/queries/aws_rds_db_instance_automated_backup_1.yaml old mode 100755 new mode 100644 index 780048212..08c30d78d --- a/queries/aws_rds_db_instance_automated_backup_1.yaml +++ b/queries/aws_rds_db_instance_automated_backup_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n arn,\n status,\n allocated_storage,\n\ - \ encrypted,\n engine\nfrom\n aws_rds_db_instance_automated_backup;" + QueryToExecute: | + SELECT + db_instance_identifier, + arn, + status, + allocated_storage, + encrypted, + engine + FROM + aws_rds_db_instance_automated_backup; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instance Automated Backups + - RDS +Title: Find AWS RDS DB Instance Automated Backups \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_2.yaml b/queries/aws_rds_db_instance_automated_backup_2.yaml old mode 100755 new mode 100644 index 2402cf059..7143435ab --- a/queries/aws_rds_db_instance_automated_backup_2.yaml +++ b/queries/aws_rds_db_instance_automated_backup_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n arn,\n status,\n backup_target,\n\ - \ instance_create_time,\n encrypted,\n engine\nfrom\n aws_rds_db_instance_automated_backup\n\ - where\n not encrypted;" + QueryToExecute: | + SELECT + db_instance_identifier, + arn, + status, + backup_target, + instance_create_time, + encrypted, + engine + FROM + aws_rds_db_instance_automated_backup + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instance Automated Backups + - RDS +Title: Find AWS RDS DB Instance Automated Backups \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_3.yaml b/queries/aws_rds_db_instance_automated_backup_3.yaml old mode 100755 new mode 100644 index 3e50781f9..f0fde0067 --- a/queries/aws_rds_db_instance_automated_backup_3.yaml +++ b/queries/aws_rds_db_instance_automated_backup_3.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n iam_database_authentication_enabled,\n\ - \ status,\n availability_zone,\n dbi_resource_id\nfrom\n aws_rds_db_instance_automated_backup\n\ - where\n not iam_database_authentication_enabled;" + QueryToExecute: | + SELECT + db_instance_identifier, + iam_database_authentication_enabled, + status, + availability_zone, + dbi_resource_id + FROM + aws_rds_db_instance_automated_backup + WHERE + NOT iam_database_authentication_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find Data on AWS RDS DB Instance Automated Backups + - RDS +Title: Find Data on AWS RDS DB Instance Automated Backups \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_4.yaml b/queries/aws_rds_db_instance_automated_backup_4.yaml old mode 100755 new mode 100644 index b5d3a04f7..82be62a95 --- a/queries/aws_rds_db_instance_automated_backup_4.yaml +++ b/queries/aws_rds_db_instance_automated_backup_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n b.arn,\n b.vpc_id,\n v.cidr_block,\n v.is_default,\n\ - \ v.instance_tenancy\nfrom\n aws_rds_db_instance_automated_backup as b,\n aws_vpc\ - \ as v\nwhere\n v.vpc_id = b.vpc_id;" + QueryToExecute: | + SELECT + b.arn, + b.vpc_id, + v.cidr_block, + v.is_default, + v.instance_tenancy + FROM + aws_rds_db_instance_automated_backup AS b, + aws_vpc AS v + WHERE + v.vpc_id = b.vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all Automated Backups for RDS DB Instances + - RDS +Title: List all Automated Backups for RDS DB Instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_5.yaml b/queries/aws_rds_db_instance_automated_backup_5.yaml old mode 100755 new mode 100644 index 6fa780d6f..c2de63c3f --- a/queries/aws_rds_db_instance_automated_backup_5.yaml +++ b/queries/aws_rds_db_instance_automated_backup_5.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n arn,\n engine,\n engine_version,\n\ - \ availability_zone,\n backup_retention_period,\n status\nfrom\n aws_rds_db_instance_automated_backup\n\ - where\n status = 'retained';" + QueryToExecute: | + SELECT + db_instance_identifier, + arn, + engine, + engine_version, + availability_zone, + backup_retention_period, + status + FROM + aws_rds_db_instance_automated_backup + WHERE + status = 'retained'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List All AWS RDS DB Instance Automated Backups + - RDS +Title: List All AWS RDS DB Instance Automated Backups \ No newline at end of file diff --git a/queries/aws_rds_db_instance_automated_backup_6.yaml b/queries/aws_rds_db_instance_automated_backup_6.yaml old mode 100755 new mode 100644 index 7ed6b919f..7d41318f8 --- a/queries/aws_rds_db_instance_automated_backup_6.yaml +++ b/queries/aws_rds_db_instance_automated_backup_6.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve - data about automated backups for RDS DB instances. +Description: Allows users to query AWS RDS DB Instance Automated Backups and retrieve data about automated backups for RDS DB instances. ID: aws_rds_db_instance_automated_backup_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n b.db_instance_identifier,\n b.arn as automated_backup_arn,\n\ - \ b.engine,\n b.kms_key_id,\n k.creation_date as kms_key_creation_date,\n \ - \ k.key_state,\n k.key_rotation_enabled\nfrom\n aws_rds_db_instance_automated_backup\ - \ as b,\n aws_kms_key as k\nwhere\n k.id = b.kms_key_id;" + QueryToExecute: | + SELECT + b.db_instance_identifier, + b.arn AS automated_backup_arn, + b.engine, + b.kms_key_id, + k.creation_date AS kms_key_creation_date, + k.key_state, + k.key_rotation_enabled + FROM + aws_rds_db_instance_automated_backup AS b, + aws_kms_key AS k + WHERE + k.id = b.kms_key_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instance Automated Backups via SQL + - RDS +Title: Find AWS RDS DB Instance Automated Backups via SQL \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_1.yaml b/queries/aws_rds_db_instance_metric_connections_1.yaml old mode 100755 new mode 100644 index 606302990..8895dc2d7 --- a/queries/aws_rds_db_instance_metric_connections_1.yaml +++ b/queries/aws_rds_db_instance_metric_connections_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS RDS DBInstance Metrics for a comprehensive - view of the number of database connections. +Description: Allows users to query AWS RDS DBInstance Metrics for a comprehensive view of the number of database connections. ID: aws_rds_db_instance_metric_connections_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Metrics for Database Connections + - RDS +Title: Find AWS RDS DBInstance Metrics for Database Connections \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_2.yaml b/queries/aws_rds_db_instance_metric_connections_2.yaml old mode 100755 new mode 100644 index a64b2b969..a02b3b5bd --- a/queries/aws_rds_db_instance_metric_connections_2.yaml +++ b/queries/aws_rds_db_instance_metric_connections_2.yaml @@ -1,23 +1,34 @@ -Description: Allows users to query AWS RDS DBInstance Metrics for a comprehensive - view of the number of database connections. +Description: Allows users to query AWS RDS DBInstance Metrics for a comprehensive view of the number of database connections. ID: aws_rds_db_instance_metric_connections_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections\n\ - where \n average > 100\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections + WHERE + average > 100 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find All AWS RDS DBInstance Connections Metrics + - RDS +Title: Find All AWS RDS DBInstance Connections Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_daily_1.yaml b/queries/aws_rds_db_instance_metric_connections_daily_1.yaml old mode 100755 new mode 100644 index e27d9db95..9dc9c9d03 --- a/queries/aws_rds_db_instance_metric_connections_daily_1.yaml +++ b/queries/aws_rds_db_instance_metric_connections_daily_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving - information about the number of database connections. +Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving information about the number of database connections. ID: aws_rds_db_instance_metric_connections_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections_daily\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections_daily + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS DB Instance Daily Connections Metrics + - RDS +Title: List AWS RDS DB Instance Daily Connections Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_daily_2.yaml b/queries/aws_rds_db_instance_metric_connections_daily_2.yaml old mode 100755 new mode 100644 index 5f3db4c95..447c01aa5 --- a/queries/aws_rds_db_instance_metric_connections_daily_2.yaml +++ b/queries/aws_rds_db_instance_metric_connections_daily_2.yaml @@ -1,21 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving - information about the number of database connections. +Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving information about the number of database connections. ID: aws_rds_db_instance_metric_connections_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections_daily\n\ - where \n average > 100\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections_daily + WHERE + average > 100 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RDS -Title: List All AWS RDS DB Instance Metric Connections Daily + - AWS RDS +Title: List All AWS RDS DB Instance Metric Connections Daily \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_daily_3.yaml b/queries/aws_rds_db_instance_metric_connections_daily_3.yaml old mode 100755 new mode 100644 index 6b502642e..ef872a4b5 --- a/queries/aws_rds_db_instance_metric_connections_daily_3.yaml +++ b/queries/aws_rds_db_instance_metric_connections_daily_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving - information about the number of database connections. +Description: Allows users to query AWS RDS DB Instance Metrics on a daily basis, retrieving information about the number of database connections. ID: aws_rds_db_instance_metric_connections_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n sum(maximum) as total_connections\n\ - from\n aws_rds_db_instance_metric_connections\nwhere \n timestamp > (current_date\ - \ - interval '7' day)\ngroup by\n db_instance_identifier\nhaving\n sum(maximum)\ - \ = 0 \n;" + QueryToExecute: | + SELECT + db_instance_identifier, + SUM(maximum) AS total_connections + FROM + aws_rds_db_instance_metric_connections + WHERE + timestamp > (CURRENT_DATE - INTERVAL '7' DAY) + GROUP BY + db_instance_identifier + HAVING + SUM(maximum) = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Zero Connections Daily + - RDS +Title: List all AWS RDS DB Instances with Zero Connections Daily \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_hourly_1.yaml b/queries/aws_rds_db_instance_metric_connections_hourly_1.yaml old mode 100755 new mode 100644 index 2abf069cf..db4569169 --- a/queries/aws_rds_db_instance_metric_connections_hourly_1.yaml +++ b/queries/aws_rds_db_instance_metric_connections_hourly_1.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Metrics on an hourly basis, - specifically the connection metrics. It provides data about the number of database - connections to each DB instance in your Amazon RDS environment. +Description: Allows users to query AWS RDS DB Instance Metrics on an hourly basis, specifically the connection metrics. It provides data about the number of database connections to each DB instance in your Amazon RDS environment. ID: aws_rds_db_instance_metric_connections_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections_hourly\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections_hourly + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all AWS RDS DB Instance Connection Metrics Hourly + - Amazon RDS +Title: List all AWS RDS DB Instance Connection Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_connections_hourly_2.yaml b/queries/aws_rds_db_instance_metric_connections_hourly_2.yaml old mode 100755 new mode 100644 index 3abeb4ca6..72a3e4449 --- a/queries/aws_rds_db_instance_metric_connections_hourly_2.yaml +++ b/queries/aws_rds_db_instance_metric_connections_hourly_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance Metrics on an hourly basis, - specifically the connection metrics. It provides data about the number of database - connections to each DB instance in your Amazon RDS environment. +Description: Allows users to query AWS RDS DB Instance Metrics on an hourly basis, specifically the connection metrics. It provides data about the number of database connections to each DB instance in your Amazon RDS environment. ID: aws_rds_db_instance_metric_connections_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_connections_hourly\n\ - where \n average > 100\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_connections_hourly + WHERE + average > 100 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all AWS RDS DB Instance Connection Metrics Hourly + - Amazon RDS +Title: List all AWS RDS DB Instance Connection Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_1.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_1.yaml old mode 100755 new mode 100644 index 31739ae3c..cfcca7ddd --- a/queries/aws_rds_db_instance_metric_cpu_utilization_1.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query Amazon RDS DBInstanceCPUUtilization to fetch data - about CPU utilization metrics for RDS DB instances. +Description: Allows users to query Amazon RDS DBInstanceCPUUtilization to fetch data about CPU utilization metrics for RDS DB instances. ID: aws_rds_db_instance_metric_cpu_utilization_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all CPU utilization metrics for RDS DB instances + - Amazon RDS +Title: List all CPU utilization metrics for RDS DB instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_2.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_2.yaml old mode 100755 new mode 100644 index 5511f9802..4542226f6 --- a/queries/aws_rds_db_instance_metric_cpu_utilization_2.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query Amazon RDS DBInstanceCPUUtilization to fetch data - about CPU utilization metrics for RDS DB instances. +Description: Allows users to query Amazon RDS DBInstanceCPUUtilization to fetch data about CPU utilization metrics for RDS DB instances. ID: aws_rds_db_instance_metric_cpu_utilization_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization\n\ - where average > 80\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + ROUND(minimum::numeric, 2) AS min_cpu, + ROUND(maximum::numeric, 2) AS max_cpu, + ROUND(average::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization + WHERE + average > 80 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List All Amazon RDS DB Instances with High CPU Utilization + - Amazon RDS +Title: List All Amazon RDS DB Instances with High CPU Utilization \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_1.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_1.yaml old mode 100755 new mode 100644 index 138b2da72..d916c18cd --- a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_1.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization - metrics. +Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization metrics. ID: aws_rds_db_instance_metric_cpu_utilization_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_daily\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_daily + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances and daily CPU usage metrics + - RDS +Title: List all AWS RDS DB Instances and daily CPU usage metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_2.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_2.yaml old mode 100755 new mode 100644 index 5450b2947..8259cf181 --- a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_2.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization - metrics. +Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization metrics. ID: aws_rds_db_instance_metric_cpu_utilization_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_daily\n\ - where average > 80\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_daily + WHERE + AVERAGE > 80 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instances with High CPU Utilization + - RDS +Title: Find AWS RDS DB Instances with High CPU Utilization \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_3.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_3.yaml old mode 100755 new mode 100644 index f9647ff20..50530cb3e --- a/queries/aws_rds_db_instance_metric_cpu_utilization_daily_3.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_daily_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization - metrics. +Description: Allows users to query AWS RDS DB Instances to retrieve daily CPU utilization metrics. ID: aws_rds_db_instance_metric_cpu_utilization_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_daily\n\ - where average < 2\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_daily + WHERE + AVERAGE < 2 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instances' Daily CPU Utilization Metrics + - RDS +Title: Find AWS RDS DB Instances' Daily CPU Utilization Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_1.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_1.yaml old mode 100755 new mode 100644 index 588292b6c..e51d226ff --- a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_1.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on - an hourly basis. +Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on an hourly basis. ID: aws_rds_db_instance_metric_cpu_utilization_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_hourly\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_hourly + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instance CPU Utilization Hourly Metrics + - RDS +Title: Find AWS RDS DB Instance CPU Utilization Hourly Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_2.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_2.yaml old mode 100755 new mode 100644 index 03d78a3e3..91dd57384 --- a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_2.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on - an hourly basis. +Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on an hourly basis. ID: aws_rds_db_instance_metric_cpu_utilization_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_hourly\n\ - where average > 80\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_hourly + WHERE + AVERAGE > 80 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS Instances with High CPU Utilization + - RDS +Title: Find AWS RDS Instances with High CPU Utilization \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_3.yaml b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_3.yaml old mode 100755 new mode 100644 index 8d7252866..fa86fa539 --- a/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_3.yaml +++ b/queries/aws_rds_db_instance_metric_cpu_utilization_hourly_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on - an hourly basis. +Description: Allows users to query AWS RDS DB Instance CPU Utilization Metrics on an hourly basis. ID: aws_rds_db_instance_metric_cpu_utilization_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_rds_db_instance_metric_cpu_utilization_hourly\n\ - where average < 2\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_rds_db_instance_metric_cpu_utilization_hourly + WHERE + AVERAGE < 2 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instance CPU Utilization on Hourly Basis + - RDS +Title: Find AWS RDS DB Instance CPU Utilization on Hourly Basis \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_1.yaml b/queries/aws_rds_db_instance_metric_read_iops_1.yaml old mode 100755 new mode 100644 index dc0ab70dd..3e59fdc7b --- a/queries/aws_rds_db_instance_metric_read_iops_1.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and - monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS - DB instances. +Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS DB instances. ID: aws_rds_db_instance_metric_read_iops_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS Read IOPS Metrics for DB Instances + - RDS +Title: Find AWS RDS Read IOPS Metrics for DB Instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_2.yaml b/queries/aws_rds_db_instance_metric_read_iops_2.yaml old mode 100755 new mode 100644 index 426da6963..aae49c89b --- a/queries/aws_rds_db_instance_metric_read_iops_2.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_2.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and - monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS - DB instances. +Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS DB instances. ID: aws_rds_db_instance_metric_read_iops_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find Read IOPS Metrics for AWS RDS DB Instances + - RDS +Title: Find Read IOPS Metrics for AWS RDS DB Instances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_3.yaml b/queries/aws_rds_db_instance_metric_read_iops_3.yaml old mode 100755 new mode 100644 index 88ea842d4..3fcb3b594 --- a/queries/aws_rds_db_instance_metric_read_iops_3.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_3.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and - monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS - DB instances. +Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS DB instances. ID: aws_rds_db_instance_metric_read_iops_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find AWS RDS DBInstance Read IOPS Metrics + - Amazon RDS +Title: Find AWS RDS DBInstance Read IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_4.yaml b/queries/aws_rds_db_instance_metric_read_iops_4.yaml old mode 100755 new mode 100644 index 14acc8eb7..2857c698b --- a/queries/aws_rds_db_instance_metric_read_iops_4.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_4.yaml @@ -1,27 +1,39 @@ -Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and - monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS - DB instances. +Description: Allows users to query AWS RDS DBInstanceMetricReadIops to retrieve and monitor the read IOPS (Input/Output Operations Per Second) metrics for Amazon RDS DB instances. ID: aws_rds_db_instance_metric_read_iops_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops as r,\n aws_rds_db_instance_metric_write_iops\ - \ as w\nwhere \n r.db_instance_identifier = w.db_instance_identifier\n and r.timestamp\ - \ = w.timestamp\norder by\n r.db_instance_identifier,\n r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops AS r, + aws_rds_db_instance_metric_write_iops AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find AWS RDS DB Instance Read IOPS Metrics + - Amazon RDS +Title: Find AWS RDS DB Instance Read IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_daily_1.yaml b/queries/aws_rds_db_instance_metric_read_iops_daily_1.yaml old mode 100755 new mode 100644 index ad86d95fe..137e0de7e --- a/queries/aws_rds_db_instance_metric_read_iops_daily_1.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_daily_1.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS - (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_daily\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_daily + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance daily read IOPS metrics + - RDS +Title: Find AWS RDS DBInstance daily read IOPS metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_daily_2.yaml b/queries/aws_rds_db_instance_metric_read_iops_daily_2.yaml old mode 100755 new mode 100644 index a331ca17b..26c1ef5a2 --- a/queries/aws_rds_db_instance_metric_read_iops_daily_2.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_daily_2.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS - (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_daily\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_daily + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Metrics for Daily Read IOPS + - RDS +Title: Find AWS RDS DBInstance Metrics for Daily Read IOPS \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_daily_3.yaml b/queries/aws_rds_db_instance_metric_read_iops_daily_3.yaml old mode 100755 new mode 100644 index 9e38879d0..2e3cea504 --- a/queries/aws_rds_db_instance_metric_read_iops_daily_3.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_daily_3.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS - (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_daily\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_daily + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Metrics for Daily Read IOPS + - RDS +Title: Find AWS RDS DBInstance Metrics for Daily Read IOPS \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_daily_4.yaml b/queries/aws_rds_db_instance_metric_read_iops_daily_4.yaml old mode 100755 new mode 100644 index a7149e343..c4809c65c --- a/queries/aws_rds_db_instance_metric_read_iops_daily_4.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_daily_4.yaml @@ -1,27 +1,39 @@ -Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS - (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DBInstance metrics for daily read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops_daily as r,\n\ - \ aws_rds_db_instance_metric_write_iops_daily as w\nwhere \n r.db_instance_identifier\ - \ = w.db_instance_identifier\n and r.timestamp = w.timestamp\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops_daily AS r, + aws_rds_db_instance_metric_write_iops_daily AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DBInstance daily read IOPS metrics + - RDS +Title: List all AWS RDS DBInstance daily read IOPS metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_hourly_1.yaml b/queries/aws_rds_db_instance_metric_read_iops_hourly_1.yaml old mode 100755 new mode 100644 index 4b533369f..0975a4bd1 --- a/queries/aws_rds_db_instance_metric_read_iops_hourly_1.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_hourly_1.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics - related to read IOPS (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics related to read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_hourly\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_hourly + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Read IOPS Metrics + - RDS +Title: List all AWS RDS DB Instances with Read IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_hourly_2.yaml b/queries/aws_rds_db_instance_metric_read_iops_hourly_2.yaml old mode 100755 new mode 100644 index 1a672c17f..a3685af75 --- a/queries/aws_rds_db_instance_metric_read_iops_hourly_2.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_hourly_2.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics - related to read IOPS (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics related to read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_hourly\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_hourly + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instances Hourly Read IOPS Over 1000 + - RDS +Title: Find AWS RDS DB Instances Hourly Read IOPS Over 1000 \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_hourly_3.yaml b/queries/aws_rds_db_instance_metric_read_iops_hourly_3.yaml old mode 100755 new mode 100644 index a402b89dd..4072dca52 --- a/queries/aws_rds_db_instance_metric_read_iops_hourly_3.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_hourly_3.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics - related to read IOPS (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics related to read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_read_iops_hourly\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_read_iops_hourly + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Instances Reading Over 8000 IOPS + - RDS +Title: Find AWS RDS DB Instances Reading Over 8000 IOPS \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_hourly_4.yaml b/queries/aws_rds_db_instance_metric_read_iops_hourly_4.yaml old mode 100755 new mode 100644 index 8848bc1db..334224731 --- a/queries/aws_rds_db_instance_metric_read_iops_hourly_4.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_hourly_4.yaml @@ -1,28 +1,39 @@ -Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics - related to read IOPS (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics related to read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_hourly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n v.iops\ - \ as provisioned_iops,\n round(r.average) +round(w.average) as iops_avg,\n round(r.average)\ - \ as read_ops_avg,\n round(w.average) as write_ops_avg\nfrom \n aws_rds_db_instance_metric_read_iops_hourly\ - \ as r,\n aws_rds_db_instance_metric_write_iops_hourly as w,\n aws_rds_db_instance\ - \ as v\nwhere \n r.db_instance_identifier = w.db_instance_identifier\n and r.timestamp\ - \ = w.timestamp\n and v.db_instance_identifier = r.db_instance_identifier \n\ - \ and r.average + w.average > v.iops\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + v.iops AS provisioned_iops, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg + FROM + aws_rds_db_instance_metric_read_iops_hourly AS r, + aws_rds_db_instance_metric_write_iops_hourly AS w, + aws_rds_db_instance AS v + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + AND v.db_instance_identifier = r.db_instance_identifier + AND r.average + w.average > v.iops + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS Instances Hourly Read IOPS Metrics + - RDS +Title: Find AWS RDS Instances Hourly Read IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_read_iops_hourly_5.yaml b/queries/aws_rds_db_instance_metric_read_iops_hourly_5.yaml old mode 100755 new mode 100644 index 258a0792d..c111e3360 --- a/queries/aws_rds_db_instance_metric_read_iops_hourly_5.yaml +++ b/queries/aws_rds_db_instance_metric_read_iops_hourly_5.yaml @@ -1,29 +1,41 @@ -Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics - related to read IOPS (Input/Output Operations Per Second). +Description: Allows users to query AWS RDS DB Instances and retrieve hourly metrics related to read IOPS (Input/Output Operations Per Second). ID: aws_rds_db_instance_metric_read_iops_hourly_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops_hourly as r,\n\ - \ aws_rds_db_instance_metric_write_iops_hourly as w\nwhere \n r.db_instance_identifier\ - \ = w.db_instance_identifier\n and r.timestamp = w.timestamp\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops_hourly AS r, + aws_rds_db_instance_metric_write_iops_hourly AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Instances with Hourly Read IOPS Metrics + - RDS +Title: List all AWS RDS DB Instances with Hourly Read IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_1.yaml b/queries/aws_rds_db_instance_metric_write_iops_1.yaml old mode 100755 new mode 100644 index 50f191cbc..601205f2c --- a/queries/aws_rds_db_instance_metric_write_iops_1.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_1.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics - on the write input/output operations per second. +Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics on the write input/output operations per second. ID: aws_rds_db_instance_metric_write_iops_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS DBInstance -Title: List AWS RDS DBInstance Write IOPS Metrics + - RDS DBInstance +Title: List AWS RDS DBInstance Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_2.yaml b/queries/aws_rds_db_instance_metric_write_iops_2.yaml old mode 100755 new mode 100644 index 13bd3efe7..ed7041144 --- a/queries/aws_rds_db_instance_metric_write_iops_2.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_2.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics - on the write input/output operations per second. +Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics on the write input/output operations per second. ID: aws_rds_db_instance_metric_write_iops_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS RDS -Title: Find AWS RDS DBInstance Write IOPS Metrics + - AWS RDS +Title: Find AWS RDS DBInstance Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_3.yaml b/queries/aws_rds_db_instance_metric_write_iops_3.yaml old mode 100755 new mode 100644 index eea01577b..971bce8e2 --- a/queries/aws_rds_db_instance_metric_write_iops_3.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_3.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics - on the write input/output operations per second. +Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics on the write input/output operations per second. ID: aws_rds_db_instance_metric_write_iops_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS DBInstance Write IOPS Metrics + - RDS +Title: List AWS RDS DBInstance Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_4.yaml b/queries/aws_rds_db_instance_metric_write_iops_4.yaml old mode 100755 new mode 100644 index 47d9d4dbc..2aabb3102 --- a/queries/aws_rds_db_instance_metric_write_iops_4.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_4.yaml @@ -1,26 +1,39 @@ -Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics - on the write input/output operations per second. +Description: Allows users to query AWS RDS DBInstance Write IOPS to retrieve metrics on the write input/output operations per second. ID: aws_rds_db_instance_metric_write_iops_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops as r,\n aws_rds_db_instance_metric_write_iops\ - \ as w\nwhere \n r.db_instance_identifier = w.db_instance_identifier\n and r.timestamp\ - \ = w.timestamp\norder by\n r.db_instance_identifier,\n r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops AS r, + aws_rds_db_instance_metric_write_iops AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS Write IOPS Metrics Using SQL + - RDS +Title: Find AWS RDS Write IOPS Metrics Using SQL \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_daily_1.yaml b/queries/aws_rds_db_instance_metric_write_iops_daily_1.yaml old mode 100755 new mode 100644 index d6a8aa16d..0a0a7dbbd --- a/queries/aws_rds_db_instance_metric_write_iops_daily_1.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_daily_1.yaml @@ -1,20 +1,31 @@ Description: Allows users to query AWS RDS DBInstance metrics for daily write IOPS. ID: aws_rds_db_instance_metric_write_iops_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_daily\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_daily + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List Daily Write IOPS for AWS RDS DBInstances + - RDS +Title: List Daily Write IOPS for AWS RDS DBInstances \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_daily_2.yaml b/queries/aws_rds_db_instance_metric_write_iops_daily_2.yaml old mode 100755 new mode 100644 index 6539a2c5a..554eeec63 --- a/queries/aws_rds_db_instance_metric_write_iops_daily_2.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_daily_2.yaml @@ -1,22 +1,35 @@ Description: Allows users to query AWS RDS DBInstance metrics for daily write IOPS. ID: aws_rds_db_instance_metric_write_iops_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_daily\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_daily + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DBInstance Daily Write IOPS Metrics + - RDS +Title: List all AWS RDS DBInstance Daily Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_daily_3.yaml b/queries/aws_rds_db_instance_metric_write_iops_daily_3.yaml old mode 100755 new mode 100644 index 2d0f0f0ad..0d357f22e --- a/queries/aws_rds_db_instance_metric_write_iops_daily_3.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_daily_3.yaml @@ -1,20 +1,33 @@ Description: Allows users to query AWS RDS DBInstance metrics for daily write IOPS. ID: aws_rds_db_instance_metric_write_iops_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_daily\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_daily + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS DBInstance Daily Write IOPS Metrics + - RDS +Title: List AWS RDS DBInstance Daily Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_daily_4.yaml b/queries/aws_rds_db_instance_metric_write_iops_daily_4.yaml old mode 100755 new mode 100644 index 0f799783e..14e7a453d --- a/queries/aws_rds_db_instance_metric_write_iops_daily_4.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_daily_4.yaml @@ -1,26 +1,39 @@ Description: Allows users to query AWS RDS DBInstance metrics for daily write IOPS. ID: aws_rds_db_instance_metric_write_iops_daily_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops_daily as r,\n\ - \ aws_rds_db_instance_metric_write_iops_daily as w\nwhere \n r.db_instance_identifier\ - \ = w.db_instance_identifier\n and r.timestamp = w.timestamp\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops_daily AS r, + aws_rds_db_instance_metric_write_iops_daily AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DBInstance Daily Write IOPS Metrics + - RDS +Title: List all AWS RDS DBInstance Daily Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_hourly_1.yaml b/queries/aws_rds_db_instance_metric_write_iops_hourly_1.yaml old mode 100755 new mode 100644 index 7454dc879..4b6baff70 --- a/queries/aws_rds_db_instance_metric_write_iops_hourly_1.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_hourly_1.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly - basis. +Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly basis. ID: aws_rds_db_instance_metric_write_iops_hourly_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_hourly\n\ - order by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_hourly + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List All AWS RDS DBInstance Write IOPS Metrics Hourly + - RDS +Title: List All AWS RDS DBInstance Write IOPS Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_hourly_2.yaml b/queries/aws_rds_db_instance_metric_write_iops_hourly_2.yaml old mode 100755 new mode 100644 index 658c407a3..cb34c34e7 --- a/queries/aws_rds_db_instance_metric_write_iops_hourly_2.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_hourly_2.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly - basis. +Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly basis. ID: aws_rds_db_instance_metric_write_iops_hourly_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_hourly\n\ - where\n average > 1000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_hourly + WHERE + average > 1000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly + - RDS +Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_hourly_3.yaml b/queries/aws_rds_db_instance_metric_write_iops_hourly_3.yaml old mode 100755 new mode 100644 index 39eb783a5..6a4b66402 --- a/queries/aws_rds_db_instance_metric_write_iops_hourly_3.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_hourly_3.yaml @@ -1,21 +1,33 @@ -Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly - basis. +Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly basis. ID: aws_rds_db_instance_metric_write_iops_hourly_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_instance_identifier,\n timestamp,\n minimum,\n \ - \ maximum,\n average,\n sum,\n sample_count\nfrom\n aws_rds_db_instance_metric_write_iops_hourly\n\ - where\n maximum > 8000\norder by\n db_instance_identifier,\n timestamp;" + QueryToExecute: | + SELECT + db_instance_identifier, + timestamp, + minimum, + maximum, + average, + sum, + sample_count + FROM + aws_rds_db_instance_metric_write_iops_hourly + WHERE + maximum > 8000 + ORDER BY + db_instance_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly + - RDS +Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_hourly_4.yaml b/queries/aws_rds_db_instance_metric_write_iops_hourly_4.yaml old mode 100755 new mode 100644 index d937b0d8b..2b8b895bc --- a/queries/aws_rds_db_instance_metric_write_iops_hourly_4.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_hourly_4.yaml @@ -1,28 +1,39 @@ -Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly - basis. +Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly basis. ID: aws_rds_db_instance_metric_write_iops_hourly_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n v.iops\ - \ as provisioned_iops,\n round(r.average) +round(w.average) as iops_avg,\n round(r.average)\ - \ as read_ops_avg,\n round(w.average) as write_ops_avg\nfrom \n aws_rds_db_instance_metric_read_iops_hourly\ - \ as r,\n aws_rds_db_instance_metric_write_iops_hourly as w,\n aws_rds_db_instance\ - \ as v\nwhere \n r.db_instance_identifier = w.db_instance_identifier\n and r.timestamp\ - \ = w.timestamp\n and v.db_instance_identifier = r.db_instance_identifier \n\ - \ and r.average + w.average > v.iops\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + v.iops AS provisioned_iops, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg + FROM + aws_rds_db_instance_metric_read_iops_hourly AS r, + aws_rds_db_instance_metric_write_iops_hourly AS w, + aws_rds_db_instance AS v + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + AND v.db_instance_identifier = r.db_instance_identifier + AND r.average + w.average > v.iops + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS DBInstance Hourly Write IOPS Metrics + - RDS +Title: List AWS RDS DBInstance Hourly Write IOPS Metrics \ No newline at end of file diff --git a/queries/aws_rds_db_instance_metric_write_iops_hourly_5.yaml b/queries/aws_rds_db_instance_metric_write_iops_hourly_5.yaml old mode 100755 new mode 100644 index bb53c094b..8f2340c7b --- a/queries/aws_rds_db_instance_metric_write_iops_hourly_5.yaml +++ b/queries/aws_rds_db_instance_metric_write_iops_hourly_5.yaml @@ -1,29 +1,41 @@ -Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly - basis. +Description: Allows users to query AWS RDS DBInstance write IOPS metrics on an hourly basis. ID: aws_rds_db_instance_metric_write_iops_hourly_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n r.db_instance_identifier,\n r.timestamp,\n round(r.average)\ - \ + round(w.average) as iops_avg,\n round(r.average) as read_ops_avg,\n round(w.average)\ - \ as write_ops_avg,\n round(r.maximum) + round(w.maximum) as iops_max,\n round(r.maximum)\ - \ as read_ops_max,\n round(w.maximum) as write_ops_max,\n round(r.minimum) +\ - \ round(w.minimum) as iops_min,\n round(r.minimum) as read_ops_min,\n round(w.minimum)\ - \ as write_ops_min\nfrom \n aws_rds_db_instance_metric_read_iops_hourly as r,\n\ - \ aws_rds_db_instance_metric_write_iops_hourly as w\nwhere \n r.db_instance_identifier\ - \ = w.db_instance_identifier\n and r.timestamp = w.timestamp\norder by\n r.db_instance_identifier,\n\ - \ r.timestamp;" + QueryToExecute: | + SELECT + r.db_instance_identifier, + r.timestamp, + ROUND(r.average) + ROUND(w.average) AS iops_avg, + ROUND(r.average) AS read_ops_avg, + ROUND(w.average) AS write_ops_avg, + ROUND(r.maximum) + ROUND(w.maximum) AS iops_max, + ROUND(r.maximum) AS read_ops_max, + ROUND(w.maximum) AS write_ops_max, + ROUND(r.minimum) + ROUND(w.minimum) AS iops_min, + ROUND(r.minimum) AS read_ops_min, + ROUND(w.minimum) AS write_ops_min + FROM + aws_rds_db_instance_metric_read_iops_hourly AS r, + aws_rds_db_instance_metric_write_iops_hourly AS w + WHERE + r.db_instance_identifier = w.db_instance_identifier + AND r.timestamp = w.timestamp + ORDER BY + r.db_instance_identifier, + r.timestamp; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly + - RDS +Title: Find AWS RDS DBInstance Write IOPS Metrics Hourly \ No newline at end of file diff --git a/queries/aws_rds_db_option_group_1.yaml b/queries/aws_rds_db_option_group_1.yaml old mode 100755 new mode 100644 index 2170f7efe..315bbd391 --- a/queries/aws_rds_db_option_group_1.yaml +++ b/queries/aws_rds_db_option_group_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS RDS DB Option Groups and provides information - about the option groups within Amazon Relational Database Service (RDS). +Description: Allows users to query AWS RDS DB Option Groups and provides information about the option groups within Amazon Relational Database Service (RDS). ID: aws_rds_db_option_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n engine_name,\n major_engine_version,\n\ - \ vpc_id\nfrom\n aws_rds_db_option_group;" + QueryToExecute: | + SELECT + name, + description, + engine_name, + major_engine_version, + vpc_id + FROM + aws_rds_db_option_group; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Relational Database Service -Title: List all AWS RDS DB Option Groups with details + - Amazon Relational Database Service +Title: List all AWS RDS DB Option Groups with details \ No newline at end of file diff --git a/queries/aws_rds_db_option_group_2.yaml b/queries/aws_rds_db_option_group_2.yaml old mode 100755 new mode 100644 index bb0aa70fe..5ed9ea74c --- a/queries/aws_rds_db_option_group_2.yaml +++ b/queries/aws_rds_db_option_group_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS RDS DB Option Groups and provides information - about the option groups within Amazon Relational Database Service (RDS). +Description: Allows users to query AWS RDS DB Option Groups and provides information about the option groups within Amazon Relational Database Service (RDS). ID: aws_rds_db_option_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n engine_name,\n allows_vpc_and_non_vpc_instance_memberships\n\ - from\n aws_rds_db_option_group\nwhere\n allows_vpc_and_non_vpc_instance_memberships;" + QueryToExecute: | + SELECT + name, + description, + engine_name, + allows_vpc_and_non_vpc_instance_memberships + FROM + aws_rds_db_option_group + WHERE + allows_vpc_and_non_vpc_instance_memberships; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Relational Database Service -Title: List all AWS RDS DB Option Groups with SQL + - Amazon Relational Database Service +Title: List all AWS RDS DB Option Groups with SQL \ No newline at end of file diff --git a/queries/aws_rds_db_option_group_3.yaml b/queries/aws_rds_db_option_group_3.yaml old mode 100755 new mode 100644 index 1d73a79bb..0d662a66b --- a/queries/aws_rds_db_option_group_3.yaml +++ b/queries/aws_rds_db_option_group_3.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS RDS DB Option Groups and provides information - about the option groups within Amazon Relational Database Service (RDS). +Description: Allows users to query AWS RDS DB Option Groups and provides information about the option groups within Amazon Relational Database Service (RDS). ID: aws_rds_db_option_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n option ->> 'OptionName' as option_name,\n option\ - \ -> 'Permanent' as Permanent,\n option -> 'Persistent' as Persistent,\n option\ - \ -> 'VpcSecurityGroupMemberships' as vpc_security_group_membership,\n option\ - \ -> 'Port' as Port\nfrom\n aws_rds_db_option_group\n cross join jsonb_array_elements(options)\ - \ as option;" + QueryToExecute: | + SELECT + name, + option ->> 'OptionName' AS option_name, + option -> 'Permanent' AS permanent, + option -> 'Persistent' AS persistent, + option -> 'VpcSecurityGroupMemberships' AS vpc_security_group_membership, + option -> 'Port' AS port + FROM + aws_rds_db_option_group + CROSS JOIN + jsonb_array_elements(options) AS option; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find AWS RDS DB Option Groups within Amazon RDS + - Amazon RDS +Title: Find AWS RDS DB Option Groups within Amazon RDS \ No newline at end of file diff --git a/queries/aws_rds_db_parameter_group_1.yaml b/queries/aws_rds_db_parameter_group_1.yaml old mode 100755 new mode 100644 index eac673aba..efac3c025 --- a/queries/aws_rds_db_parameter_group_1.yaml +++ b/queries/aws_rds_db_parameter_group_1.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS RDS DB Parameter Groups, providing information - about the configurations that control the behavior of the databases that they are - associated with. +Description: Allows users to query AWS RDS DB Parameter Groups, providing information about the configurations that control the behavior of the databases that they are associated with. ID: aws_rds_db_parameter_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n db_parameter_group_family\n\ - from\n aws_rds_db_parameter_group;" + QueryToExecute: | + SELECT + name, + description, + db_parameter_group_family + FROM + aws_rds_db_parameter_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS DB Parameter Groups -Title: Find AWS RDS DB Parameter Groups' Configurations + - RDS DB Parameter Groups +Title: Find AWS RDS DB Parameter Groups' Configurations \ No newline at end of file diff --git a/queries/aws_rds_db_parameter_group_2.yaml b/queries/aws_rds_db_parameter_group_2.yaml old mode 100755 new mode 100644 index 25aca90ba..10be71ec2 --- a/queries/aws_rds_db_parameter_group_2.yaml +++ b/queries/aws_rds_db_parameter_group_2.yaml @@ -1,28 +1,35 @@ -Description: Allows users to query AWS RDS DB Parameter Groups, providing information - about the configurations that control the behavior of the databases that they are - associated with. +Description: Allows users to query AWS RDS DB Parameter Groups, providing information about the configurations that control the behavior of the databases that they are associated with. ID: aws_rds_db_parameter_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n db_parameter_group_family,\n pg ->> 'ParameterName'\ - \ as parameter_name,\n pg ->> 'ParameterValue' as parameter_value,\n pg ->>\ - \ 'AllowedValues' as allowed_values,\n pg ->> 'ApplyType' as apply_type,\n pg\ - \ ->> 'IsModifiable' as is_modifiable,\n pg ->> 'DataType' as data_type,\n pg\ - \ ->> 'Description' as description,\n pg ->> 'MinimumEngineVersion' as minimum_engine_version\n\ - from\n aws_rds_db_parameter_group\n cross join jsonb_array_elements(parameters)\ - \ as pg;" + QueryToExecute: | + SELECT + name, + db_parameter_group_family, + pg ->> 'ParameterName' AS parameter_name, + pg ->> 'ParameterValue' AS parameter_value, + pg ->> 'AllowedValues' AS allowed_values, + pg ->> 'ApplyType' AS apply_type, + pg ->> 'IsModifiable' AS is_modifiable, + pg ->> 'DataType' AS data_type, + pg ->> 'Description' AS description, + pg ->> 'MinimumEngineVersion' AS minimum_engine_version + FROM + aws_rds_db_parameter_group + CROSS JOIN + jsonb_array_elements(parameters) AS pg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Parameter Groups configurations + - RDS +Title: List all AWS RDS DB Parameter Groups configurations \ No newline at end of file diff --git a/queries/aws_rds_db_proxy_1.yaml b/queries/aws_rds_db_proxy_1.yaml old mode 100755 new mode 100644 index 0350fd3ff..6e3c7d921 --- a/queries/aws_rds_db_proxy_1.yaml +++ b/queries/aws_rds_db_proxy_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query DB Proxies in Amazon RDS to fetch detailed information - about each proxy, including its ARN, name, engine family, role ARN, status, and - more. +Description: Allows users to query DB Proxies in Amazon RDS to fetch detailed information about each proxy, including its ARN, name, engine family, role ARN, status, and more. ID: aws_rds_db_proxy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_proxy_name,\n status,\n engine_family\nfrom\n aws_rds_db_proxy;" + QueryToExecute: | + SELECT + db_proxy_name, + status, + engine_family + FROM + aws_rds_db_proxy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find Amazon RDS DB Proxy Details via SQL Query + - Amazon RDS +Title: Find Amazon RDS DB Proxy Details via SQL Query \ No newline at end of file diff --git a/queries/aws_rds_db_proxy_2.yaml b/queries/aws_rds_db_proxy_2.yaml old mode 100755 new mode 100644 index 02aecb23b..bee4dea57 --- a/queries/aws_rds_db_proxy_2.yaml +++ b/queries/aws_rds_db_proxy_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query DB Proxies in Amazon RDS to fetch detailed information - about each proxy, including its ARN, name, engine family, role ARN, status, and - more. +Description: Allows users to query DB Proxies in Amazon RDS to fetch detailed information about each proxy, including its ARN, name, engine family, role ARN, status, and more. ID: aws_rds_db_proxy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_proxy_name,\n engine_family,\n a ->> 'AuthScheme'\ - \ as auth_scheme,\n a ->> 'Description' as auth_description,\n a ->> 'IAMAuth'\ - \ as iam_auth,\n a ->> 'SecretArn' as secret_arn,\n a ->> 'UserName' as user_name\n\ - from\n aws_rds_db_proxy,\n jsonb_array_elements(auth) as a;" + QueryToExecute: | + SELECT + db_proxy_name, + engine_family, + a ->> 'AuthScheme' AS auth_scheme, + a ->> 'Description' AS auth_description, + a ->> 'IAMAuth' AS iam_auth, + a ->> 'SecretArn' AS secret_arn, + a ->> 'UserName' AS user_name + FROM + aws_rds_db_proxy, + jsonb_array_elements(auth) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all Detailed Information of Amazon RDS DB Proxies + - Amazon RDS +Title: List all Detailed Information of Amazon RDS DB Proxies \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_1.yaml b/queries/aws_rds_db_recommendation_1.yaml old mode 100755 new mode 100644 index 13bccf9dc..baf8be28e --- a/queries/aws_rds_db_recommendation_1.yaml +++ b/queries/aws_rds_db_recommendation_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n title,\n severity,\n description,\n\ - \ created_time\nfrom\n aws_rds_db_recommendation\nwhere\n severity = 'high';" + QueryToExecute: | + SELECT + recommendation_id, + title, + severity, + description, + created_time + FROM + aws_rds_db_recommendation + WHERE + severity = 'high'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Recommendations with High Severity + - RDS +Title: Find AWS RDS DB Recommendations with High Severity \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_2.yaml b/queries/aws_rds_db_recommendation_2.yaml old mode 100755 new mode 100644 index cd6122310..359b81a45 --- a/queries/aws_rds_db_recommendation_2.yaml +++ b/queries/aws_rds_db_recommendation_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n title,\n created_time,\n description\n\ - from\n aws_rds_db_recommendation\nwhere\n created_time >= now() - interval '30\ - \ days';" + QueryToExecute: | + SELECT + recommendation_id, + title, + created_time, + description + FROM + aws_rds_db_recommendation + WHERE + created_time >= NOW() - INTERVAL '30 days'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Recommendations and Details + - RDS +Title: List all AWS RDS DB Recommendations and Details \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_3.yaml b/queries/aws_rds_db_recommendation_3.yaml old mode 100755 new mode 100644 index 41d8ac18a..b6d908a1e --- a/queries/aws_rds_db_recommendation_3.yaml +++ b/queries/aws_rds_db_recommendation_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n title,\n recommendation,\n recommended_actions\n\ - from\n aws_rds_db_recommendation;" + QueryToExecute: | + SELECT + recommendation_id, + title, + recommendation, + recommended_actions + FROM + aws_rds_db_recommendation; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find All Recommendations and Actions for AWS RDS DB + - RDS +Title: Find All Recommendations and Actions for AWS RDS DB \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_4.yaml b/queries/aws_rds_db_recommendation_4.yaml old mode 100755 new mode 100644 index 34e8b6a19..f58d48246 --- a/queries/aws_rds_db_recommendation_4.yaml +++ b/queries/aws_rds_db_recommendation_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n title,\n impact,\n description\n\ - from\n aws_rds_db_recommendation\norder by\n impact desc;" + QueryToExecute: | + SELECT + recommendation_id, + title, + impact, + description + FROM + aws_rds_db_recommendation + ORDER BY + impact DESC; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all AWS RDS DB Recommendations and Suggested Actions + - Amazon RDS +Title: List all AWS RDS DB Recommendations and Suggested Actions \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_5.yaml b/queries/aws_rds_db_recommendation_5.yaml old mode 100755 new mode 100644 index 0db232550..f4819c404 --- a/queries/aws_rds_db_recommendation_5.yaml +++ b/queries/aws_rds_db_recommendation_5.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n title,\n status,\n updated_time\n\ - from\n aws_rds_db_recommendation\nwhere\n status != 'resolved';" + QueryToExecute: | + SELECT + recommendation_id, + title, + status, + updated_time + FROM + aws_rds_db_recommendation + WHERE + status != 'resolved'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find AWS RDS DB Recommendations and Statuses + - RDS +Title: Find AWS RDS DB Recommendations and Statuses \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_6.yaml b/queries/aws_rds_db_recommendation_6.yaml old mode 100755 new mode 100644 index 1eb0855f7..6a86b180b --- a/queries/aws_rds_db_recommendation_6.yaml +++ b/queries/aws_rds_db_recommendation_6.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n issue_details -> 'PerformanceIssueDetails'\ - \ ->> 'Analysis' as analysis,\n issue_details -> 'PerformanceIssueDetails' ->>\ - \ 'EndTime' as end_time,\n issue_details -> 'PerformanceIssueDetails' ->> 'StartTime'\ - \ as start_time,\n issue_details -> 'PerformanceIssueDetails' -> 'Metrics' as\ - \ metrics\nfrom\n aws_rds_db_recommendation\nwhere\n issue_details is not null;" + QueryToExecute: | + SELECT + recommendation_id, + issue_details -> 'PerformanceIssueDetails' ->> 'Analysis' AS analysis, + issue_details -> 'PerformanceIssueDetails' ->> 'EndTime' AS end_time, + issue_details -> 'PerformanceIssueDetails' ->> 'StartTime' AS start_time, + issue_details -> 'PerformanceIssueDetails' -> 'Metrics' AS metrics + FROM + aws_rds_db_recommendation + WHERE + issue_details IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS DB Recommendation -Title: Find AWS RDS DB Recommendations and Their Statuses + - RDS DB Recommendation +Title: Find AWS RDS DB Recommendations and Their Statuses \ No newline at end of file diff --git a/queries/aws_rds_db_recommendation_7.yaml b/queries/aws_rds_db_recommendation_7.yaml old mode 100755 new mode 100644 index 35d6dce4b..205c73bda --- a/queries/aws_rds_db_recommendation_7.yaml +++ b/queries/aws_rds_db_recommendation_7.yaml @@ -1,27 +1,34 @@ -Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable - information about each recommendation''s status, impact, and suggested actions. +Description: Allows users to query AWS RDS DB Recommendations and retrieve valuable information about each recommendation's status, impact, and suggested actions. ID: aws_rds_db_recommendation_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n recommendation_id,\n action ->> 'Title' as title,\n\ - \ action ->> 'Status' as status,\n action ->> 'ActionId' as action_id,\n action\ - \ ->> 'Operation' as operation,\n action -> 'ApplyModes' as apply_modes,\n action\ - \ -> 'Parameters' as parameters,\n action ->> 'Description' as description,\n\ - \ action ->> 'IssueDetails' as issue_details,\n action -> 'ContextAttributes'\ - \ as context_attributes\nfrom\n aws_rds_db_recommendation,\n jsonb_array_elements(recommended_actions)\ - \ as action;" + QueryToExecute: | + SELECT + recommendation_id, + action ->> 'Title' AS title, + action ->> 'Status' AS status, + action ->> 'ActionId' AS action_id, + action ->> 'Operation' AS operation, + action -> 'ApplyModes' AS apply_modes, + action -> 'Parameters' AS parameters, + action ->> 'Description' AS description, + action ->> 'IssueDetails' AS issue_details, + action -> 'ContextAttributes' AS context_attributes + FROM + aws_rds_db_recommendation, + jsonb_array_elements(recommended_actions) AS action; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find all AWS RDS DB recommendation statuses and actions + - RDS +Title: Find all AWS RDS DB recommendation statuses and actions \ No newline at end of file diff --git a/queries/aws_rds_db_snapshot_1.yaml b/queries/aws_rds_db_snapshot_1.yaml old mode 100755 new mode 100644 index 24dac02cd..2ca22a728 --- a/queries/aws_rds_db_snapshot_1.yaml +++ b/queries/aws_rds_db_snapshot_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Amazon RDS DB Snapshots for information regarding - manual and automatic snapshots of an Amazon RDS DB instance. +Description: Allows users to query Amazon RDS DB Snapshots for information regarding manual and automatic snapshots of an Amazon RDS DB instance. ID: aws_rds_db_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_snapshot_identifier,\n encrypted\nfrom\n aws_rds_db_snapshot\n\ - where\n not encrypted;" + QueryToExecute: | + SELECT + db_snapshot_identifier, + encrypted + FROM + aws_rds_db_snapshot + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find Non-encrypted RDS DB Snapshots for AWS + - Amazon RDS +Title: Find Non-encrypted RDS DB Snapshots for AWS \ No newline at end of file diff --git a/queries/aws_rds_db_snapshot_2.yaml b/queries/aws_rds_db_snapshot_2.yaml old mode 100755 new mode 100644 index 5c698f4ad..daabef3b3 --- a/queries/aws_rds_db_snapshot_2.yaml +++ b/queries/aws_rds_db_snapshot_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Amazon RDS DB Snapshots for information regarding - manual and automatic snapshots of an Amazon RDS DB instance. +Description: Allows users to query Amazon RDS DB Snapshots for information regarding manual and automatic snapshots of an Amazon RDS DB instance. ID: aws_rds_db_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_snapshot_identifier,\n type\nfrom\n aws_rds_db_snapshot\n\ - where\n type = 'manual';" + QueryToExecute: | + SELECT + db_snapshot_identifier, + type + FROM + aws_rds_db_snapshot + WHERE + type = 'manual'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List Amazon RDS DB manual snapshots + - Amazon RDS +Title: List Amazon RDS DB manual snapshots \ No newline at end of file diff --git a/queries/aws_rds_db_snapshot_3.yaml b/queries/aws_rds_db_snapshot_3.yaml old mode 100755 new mode 100644 index 0553c9119..673e6ba8e --- a/queries/aws_rds_db_snapshot_3.yaml +++ b/queries/aws_rds_db_snapshot_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Amazon RDS DB Snapshots for information regarding - manual and automatic snapshots of an Amazon RDS DB instance. +Description: Allows users to query Amazon RDS DB Snapshots for information regarding manual and automatic snapshots of an Amazon RDS DB instance. ID: aws_rds_db_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_snapshot_identifier,\n encrypted\nfrom\n aws_rds_db_snapshot\n\ - where\n not encrypted;" + QueryToExecute: | + SELECT + db_snapshot_identifier, + encrypted + FROM + aws_rds_db_snapshot + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: Find Information on Amazon RDS DB Snapshots + - Amazon RDS +Title: Find Information on Amazon RDS DB Snapshots \ No newline at end of file diff --git a/queries/aws_rds_db_snapshot_4.yaml b/queries/aws_rds_db_snapshot_4.yaml old mode 100755 new mode 100644 index 6c29b752b..ead5a25c2 --- a/queries/aws_rds_db_snapshot_4.yaml +++ b/queries/aws_rds_db_snapshot_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Amazon RDS DB Snapshots for information regarding - manual and automatic snapshots of an Amazon RDS DB instance. +Description: Allows users to query Amazon RDS DB Snapshots for information regarding manual and automatic snapshots of an Amazon RDS DB instance. ID: aws_rds_db_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n db_snapshot_identifier,\n db_instance_identifier,\n\ - \ engine,\n engine_version,\n allocated_storage,\n storage_type\nfrom\n aws_rds_db_snapshot;" + QueryToExecute: | + SELECT + db_snapshot_identifier, + db_instance_identifier, + engine, + engine_version, + allocated_storage, + storage_type + FROM + aws_rds_db_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List Amazon RDS DB Snapshots Information + - RDS +Title: List Amazon RDS DB Snapshots Information \ No newline at end of file diff --git a/queries/aws_rds_db_subnet_group_1.yaml b/queries/aws_rds_db_subnet_group_1.yaml old mode 100755 new mode 100644 index fb8336ca6..9606c293b --- a/queries/aws_rds_db_subnet_group_1.yaml +++ b/queries/aws_rds_db_subnet_group_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information - about each DB subnet group configured in an AWS account. +Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information about each DB subnet group configured in an AWS account. ID: aws_rds_db_subnet_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n status,\n vpc_id\nfrom\n aws_rds_db_subnet_group;" + QueryToExecute: | + SELECT + name, + status, + vpc_id + FROM + aws_rds_db_subnet_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Query AWS RDS DB Subnet Groups Information + - RDS +Title: Query AWS RDS DB Subnet Groups Information \ No newline at end of file diff --git a/queries/aws_rds_db_subnet_group_2.yaml b/queries/aws_rds_db_subnet_group_2.yaml old mode 100755 new mode 100644 index 986827eb1..dad8300ec --- a/queries/aws_rds_db_subnet_group_2.yaml +++ b/queries/aws_rds_db_subnet_group_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information - about each DB subnet group configured in an AWS account. +Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information about each DB subnet group configured in an AWS account. ID: aws_rds_db_subnet_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n subnet -> 'SubnetAvailabilityZone' ->> 'Name'\ - \ as subnet_availability_zone,\n subnet ->> 'SubnetIdentifier' as subnet_identifier,\n\ - \ subnet -> 'SubnetOutpost' ->> 'Arn' as subnet_outpost,\n subnet ->> 'SubnetStatus'\ - \ as subnet_status\nfrom\n aws_rds_db_subnet_group\n cross join jsonb_array_elements(subnets)\ - \ as subnet;" + QueryToExecute: | + SELECT + name, + subnet -> 'SubnetAvailabilityZone' ->> 'Name' AS subnet_availability_zone, + subnet ->> 'SubnetIdentifier' AS subnet_identifier, + subnet -> 'SubnetOutpost' ->> 'Arn' AS subnet_outpost, + subnet ->> 'SubnetStatus' AS subnet_status + FROM + aws_rds_db_subnet_group + CROSS JOIN + jsonb_array_elements(subnets) AS subnet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Subnet Groups Information + - RDS +Title: List all AWS RDS DB Subnet Groups Information \ No newline at end of file diff --git a/queries/aws_rds_db_subnet_group_3.yaml b/queries/aws_rds_db_subnet_group_3.yaml old mode 100755 new mode 100644 index 0125db8ae..a830aad30 --- a/queries/aws_rds_db_subnet_group_3.yaml +++ b/queries/aws_rds_db_subnet_group_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information - about each DB subnet group configured in an AWS account. +Description: Allows users to query AWS RDS DB Subnet Groups to retrieve information about each DB subnet group configured in an AWS account. ID: aws_rds_db_subnet_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tags\nfrom\n aws_rds_db_subnet_group\nwhere\n\ - \ not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + name, + tags + FROM + aws_rds_db_subnet_group + WHERE + NOT tags :: JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS DB Subnet Groups + - RDS +Title: List all AWS RDS DB Subnet Groups \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_1.yaml b/queries/aws_rds_reserved_db_instance_1.yaml old mode 100755 new mode 100644 index e652c20c8..7157430b6 --- a/queries/aws_rds_reserved_db_instance_1.yaml +++ b/queries/aws_rds_reserved_db_instance_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class\nfrom\n aws_rds_reserved_db_instance;" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class + FROM + aws_rds_reserved_db_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List AWS RDS Reserved DB Instances and Details + - RDS +Title: List AWS RDS Reserved DB Instances and Details \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_2.yaml b/queries/aws_rds_reserved_db_instance_2.yaml old mode 100755 new mode 100644 index 258bf4ab8..7d087d69e --- a/queries/aws_rds_reserved_db_instance_2.yaml +++ b/queries/aws_rds_reserved_db_instance_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class\nfrom\n aws_rds_reserved_db_instance\nwhere\n not multi_az;" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class + FROM + aws_rds_reserved_db_instance + WHERE + NOT multi_az; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS Reserved DB Instances + - RDS +Title: List all AWS RDS Reserved DB Instances \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_3.yaml b/queries/aws_rds_reserved_db_instance_3.yaml old mode 100755 new mode 100644 index e2c405f5c..7b321ca1f --- a/queries/aws_rds_reserved_db_instance_3.yaml +++ b/queries/aws_rds_reserved_db_instance_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class\nfrom\n aws_rds_reserved_db_instance\nwhere\n offering_type\ - \ = 'All Upfront';" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class + FROM + aws_rds_reserved_db_instance + WHERE + offering_type = 'All Upfront'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: Find all RDS Reserved DB Instances with Costs and Status + - RDS +Title: Find all RDS Reserved DB Instances with Costs and Status \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_4.yaml b/queries/aws_rds_reserved_db_instance_4.yaml old mode 100755 new mode 100644 index f1943a1b0..a8047802c --- a/queries/aws_rds_reserved_db_instance_4.yaml +++ b/queries/aws_rds_reserved_db_instance_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class\nfrom\n aws_rds_reserved_db_instance\norder by\n duration\ - \ desc;" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class + FROM + aws_rds_reserved_db_instance + ORDER BY + duration DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all Reserved DB Instances in AWS RDS + - RDS +Title: List all Reserved DB Instances in AWS RDS \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_5.yaml b/queries/aws_rds_reserved_db_instance_5.yaml old mode 100755 new mode 100644 index f28c0ee58..b1a45d2c5 --- a/queries/aws_rds_reserved_db_instance_5.yaml +++ b/queries/aws_rds_reserved_db_instance_5.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class,\n usage_price\nfrom\n aws_rds_reserved_db_instance\norder\ - \ by\n usage_price desc;" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class, + usage_price + FROM + aws_rds_reserved_db_instance + ORDER BY + usage_price DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - RDS -Title: List all AWS RDS Reserved DB Instances and Details + - RDS +Title: List all AWS RDS Reserved DB Instances and Details \ No newline at end of file diff --git a/queries/aws_rds_reserved_db_instance_6.yaml b/queries/aws_rds_reserved_db_instance_6.yaml old mode 100755 new mode 100644 index aa01a7361..2545e440d --- a/queries/aws_rds_reserved_db_instance_6.yaml +++ b/queries/aws_rds_reserved_db_instance_6.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query RDS Reserved DB Instances in AWS, providing details - such as reservation status, instance type, duration, and associated costs. +Description: Allows users to query RDS Reserved DB Instances in AWS, providing details such as reservation status, instance type, duration, and associated costs. ID: aws_rds_reserved_db_instance_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n reserved_db_instance_id,\n arn,\n reserved_db_instances_offering_id,\n\ - \ state,\n class,\n usage_price\nfrom\n aws_rds_reserved_db_instance\nwhere\n\ - \ state <> 'active';" + QueryToExecute: | + SELECT + reserved_db_instance_id, + arn, + reserved_db_instances_offering_id, + state, + class, + usage_price + FROM + aws_rds_reserved_db_instance + WHERE + state <> 'active'; Tags: cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon RDS -Title: List all AWS RDS Reserved DB Instances with details and costs + - Amazon RDS +Title: List all AWS RDS Reserved DB Instances with details and costs \ No newline at end of file diff --git a/queries/aws_redshift_cluster_1.yaml b/queries/aws_redshift_cluster_1.yaml old mode 100755 new mode 100644 index 788036b05..09a58f7f2 --- a/queries/aws_redshift_cluster_1.yaml +++ b/queries/aws_redshift_cluster_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive - information about each cluster, including its configuration, status, performance, - and security settings. +Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive information about each cluster, including its configuration, status, performance, and security settings. ID: aws_redshift_cluster_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n arn,\n node_type,\n region\n\ - from\n aws_redshift_cluster;" + QueryToExecute: | + SELECT + cluster_identifier, + arn, + node_type, + region + FROM + aws_redshift_cluster; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Redshift -Title: List all AWS Redshift Clusters including Configurations + - AWS Redshift +Title: List all AWS Redshift Clusters including Configurations \ No newline at end of file diff --git a/queries/aws_redshift_cluster_2.yaml b/queries/aws_redshift_cluster_2.yaml old mode 100755 new mode 100644 index cd17098c4..e61f2e9da --- a/queries/aws_redshift_cluster_2.yaml +++ b/queries/aws_redshift_cluster_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive - information about each cluster, including its configuration, status, performance, - and security settings. +Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive information about each cluster, including its configuration, status, performance, and security settings. ID: aws_redshift_cluster_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n node_type,\n number_of_nodes,\n\ - \ publicly_accessible\nfrom\n aws_redshift_cluster\nwhere\n publicly_accessible;" + QueryToExecute: | + SELECT + cluster_identifier, + node_type, + number_of_nodes, + publicly_accessible + FROM + aws_redshift_cluster + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find all AWS Redshift Clusters with Configuration Details + - Redshift +Title: Find all AWS Redshift Clusters with Configuration Details \ No newline at end of file diff --git a/queries/aws_redshift_cluster_3.yaml b/queries/aws_redshift_cluster_3.yaml old mode 100755 new mode 100644 index 8fd741031..ac601c475 --- a/queries/aws_redshift_cluster_3.yaml +++ b/queries/aws_redshift_cluster_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive - information about each cluster, including its configuration, status, performance, - and security settings. +Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive information about each cluster, including its configuration, status, performance, and security settings. ID: aws_redshift_cluster_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n node_type,\n number_of_nodes,\n\ - \ vpc_id\nfrom\n aws_redshift_cluster\nwhere\n vpc_id is null;" + QueryToExecute: | + SELECT + cluster_identifier, + node_type, + number_of_nodes, + vpc_id + FROM + aws_redshift_cluster + WHERE + vpc_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find AWS Redshift Cluster Configurations and Details + - Redshift +Title: Find AWS Redshift Cluster Configurations and Details \ No newline at end of file diff --git a/queries/aws_redshift_cluster_4.yaml b/queries/aws_redshift_cluster_4.yaml old mode 100755 new mode 100644 index b3fc563cd..ebdf583dd --- a/queries/aws_redshift_cluster_4.yaml +++ b/queries/aws_redshift_cluster_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive - information about each cluster, including its configuration, status, performance, - and security settings. +Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive information about each cluster, including its configuration, status, performance, and security settings. ID: aws_redshift_cluster_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n node_type,\n number_of_nodes,\n\ - \ encrypted\nfrom\n aws_redshift_cluster\nwhere\n not encrypted;" + QueryToExecute: | + SELECT + cluster_identifier, + node_type, + number_of_nodes, + encrypted + FROM + aws_redshift_cluster + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Clusters and list configurations + - Redshift +Title: List all AWS Redshift Clusters and list configurations \ No newline at end of file diff --git a/queries/aws_redshift_cluster_5.yaml b/queries/aws_redshift_cluster_5.yaml old mode 100755 new mode 100644 index 2236ded5c..a0b14371d --- a/queries/aws_redshift_cluster_5.yaml +++ b/queries/aws_redshift_cluster_5.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive - information about each cluster, including its configuration, status, performance, - and security settings. +Description: Allows users to query AWS Redshift Clusters and retrieve comprehensive information about each cluster, including its configuration, status, performance, and security settings. ID: aws_redshift_cluster_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n logging_status -> 'LoggingEnabled'\ - \ as LoggingEnabled\nfrom\n aws_redshift_cluster" + QueryToExecute: | + SELECT + cluster_identifier, + logging_status -> 'LoggingEnabled' AS LoggingEnabled + FROM + aws_redshift_cluster Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Clusters and Their Status + - Redshift +Title: List all AWS Redshift Clusters and Their Status \ No newline at end of file diff --git a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_1.yaml b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_1.yaml old mode 100755 new mode 100644 index 5997a2e61..b79792ba9 --- a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_1.yaml +++ b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on - a daily basis. +Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on a daily basis. ID: aws_redshift_cluster_metric_cpu_utilization_daily_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_redshift_cluster_metric_cpu_utilization_daily\n\ - order by\n cluster_identifier,\n timestamp;" + QueryToExecute: | + SELECT + cluster_identifier, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_redshift_cluster_metric_cpu_utilization_daily + ORDER BY + cluster_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List AWS Redshift CPU Utilization Metrics by day + - Redshift +Title: List AWS Redshift CPU Utilization Metrics by day \ No newline at end of file diff --git a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_2.yaml b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_2.yaml old mode 100755 new mode 100644 index 026046e32..f1afc884b --- a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_2.yaml +++ b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on - a daily basis. +Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on a daily basis. ID: aws_redshift_cluster_metric_cpu_utilization_daily_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_redshift_cluster_metric_cpu_utilization_daily\n\ - where average > 80\norder by\n cluster_identifier,\n timestamp;" + QueryToExecute: | + SELECT + cluster_identifier, + timestamp, + ROUND(MINIMUM::numeric, 2) AS min_cpu, + ROUND(MAXIMUM::numeric, 2) AS max_cpu, + ROUND(AVERAGE::numeric, 2) AS avg_cpu, + sample_count + FROM + aws_redshift_cluster_metric_cpu_utilization_daily + WHERE + AVERAGE > 80 + ORDER BY + cluster_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find Daily AWS Redshift Cluster High CPU Utilization + - Redshift +Title: Find Daily AWS Redshift Cluster High CPU Utilization \ No newline at end of file diff --git a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_3.yaml b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_3.yaml old mode 100755 new mode 100644 index df58e7c90..ea61b5fe2 --- a/queries/aws_redshift_cluster_metric_cpu_utilization_daily_3.yaml +++ b/queries/aws_redshift_cluster_metric_cpu_utilization_daily_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on - a daily basis. +Description: Allows users to query AWS Redshift Cluster CPU Utilization Metrics on a daily basis. ID: aws_redshift_cluster_metric_cpu_utilization_daily_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_identifier,\n timestamp,\n round(minimum::numeric,2)\ - \ as min_cpu,\n round(maximum::numeric,2) as max_cpu,\n round(average::numeric,2)\ - \ as avg_cpu,\n sample_count\nfrom\n aws_redshift_cluster_metric_cpu_utilization_daily\n\ - where average < 2\norder by\n cluster_identifier,\n timestamp;" + QueryToExecute: | + SELECT + cluster_identifier, + timestamp, + ROUND(MINIMUM::NUMERIC, 2) AS min_cpu, + ROUND(MAXIMUM::NUMERIC, 2) AS max_cpu, + ROUND(AVERAGE::NUMERIC, 2) AS avg_cpu, + sample_count + FROM + aws_redshift_cluster_metric_cpu_utilization_daily + WHERE + AVERAGE < 2 + ORDER BY + cluster_identifier, + timestamp; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List AWS Redshift Cluster CPU Utilization Metrics Daily + - Redshift +Title: List AWS Redshift Cluster CPU Utilization Metrics Daily \ No newline at end of file diff --git a/queries/aws_redshift_event_subscription_1.yaml b/queries/aws_redshift_event_subscription_1.yaml old mode 100755 new mode 100644 index 2bfc6eae9..282de5ee0 --- a/queries/aws_redshift_event_subscription_1.yaml +++ b/queries/aws_redshift_event_subscription_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Redshift Event Subscriptions, providing insights - into the subscription''s configuration, status, and associated Redshift clusters. +Description: Allows users to query AWS Redshift Event Subscriptions, providing insights into the subscription's configuration, status, and associated Redshift clusters. ID: aws_redshift_event_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cust_subscription_id,\n customer_aws_id,\n status,\n\ - \ sns_topic_arn,\n subscription_creation_time\nfrom\n aws_redshift_event_subscription;" + QueryToExecute: | + SELECT + cust_subscription_id, + customer_aws_id, + status, + sns_topic_arn, + subscription_creation_time + FROM + aws_redshift_event_subscription; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List All AWS Redshift Event Subscription Configurations + - Redshift +Title: List All AWS Redshift Event Subscription Configurations \ No newline at end of file diff --git a/queries/aws_redshift_event_subscription_2.yaml b/queries/aws_redshift_event_subscription_2.yaml old mode 100755 new mode 100644 index 663201da1..8c4b99399 --- a/queries/aws_redshift_event_subscription_2.yaml +++ b/queries/aws_redshift_event_subscription_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Redshift Event Subscriptions, providing insights - into the subscription''s configuration, status, and associated Redshift clusters. +Description: Allows users to query AWS Redshift Event Subscriptions, providing insights into the subscription's configuration, status, and associated Redshift clusters. ID: aws_redshift_event_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cust_subscription_id,\n customer_aws_id,\n status,\n\ - \ enabled,\n sns_topic_arn,\n subscription_creation_time\nfrom\n aws_redshift_event_subscription\n\ - where\n enabled is false;" + QueryToExecute: | + SELECT + cust_subscription_id, + customer_aws_id, + status, + enabled, + sns_topic_arn, + subscription_creation_time + FROM + aws_redshift_event_subscription + WHERE + enabled IS false; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find all AWS Redshift Event Subscriptions + - Redshift +Title: Find all AWS Redshift Event Subscriptions \ No newline at end of file diff --git a/queries/aws_redshift_event_subscription_3.yaml b/queries/aws_redshift_event_subscription_3.yaml old mode 100755 new mode 100644 index 59b00c588..dd519b319 --- a/queries/aws_redshift_event_subscription_3.yaml +++ b/queries/aws_redshift_event_subscription_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Redshift Event Subscriptions, providing insights - into the subscription''s configuration, status, and associated Redshift clusters. +Description: Allows users to query AWS Redshift Event Subscriptions, providing insights into the subscription's configuration, status, and associated Redshift clusters. ID: aws_redshift_event_subscription_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cust_subscription_id,\n severity,\n source_type,\n\ - \ event_categories_list,\n source_ids_list\nfrom\n aws_redshift_event_subscription;" + QueryToExecute: | + SELECT + cust_subscription_id, + severity, + source_type, + event_categories_list, + source_ids_list + FROM + aws_redshift_event_subscription; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Event Subscriptions and Their Configurations + - Redshift +Title: List all AWS Redshift Event Subscriptions and Their Configurations \ No newline at end of file diff --git a/queries/aws_redshift_event_subscription_4.yaml b/queries/aws_redshift_event_subscription_4.yaml old mode 100755 new mode 100644 index 84b89f1d6..d4755e543 --- a/queries/aws_redshift_event_subscription_4.yaml +++ b/queries/aws_redshift_event_subscription_4.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Redshift Event Subscriptions, providing insights - into the subscription''s configuration, status, and associated Redshift clusters. +Description: Allows users to query AWS Redshift Event Subscriptions, providing insights into the subscription's configuration, status, and associated Redshift clusters. ID: aws_redshift_event_subscription_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.cust_subscription_id,\n e.status,\n s.kms_master_key_id,\n\ - \ s.topic_arn as arn\nfrom\n aws_redshift_event_subscription as e\n join aws_sns_topic\ - \ as s on s.topic_arn = e.sns_topic_arn\nwhere\n s.kms_master_key_id is null;" + QueryToExecute: | + SELECT + e.cust_subscription_id, + e.status, + s.kms_master_key_id, + s.topic_arn AS arn + FROM + aws_redshift_event_subscription AS e + JOIN + aws_sns_topic AS s + ON s.topic_arn = e.sns_topic_arn + WHERE + s.kms_master_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Redshift -Title: Find AWS Redshift Event Subscriptions with Configuration and Status + - AWS Redshift +Title: Find AWS Redshift Event Subscriptions with Configuration and Status \ No newline at end of file diff --git a/queries/aws_redshift_parameter_group_1.yaml b/queries/aws_redshift_parameter_group_1.yaml old mode 100755 new mode 100644 index 4676a03e0..7ec08acc5 --- a/queries/aws_redshift_parameter_group_1.yaml +++ b/queries/aws_redshift_parameter_group_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query Amazon Redshift Parameter Groups to obtain detailed - information about the configuration parameters and settings for Redshift clusters. - This can be useful for managing and optimizing the performance of Redshift databases. +Description: Allows users to query Amazon Redshift Parameter Groups to obtain detailed information about the configuration parameters and settings for Redshift clusters. This can be useful for managing and optimizing the performance of Redshift databases. ID: aws_redshift_parameter_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n family\nfrom\n aws_redshift_parameter_group;" + QueryToExecute: | + SELECT + name, + description, + family + FROM + aws_redshift_parameter_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Redshift -Title: List all Amazon Redshift Parameter Groups configuration settings + - Amazon Redshift +Title: List all Amazon Redshift Parameter Groups configuration settings \ No newline at end of file diff --git a/queries/aws_redshift_parameter_group_2.yaml b/queries/aws_redshift_parameter_group_2.yaml old mode 100755 new mode 100644 index f9cb3dc57..43c65c18d --- a/queries/aws_redshift_parameter_group_2.yaml +++ b/queries/aws_redshift_parameter_group_2.yaml @@ -1,27 +1,35 @@ -Description: Allows users to query Amazon Redshift Parameter Groups to obtain detailed - information about the configuration parameters and settings for Redshift clusters. - This can be useful for managing and optimizing the performance of Redshift databases. +Description: Allows users to query Amazon Redshift Parameter Groups to obtain detailed information about the configuration parameters and settings for Redshift clusters. This can be useful for managing and optimizing the performance of Redshift databases. ID: aws_redshift_parameter_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p ->> 'ParameterName' as parameter_name,\n \ - \ p ->> 'ParameterValue' as parameter_value,\n p ->> 'Description' as description,\n\ - \ p ->> 'Source' as source,\n p ->> 'DataType' as data_type,\n p ->> 'ApplyType'\ - \ as apply_type,\n p ->> 'IsModifiable' as is_modifiable,\n p ->> 'AllowedValues'\ - \ as allowed_values,\n p ->> 'MinimumEngineVersion' as minimum_engine_version\n\ - from\n aws_redshift_parameter_group,\n jsonb_array_elements(parameters) as p\n\ - where\n p ->> 'ParameterName' = 'require_ssl'\n and p ->> 'ParameterValue' =\ - \ 'false';" + QueryToExecute: | + SELECT + name, + p ->> 'ParameterName' AS parameter_name, + p ->> 'ParameterValue' AS parameter_value, + p ->> 'Description' AS description, + p ->> 'Source' AS source, + p ->> 'DataType' AS data_type, + p ->> 'ApplyType' AS apply_type, + p ->> 'IsModifiable' AS is_modifiable, + p ->> 'AllowedValues' AS allowed_values, + p ->> 'MinimumEngineVersion' AS minimum_engine_version + FROM + aws_redshift_parameter_group, + jsonb_array_elements(parameters) AS p + WHERE + p ->> 'ParameterName' = 'require_ssl' + AND p ->> 'ParameterValue' = 'false'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Redshift -Title: Find Amazon Redshift Parameter Groups Configuration + - Amazon Redshift +Title: Find Amazon Redshift Parameter Groups Configuration \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_1.yaml b/queries/aws_redshift_snapshot_1.yaml old mode 100755 new mode 100644 index 7d1e0ef2c..9be102346 --- a/queries/aws_redshift_snapshot_1.yaml +++ b/queries/aws_redshift_snapshot_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n cluster_identifier,\n node_type,\n\ - \ encrypted\nfrom\n aws_redshift_snapshot;" + QueryToExecute: | + SELECT + snapshot_identifier, + cluster_identifier, + node_type, + encrypted + FROM + aws_redshift_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List AWS Redshift Snapshots with Their Configuration + - Redshift +Title: List AWS Redshift Snapshots with Their Configuration \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_2.yaml b/queries/aws_redshift_snapshot_2.yaml old mode 100755 new mode 100644 index f7e11ad5b..69ead6553 --- a/queries/aws_redshift_snapshot_2.yaml +++ b/queries/aws_redshift_snapshot_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n snapshot_type\nfrom\n aws_redshift_snapshot\n\ - where\n snapshot_type = 'manual';" + QueryToExecute: | + SELECT + snapshot_identifier, + snapshot_type + FROM + aws_redshift_snapshot + WHERE + snapshot_type = 'manual'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Snapshots with Configuration Details + - Redshift +Title: List all AWS Redshift Snapshots with Configuration Details \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_3.yaml b/queries/aws_redshift_snapshot_3.yaml old mode 100755 new mode 100644 index df1c75596..b3830f99a --- a/queries/aws_redshift_snapshot_3.yaml +++ b/queries/aws_redshift_snapshot_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n cluster_identifier,\n node_type,\n\ - \ number_of_nodes,\n encrypted\nfrom\n aws_redshift_snapshot\nwhere\n not\ - \ encrypted;" + QueryToExecute: | + SELECT + snapshot_identifier, + cluster_identifier, + node_type, + number_of_nodes, + encrypted + FROM + aws_redshift_snapshot + WHERE + NOT encrypted; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List All AWS Redshift Snapshots Configuration and Status + - Redshift +Title: List All AWS Redshift Snapshots Configuration and Status \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_4.yaml b/queries/aws_redshift_snapshot_4.yaml old mode 100755 new mode 100644 index 69731d307..7c852a54a --- a/queries/aws_redshift_snapshot_4.yaml +++ b/queries/aws_redshift_snapshot_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n cluster_identifier,\n number_of_nodes,\n\ - \ cluster_version,\n engine_full_version,\n restorable_node_types\nfrom\n \ - \ aws_redshift_snapshot;" + QueryToExecute: | + SELECT + snapshot_identifier, + cluster_identifier, + number_of_nodes, + cluster_version, + engine_full_version, + restorable_node_types + FROM + aws_redshift_snapshot; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Snapshots with Details + - Redshift +Title: List all AWS Redshift Snapshots with Details \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_5.yaml b/queries/aws_redshift_snapshot_5.yaml old mode 100755 new mode 100644 index 3d74d5a4f..9dcc098b4 --- a/queries/aws_redshift_snapshot_5.yaml +++ b/queries/aws_redshift_snapshot_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n accounts_with_restore_access\n\ - from\n aws_redshift_snapshot\nwhere\n accounts_with_restore_access is not null;" + QueryToExecute: | + SELECT + snapshot_identifier, + accounts_with_restore_access + FROM + aws_redshift_snapshot + WHERE + accounts_with_restore_access IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find AWS Redshift Snapshots and Restore Access Details + - Redshift +Title: Find AWS Redshift Snapshots and Restore Access Details \ No newline at end of file diff --git a/queries/aws_redshift_snapshot_6.yaml b/queries/aws_redshift_snapshot_6.yaml old mode 100755 new mode 100644 index 8ca8fd6d2..ec8848837 --- a/queries/aws_redshift_snapshot_6.yaml +++ b/queries/aws_redshift_snapshot_6.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query Redshift Snapshots, providing details about each - snapshot''s configuration, status, and associated metadata. +Description: Allows users to query Redshift Snapshots, providing details about each snapshot's configuration, status, and associated metadata. ID: aws_redshift_snapshot_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n snapshot_identifier,\n p ->> 'AccountId' as account_id,\n\ - \ p ->> 'AccountAlias' as account_alias\nfrom\n aws_redshift_snapshot,\n jsonb_array_elements(accounts_with_restore_access)\ - \ as p;" + QueryToExecute: | + SELECT + snapshot_identifier, + p ->> 'AccountId' AS account_id, + p ->> 'AccountAlias' AS account_alias + FROM + aws_redshift_snapshot, + jsonb_array_elements(accounts_with_restore_access) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Snapshots with details + - Redshift +Title: List all AWS Redshift Snapshots with details \ No newline at end of file diff --git a/queries/aws_redshift_subnet_group_1.yaml b/queries/aws_redshift_subnet_group_1.yaml old mode 100755 new mode 100644 index 1b1714a11..36d1a1db2 --- a/queries/aws_redshift_subnet_group_1.yaml +++ b/queries/aws_redshift_subnet_group_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Redshift Subnet Groups and get detailed information - about each subnet group, including its name, description, VPC ID, subnet IDs, and - status. +Description: Allows users to query AWS Redshift Subnet Groups and get detailed information about each subnet group, including its name, description, VPC ID, subnet IDs, and status. ID: aws_redshift_subnet_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_subnet_group_name,\n description,\n subnet_group_status,\n\ - \ vpc_id\nfrom\n aws_redshift_subnet_group;" + QueryToExecute: | + SELECT + cluster_subnet_group_name, + description, + subnet_group_status, + vpc_id + FROM + aws_redshift_subnet_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: List all AWS Redshift Subnet Groups and their details + - Redshift +Title: List all AWS Redshift Subnet Groups and their details \ No newline at end of file diff --git a/queries/aws_redshift_subnet_group_2.yaml b/queries/aws_redshift_subnet_group_2.yaml old mode 100755 new mode 100644 index 7ea9d716a..3099507df --- a/queries/aws_redshift_subnet_group_2.yaml +++ b/queries/aws_redshift_subnet_group_2.yaml @@ -1,26 +1,29 @@ -Description: Allows users to query AWS Redshift Subnet Groups and get detailed information - about each subnet group, including its name, description, VPC ID, subnet IDs, and - status. +Description: Allows users to query AWS Redshift Subnet Groups and get detailed information about each subnet group, including its name, description, VPC ID, subnet IDs, and status. ID: aws_redshift_subnet_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_subnet_group_name,\n subnet -> 'SubnetAvailabilityZone'\ - \ ->> 'Name' as subnet_availability_zone,\n subnet -> 'SubnetAvailabilityZone'\ - \ ->> 'SupportedPlatforms' as supported_platforms,\n subnet ->> 'SubnetIdentifier'\ - \ as subnet_identifier,\n subnet ->> 'SubnetStatus' as subnet_status\nfrom\n\ - \ aws_redshift_subnet_group,\n jsonb_array_elements(subnets) as subnet;" + QueryToExecute: | + SELECT + cluster_subnet_group_name, + subnet -> 'SubnetAvailabilityZone' ->> 'Name' AS subnet_availability_zone, + subnet -> 'SubnetAvailabilityZone' ->> 'SupportedPlatforms' AS supported_platforms, + subnet ->> 'SubnetIdentifier' AS subnet_identifier, + subnet ->> 'SubnetStatus' AS subnet_status + FROM + aws_redshift_subnet_group, + jsonb_array_elements(subnets) AS subnet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find AWS Redshift Subnet Group Details and Status + - Redshift +Title: Find AWS Redshift Subnet Group Details and Status \ No newline at end of file diff --git a/queries/aws_redshift_subnet_group_3.yaml b/queries/aws_redshift_subnet_group_3.yaml old mode 100755 new mode 100644 index 7f4168184..1d6fb4e54 --- a/queries/aws_redshift_subnet_group_3.yaml +++ b/queries/aws_redshift_subnet_group_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Redshift Subnet Groups and get detailed information - about each subnet group, including its name, description, VPC ID, subnet IDs, and - status. +Description: Allows users to query AWS Redshift Subnet Groups and get detailed information about each subnet group, including its name, description, VPC ID, subnet IDs, and status. ID: aws_redshift_subnet_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n cluster_subnet_group_name,\n tags\nfrom\n aws_redshift_subnet_group\n\ - where\n not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + cluster_subnet_group_name, + tags + FROM + aws_redshift_subnet_group + WHERE + NOT tags::JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift -Title: Find AWS Redshift Subnet Groups and Their Details + - Redshift +Title: Find AWS Redshift Subnet Groups and Their Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_namespace_1.yaml b/queries/aws_redshiftserverless_namespace_1.yaml old mode 100755 new mode 100644 index 94d447a2f..13063f948 --- a/queries/aws_redshiftserverless_namespace_1.yaml +++ b/queries/aws_redshiftserverless_namespace_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Redshift Serverless Namespace data. This table - provides information about each namespace within an AWS Redshift Serverless cluster. - It allows DevOps engineers to query namespace-specific details, including the namespace - ARN, creation date, and associated metadata. +Description: Allows users to query AWS Redshift Serverless Namespace data. This table provides information about each namespace within an AWS Redshift Serverless cluster. It allows DevOps engineers to query namespace-specific details, including the namespace ARN, creation date, and associated metadata. ID: aws_redshiftserverless_namespace_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n namespace_name,\n namespace_arn,\n namespace_id,\n\ - \ creation_date,\n db_name,\n region,\n status\nfrom\n aws_redshiftserverless_namespace;" + QueryToExecute: | + SELECT + namespace_name, + namespace_arn, + namespace_id, + creation_date, + db_name, + region, + status + FROM + aws_redshiftserverless_namespace; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List AWS Redshift Serverless Namespace Details + - Redshift Serverless +Title: List AWS Redshift Serverless Namespace Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_namespace_2.yaml b/queries/aws_redshiftserverless_namespace_2.yaml old mode 100755 new mode 100644 index 8f36f84b9..67cad3788 --- a/queries/aws_redshiftserverless_namespace_2.yaml +++ b/queries/aws_redshiftserverless_namespace_2.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS Redshift Serverless Namespace data. This table - provides information about each namespace within an AWS Redshift Serverless cluster. - It allows DevOps engineers to query namespace-specific details, including the namespace - ARN, creation date, and associated metadata. +Description: Allows users to query AWS Redshift Serverless Namespace data. This table provides information about each namespace within an AWS Redshift Serverless cluster. It allows DevOps engineers to query namespace-specific details, including the namespace ARN, creation date, and associated metadata. ID: aws_redshiftserverless_namespace_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n namespace_name,\n namespace_arn,\n namespace_id,\n\ - \ creation_date,\n db_name,\n region,\n status\nfrom\n aws_redshiftserverless_namespace\n\ - where\n status <> 'AVAILABLE';" + QueryToExecute: | + SELECT + namespace_name, + namespace_arn, + namespace_id, + creation_date, + db_name, + region, + status + FROM + aws_redshiftserverless_namespace + WHERE + status <> 'AVAILABLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List AWS Redshift Serverless Namespace Details + - Redshift Serverless +Title: List AWS Redshift Serverless Namespace Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_namespace_3.yaml b/queries/aws_redshiftserverless_namespace_3.yaml old mode 100755 new mode 100644 index 9d271521f..5cbdfa792 --- a/queries/aws_redshiftserverless_namespace_3.yaml +++ b/queries/aws_redshiftserverless_namespace_3.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS Redshift Serverless Namespace data. This table - provides information about each namespace within an AWS Redshift Serverless cluster. - It allows DevOps engineers to query namespace-specific details, including the namespace - ARN, creation date, and associated metadata. +Description: Allows users to query AWS Redshift Serverless Namespace data. This table provides information about each namespace within an AWS Redshift Serverless cluster. It allows DevOps engineers to query namespace-specific details, including the namespace ARN, creation date, and associated metadata. ID: aws_redshiftserverless_namespace_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n namespace_name,\n namespace_arn,\n namespace_id,\n\ - \ creation_date,\n db_name,\n region,\n status\nfrom\n aws_redshiftserverless_namespace\n\ - where\n kms_key_id is null;" + QueryToExecute: | + SELECT + namespace_name, + namespace_arn, + namespace_id, + creation_date, + db_name, + region, + status + FROM + aws_redshiftserverless_namespace + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List all AWS Redshift Serverless Namespace Data + - Redshift Serverless +Title: List all AWS Redshift Serverless Namespace Data \ No newline at end of file diff --git a/queries/aws_redshiftserverless_namespace_4.yaml b/queries/aws_redshiftserverless_namespace_4.yaml old mode 100755 new mode 100644 index a76095ae6..fe257be56 --- a/queries/aws_redshiftserverless_namespace_4.yaml +++ b/queries/aws_redshiftserverless_namespace_4.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Redshift Serverless Namespace data. This table - provides information about each namespace within an AWS Redshift Serverless cluster. - It allows DevOps engineers to query namespace-specific details, including the namespace - ARN, creation date, and associated metadata. +Description: Allows users to query AWS Redshift Serverless Namespace data. This table provides information about each namespace within an AWS Redshift Serverless cluster. It allows DevOps engineers to query namespace-specific details, including the namespace ARN, creation date, and associated metadata. ID: aws_redshiftserverless_namespace_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n namespace_name,\n namespace_arn,\n namespace_id,\n\ - \ creation_date,\n default_iam_role_arn\nfrom\n aws_redshiftserverless_namespace;" + QueryToExecute: | + SELECT + namespace_name, + namespace_arn, + namespace_id, + creation_date, + default_iam_role_arn + FROM + aws_redshiftserverless_namespace; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List AWS Redshift Serverless Namespace Details + - Redshift Serverless +Title: List AWS Redshift Serverless Namespace Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_1.yaml b/queries/aws_redshiftserverless_workgroup_1.yaml old mode 100755 new mode 100644 index 79f3180e1..cf4de970e --- a/queries/aws_redshiftserverless_workgroup_1.yaml +++ b/queries/aws_redshiftserverless_workgroup_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workgroup_name,\n workgroup_arn,\n workgroup_id,\n\ - \ base_capacity,\n creation_date,\n region,\n status\nfrom\n aws_redshiftserverless_workgroup;" + QueryToExecute: | + SELECT + workgroup_name, + workgroup_arn, + workgroup_id, + base_capacity, + creation_date, + region, + status + FROM + aws_redshiftserverless_workgroup; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List AWS Redshift Serverless Workgroup Details + - Redshift Serverless +Title: List AWS Redshift Serverless Workgroup Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_2.yaml b/queries/aws_redshiftserverless_workgroup_2.yaml old mode 100755 new mode 100644 index 6cb1355f6..69e9f05df --- a/queries/aws_redshiftserverless_workgroup_2.yaml +++ b/queries/aws_redshiftserverless_workgroup_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workgroup_name,\n workgroup_arn,\n workgroup_id,\n\ - \ base_capacity,\n creation_date,\n region,\n status\nfrom\n aws_redshiftserverless_workgroup\n\ - where\n status <> 'AVAILABLE';" + QueryToExecute: | + SELECT + workgroup_name, + workgroup_arn, + workgroup_id, + base_capacity, + creation_date, + region, + status + FROM + aws_redshiftserverless_workgroup + WHERE + status <> 'AVAILABLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List all AWS Redshift Serverless Workgroup details + - Redshift Serverless +Title: List all AWS Redshift Serverless Workgroup details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_3.yaml b/queries/aws_redshiftserverless_workgroup_3.yaml old mode 100755 new mode 100644 index eee09af35..207ff5261 --- a/queries/aws_redshiftserverless_workgroup_3.yaml +++ b/queries/aws_redshiftserverless_workgroup_3.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workgroup_name,\n workgroup_arn,\n workgroup_id,\n\ - \ base_capacity,\n creation_date,\n region,\n status\nfrom\n aws_redshiftserverless_workgroup\n\ - where\n publicly_accessible;" + QueryToExecute: | + SELECT + workgroup_name, + workgroup_arn, + workgroup_id, + base_capacity, + creation_date, + region, + status + FROM + aws_redshiftserverless_workgroup + WHERE + publicly_accessible; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List all AWS Redshift Serverless Workgroup Details + - Redshift Serverless +Title: List all AWS Redshift Serverless Workgroup Details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_4.yaml b/queries/aws_redshiftserverless_workgroup_4.yaml old mode 100755 new mode 100644 index d730ac6cc..88acf4068 --- a/queries/aws_redshiftserverless_workgroup_4.yaml +++ b/queries/aws_redshiftserverless_workgroup_4.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n sum(base_capacity) total_base_capacity\nfrom\n aws_redshiftserverless_workgroup\n\ - where\n status = 'AVAILABLE';" + QueryToExecute: | + SELECT + SUM(base_capacity) AS total_base_capacity + FROM + aws_redshiftserverless_workgroup + WHERE + status = 'AVAILABLE'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List all AWS Redshift Serverless Workgroup details + - Redshift Serverless +Title: List all AWS Redshift Serverless Workgroup details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_5.yaml b/queries/aws_redshiftserverless_workgroup_5.yaml old mode 100755 new mode 100644 index d7894c701..97ef12f81 --- a/queries/aws_redshiftserverless_workgroup_5.yaml +++ b/queries/aws_redshiftserverless_workgroup_5.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workgroup_arn,\n endpoint ->> 'Address' as endpoint_address,\n\ - \ endpoint ->> 'Port' as endpoint_port,\n endpoint -> 'VpcEndpoints' as endpoint_vpc_details\n\ - from\n aws_redshiftserverless_workgroup;" + QueryToExecute: | + SELECT + workgroup_arn, + endpoint ->> 'Address' AS endpoint_address, + endpoint ->> 'Port' AS endpoint_port, + endpoint -> 'VpcEndpoints' AS endpoint_vpc_details + FROM + aws_redshiftserverless_workgroup; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List all AWS Redshift Serverless Workgroup details + - Redshift Serverless +Title: List all AWS Redshift Serverless Workgroup details \ No newline at end of file diff --git a/queries/aws_redshiftserverless_workgroup_6.yaml b/queries/aws_redshiftserverless_workgroup_6.yaml old mode 100755 new mode 100644 index f021d6ae9..199789ec2 --- a/queries/aws_redshiftserverless_workgroup_6.yaml +++ b/queries/aws_redshiftserverless_workgroup_6.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Redshift Serverless Workgroup information, - including workgroup details, query execution settings, and enforce workgroup configuration. +Description: Allows users to query AWS Redshift Serverless Workgroup information, including workgroup details, query execution settings, and enforce workgroup configuration. ID: aws_redshiftserverless_workgroup_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workgroup_arn,\n p ->> 'ParameterKey' as parameter_key,\n\ - \ p ->> 'ParameterValue' as parameter_value\nfrom\n aws_redshiftserverless_workgroup,\n\ - \ jsonb_array_elements(config_parameters) p;" + QueryToExecute: | + SELECT + workgroup_arn, + p ->> 'ParameterKey' AS parameter_key, + p ->> 'ParameterValue' AS parameter_value + FROM + aws_redshiftserverless_workgroup, + JSONB_ARRAY_ELEMENTS(config_parameters) p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Redshift Serverless -Title: List All Details of AWS Redshift Serverless Workgroup + - Redshift Serverless +Title: List All Details of AWS Redshift Serverless Workgroup \ No newline at end of file diff --git a/queries/aws_region_1.yaml b/queries/aws_region_1.yaml old mode 100755 new mode 100644 index 5b47ca41b..1e5344987 --- a/queries/aws_region_1.yaml +++ b/queries/aws_region_1.yaml @@ -1,19 +1,23 @@ -Description: Allows users to query AWS Region to retrieve details about AWS regions - including their names, descriptions, and statuses. +Description: Allows users to query AWS Region to retrieve details about AWS regions including their names, descriptions, and statuses. ID: aws_region_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n opt_in_status\nfrom\n aws_region;" + QueryToExecute: | + SELECT + name, + opt_in_status + FROM + aws_region; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Regions -Title: List all AWS Region Details Including Names and Statuses + - AWS Regions +Title: List all AWS Region Details Including Names and Statuses \ No newline at end of file diff --git a/queries/aws_region_2.yaml b/queries/aws_region_2.yaml old mode 100755 new mode 100644 index 87db21dd6..fe7709de3 --- a/queries/aws_region_2.yaml +++ b/queries/aws_region_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Region to retrieve details about AWS regions - including their names, descriptions, and statuses. +Description: Allows users to query AWS Region to retrieve details about AWS regions including their names, descriptions, and statuses. ID: aws_region_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n opt_in_status\nfrom\n aws_region\nwhere\n \ - \ opt_in_status = 'not-opted-in';" + QueryToExecute: | + SELECT + name, + opt_in_status + FROM + aws_region + WHERE + opt_in_status = 'not-opted-in'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Region -Title: Find AWS Region Details and Statuses + - AWS Region +Title: Find AWS Region Details and Statuses \ No newline at end of file diff --git a/queries/aws_resource_explorer_index_1.yaml b/queries/aws_resource_explorer_index_1.yaml old mode 100755 new mode 100644 index b579d6a2b..c7aa1d8c2 --- a/queries/aws_resource_explorer_index_1.yaml +++ b/queries/aws_resource_explorer_index_1.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query AWS Resource Explorer Index, providing a comprehensive - view of all resources across different AWS services in a single table. +Description: Allows users to query AWS Resource Explorer Index, providing a comprehensive view of all resources across different AWS services in a single table. ID: aws_resource_explorer_index_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n type\nfrom\n aws_resource_explorer_index;" + QueryToExecute: | + SELECT + arn, + region, + type + FROM + aws_resource_explorer_index; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: List all resources across AWS services + - Resource Explorer +Title: List all resources across AWS services \ No newline at end of file diff --git a/queries/aws_resource_explorer_index_2.yaml b/queries/aws_resource_explorer_index_2.yaml old mode 100755 new mode 100644 index 091dd9839..05a819f40 --- a/queries/aws_resource_explorer_index_2.yaml +++ b/queries/aws_resource_explorer_index_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Resource Explorer Index, providing a comprehensive - view of all resources across different AWS services in a single table. +Description: Allows users to query AWS Resource Explorer Index, providing a comprehensive view of all resources across different AWS services in a single table. ID: aws_resource_explorer_index_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n type\nfrom\n aws_resource_explorer_index\n\ - where\n type = 'AGGREGATOR';" + QueryToExecute: | + SELECT + arn, + region, + type + FROM + aws_resource_explorer_index + WHERE + type = 'AGGREGATOR'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: List all AWS resources from Resource Explorer Index + - Resource Explorer +Title: List all AWS resources from Resource Explorer Index \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_1.yaml b/queries/aws_resource_explorer_search_1.yaml old mode 100755 new mode 100644 index 44b26113a..bcacca76c --- a/queries/aws_resource_explorer_search_1.yaml +++ b/queries/aws_resource_explorer_search_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search;" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: Find all AWS resources with details across services + - Resource Explorer +Title: Find all AWS resources with details across services \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_2.yaml b/queries/aws_resource_explorer_search_2.yaml old mode 100755 new mode 100644 index 5d440600b..ce3bfef70 --- a/queries/aws_resource_explorer_search_2.yaml +++ b/queries/aws_resource_explorer_search_2.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = '-service:iam';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = '-service:iam'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: Find AWS Resource Details with AWS Resource Explorer + - AWS Resource Explorer +Title: Find AWS Resource Details with AWS Resource Explorer \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_3.yaml b/queries/aws_resource_explorer_search_3.yaml old mode 100755 new mode 100644 index 040c2e405..e9a6ce35c --- a/queries/aws_resource_explorer_search_3.yaml +++ b/queries/aws_resource_explorer_search_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = '-service:iam region:us-*';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = '-service:iam region:us-*'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: List all AWS resources with detailed information + - Resource Explorer +Title: List all AWS resources with detailed information \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_4.yaml b/queries/aws_resource_explorer_search_4.yaml old mode 100755 new mode 100644 index 89b0efa11..45405089c --- a/queries/aws_resource_explorer_search_4.yaml +++ b/queries/aws_resource_explorer_search_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = 'resourcetype:iam:user';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = 'resourcetype:iam:user'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: List All AWS Resources in Resource Explorer + - Resource Explorer +Title: List All AWS Resources in Resource Explorer \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_5.yaml b/queries/aws_resource_explorer_search_5.yaml old mode 100755 new mode 100644 index 432e7245e..218512f51 --- a/queries/aws_resource_explorer_search_5.yaml +++ b/queries/aws_resource_explorer_search_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = '-tag:none';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = '-tag:none'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: List all Resources Across AWS Services + - AWS Resource Explorer +Title: List all Resources Across AWS Services \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_6.yaml b/queries/aws_resource_explorer_search_6.yaml old mode 100755 new mode 100644 index 7d6b4d813..23516b86a --- a/queries/aws_resource_explorer_search_6.yaml +++ b/queries/aws_resource_explorer_search_6.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = 'tag.key:environment';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = 'tag.key:environment'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: List all resources across AWS services + - AWS Resource Explorer +Title: List all resources across AWS services \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_7.yaml b/queries/aws_resource_explorer_search_7.yaml old mode 100755 new mode 100644 index 891a30788..159b933bd --- a/queries/aws_resource_explorer_search_7.yaml +++ b/queries/aws_resource_explorer_search_7.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n query = 'region:global';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + query = 'region:global'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: List all resources across AWS services + - AWS Resource Explorer +Title: List all resources across AWS services \ No newline at end of file diff --git a/queries/aws_resource_explorer_search_8.yaml b/queries/aws_resource_explorer_search_8.yaml old mode 100755 new mode 100644 index 33f4c1bf0..575b42988 --- a/queries/aws_resource_explorer_search_8.yaml +++ b/queries/aws_resource_explorer_search_8.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Resource Explorer to obtain a structured view - of all resources across AWS services. It provides detailed information about each - resource, including the service name, resource type, resource ID, and associated - tags. +Description: Allows users to query AWS Resource Explorer to obtain a structured view of all resources across AWS services. It provides detailed information about each resource, including the service name, resource type, resource ID, and associated tags. ID: aws_resource_explorer_search_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region,\n resource_type,\n service,\n owning_account_id\n\ - from\n aws_resource_explorer_search\nwhere\n view_arn = 'arn:aws:resource-explorer-2:ap-south-1:111122223333:view/view1/7c9e9845-4736-409f-9c0f-673fe7ce3e46';" + QueryToExecute: | + SELECT + arn, + region, + resource_type, + service, + owning_account_id + FROM + aws_resource_explorer_search + WHERE + view_arn = 'arn:aws:resource-explorer-2:ap-south-1:111122223333:view/view1/7c9e9845-4736-409f-9c0f-673fe7ce3e46'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: List all AWS resources with details using Resource Explorer + - AWS Resource Explorer +Title: List all AWS resources with details using Resource Explorer \ No newline at end of file diff --git a/queries/aws_resource_explorer_supported_resource_type_1.yaml b/queries/aws_resource_explorer_supported_resource_type_1.yaml old mode 100755 new mode 100644 index b1f203fe2..898b0027a --- a/queries/aws_resource_explorer_supported_resource_type_1.yaml +++ b/queries/aws_resource_explorer_supported_resource_type_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Resource Explorer Supported Resource Types - to obtain details about supported resource types for AWS Resource Groups. +Description: Allows users to query AWS Resource Explorer Supported Resource Types to obtain details about supported resource types for AWS Resource Groups. ID: aws_resource_explorer_supported_resource_type_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n resource_type\nfrom\n aws_resource_explorer_supported_resource_type;" + QueryToExecute: | + SELECT + service, + resource_type + FROM + aws_resource_explorer_supported_resource_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Explorer -Title: Find AWS Resource Explorer Supported Resource Types + - AWS Resource Explorer +Title: Find AWS Resource Explorer Supported Resource Types \ No newline at end of file diff --git a/queries/aws_resource_explorer_supported_resource_type_2.yaml b/queries/aws_resource_explorer_supported_resource_type_2.yaml old mode 100755 new mode 100644 index f6cdccece..1830cd630 --- a/queries/aws_resource_explorer_supported_resource_type_2.yaml +++ b/queries/aws_resource_explorer_supported_resource_type_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Resource Explorer Supported Resource Types - to obtain details about supported resource types for AWS Resource Groups. +Description: Allows users to query AWS Resource Explorer Supported Resource Types to obtain details about supported resource types for AWS Resource Groups. ID: aws_resource_explorer_supported_resource_type_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service,\n resource_type\nfrom\n aws_resource_explorer_supported_resource_type\n\ - where\n service = 'iam';" + QueryToExecute: | + SELECT + service, + resource_type + FROM + aws_resource_explorer_supported_resource_type + WHERE + service = 'iam'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Explorer -Title: Find supported AWS Resource Explorer types for Resource Groups + - Resource Explorer +Title: Find supported AWS Resource Explorer types for Resource Groups \ No newline at end of file diff --git a/queries/aws_route53_domain_1.yaml b/queries/aws_route53_domain_1.yaml old mode 100755 new mode 100644 index 9258266e1..5f85aa122 --- a/queries/aws_route53_domain_1.yaml +++ b/queries/aws_route53_domain_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Route 53 Domains for detailed information about - domain names, including their status, expiration date, and associated tags. +Description: Allows users to query AWS Route 53 Domains for detailed information about domain names, including their status, expiration date, and associated tags. ID: aws_route53_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n auto_renew,\n expiration_date\nfrom\n\ - \ aws_route53_domain;" + QueryToExecute: | + SELECT + domain_name, + auto_renew, + expiration_date + FROM + aws_route53_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find all AWS Route 53 Domains Information + - Route 53 +Title: Find all AWS Route 53 Domains Information \ No newline at end of file diff --git a/queries/aws_route53_domain_2.yaml b/queries/aws_route53_domain_2.yaml old mode 100755 new mode 100644 index 302850b88..e4549d64c --- a/queries/aws_route53_domain_2.yaml +++ b/queries/aws_route53_domain_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Route 53 Domains for detailed information about - domain names, including their status, expiration date, and associated tags. +Description: Allows users to query AWS Route 53 Domains for detailed information about domain names, including their status, expiration date, and associated tags. ID: aws_route53_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n auto_renew,\n expiration_date\nfrom\n\ - \ aws_route53_domain\nwhere\n auto_renew;" + QueryToExecute: | + SELECT + domain_name, + auto_renew, + expiration_date + FROM + aws_route53_domain + WHERE + auto_renew; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Domains with Details + - Route 53 +Title: List all AWS Route 53 Domains with Details \ No newline at end of file diff --git a/queries/aws_route53_domain_3.yaml b/queries/aws_route53_domain_3.yaml old mode 100755 new mode 100644 index 0caeed980..1d1475806 --- a/queries/aws_route53_domain_3.yaml +++ b/queries/aws_route53_domain_3.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Route 53 Domains for detailed information about - domain names, including their status, expiration date, and associated tags. +Description: Allows users to query AWS Route 53 Domains for detailed information about domain names, including their status, expiration date, and associated tags. ID: aws_route53_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n domain_name,\n expiration_date,\n transfer_lock\nfrom\n\ - \ aws_route53_domain\nwhere\n transfer_lock;" + QueryToExecute: | + SELECT + domain_name, + expiration_date, + transfer_lock + FROM + aws_route53_domain + WHERE + transfer_lock; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Domains with Transfer Lock Status + - Route 53 +Title: Find AWS Route 53 Domains with Transfer Lock Status \ No newline at end of file diff --git a/queries/aws_route53_health_check_1.yaml b/queries/aws_route53_health_check_1.yaml old mode 100755 new mode 100644 index 8a2777a41..747bfae08 --- a/queries/aws_route53_health_check_1.yaml +++ b/queries/aws_route53_health_check_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n akas,\n id,\n health_check_version,\n health_check_config\n\ - from \n aws_route53_health_check;" + QueryToExecute: | + SELECT + akas, + id, + health_check_version, + health_check_config + FROM + aws_route53_health_check; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all Health Check Details in AWS Route 53 + - Route 53 +Title: List all Health Check Details in AWS Route 53 \ No newline at end of file diff --git a/queries/aws_route53_health_check_2.yaml b/queries/aws_route53_health_check_2.yaml old mode 100755 new mode 100644 index 0b4539236..881507daf --- a/queries/aws_route53_health_check_2.yaml +++ b/queries/aws_route53_health_check_2.yaml @@ -1,28 +1,32 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n health_check_version,\n cloud_watch_alarm_configuration\ - \ ->> 'ComparisonOperator' as cloud_watch_comparison_operator,\n cloud_watch_alarm_configuration\ - \ ->> 'Dimensions' as cloud_watch_dimensions,\n cloud_watch_alarm_configuration\ - \ ->> 'EvaluationPeriods' as cloud_watch_evaluation_periods,\n cloud_watch_alarm_configuration\ - \ ->> 'MetricName' as cloud_watch_metric_name,\n cloud_watch_alarm_configuration\ - \ ->> 'Period' as cloud_watch_period,\n cloud_watch_alarm_configuration ->> 'Statistic'\ - \ as cloud_watch_statistic,\n cloud_watch_alarm_configuration ->> 'Threshold'\ - \ as cloud_watch_threshold\nfrom \n aws_route53_health_check\nwhere\n cloud_watch_alarm_configuration\ - \ is not null;" + QueryToExecute: | + SELECT + id, + health_check_version, + cloud_watch_alarm_configuration ->> 'ComparisonOperator' AS cloud_watch_comparison_operator, + cloud_watch_alarm_configuration ->> 'Dimensions' AS cloud_watch_dimensions, + cloud_watch_alarm_configuration ->> 'EvaluationPeriods' AS cloud_watch_evaluation_periods, + cloud_watch_alarm_configuration ->> 'MetricName' AS cloud_watch_metric_name, + cloud_watch_alarm_configuration ->> 'Period' AS cloud_watch_period, + cloud_watch_alarm_configuration ->> 'Statistic' AS cloud_watch_statistic, + cloud_watch_alarm_configuration ->> 'Threshold' AS cloud_watch_threshold + FROM + aws_route53_health_check + WHERE + cloud_watch_alarm_configuration IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Health Check Data and Configuration + - Route 53 +Title: List all AWS Route 53 Health Check Data and Configuration \ No newline at end of file diff --git a/queries/aws_route53_health_check_3.yaml b/queries/aws_route53_health_check_3.yaml old mode 100755 new mode 100644 index 8452e9e29..e0d42c93c --- a/queries/aws_route53_health_check_3.yaml +++ b/queries/aws_route53_health_check_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n health_check_version,\n linked_service_description,\n\ - \ linked_service_principal\nfrom \n aws_route53_health_check\nwhere\n linked_service_description\ - \ is not null;" + QueryToExecute: | + SELECT + id, + health_check_version, + linked_service_description, + linked_service_principal + FROM + aws_route53_health_check + WHERE + linked_service_description IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Health Check Configuration and Status + - Route 53 +Title: Find AWS Route 53 Health Check Configuration and Status \ No newline at end of file diff --git a/queries/aws_route53_health_check_4.yaml b/queries/aws_route53_health_check_4.yaml old mode 100755 new mode 100644 index 559e2d68e..00fd01ae1 --- a/queries/aws_route53_health_check_4.yaml +++ b/queries/aws_route53_health_check_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n health_check_version,\n health_check_config ->>\ - \ 'Disabled' as disabled\nfrom \n aws_route53_health_check \nwhere\n cast(health_check_config\ - \ ->> 'Disabled' as boolean);" + QueryToExecute: | + SELECT + id, + health_check_version, + health_check_config ->> 'Disabled' AS disabled + FROM + aws_route53_health_check + WHERE + CAST(health_check_config ->> 'Disabled' AS BOOLEAN); Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Route 53 -Title: List all AWS Route 53 Health Check using SQL + - AWS Route 53 +Title: List all AWS Route 53 Health Check using SQL \ No newline at end of file diff --git a/queries/aws_route53_health_check_5.yaml b/queries/aws_route53_health_check_5.yaml old mode 100755 new mode 100644 index 9807ad894..a5fe1c842 --- a/queries/aws_route53_health_check_5.yaml +++ b/queries/aws_route53_health_check_5.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n health_check_version,\n health_check_config ->>\ - \ 'FullyQualifiedDomainName' as fully_qualified_domain_name,\n health_check_config\ - \ ->> 'IPAddress' as ip_address,\n health_check_config ->> 'Port' as port,\n\ - \ health_check_config ->> 'Type' as type,\n health_check_config ->> 'RequestInterval'\ - \ as request_interval\nfrom \n aws_route53_health_check;" + QueryToExecute: | + SELECT + id, + health_check_version, + health_check_config ->> 'FullyQualifiedDomainName' AS fully_qualified_domain_name, + health_check_config ->> 'IPAddress' AS ip_address, + health_check_config ->> 'Port' AS port, + health_check_config ->> 'Type' AS type, + health_check_config ->> 'RequestInterval' AS request_interval + FROM + aws_route53_health_check; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Health Check Configuration Details + - Route 53 +Title: Find AWS Route 53 Health Check Configuration Details \ No newline at end of file diff --git a/queries/aws_route53_health_check_6.yaml b/queries/aws_route53_health_check_6.yaml old mode 100755 new mode 100644 index 1722e3887..34e53d793 --- a/queries/aws_route53_health_check_6.yaml +++ b/queries/aws_route53_health_check_6.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n health_check_version,\n health_check_config ->>\ - \ 'FullyQualifiedDomainName' as fully_qualified_domain_name,\n health_check_config\ - \ ->> 'IPAddress' as ip_address,\n health_check_config ->> 'Port' as port,\n\ - \ health_check_config ->> 'Type' as type,\n health_check_config ->> 'RequestInterval'\ - \ as request_interval,\n health_check_config ->> 'AlarmIdentifier' as alarm_identifier\n\ - from \n aws_route53_health_check\nwhere\n health_check_config ->> 'AlarmIdentifier'\ - \ is not null;" + QueryToExecute: | + SELECT + id, + health_check_version, + health_check_config ->> 'FullyQualifiedDomainName' AS fully_qualified_domain_name, + health_check_config ->> 'IPAddress' AS ip_address, + health_check_config ->> 'Port' AS port, + health_check_config ->> 'Type' AS type, + health_check_config ->> 'RequestInterval' AS request_interval, + health_check_config ->> 'AlarmIdentifier' AS alarm_identifier + FROM + aws_route53_health_check + WHERE + health_check_config ->> 'AlarmIdentifier' IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Health Check Details and Status + - Route 53 +Title: Find AWS Route 53 Health Check Details and Status \ No newline at end of file diff --git a/queries/aws_route53_health_check_7.yaml b/queries/aws_route53_health_check_7.yaml old mode 100755 new mode 100644 index b81e2c3f4..97873522d --- a/queries/aws_route53_health_check_7.yaml +++ b/queries/aws_route53_health_check_7.yaml @@ -1,27 +1,33 @@ -Description: Allows users to query AWS Route 53 Health Check data, providing information - about health checks within AWS Route 53. This includes details such as health check - configuration, health check status, and associated metadata. +Description: Allows users to query AWS Route 53 Health Check data, providing information about health checks within AWS Route 53. This includes details such as health check configuration, health check status, and associated metadata. ID: aws_route53_health_check_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.id,\n r.health_check_version,\n hc ->> 'IPAddress'\ - \ as ip_address,\n hc ->> 'Region' as region,\n hc-> 'StatusReport' as status_report\n\ - from \n aws_route53_health_check as r,\n jsonb_array_elements(health_check_status)\ - \ hc \nwhere \n hc-> 'StatusReport' ->> 'Status' not like '%Success%';" + QueryToExecute: | + SELECT + r.id, + r.health_check_version, + hc ->> 'IPAddress' AS ip_address, + hc ->> 'Region' AS region, + hc -> 'StatusReport' AS status_report + FROM + aws_route53_health_check AS r, + jsonb_array_elements(health_check_status) hc + WHERE + hc-> 'StatusReport' ->> 'Status' NOT LIKE '%Success%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Health Check Details + - Route 53 +Title: Find AWS Route 53 Health Check Details \ No newline at end of file diff --git a/queries/aws_route53_query_log_1.yaml b/queries/aws_route53_query_log_1.yaml old mode 100755 new mode 100644 index 88b8642c2..89293a19e --- a/queries/aws_route53_query_log_1.yaml +++ b/queries/aws_route53_query_log_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Route 53 Query Log data, providing insights - into DNS queries made to Route 53 hosted zones. +Description: Allows users to query AWS Route 53 Query Log data, providing insights into DNS queries made to Route 53 hosted zones. ID: aws_route53_query_log_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n hosted_zone_id,\n cloud_watch_logs_log_group_arn,\n\ - \ title,\n akas\nfrom\n aws_route53_query_log;" + QueryToExecute: | + SELECT + id, + hosted_zone_id, + cloud_watch_logs_log_group_arn, + title, + akas + FROM + aws_route53_query_log; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Query Log DNS queries + - Route 53 +Title: List all AWS Route 53 Query Log DNS queries \ No newline at end of file diff --git a/queries/aws_route53_query_log_2.yaml b/queries/aws_route53_query_log_2.yaml old mode 100755 new mode 100644 index 4c7aa5b81..5adee0152 --- a/queries/aws_route53_query_log_2.yaml +++ b/queries/aws_route53_query_log_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Route 53 Query Log data, providing insights - into DNS queries made to Route 53 hosted zones. +Description: Allows users to query AWS Route 53 Query Log data, providing insights into DNS queries made to Route 53 hosted zones. ID: aws_route53_query_log_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n l.id,\n l.hosted_zone_id,\n z.private_zone,\n z.resource_record_set_count\n\ - from\n aws_route53_query_log as l,\n aws_route53_zone as z\nwhere\n z.id =\ - \ l.hosted_zone_id;" + QueryToExecute: | + SELECT + l.id, + l.hosted_zone_id, + z.private_zone, + z.resource_record_set_count + FROM + aws_route53_query_log AS l, + aws_route53_zone AS z + WHERE + z.id = l.hosted_zone_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Query Log Data with SQL + - Route 53 +Title: Find AWS Route 53 Query Log Data with SQL \ No newline at end of file diff --git a/queries/aws_route53_query_log_3.yaml b/queries/aws_route53_query_log_3.yaml old mode 100755 new mode 100644 index 17944197b..2a628e906 --- a/queries/aws_route53_query_log_3.yaml +++ b/queries/aws_route53_query_log_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Route 53 Query Log data, providing insights - into DNS queries made to Route 53 hosted zones. +Description: Allows users to query AWS Route 53 Query Log data, providing insights into DNS queries made to Route 53 hosted zones. ID: aws_route53_query_log_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hosted_zone_id,\n count(id)\nfrom\n aws_route53_query_log\n\ - group by\n hosted_zone_id;" + QueryToExecute: | + SELECT + hosted_zone_id, + COUNT(id) + FROM + aws_route53_query_log + GROUP BY + hosted_zone_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all DNS Queries from AWS Route 53 Query Log + - Route 53 +Title: List all DNS Queries from AWS Route 53 Query Log \ No newline at end of file diff --git a/queries/aws_route53_record_1.yaml b/queries/aws_route53_record_1.yaml old mode 100755 new mode 100644 index 7156375a7..44b8c1f4a --- a/queries/aws_route53_record_1.yaml +++ b/queries/aws_route53_record_1.yaml @@ -1,25 +1,27 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n type,\n records,\n alias_target\nfrom\n aws_route53_record;" + QueryToExecute: | + SELECT + name, + type, + records, + alias_target + FROM + aws_route53_record; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Record Details Using SQL + - Route 53 +Title: Find AWS Route 53 Record Details Using SQL \ No newline at end of file diff --git a/queries/aws_route53_record_2.yaml b/queries/aws_route53_record_2.yaml old mode 100755 new mode 100644 index 6847900ae..5d3cae383 --- a/queries/aws_route53_record_2.yaml +++ b/queries/aws_route53_record_2.yaml @@ -1,26 +1,29 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n r.type,\n record\nfrom\n aws_route53_record\ - \ as r,\n jsonb_array_elements_text(records) as record\nwhere\n name = 'test.com.';" + QueryToExecute: | + SELECT + r.name, + r.type, + record + FROM + aws_route53_record AS r, + jsonb_array_elements_text(records) AS record + WHERE + name = 'test.com.'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 DNS -Title: Find AWS Route 53 DNS Records with Steampipe SQL + - Route 53 DNS +Title: Find AWS Route 53 DNS Records with Steampipe SQL \ No newline at end of file diff --git a/queries/aws_route53_record_3.yaml b/queries/aws_route53_record_3.yaml old mode 100755 new mode 100644 index 9d51c6053..8680bbf98 --- a/queries/aws_route53_record_3.yaml +++ b/queries/aws_route53_record_3.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n r.type,\n record\nfrom\n aws_route53_record\ - \ as r,\n jsonb_array_elements_text(records) as record\nwhere\n r.type = 'NS';" + QueryToExecute: | + SELECT + r.name, + r.type, + record + FROM + aws_route53_record AS r, + jsonb_array_elements_text(records) AS record + WHERE + r.type = 'NS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find DNS Records with AWS Route 53 Using Steampipe + - Route 53 +Title: Find DNS Records with AWS Route 53 Using Steampipe \ No newline at end of file diff --git a/queries/aws_route53_record_4.yaml b/queries/aws_route53_record_4.yaml old mode 100755 new mode 100644 index 5455ae333..bf7eb467b --- a/queries/aws_route53_record_4.yaml +++ b/queries/aws_route53_record_4.yaml @@ -1,27 +1,30 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.name,\n r.type,\n record\nfrom\n aws_route53_record\ - \ as r,\n jsonb_array_elements_text(records) as record\nwhere\n r.name = 'test.com.'\n\ - \ and r.type = 'NS';" + QueryToExecute: | + SELECT + r.name, + r.type, + record + FROM + aws_route53_record AS r, + jsonb_array_elements_text(records) AS record + WHERE + r.name = 'test.com.' + AND r.type = 'NS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 DNS Record Details + - Route 53 +Title: List AWS Route 53 DNS Record Details \ No newline at end of file diff --git a/queries/aws_route53_record_5.yaml b/queries/aws_route53_record_5.yaml old mode 100755 new mode 100644 index fb570cb45..a95a38284 --- a/queries/aws_route53_record_5.yaml +++ b/queries/aws_route53_record_5.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n type,\n count(*)\nfrom\n aws_route53_record\ngroup\ - \ by\n type\norder by\n count desc;" + QueryToExecute: | + SELECT + type, + COUNT(*) + FROM + aws_route53_record + GROUP BY + type + ORDER BY + COUNT DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find DNS Record Details in AWS Route 53 + - Route 53 +Title: Find DNS Record Details in AWS Route 53 \ No newline at end of file diff --git a/queries/aws_route53_record_6.yaml b/queries/aws_route53_record_6.yaml old mode 100755 new mode 100644 index 97954105c..8c5eeb0d4 --- a/queries/aws_route53_record_6.yaml +++ b/queries/aws_route53_record_6.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n type,\n records,\n alias_target,\n geo_location\ - \ ->> 'ContinentCode' as continent,\n geo_location ->> 'CountryCode' as country,\n\ - \ geo_location ->> 'SubdivisionCode' as subdivision\nfrom\n aws_route53_record\n\ - where\n geo_location is not null\norder by\n name;" + QueryToExecute: | + SELECT + name, + type, + records, + alias_target, + geo_location ->> 'ContinentCode' AS continent, + geo_location ->> 'CountryCode' AS country, + geo_location ->> 'SubdivisionCode' AS subdivision + FROM + aws_route53_record + WHERE + geo_location IS NOT NULL + ORDER BY + name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - DNS -Title: List all DNS records in AWS Route 53 using SQL + - DNS +Title: List all DNS records in AWS Route 53 using SQL \ No newline at end of file diff --git a/queries/aws_route53_record_7.yaml b/queries/aws_route53_record_7.yaml old mode 100755 new mode 100644 index 70a75588a..0eb48b152 --- a/queries/aws_route53_record_7.yaml +++ b/queries/aws_route53_record_7.yaml @@ -1,27 +1,30 @@ -Description: Allows users to query Route 53 DNS records within Amazon Web Services. - The `aws_route53_record` table in Steampipe provides information about DNS records - within AWS Route 53. This table allows DevOps engineers to query record-specific - details, including type, name, TTL, and associated metadata. Users can utilize this - table to gather insights on DNS records, such as record types, verification of TTL - values, and more. +Description: Allows users to query Route 53 DNS records within Amazon Web Services. The `aws_route53_record` table in Steampipe provides information about DNS records within AWS Route 53. This table allows DevOps engineers to query record-specific details, including type, name, TTL, and associated metadata. Users can utilize this table to gather insights on DNS records, such as record types, verification of TTL values, and more. ID: aws_route53_record_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n type,\n count(*)\nfrom\n aws_route53_record\n\ - \ left join jsonb_array_elements_text(records) as record on true\ngroup by\n\ - \ name,\n type;" + QueryToExecute: | + SELECT + name, + type, + COUNT(*) + FROM + aws_route53_record + LEFT JOIN jsonb_array_elements_text(records) AS record ON true + GROUP BY + name, + type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find all DNS Records in AWS Route 53 + - Route 53 +Title: Find all DNS Records in AWS Route 53 \ No newline at end of file diff --git a/queries/aws_route53_resolver_endpoint_1.yaml b/queries/aws_route53_resolver_endpoint_1.yaml old mode 100755 new mode 100644 index a516b3f84..fc9009b2d --- a/queries/aws_route53_resolver_endpoint_1.yaml +++ b/queries/aws_route53_resolver_endpoint_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed - information about each endpoint, including its ID, direction, IP addresses, and - status, among other details. +Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed information about each endpoint, including its ID, direction, IP addresses, and status, among other details. ID: aws_route53_resolver_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n direction,\n ip_address_count\n status\n\ - from\n aws_route53_resolver_endpoint;" + QueryToExecute: | + SELECT + name, + id, + direction, + ip_address_count, + status + FROM + aws_route53_resolver_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 Resolver -Title: List all AWS Route 53 Resolver Endpoints with Details + - Route 53 Resolver +Title: List all AWS Route 53 Resolver Endpoints with Details \ No newline at end of file diff --git a/queries/aws_route53_resolver_endpoint_2.yaml b/queries/aws_route53_resolver_endpoint_2.yaml old mode 100755 new mode 100644 index 041f2b64c..46d1a119c --- a/queries/aws_route53_resolver_endpoint_2.yaml +++ b/queries/aws_route53_resolver_endpoint_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed - information about each endpoint, including its ID, direction, IP addresses, and - status, among other details. +Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed information about each endpoint, including its ID, direction, IP addresses, and status, among other details. ID: aws_route53_resolver_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n direction,\n ip_address_count\n status\n\ - from\n aws_route53_resolver_endpoint\nwhere\n id = 'rslvr-out-ebb7db0b7498463eb';" + QueryToExecute: | + SELECT + name, + id, + direction, + ip_address_count, + status + FROM + aws_route53_resolver_endpoint + WHERE + id = 'rslvr-out-ebb7db0b7498463eb'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 Resolver Endpoints with Details + - Route 53 +Title: List AWS Route 53 Resolver Endpoints with Details \ No newline at end of file diff --git a/queries/aws_route53_resolver_endpoint_3.yaml b/queries/aws_route53_resolver_endpoint_3.yaml old mode 100755 new mode 100644 index d3e6e6bb0..533300efa --- a/queries/aws_route53_resolver_endpoint_3.yaml +++ b/queries/aws_route53_resolver_endpoint_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed - information about each endpoint, including its ID, direction, IP addresses, and - status, among other details. +Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed information about each endpoint, including its ID, direction, IP addresses, and status, among other details. ID: aws_route53_resolver_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n direction,\n status,\n status_message\n\ - from\n aws_route53_resolver_endpoint\nwhere\n status = 'ACTION_NEEDED';" + QueryToExecute: | + SELECT + name, + id, + direction, + status, + status_message + FROM + aws_route53_resolver_endpoint + WHERE + status = 'ACTION_NEEDED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 Resolver -Title: List all AWS Route 53 Resolver Endpoints Needing Action + - Route 53 Resolver +Title: List all AWS Route 53 Resolver Endpoints Needing Action \ No newline at end of file diff --git a/queries/aws_route53_resolver_endpoint_4.yaml b/queries/aws_route53_resolver_endpoint_4.yaml old mode 100755 new mode 100644 index cbf54c292..39e447080 --- a/queries/aws_route53_resolver_endpoint_4.yaml +++ b/queries/aws_route53_resolver_endpoint_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed - information about each endpoint, including its ID, direction, IP addresses, and - status, among other details. +Description: Allows users to query AWS Route 53 Resolver Endpoints, providing detailed information about each endpoint, including its ID, direction, IP addresses, and status, among other details. ID: aws_route53_resolver_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p ->> 'Ip' as ip,\n p ->> 'Status' as status,\n\ - \ p ->> 'SubnetId' as subnet_id\nfrom\n aws_route53_resolver_endpoint,\n jsonb_array_elements(ip_addresses)\ - \ as p;" + QueryToExecute: | + SELECT + name, + p ->> 'Ip' AS ip, + p ->> 'Status' AS status, + p ->> 'SubnetId' AS subnet_id + FROM + aws_route53_resolver_endpoint, + jsonb_array_elements(ip_addresses) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List All AWS Route 53 Resolver Endpoints and Details + - Route 53 +Title: List All AWS Route 53 Resolver Endpoints and Details \ No newline at end of file diff --git a/queries/aws_route53_resolver_query_log_config_1.yaml b/queries/aws_route53_resolver_query_log_config_1.yaml old mode 100755 new mode 100644 index 1b430f93a..775ccda6d --- a/queries/aws_route53_resolver_query_log_config_1.yaml +++ b/queries/aws_route53_resolver_query_log_config_1.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Route 53 Resolver Query Log Configurations. ID: aws_route53_resolver_query_log_config_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n creation_time,\n share_status,\n\ - \ status\nfrom\n aws_route53_resolver_query_log_config;" + QueryToExecute: | + SELECT + name, + id, + arn, + creation_time, + share_status, + status + FROM + aws_route53_resolver_query_log_config; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find Route 53 Resolver Query Log Configurations + - Route 53 +Title: Find Route 53 Resolver Query Log Configurations \ No newline at end of file diff --git a/queries/aws_route53_resolver_query_log_config_2.yaml b/queries/aws_route53_resolver_query_log_config_2.yaml old mode 100755 new mode 100644 index dc0bc3b64..95a172dd3 --- a/queries/aws_route53_resolver_query_log_config_2.yaml +++ b/queries/aws_route53_resolver_query_log_config_2.yaml @@ -1,24 +1,34 @@ Description: Allows users to query AWS Route 53 Resolver Query Log Configurations. ID: aws_route53_resolver_query_log_config_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n creation_time,\n share_status,\n\ - \ status,\n destination_arn\nfrom\n aws_route53_resolver_query_log_config\n\ - where\n owner_id <> account_id;" + QueryToExecute: | + SELECT + name, + id, + arn, + creation_time, + share_status, + status, + destination_arn + FROM + aws_route53_resolver_query_log_config + WHERE + owner_id <> account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 + - Route 53 cloud_traffic_analytics: - - 'true' -Title: List all AWS Route 53 Resolver Query Log Configurations + - "true" +Title: List all AWS Route 53 Resolver Query Log Configurations \ No newline at end of file diff --git a/queries/aws_route53_resolver_query_log_config_3.yaml b/queries/aws_route53_resolver_query_log_config_3.yaml old mode 100755 new mode 100644 index 8a61b60df..708cf16c5 --- a/queries/aws_route53_resolver_query_log_config_3.yaml +++ b/queries/aws_route53_resolver_query_log_config_3.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Route 53 Resolver Query Log Configurations. ID: aws_route53_resolver_query_log_config_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n creator_request_id,\n destination_arn\n\ - from\n aws_route53_resolver_query_log_config\nwhere\n status = 'FAILED';" + QueryToExecute: | + SELECT + name, + id, + creator_request_id, + destination_arn + FROM + aws_route53_resolver_query_log_config + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Resolver Query Log Configurations + - Route 53 +Title: Find AWS Route 53 Resolver Query Log Configurations \ No newline at end of file diff --git a/queries/aws_route53_resolver_query_log_config_4.yaml b/queries/aws_route53_resolver_query_log_config_4.yaml old mode 100755 new mode 100644 index fb5cb931b..cbde1af56 --- a/queries/aws_route53_resolver_query_log_config_4.yaml +++ b/queries/aws_route53_resolver_query_log_config_4.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Route 53 Resolver Query Log Configurations. ID: aws_route53_resolver_query_log_config_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n share_status,\n association_count\n\ - from\n aws_route53_resolver_query_log_config\nwhere\n share_status = 'SHARED';" + QueryToExecute: | + SELECT + name, + id, + share_status, + association_count + FROM + aws_route53_resolver_query_log_config + WHERE + share_status = 'SHARED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Resolver Query Log Configurations + - Route 53 +Title: Find AWS Route 53 Resolver Query Log Configurations \ No newline at end of file diff --git a/queries/aws_route53_resolver_query_log_config_5.yaml b/queries/aws_route53_resolver_query_log_config_5.yaml old mode 100755 new mode 100644 index f9b9c495b..c854bff59 --- a/queries/aws_route53_resolver_query_log_config_5.yaml +++ b/queries/aws_route53_resolver_query_log_config_5.yaml @@ -1,20 +1,28 @@ Description: Allows users to query AWS Route 53 Resolver Query Log Configurations. ID: aws_route53_resolver_query_log_config_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n creation_time,\n destination_arn,\n\ - \ status\nfrom\n aws_route53_resolver_query_log_config\nwhere\n creation_time\ - \ >= now() - interval '30' day;" + QueryToExecute: | + SELECT + name, + id, + creation_time, + destination_arn, + status + FROM + aws_route53_resolver_query_log_config + WHERE + creation_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Resolver Query Log Configurations + - Route 53 +Title: Find AWS Route 53 Resolver Query Log Configurations \ No newline at end of file diff --git a/queries/aws_route53_resolver_rule_1.yaml b/queries/aws_route53_resolver_rule_1.yaml old mode 100755 new mode 100644 index 423b2f98e..bb7978874 --- a/queries/aws_route53_resolver_rule_1.yaml +++ b/queries/aws_route53_resolver_rule_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS - resolver rules configured in an AWS account. +Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS resolver rules configured in an AWS account. ID: aws_route53_resolver_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n domain_name owner_id,\n resolver_endpoint_id,\n\ - \ rule_type,\n share_status,\n status\nfrom\n aws_route53_resolver_rule;" + QueryToExecute: | + SELECT + name, + domain_name AS owner_id, + resolver_endpoint_id, + rule_type, + share_status, + status + FROM + aws_route53_resolver_rule; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Resolver Rules + - Route 53 +Title: List all AWS Route 53 Resolver Rules \ No newline at end of file diff --git a/queries/aws_route53_resolver_rule_2.yaml b/queries/aws_route53_resolver_rule_2.yaml old mode 100755 new mode 100644 index ed775c9cc..73cebff01 --- a/queries/aws_route53_resolver_rule_2.yaml +++ b/queries/aws_route53_resolver_rule_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS - resolver rules configured in an AWS account. +Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS resolver rules configured in an AWS account. ID: aws_route53_resolver_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n resolver_rule_associations\n\ - from\n aws_route53_resolver_rule\nWhere\n resolver_rule_associations = '[]';" + QueryToExecute: | + SELECT + name, + id, + arn, + resolver_rule_associations + FROM + aws_route53_resolver_rule + WHERE + resolver_rule_associations = '[]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find Route 53 Resolver Rules Configured in AWS Account + - Route 53 +Title: Find Route 53 Resolver Rules Configured in AWS Account \ No newline at end of file diff --git a/queries/aws_route53_resolver_rule_3.yaml b/queries/aws_route53_resolver_rule_3.yaml old mode 100755 new mode 100644 index cfcf4cb16..0f1161d00 --- a/queries/aws_route53_resolver_rule_3.yaml +++ b/queries/aws_route53_resolver_rule_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS - resolver rules configured in an AWS account. +Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS resolver rules configured in an AWS account. ID: aws_route53_resolver_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p ->> 'Ip' as ip,\n p ->> 'Port' as port\n\ - from\n aws_route53_resolver_rule,\n jsonb_array_elements(target_ips) as p;" + QueryToExecute: | + SELECT + name, + p ->> 'Ip' AS ip, + p ->> 'Port' AS port + FROM + aws_route53_resolver_rule, + JSONB_ARRAY_ELEMENTS(target_ips) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find AWS Route 53 Resolver Rule Data in AWS Account + - Route 53 +Title: Find AWS Route 53 Resolver Rule Data in AWS Account \ No newline at end of file diff --git a/queries/aws_route53_resolver_rule_4.yaml b/queries/aws_route53_resolver_rule_4.yaml old mode 100755 new mode 100644 index 7f0baf1ec..46ef5cb07 --- a/queries/aws_route53_resolver_rule_4.yaml +++ b/queries/aws_route53_resolver_rule_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS - resolver rules configured in an AWS account. +Description: Allows users to query AWS Route 53 Resolver Rule to obtain data on DNS resolver rules configured in an AWS account. ID: aws_route53_resolver_rule_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n share_status,\n rule_type\nfrom\n aws_route53_resolver_rule\n\ - where\n share_status = 'SHARED';" + QueryToExecute: | + SELECT + name, + id, + share_status, + rule_type + FROM + aws_route53_resolver_rule + WHERE + share_status = 'SHARED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find all AWS Route 53 Resolver Rules Configuration + - Route 53 +Title: Find all AWS Route 53 Resolver Rules Configuration \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_1.yaml b/queries/aws_route53_traffic_policy_1.yaml old mode 100755 new mode 100644 index c887ff70e..a2363406d --- a/queries/aws_route53_traffic_policy_1.yaml +++ b/queries/aws_route53_traffic_policy_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information - about each policy''s versions, including the policy identifier, name, type, and - document. This table also provides data related to the policy''s associated metadata. +Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information about each policy's versions, including the policy identifier, name, type, and document. This table also provides data related to the policy's associated metadata. ID: aws_route53_traffic_policy_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n version,\n document,\n region\nfrom\ - \ \n aws_route53_traffic_policy;" + QueryToExecute: | + SELECT + name, + id, + version, + document, + region + FROM + aws_route53_traffic_policy; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Traffic Policies and Metadata + - Route 53 +Title: List all AWS Route 53 Traffic Policies and Metadata \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_2.yaml b/queries/aws_route53_traffic_policy_2.yaml old mode 100755 new mode 100644 index 90eb8f47f..3988d10f1 --- a/queries/aws_route53_traffic_policy_2.yaml +++ b/queries/aws_route53_traffic_policy_2.yaml @@ -1,23 +1,37 @@ -Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information - about each policy''s versions, including the policy identifier, name, type, and - document. This table also provides data related to the policy''s associated metadata. +Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information about each policy's versions, including the policy identifier, name, type, and document. This table also provides data related to the policy's associated metadata. ID: aws_route53_traffic_policy_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name,\n policy.id,\n policy.version, \n comment \n\ - from \n aws_route53_traffic_policy policy,\n (select\n id,\n max(version)\ - \ as version\n from \n aws_route53_traffic_policy \n group by \n id) as\ - \ latest\nwhere \n latest.id = policy.id \n and latest.version = policy.version;" + QueryToExecute: | + SELECT + name, + policy.id, + policy.version, + comment + FROM + aws_route53_traffic_policy policy, + ( + SELECT + id, + MAX(version) AS version + FROM + aws_route53_traffic_policy + GROUP BY + id + ) AS latest + WHERE + latest.id = policy.id + AND latest.version = policy.version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: Find All AWS Route 53 Traffic Policy Versions and Metadata + - Route 53 +Title: Find All AWS Route 53 Traffic Policy Versions and Metadata \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_3.yaml b/queries/aws_route53_traffic_policy_3.yaml old mode 100755 new mode 100644 index 4f15ee710..528948a48 --- a/queries/aws_route53_traffic_policy_3.yaml +++ b/queries/aws_route53_traffic_policy_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information - about each policy''s versions, including the policy identifier, name, type, and - document. This table also provides data related to the policy''s associated metadata. +Description: Allows users to query AWS Route 53 Traffic Policies to retrieve information about each policy's versions, including the policy identifier, name, type, and document. This table also provides data related to the policy's associated metadata. ID: aws_route53_traffic_policy_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n document ->> 'RecordType' as dns_type,\n count(id) as\ - \ \"policies\"\nfrom\n aws_route53_traffic_policy\ngroup by \n dns_type;" + QueryToExecute: | + SELECT + document ->> 'RecordType' AS dns_type, + COUNT(id) AS policies + FROM + aws_route53_traffic_policy + GROUP BY + dns_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Traffic Policies with Versions + - Route 53 +Title: List all AWS Route 53 Traffic Policies with Versions \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_instance_1.yaml b/queries/aws_route53_traffic_policy_instance_1.yaml old mode 100755 new mode 100644 index 821edcc1a..64ce37b38 --- a/queries/aws_route53_traffic_policy_instance_1.yaml +++ b/queries/aws_route53_traffic_policy_instance_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing - detailed information about each instance such as the ID, version, DNS name, and - more. This table is useful for gaining insights into the configuration and status - of traffic policy instances. +Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing detailed information about each instance such as the ID, version, DNS name, and more. This table is useful for gaining insights into the configuration and status of traffic policy instances. ID: aws_route53_traffic_policy_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n hosted_zone_id,\n ttl,\n region\nfrom\ - \ \n aws_route53_traffic_policy_instance;" + QueryToExecute: | + SELECT + name, + id, + hosted_zone_id, + ttl, + region + FROM + aws_route53_traffic_policy_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Traffic Policy Instances + - Route 53 +Title: List all AWS Route 53 Traffic Policy Instances \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_instance_2.yaml b/queries/aws_route53_traffic_policy_instance_2.yaml old mode 100755 new mode 100644 index a89ea4dce..6b2e5a691 --- a/queries/aws_route53_traffic_policy_instance_2.yaml +++ b/queries/aws_route53_traffic_policy_instance_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing - detailed information about each instance such as the ID, version, DNS name, and - more. This table is useful for gaining insights into the configuration and status - of traffic policy instances. +Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing detailed information about each instance such as the ID, version, DNS name, and more. This table is useful for gaining insights into the configuration and status of traffic policy instances. ID: aws_route53_traffic_policy_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n i.name,\n i.id,\n h.id as hosted_zone_id,\n h.name\ - \ as hosted_zone_name,\n h.caller_reference,\n h.private_zone\nfrom \n aws_route53_traffic_policy_instance\ - \ i\n join aws_route53_zone h on i.hosted_zone_id = h.id;" + QueryToExecute: | + SELECT + i.name, + i.id, + h.id AS hosted_zone_id, + h.name AS hosted_zone_name, + h.caller_reference, + h.private_zone + FROM + aws_route53_traffic_policy_instance i + JOIN aws_route53_zone h ON i.hosted_zone_id = h.id; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Traffic Policy Instances + - Route 53 +Title: List all AWS Route 53 Traffic Policy Instances \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_instance_3.yaml b/queries/aws_route53_traffic_policy_instance_3.yaml old mode 100755 new mode 100644 index e9710b8ec..6c3b62b30 --- a/queries/aws_route53_traffic_policy_instance_3.yaml +++ b/queries/aws_route53_traffic_policy_instance_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing - detailed information about each instance such as the ID, version, DNS name, and - more. This table is useful for gaining insights into the configuration and status - of traffic policy instances. +Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing detailed information about each instance such as the ID, version, DNS name, and more. This table is useful for gaining insights into the configuration and status of traffic policy instances. ID: aws_route53_traffic_policy_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n i.name,\n i.id,\n traffic_policy_id,\n p.name as\ - \ traffic_policy_name,\n traffic_policy_type,\n traffic_policy_version,\n p.document\n\ - from \n aws_route53_traffic_policy_instance i\n join aws_route53_traffic_policy\ - \ p on i.traffic_policy_id = p.id \n and i.traffic_policy_version = p.version;" + QueryToExecute: | + SELECT + i.name, + i.id, + traffic_policy_id, + p.name AS traffic_policy_name, + traffic_policy_type, + traffic_policy_version, + p.document + FROM + aws_route53_traffic_policy_instance i + JOIN + aws_route53_traffic_policy p + ON + i.traffic_policy_id = p.id + AND + i.traffic_policy_version = p.version; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Traffic Policy Instances + - Route 53 +Title: List all AWS Route 53 Traffic Policy Instances \ No newline at end of file diff --git a/queries/aws_route53_traffic_policy_instance_4.yaml b/queries/aws_route53_traffic_policy_instance_4.yaml old mode 100755 new mode 100644 index 2c33b91c9..7c7c3384a --- a/queries/aws_route53_traffic_policy_instance_4.yaml +++ b/queries/aws_route53_traffic_policy_instance_4.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing - detailed information about each instance such as the ID, version, DNS name, and - more. This table is useful for gaining insights into the configuration and status - of traffic policy instances. +Description: Allows users to query AWS Route 53 Traffic Policy Instances, providing detailed information about each instance such as the ID, version, DNS name, and more. This table is useful for gaining insights into the configuration and status of traffic policy instances. ID: aws_route53_traffic_policy_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n state,\n hosted_zone_id,\n message\ - \ as failed_reason\nfrom \n aws_route53_traffic_policy_instance\nwhere\n state\ - \ = 'Failed';" + QueryToExecute: | + SELECT + name, + id, + state, + hosted_zone_id, + message AS failed_reason + FROM + aws_route53_traffic_policy_instance + WHERE + state = 'Failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List All AWS Route 53 Traffic Policy Instances + - Route 53 +Title: List All AWS Route 53 Traffic Policy Instances \ No newline at end of file diff --git a/queries/aws_route53_vpc_association_authorization_1.yaml b/queries/aws_route53_vpc_association_authorization_1.yaml old mode 100755 new mode 100644 index 986c6bc0c..75abf570f --- a/queries/aws_route53_vpc_association_authorization_1.yaml +++ b/queries/aws_route53_vpc_association_authorization_1.yaml @@ -1,21 +1,26 @@ -Description: Gets a list of the VPCs that were created by other accounts and that - can be associated with a specified hosted zone because you''ve submitted one or - more `CreateVPCAssociationAuthorization` requests. +Description: Gets a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone because you've submitted one or more `CreateVPCAssociationAuthorization` requests. ID: aws_route53_vpc_association_authorization_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hosted_zone_id,\n vpc_id,\n vpc_region\nfrom\n aws_route53_vpc_association_authorization\n\ - where\n hosted_zone_id = 'Z3M3LMPEXAMPLE';" + QueryToExecute: | + SELECT + hosted_zone_id, + vpc_id, + vpc_region + FROM + aws_route53_vpc_association_authorization + WHERE + hosted_zone_id = 'Z3M3LMPEXAMPLE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route53 -Title: List all VPCs created by other accounts for a hosted zone + - Route53 +Title: List all VPCs created by other accounts for a hosted zone \ No newline at end of file diff --git a/queries/aws_route53_vpc_association_authorization_2.yaml b/queries/aws_route53_vpc_association_authorization_2.yaml old mode 100755 new mode 100644 index bbd0bfc70..6429de89d --- a/queries/aws_route53_vpc_association_authorization_2.yaml +++ b/queries/aws_route53_vpc_association_authorization_2.yaml @@ -1,21 +1,28 @@ -Description: Gets a list of the VPCs that were created by other accounts and that - can be associated with a specified hosted zone because you''ve submitted one or - more `CreateVPCAssociationAuthorization` requests. +Description: Gets a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone because you've submitted one or more `CreateVPCAssociationAuthorization` requests. ID: aws_route53_vpc_association_authorization_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hosted_zone_id,\n vpc_id,\n vpc_region\nfrom\n aws_route53_vpc_association_authorization\n\ - where\n hosted_zone_id = 'Z3M3LMPEXAMPLE'\norder by\n vpc_region desc;" + QueryToExecute: | + SELECT + hosted_zone_id, + vpc_id, + vpc_region + FROM + aws_route53_vpc_association_authorization + WHERE + hosted_zone_id = 'Z3M3LMPEXAMPLE' + ORDER BY + vpc_region DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route53 -Title: List all VPCs from other accounts for Route53 association + - Route53 +Title: List all VPCs from other accounts for Route53 association \ No newline at end of file diff --git a/queries/aws_route53_vpc_association_authorization_3.yaml b/queries/aws_route53_vpc_association_authorization_3.yaml old mode 100755 new mode 100644 index da59cb345..b8dffea28 --- a/queries/aws_route53_vpc_association_authorization_3.yaml +++ b/queries/aws_route53_vpc_association_authorization_3.yaml @@ -1,24 +1,31 @@ -Description: Gets a list of the VPCs that were created by other accounts and that - can be associated with a specified hosted zone because you''ve submitted one or - more `CreateVPCAssociationAuthorization` requests. +Description: Gets a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone because you've submitted one or more `CreateVPCAssociationAuthorization` requests. ID: aws_route53_vpc_association_authorization_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n auth.hosted_zone_id,\n z.name,\n auth.vpc_id,\n auth.vpc_region\n\ - from\n aws_route53_vpc_association_authorization auth\ninner join\n aws_route53_zone\ - \ z on auth.hosted_zone_id = z.id\nwhere z.name = 'mycooldomain.xyz';" + QueryToExecute: | + SELECT + auth.hosted_zone_id, + z.name, + auth.vpc_id, + auth.vpc_region + FROM + aws_route53_vpc_association_authorization auth + INNER JOIN + aws_route53_zone z ON auth.hosted_zone_id = z.id + WHERE + z.name = 'mycooldomain.xyz'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route53 -Title: List all VPCs for AWS Route53 VPC Association Authorization + - Route53 +Title: List all VPCs for AWS Route53 VPC Association Authorization \ No newline at end of file diff --git a/queries/aws_route53_zone_1.yaml b/queries/aws_route53_zone_1.yaml old mode 100755 new mode 100644 index ac6b88ad6..221c105c8 --- a/queries/aws_route53_zone_1.yaml +++ b/queries/aws_route53_zone_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n private_zone,\n resource_record_set_count\n\ - from \n aws_route53_zone;" + QueryToExecute: | + SELECT + name, + id, + private_zone, + resource_record_set_count + FROM + aws_route53_zone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 Zone Details Including Hosted Zone ID + - Route 53 +Title: List AWS Route 53 Zone Details Including Hosted Zone ID \ No newline at end of file diff --git a/queries/aws_route53_zone_2.yaml b/queries/aws_route53_zone_2.yaml old mode 100755 new mode 100644 index 2b4129b92..beab42792 --- a/queries/aws_route53_zone_2.yaml +++ b/queries/aws_route53_zone_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n comment,\n private_zone,\n resource_record_set_count\n\ - from \n aws_route53_zone\nwhere\n private_zone;" + QueryToExecute: | + SELECT + name, + id, + comment, + private_zone, + resource_record_set_count + FROM + aws_route53_zone + WHERE + private_zone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Zone Details Including Tags and Counts + - Route 53 +Title: List all AWS Route 53 Zone Details Including Tags and Counts \ No newline at end of file diff --git a/queries/aws_route53_zone_3.yaml b/queries/aws_route53_zone_3.yaml old mode 100755 new mode 100644 index 5869b7121..ba1f45b96 --- a/queries/aws_route53_zone_3.yaml +++ b/queries/aws_route53_zone_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n comment,\n private_zone,\n resource_record_set_count\n\ - from \n aws_route53_zone\nwhere\n not private_zone;" + QueryToExecute: | + SELECT + name, + id, + comment, + private_zone, + resource_record_set_count + FROM + aws_route53_zone + WHERE + NOT private_zone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 Zone Details Including Hosted Zone ID + - Route 53 +Title: List AWS Route 53 Zone Details Including Hosted Zone ID \ No newline at end of file diff --git a/queries/aws_route53_zone_4.yaml b/queries/aws_route53_zone_4.yaml old mode 100755 new mode 100644 index 9629bd948..b250b7f2d --- a/queries/aws_route53_zone_4.yaml +++ b/queries/aws_route53_zone_4.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n private_zone,\n resource_record_set_count\n\ - from \n aws_route53_zone\nwhere\n name like '%.turbot.com." + QueryToExecute: | + SELECT + name, + id, + private_zone, + resource_record_set_count + FROM + aws_route53_zone + WHERE + name LIKE '%.turbot.com.' Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List all AWS Route 53 Zone details including record count + - Route 53 +Title: List all AWS Route 53 Zone details including record count \ No newline at end of file diff --git a/queries/aws_route53_zone_5.yaml b/queries/aws_route53_zone_5.yaml old mode 100755 new mode 100644 index 768d70f29..a9d051cc5 --- a/queries/aws_route53_zone_5.yaml +++ b/queries/aws_route53_zone_5.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name,\n id,\n v ->> 'VPCId' as vpc_id,\n v ->> 'VPCRegion'\ - \ as vpc_region\nfrom\n aws_route53_zone,\n jsonb_array_elements(vpcs) as v;" + QueryToExecute: | + SELECT + name, + id, + v ->> 'VPCId' AS vpc_id, + v ->> 'VPCRegion' AS vpc_region + FROM + aws_route53_zone, + jsonb_array_elements(vpcs) AS v; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 Zone Details with Associated Tags + - Route 53 +Title: List AWS Route 53 Zone Details with Associated Tags \ No newline at end of file diff --git a/queries/aws_route53_zone_6.yaml b/queries/aws_route53_zone_6.yaml old mode 100755 new mode 100644 index 204a7413a..0630a196d --- a/queries/aws_route53_zone_6.yaml +++ b/queries/aws_route53_zone_6.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Route 53 Zone details including hosted zone - ID, name, type, record set count, and associated tags. +Description: Allows users to query AWS Route 53 Zone details including hosted zone ID, name, type, record set count, and associated tags. ID: aws_route53_zone_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n name,\n id,\n v.vpc_id as vpc_id,\n v.cidr_block\ - \ as cidr_block,\n v.is_default as is_default,\n v.dhcp_options_id as dhcp_options_id\n\ - from\n aws_route53_zone,\n jsonb_array_elements(vpcs) as p,\n aws_vpc as v\n\ - where\n p ->> 'VPCId' = v.vpc_id;" + QueryToExecute: | + SELECT + name, + id, + v.vpc_id AS vpc_id, + v.cidr_block AS cidr_block, + v.is_default AS is_default, + v.dhcp_options_id AS dhcp_options_id + FROM + aws_route53_zone, + jsonb_array_elements(vpcs) AS p, + aws_vpc AS v + WHERE + p ->> 'VPCId' = v.vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Route 53 -Title: List AWS Route 53 Zone Details including Hosted Zone ID + - Route 53 +Title: List AWS Route 53 Zone Details including Hosted Zone ID \ No newline at end of file diff --git a/queries/aws_s3_access_point_1.yaml b/queries/aws_s3_access_point_1.yaml old mode 100755 new mode 100644 index 0abf6ce0d..a47c6237d --- a/queries/aws_s3_access_point_1.yaml +++ b/queries/aws_s3_access_point_1.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query AWS S3 Access Point details such as name, bucket, - network origin, policy status, creation time, and more. +Description: Allows users to query AWS S3 Access Point details such as name, bucket, network origin, policy status, creation time, and more. ID: aws_s3_access_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_arn,\n bucket_name\nfrom\n aws_s3_access_point;" + QueryToExecute: | + SELECT + name, + access_point_arn, + bucket_name + FROM + aws_s3_access_point; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Access Point details using SQL + - S3 +Title: List all AWS S3 Access Point details using SQL \ No newline at end of file diff --git a/queries/aws_s3_access_point_2.yaml b/queries/aws_s3_access_point_2.yaml old mode 100755 new mode 100644 index 77341a7b5..a123b0111 --- a/queries/aws_s3_access_point_2.yaml +++ b/queries/aws_s3_access_point_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS S3 Access Point details such as name, bucket, - network origin, policy status, creation time, and more. +Description: Allows users to query AWS S3 Access Point details such as name, bucket, network origin, policy status, creation time, and more. ID: aws_s3_access_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_arn,\n vpc_id\nfrom\n aws_s3_access_point\n\ - where\n vpc_id is not null;" + QueryToExecute: | + SELECT + name, + access_point_arn, + vpc_id + FROM + aws_s3_access_point + WHERE + vpc_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Access Point details + - S3 +Title: List all AWS S3 Access Point details \ No newline at end of file diff --git a/queries/aws_s3_access_point_3.yaml b/queries/aws_s3_access_point_3.yaml old mode 100755 new mode 100644 index f77bd3294..b3c017259 --- a/queries/aws_s3_access_point_3.yaml +++ b/queries/aws_s3_access_point_3.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS S3 Access Point details such as name, bucket, - network origin, policy status, creation time, and more. +Description: Allows users to query AWS S3 Access Point details such as name, bucket, network origin, policy status, creation time, and more. ID: aws_s3_access_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n block_public_acls,\n block_public_policy,\n\ - \ ignore_public_acls,\n restrict_public_buckets\nfrom\n aws_s3_access_point\n\ - where\n not block_public_acls\n or not block_public_policy\n or not ignore_public_acls\n\ - \ or not restrict_public_buckets;" + QueryToExecute: | + SELECT + name, + block_public_acls, + block_public_policy, + ignore_public_acls, + restrict_public_buckets + FROM + aws_s3_access_point + WHERE + NOT block_public_acls + OR NOT block_public_policy + OR NOT ignore_public_acls + OR NOT restrict_public_buckets; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Access Point details with public policies + - S3 +Title: Find AWS S3 Access Point details with public policies \ No newline at end of file diff --git a/queries/aws_s3_access_point_4.yaml b/queries/aws_s3_access_point_4.yaml old mode 100755 new mode 100644 index eb60b42e9..709e34c59 --- a/queries/aws_s3_access_point_4.yaml +++ b/queries/aws_s3_access_point_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS S3 Access Point details such as name, bucket, - network origin, policy status, creation time, and more. +Description: Allows users to query AWS S3 Access Point details such as name, bucket, network origin, policy status, creation time, and more. ID: aws_s3_access_point_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n access_point_policy_is_public\nfrom\n aws_s3_access_point\n\ - where\n access_point_policy_is_public;" + QueryToExecute: | + SELECT + name, + access_point_policy_is_public + FROM + aws_s3_access_point + WHERE + access_point_policy_is_public; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Access Point details including name and policy + - S3 +Title: List all AWS S3 Access Point details including name and policy \ No newline at end of file diff --git a/queries/aws_s3_access_point_5.yaml b/queries/aws_s3_access_point_5.yaml old mode 100755 new mode 100644 index 5cae9cd0f..158f81961 --- a/queries/aws_s3_access_point_5.yaml +++ b/queries/aws_s3_access_point_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS S3 Access Point details such as name, bucket, - network origin, policy status, creation time, and more. +Description: Allows users to query AWS S3 Access Point details such as name, bucket, network origin, policy status, creation time, and more. ID: aws_s3_access_point_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n count(name) access_point_count\nfrom\n\ - \ aws_s3_access_point\ngroup by\n bucket_name;" + QueryToExecute: | + SELECT + bucket_name, + COUNT(name) AS access_point_count + FROM + aws_s3_access_point + GROUP BY + bucket_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 Access Point -Title: List AWS S3 Access Point Details Including Name, Bucket + - S3 Access Point +Title: List AWS S3 Access Point Details Including Name, Bucket \ No newline at end of file diff --git a/queries/aws_s3_bucket_1.yaml b/queries/aws_s3_bucket_1.yaml old mode 100755 new mode 100644 index 6ebbc8ff0..1dff4164a --- a/queries/aws_s3_bucket_1.yaml +++ b/queries/aws_s3_bucket_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n region,\n account_id,\n bucket_policy_is_public\n\ - from\n aws_s3_bucket;" + QueryToExecute: | + SELECT + name, + region, + account_id, + bucket_policy_is_public + FROM + aws_s3_bucket; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Buckets with Configuration and Policies + - S3 +Title: List all AWS S3 Buckets with Configuration and Policies \ No newline at end of file diff --git a/queries/aws_s3_bucket_10.yaml b/queries/aws_s3_bucket_10.yaml old mode 100755 new mode 100644 index 1f3c325f6..825b2f4e5 --- a/queries/aws_s3_bucket_10.yaml +++ b/queries/aws_s3_bucket_10.yaml @@ -1,26 +1,38 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_s3_bucket,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n string_to_array(p, ':') as pa,\n jsonb_array_elements_text(s -> 'Action')\ - \ as a\nwhere\n s ->> 'Effect' = 'Allow'\n and (\n pa[5] != account_id\n\ - \ or p = '*'\n );" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_s3_bucket, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + string_to_array(p, ':') AS pa, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND ( + pa[5] != account_id + OR p = '*' + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Bucket Policies and Permissions + - S3 +Title: Find AWS S3 Bucket Policies and Permissions \ No newline at end of file diff --git a/queries/aws_s3_bucket_11.yaml b/queries/aws_s3_bucket_11.yaml old mode 100755 new mode 100644 index d0d1d8b57..0d7ec34af --- a/queries/aws_s3_bucket_11.yaml +++ b/queries/aws_s3_bucket_11.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n object_lock_configuration ->> 'ObjectLockEnabled'\ - \ as object_lock_enabled\nfrom\n aws_s3_bucket\nwhere\n object_lock_configuration\ - \ ->> 'ObjectLockEnabled' = 'Enabled';" + QueryToExecute: | + SELECT + name, + object_lock_configuration ->> 'ObjectLockEnabled' AS object_lock_enabled + FROM + aws_s3_bucket + WHERE + object_lock_configuration ->> 'ObjectLockEnabled' = 'Enabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Buckets with Object Lock Enabled + - S3 +Title: Find AWS S3 Buckets with Object Lock Enabled \ No newline at end of file diff --git a/queries/aws_s3_bucket_12.yaml b/queries/aws_s3_bucket_12.yaml old mode 100755 new mode 100644 index c4f144429..7abf65b42 --- a/queries/aws_s3_bucket_12.yaml +++ b/queries/aws_s3_bucket_12.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n website_configuration -> 'IndexDocument' ->>\ - \ 'Suffix' as suffix\nfrom\n aws_s3_bucket\nwhere\n website_configuration ->\ - \ 'IndexDocument' ->> 'Suffix' is not null;" + QueryToExecute: | + SELECT + name, + website_configuration -> 'IndexDocument' ->> 'Suffix' AS suffix + FROM + aws_s3_bucket + WHERE + website_configuration -> 'IndexDocument' ->> 'Suffix' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all detailed AWS S3 Bucket Information via SQL + - S3 +Title: Find all detailed AWS S3 Bucket Information via SQL \ No newline at end of file diff --git a/queries/aws_s3_bucket_13.yaml b/queries/aws_s3_bucket_13.yaml old mode 100755 new mode 100644 index 8777565fa..b19f60ecf --- a/queries/aws_s3_bucket_13.yaml +++ b/queries/aws_s3_bucket_13.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_13 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n b.name,\n r ->> 'ObjectOwnership' as object_ownership\n\ - from\n aws_s3_bucket as b,\n jsonb_array_elements(object_ownership_controls\ - \ -> 'Rules') as r;" + QueryToExecute: | + SELECT + b.name, + r ->> 'ObjectOwnership' AS object_ownership + FROM + aws_s3_bucket AS b, + jsonb_array_elements(object_ownership_controls -> 'Rules') AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Buckets Configuration and Permissions + - S3 +Title: Find all AWS S3 Buckets Configuration and Permissions \ No newline at end of file diff --git a/queries/aws_s3_bucket_2.yaml b/queries/aws_s3_bucket_2.yaml old mode 100755 new mode 100644 index 55b1432ca..bfca87266 --- a/queries/aws_s3_bucket_2.yaml +++ b/queries/aws_s3_bucket_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n region,\n account_id,\n versioning_enabled\n\ - from\n aws_s3_bucket\nwhere\n not versioning_enabled;" + QueryToExecute: | + SELECT + name, + region, + account_id, + versioning_enabled + FROM + aws_s3_bucket + WHERE + NOT versioning_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Buckets Missing Versioning Using SQL + - S3 +Title: Find AWS S3 Buckets Missing Versioning Using SQL \ No newline at end of file diff --git a/queries/aws_s3_bucket_3.yaml b/queries/aws_s3_bucket_3.yaml old mode 100755 new mode 100644 index c109b975f..3dd9fad1c --- a/queries/aws_s3_bucket_3.yaml +++ b/queries/aws_s3_bucket_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n server_side_encryption_configuration\nfrom\n\ - \ aws_s3_bucket\nwhere\n server_side_encryption_configuration is null;" + QueryToExecute: | + SELECT + name, + server_side_encryption_configuration + FROM + aws_s3_bucket + WHERE + server_side_encryption_configuration IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 buckets with no server-side encryption + - S3 +Title: Find AWS S3 buckets with no server-side encryption \ No newline at end of file diff --git a/queries/aws_s3_bucket_4.yaml b/queries/aws_s3_bucket_4.yaml old mode 100755 new mode 100644 index be232e1f7..dec6d5625 --- a/queries/aws_s3_bucket_4.yaml +++ b/queries/aws_s3_bucket_4.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n block_public_acls,\n block_public_policy,\n\ - \ ignore_public_acls,\n restrict_public_buckets\nfrom\n aws_s3_bucket\nwhere\n\ - \ not block_public_acls\n or not block_public_policy\n or not ignore_public_acls\n\ - \ or not restrict_public_buckets;" + QueryToExecute: | + SELECT + name, + block_public_acls, + block_public_policy, + ignore_public_acls, + restrict_public_buckets + FROM + aws_s3_bucket + WHERE + NOT block_public_acls + OR NOT block_public_policy + OR NOT ignore_public_acls + OR NOT restrict_public_buckets; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Buckets with Public Access Details + - S3 +Title: Find AWS S3 Buckets with Public Access Details \ No newline at end of file diff --git a/queries/aws_s3_bucket_5.yaml b/queries/aws_s3_bucket_5.yaml old mode 100755 new mode 100644 index ee95fdd89..807143b4b --- a/queries/aws_s3_bucket_5.yaml +++ b/queries/aws_s3_bucket_5.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n bucket_policy_is_public\nfrom\n aws_s3_bucket\n\ - where\n bucket_policy_is_public;" + QueryToExecute: | + SELECT + name, + bucket_policy_is_public + FROM + aws_s3_bucket + WHERE + bucket_policy_is_public; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find All AWS S3 Bucket Policies and Configurations + - S3 +Title: Find All AWS S3 Bucket Policies and Configurations \ No newline at end of file diff --git a/queries/aws_s3_bucket_6.yaml b/queries/aws_s3_bucket_6.yaml old mode 100755 new mode 100644 index f4c66a945..31266de17 --- a/queries/aws_s3_bucket_6.yaml +++ b/queries/aws_s3_bucket_6.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n logging ->> 'TargetBucket' as target_bucket\n\ - from\n aws_s3_bucket\nwhere\n logging ->> 'TargetBucket' = name;" + QueryToExecute: | + SELECT + name, + logging ->> 'TargetBucket' AS target_bucket + FROM + aws_s3_bucket + WHERE + logging ->> 'TargetBucket' = name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Buckets with Specific Logging Target + - S3 +Title: Find AWS S3 Buckets with Specific Logging Target \ No newline at end of file diff --git a/queries/aws_s3_bucket_7.yaml b/queries/aws_s3_bucket_7.yaml old mode 100755 new mode 100644 index 75805b253..62603d311 --- a/queries/aws_s3_bucket_7.yaml +++ b/queries/aws_s3_bucket_7.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tags ->> 'fizz' as fizz\nfrom\n aws_s3_bucket\n\ - where\n tags ->> 'application' is null;" + QueryToExecute: | + SELECT + name, + tags ->> 'fizz' AS fizz + FROM + aws_s3_bucket + WHERE + tags ->> 'application' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Buckets Information with SQL + - S3 +Title: Find all AWS S3 Buckets Information with SQL \ No newline at end of file diff --git a/queries/aws_s3_bucket_8.yaml b/queries/aws_s3_bucket_8.yaml old mode 100755 new mode 100644 index 009273836..6aec810d2 --- a/queries/aws_s3_bucket_8.yaml +++ b/queries/aws_s3_bucket_8.yaml @@ -1,27 +1,37 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s ->> 'Condition' as conditions,\n ssl\nfrom\n aws_s3_bucket,\n\ - \ jsonb_array_elements(policy_std -> 'Statement') as s,\n jsonb_array_elements_text(s\ - \ -> 'Principal' -> 'AWS') as p,\n jsonb_array_elements_text(s -> 'Action') as\ - \ a,\n jsonb_array_elements_text(\n s -> 'Condition' -> 'Bool' -> 'aws:securetransport'\n\ - \ ) as ssl\nwhere\n p = '*'\n and s ->> 'Effect' = 'Deny'\n and ssl :: bool\ - \ = false;" + QueryToExecute: | + SELECT + name, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s ->> 'Condition' AS conditions, + ssl + FROM + aws_s3_bucket, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a, + jsonb_array_elements_text(s -> 'Condition' -> 'Bool' -> 'aws:SecureTransport') AS ssl + WHERE + p = '*' + AND s ->> 'Effect' = 'Deny' + AND ssl :: BOOL = FALSE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 buckets with insecure policies + - S3 +Title: Find all AWS S3 buckets with insecure policies \ No newline at end of file diff --git a/queries/aws_s3_bucket_9.yaml b/queries/aws_s3_bucket_9.yaml old mode 100755 new mode 100644 index 48a12c32e..e6e2365ec --- a/queries/aws_s3_bucket_9.yaml +++ b/queries/aws_s3_bucket_9.yaml @@ -1,27 +1,41 @@ -Description: Allows users to query AWS S3 buckets for detailed information about their - configuration, policies, and permissions. +Description: Allows users to query AWS S3 buckets for detailed information about their configuration, policies, and permissions. ID: aws_s3_bucket_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name\nfrom\n aws_s3_bucket\nwhere\n name not in (\n\ - \ select\n name\n from\n aws_s3_bucket,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a,\n jsonb_array_elements_text(\n\ - \ s -> 'Condition' -> 'Bool' -> 'aws:securetransport'\n ) as ssl\n\ - \ where\n p = '*'\n and s ->> 'Effect' = 'Deny'\n and ssl ::\ - \ bool = false\n );" + QueryToExecute: | + SELECT + name + FROM + aws_s3_bucket + WHERE + name NOT IN ( + SELECT + name + FROM + aws_s3_bucket, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a, + jsonb_array_elements_text( + s -> 'Condition' -> 'Bool' -> 'aws:securetransport' + ) AS ssl + WHERE + p = '*' + AND s ->> 'Effect' = 'Deny' + AND ssl::bool = FALSE + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Buckets with Specific Policies and Permissions + - S3 +Title: Find AWS S3 Buckets with Specific Policies and Permissions \ No newline at end of file diff --git a/queries/aws_s3_bucket_intelligent_tiering_configuration_1.yaml b/queries/aws_s3_bucket_intelligent_tiering_configuration_1.yaml old mode 100755 new mode 100644 index 44d7aced6..4fdf97967 --- a/queries/aws_s3_bucket_intelligent_tiering_configuration_1.yaml +++ b/queries/aws_s3_bucket_intelligent_tiering_configuration_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Intelligent Tiering configurations for S3 buckets. - It provides information about each configuration, including the bucket name, the - ID of the configuration, and the status of the configuration. +Description: Allows users to query Intelligent Tiering configurations for S3 buckets. It provides information about each configuration, including the bucket name, the ID of the configuration, and the status of the configuration. ID: aws_s3_bucket_intelligent_tiering_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n id,\n status,\n tierings\nfrom\n aws_s3_bucket_intelligent_tiering_configuration;" + QueryToExecute: | + SELECT + bucket_name, + id, + status, + tierings + FROM + aws_s3_bucket_intelligent_tiering_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 Bucket -Title: List all Intelligent Tiering Configurations in AWS S3 + - S3 Bucket +Title: List all Intelligent Tiering Configurations in AWS S3 \ No newline at end of file diff --git a/queries/aws_s3_bucket_intelligent_tiering_configuration_2.yaml b/queries/aws_s3_bucket_intelligent_tiering_configuration_2.yaml old mode 100755 new mode 100644 index 8ddc77fbd..072ec1faf --- a/queries/aws_s3_bucket_intelligent_tiering_configuration_2.yaml +++ b/queries/aws_s3_bucket_intelligent_tiering_configuration_2.yaml @@ -1,28 +1,48 @@ -Description: Allows users to query Intelligent Tiering configurations for S3 buckets. - It provides information about each configuration, including the bucket name, the - ID of the configuration, and the status of the configuration. +Description: Allows users to query Intelligent Tiering configurations for S3 buckets. It provides information about each configuration, including the bucket name, the ID of the configuration, and the status of the configuration. ID: aws_s3_bucket_intelligent_tiering_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with intelligent_tiering_configuration as MATERIALIZED (\nselect\n\ - \ bucket_name, id, status\nfrom\n aws_s3_bucket_intelligent_tiering_configuration\ - \ ),\n bucket as MATERIALIZED (\n select\n name, region\n from\n aws_s3_bucket\ - \ )\n select distinct\n b.name,\n b.region,\n case\n \ - \ when\n i.id is null\n then\n 'Bucket does not have\ - \ intelligent tiering configured'\n else\n 'Bucket has intelligent\ - \ tiering configured'\n end\n as intelligent_tiering_configuration_status\n\ - \ from\n bucket as b\n left join\n intelligent_tiering_configuration\ - \ as i\n on b.name = i.bucket_name;" + QueryToExecute: | + WITH intelligent_tiering_configuration AS MATERIALIZED ( + SELECT + bucket_name, + id, + status + FROM + aws_s3_bucket_intelligent_tiering_configuration + ), + bucket AS MATERIALIZED ( + SELECT + name, + region + FROM + aws_s3_bucket + ) + SELECT DISTINCT + b.name, + b.region, + CASE + WHEN i.id IS NULL THEN + 'Bucket does not have intelligent tiering configured' + ELSE + 'Bucket has intelligent tiering configured' + END AS intelligent_tiering_configuration_status + FROM + bucket AS b + LEFT JOIN + intelligent_tiering_configuration AS i + ON + b.name = i.bucket_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Buckets with Intelligent Tiering Configuration + - S3 +Title: List all AWS S3 Buckets with Intelligent Tiering Configuration \ No newline at end of file diff --git a/queries/aws_s3_bucket_intelligent_tiering_configuration_3.yaml b/queries/aws_s3_bucket_intelligent_tiering_configuration_3.yaml old mode 100755 new mode 100644 index ee097fa8a..166f15899 --- a/queries/aws_s3_bucket_intelligent_tiering_configuration_3.yaml +++ b/queries/aws_s3_bucket_intelligent_tiering_configuration_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query Intelligent Tiering configurations for S3 buckets. - It provides information about each configuration, including the bucket name, the - ID of the configuration, and the status of the configuration. +Description: Allows users to query Intelligent Tiering configurations for S3 buckets. It provides information about each configuration, including the bucket name, the ID of the configuration, and the status of the configuration. ID: aws_s3_bucket_intelligent_tiering_configuration_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n id,\n status,\n tierings\nfrom\n aws_s3_bucket_intelligent_tiering_configuration\n\ - where\n status = 'Enabled';" + QueryToExecute: | + SELECT + bucket_name, + id, + status, + tierings + FROM + aws_s3_bucket_intelligent_tiering_configuration + WHERE + status = 'Enabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all Intelligent Tiering configurations for S3 buckets + - S3 +Title: List all Intelligent Tiering configurations for S3 buckets \ No newline at end of file diff --git a/queries/aws_s3_bucket_intelligent_tiering_configuration_4.yaml b/queries/aws_s3_bucket_intelligent_tiering_configuration_4.yaml old mode 100755 new mode 100644 index 2c4d08b83..1936c53ec --- a/queries/aws_s3_bucket_intelligent_tiering_configuration_4.yaml +++ b/queries/aws_s3_bucket_intelligent_tiering_configuration_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query Intelligent Tiering configurations for S3 buckets. - It provides information about each configuration, including the bucket name, the - ID of the configuration, and the status of the configuration. +Description: Allows users to query Intelligent Tiering configurations for S3 buckets. It provides information about each configuration, including the bucket name, the ID of the configuration, and the status of the configuration. ID: aws_s3_bucket_intelligent_tiering_configuration_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.bucket_name,\n s.id,\n s.status,\n t ->> 'AccessTier'\ - \ as access_tier,\n t ->> 'Days' as days\nfrom\n aws_s3_bucket_intelligent_tiering_configuration\ - \ as s,\n jsonb_array_elements(tierings) as t;" + QueryToExecute: | + SELECT + s.bucket_name, + s.id, + s.status, + t ->> 'AccessTier' AS access_tier, + t ->> 'Days' AS days + FROM + aws_s3_bucket_intelligent_tiering_configuration AS s, + jsonb_array_elements(tierings) AS t; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all Intelligent Tiering Configurations in AWS S3 Buckets + - S3 +Title: Find all Intelligent Tiering Configurations in AWS S3 Buckets \ No newline at end of file diff --git a/queries/aws_s3_bucket_intelligent_tiering_configuration_5.yaml b/queries/aws_s3_bucket_intelligent_tiering_configuration_5.yaml old mode 100755 new mode 100644 index 6b9e4e54d..6686d991b --- a/queries/aws_s3_bucket_intelligent_tiering_configuration_5.yaml +++ b/queries/aws_s3_bucket_intelligent_tiering_configuration_5.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query Intelligent Tiering configurations for S3 buckets. - It provides information about each configuration, including the bucket name, the - ID of the configuration, and the status of the configuration. +Description: Allows users to query Intelligent Tiering configurations for S3 buckets. It provides information about each configuration, including the bucket name, the ID of the configuration, and the status of the configuration. ID: aws_s3_bucket_intelligent_tiering_configuration_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n id,\n filter -> 'And' as filter_and,\n\ - \ filter -> 'Prefix' as filter_prefix,\n filter -> 'Tag' as filter_tag\nfrom\n\ - \ aws_s3_bucket_intelligent_tiering_configuration;" + QueryToExecute: | + SELECT + bucket_name, + id, + filter -> 'And' AS filter_and, + filter -> 'Prefix' AS filter_prefix, + filter -> 'Tag' AS filter_tag + FROM + aws_s3_bucket_intelligent_tiering_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all Intelligent Tiering Configurations in AWS S3 Buckets + - S3 +Title: Find all Intelligent Tiering Configurations in AWS S3 Buckets \ No newline at end of file diff --git a/queries/aws_s3_multi_region_access_point_1.yaml b/queries/aws_s3_multi_region_access_point_1.yaml old mode 100755 new mode 100644 index ba3fd8436..cc4fefd2f --- a/queries/aws_s3_multi_region_access_point_1.yaml +++ b/queries/aws_s3_multi_region_access_point_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information - about their configuration, status, and associated policies. +Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information about their configuration, status, and associated policies. ID: aws_s3_multi_region_access_point_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n alias,\n status,\n created_at\nfrom\n aws_s3_multi_region_access_point;" + QueryToExecute: | + SELECT + alias, + status, + created_at + FROM + aws_s3_multi_region_access_point; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 Multi-Region Access Point -Title: List all AWS S3 Multi-Region Access Points configuration and status + - S3 Multi-Region Access Point +Title: List all AWS S3 Multi-Region Access Points configuration and status \ No newline at end of file diff --git a/queries/aws_s3_multi_region_access_point_2.yaml b/queries/aws_s3_multi_region_access_point_2.yaml old mode 100755 new mode 100644 index 80c10df0d..920709f9f --- a/queries/aws_s3_multi_region_access_point_2.yaml +++ b/queries/aws_s3_multi_region_access_point_2.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information - about their configuration, status, and associated policies. +Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information about their configuration, status, and associated policies. ID: aws_s3_multi_region_access_point_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n public_access_block ->> 'BlockPublicAcls' as\ - \ block_public_acls,\n public_access_block ->> 'BlockPublicPolicy' as block_public_policy,\n\ - \ public_access_block ->> 'IgnorePublicAcls' as ignore_public_acls,\n public_access_block\ - \ ->> 'RestrictPublicBuckets' as restrict_public_buckets \nfrom\n aws_s3_multi_region_access_point\ - \ \nwhere\n public_access_block ->> 'BlockPublicAcls'::text = 'true' \n and\ - \ public_access_block ->> 'BlockPublicPolicy'::text = 'true' \n and public_access_block\ - \ ->> 'IgnorePublicAcls'::text = 'true' \n and public_access_block ->> 'RestrictPublicBuckets'::text\ - \ = 'true';" + QueryToExecute: | + SELECT + name, + public_access_block ->> 'BlockPublicAcls' AS block_public_acls, + public_access_block ->> 'BlockPublicPolicy' AS block_public_policy, + public_access_block ->> 'IgnorePublicAcls' AS ignore_public_acls, + public_access_block ->> 'RestrictPublicBuckets' AS restrict_public_buckets + FROM + aws_s3_multi_region_access_point + WHERE + public_access_block ->> 'BlockPublicAcls'::text = 'true' + AND public_access_block ->> 'BlockPublicPolicy'::text = 'true' + AND public_access_block ->> 'IgnorePublicAcls'::text = 'true' + AND public_access_block ->> 'RestrictPublicBuckets'::text = 'true'; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Multi-Region Access Points configuration and status + - S3 +Title: Find AWS S3 Multi-Region Access Points configuration and status \ No newline at end of file diff --git a/queries/aws_s3_multi_region_access_point_3.yaml b/queries/aws_s3_multi_region_access_point_3.yaml old mode 100755 new mode 100644 index 449ad46f5..12b9565e3 --- a/queries/aws_s3_multi_region_access_point_3.yaml +++ b/queries/aws_s3_multi_region_access_point_3.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information - about their configuration, status, and associated policies. +Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information about their configuration, status, and associated policies. ID: aws_s3_multi_region_access_point_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n policy -> 'Established' -> 'Policy' as established_policy,\n\ - \ policy -> 'Proposed' -> 'Policy' as proposed_policy\nfrom\n aws_s3_multi_region_access_point;" + QueryToExecute: | + SELECT + name, + policy -> 'Established' -> 'Policy' AS established_policy, + policy -> 'Proposed' -> 'Policy' AS proposed_policy + FROM + aws_s3_multi_region_access_point; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Multi-Region Access Point Configuration and Policies + - S3 +Title: Find AWS S3 Multi-Region Access Point Configuration and Policies \ No newline at end of file diff --git a/queries/aws_s3_multi_region_access_point_4.yaml b/queries/aws_s3_multi_region_access_point_4.yaml old mode 100755 new mode 100644 index 713ac1145..9633d1e63 --- a/queries/aws_s3_multi_region_access_point_4.yaml +++ b/queries/aws_s3_multi_region_access_point_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information - about their configuration, status, and associated policies. +Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information about their configuration, status, and associated policies. ID: aws_s3_multi_region_access_point_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r ->> 'Bucket' as bucket_name,\n count(name) access_point_count\n\ - from\n aws_s3_multi_region_access_point,\n jsonb_array_elements(regions) as\ - \ r\ngroup by\n bucket_name;" + QueryToExecute: | + SELECT + r ->> 'Bucket' AS bucket_name, + COUNT(name) AS access_point_count + FROM + aws_s3_multi_region_access_point, + JSONB_ARRAY_ELEMENTS(regions) AS r + GROUP BY + bucket_name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS S3 -Title: List all AWS S3 Multi-Region Access Points and Configuration + - AWS S3 +Title: List all AWS S3 Multi-Region Access Points and Configuration \ No newline at end of file diff --git a/queries/aws_s3_multi_region_access_point_5.yaml b/queries/aws_s3_multi_region_access_point_5.yaml old mode 100755 new mode 100644 index 63e8b6c2f..69ff5ce19 --- a/queries/aws_s3_multi_region_access_point_5.yaml +++ b/queries/aws_s3_multi_region_access_point_5.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information - about their configuration, status, and associated policies. +Description: Allows users to query AWS S3 Multi-Region Access Points to retrieve information about their configuration, status, and associated policies. ID: aws_s3_multi_region_access_point_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.name,\n r ->> 'Bucket' as bucket_name,\n b.creation_date\ - \ as bucket_creation_date,\n b.bucket_policy_is_public,\n b.versioning_enabled\n\ - from\n aws_s3_multi_region_access_point as a,\n jsonb_array_elements(a.regions)\ - \ as r,\n aws_s3_bucket as b\nwhere\n b.name = r ->> 'Bucket';" + QueryToExecute: | + SELECT + a.name, + r ->> 'Bucket' AS bucket_name, + b.creation_date AS bucket_creation_date, + b.bucket_policy_is_public, + b.versioning_enabled + FROM + aws_s3_multi_region_access_point AS a, + jsonb_array_elements(a.regions) AS r, + aws_s3_bucket AS b + WHERE + b.name = r ->> 'Bucket'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Query AWS S3 Multi-Region Access Points Configuration + - S3 +Title: Query AWS S3 Multi-Region Access Points Configuration \ No newline at end of file diff --git a/queries/aws_s3_object_1.yaml b/queries/aws_s3_object_1.yaml old mode 100755 new mode 100644 index cec561c10..0be837857 --- a/queries/aws_s3_object_1.yaml +++ b/queries/aws_s3_object_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class,\n\ - \ version_id\nfrom\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test';" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class, + version_id + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Objects and Retrieve Metadata Details + - S3 +Title: Find AWS S3 Objects and Retrieve Metadata Details \ No newline at end of file diff --git a/queries/aws_s3_object_10.yaml b/queries/aws_s3_object_10.yaml old mode 100755 new mode 100644 index 09c50a371..0ce37d8ba --- a/queries/aws_s3_object_10.yaml +++ b/queries/aws_s3_object_10.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n bucket_name,\n jsonb_pretty(tags) as tags\n\ - from\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n and tags ->>\ - \ 'application' is not null;" + QueryToExecute: | + SELECT + key, + bucket_name, + JSONB_PRETTY(tags) AS tags + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND tags ->> 'application' IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Object Metadata and Details + - S3 +Title: Find AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_11.yaml b/queries/aws_s3_object_11.yaml old mode 100755 new mode 100644 index f6d5b1a91..b2518e25b --- a/queries/aws_s3_object_11.yaml +++ b/queries/aws_s3_object_11.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n o.arn as object_arn,\n bucket_name,\n last_modified,\n\ - \ bucket_key_enabled\nfrom\n aws_s3_object as o,\n aws_s3_bucket as b\nwhere\n\ - \ o.bucket_name = b.name\n and not bucket_key_enabled;" + QueryToExecute: | + SELECT + key, + o.arn AS object_arn, + bucket_name, + last_modified, + bucket_key_enabled + FROM + aws_s3_object AS o, + aws_s3_bucket AS b + WHERE + o.bucket_name = b.name + AND NOT bucket_key_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Object Metadata and Details + - S3 +Title: Find all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_12.yaml b/queries/aws_s3_object_12.yaml old mode 100755 new mode 100644 index 389f7707d..e82a87eb5 --- a/queries/aws_s3_object_12.yaml +++ b/queries/aws_s3_object_12.yaml @@ -1,25 +1,40 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class\n\ - from\n aws_s3_object\nwhere\n bucket_name in\n (\n select\n name\n\ - \ from\n aws_s3_bucket\n where\n not block_public_acls\n \ - \ or not block_public_policy\n or not ignore_public_acls\n or not restrict_public_buckets\n\ - \ );" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class + FROM + aws_s3_object + WHERE + bucket_name IN ( + SELECT + name + FROM + aws_s3_bucket + WHERE + NOT block_public_acls + OR NOT block_public_policy + OR NOT ignore_public_acls + OR NOT restrict_public_buckets + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Object Metadata and Details + - S3 +Title: Find all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_13.yaml b/queries/aws_s3_object_13.yaml old mode 100755 new mode 100644 index c2ccb1aaf..e3d729bf3 --- a/queries/aws_s3_object_13.yaml +++ b/queries/aws_s3_object_13.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_13 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.key,\n b ->> 'awsAccountId' as account_id,\n b ->>\ - \ 'digestEndTime' as digest_end_time,\n b ->> 'digestPublicKeyFingerprint' as\ - \ digest_public_key_fingerprint,\n b ->> 'digestS3Bucket' as digest_s3_bucket,\n\ - \ b ->> 'digestStartTime' as digest_start_time\nfrom\n aws_s3_object as s,\n\ - \ jsonb_array_elements(body::jsonb) as b\nwhere\n bucket_name = 'steampipe-test'\n\ - \ and prefix = 'test1/log_text.txt';" + QueryToExecute: | + SELECT + s.key, + b ->> 'awsAccountId' AS account_id, + b ->> 'digestEndTime' AS digest_end_time, + b ->> 'digestPublicKeyFingerprint' AS digest_public_key_fingerprint, + b ->> 'digestS3Bucket' AS digest_s3_bucket, + b ->> 'digestStartTime' AS digest_start_time + FROM + aws_s3_object AS s, + jsonb_array_elements(body::jsonb) AS b + WHERE + bucket_name = 'steampipe-test' + AND prefix = 'test1/log_text.txt'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Object Metadata and Details + - S3 +Title: List all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_2.yaml b/queries/aws_s3_object_2.yaml old mode 100755 new mode 100644 index 346ad760b..8acf541db --- a/queries/aws_s3_object_2.yaml +++ b/queries/aws_s3_object_2.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class,\n\ - \ version_id\nfrom\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n\ - \ and prefix = 'test/logs/2021/03/01/12';" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class, + version_id + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND prefix = 'test/logs/2021/03/01/12'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 Object -Title: List all AWS S3 Object Metadata and Details + - S3 Object +Title: List all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_3.yaml b/queries/aws_s3_object_3.yaml old mode 100755 new mode 100644 index e459e292e..8166b2bf1 --- a/queries/aws_s3_object_3.yaml +++ b/queries/aws_s3_object_3.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class,\n\ - \ version_id\nfrom\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n\ - \ and prefix = 'test/logs/2021/03/01/12/abc.txt';" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class, + version_id + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND prefix = 'test/logs/2021/03/01/12/abc.txt'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find AWS S3 Object Metadata and Details with SQL + - S3 +Title: Find AWS S3 Object Metadata and Details with SQL \ No newline at end of file diff --git a/queries/aws_s3_object_4.yaml b/queries/aws_s3_object_4.yaml old mode 100755 new mode 100644 index a9b921aff..4be959a50 --- a/queries/aws_s3_object_4.yaml +++ b/queries/aws_s3_object_4.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class,\n\ - \ version_id\nfrom\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n\ - \ and sse_kms_key_id is not null;" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class, + version_id + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND sse_kms_key_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Objects with Encryptions Using SQL + - S3 +Title: List all AWS S3 Objects with Encryptions Using SQL \ No newline at end of file diff --git a/queries/aws_s3_object_5.yaml b/queries/aws_s3_object_5.yaml old mode 100755 new mode 100644 index 09c8931c2..0ea1e886a --- a/queries/aws_s3_object_5.yaml +++ b/queries/aws_s3_object_5.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n arn,\n bucket_name,\n last_modified,\n storage_class,\n\ - \ version_id\nfrom\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n\ - \ and last_modified < current_date - interval '3 months';" + QueryToExecute: | + SELECT + key, + arn, + bucket_name, + last_modified, + storage_class, + version_id + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND last_modified < CURRENT_DATE - INTERVAL '3 months'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Objects and Metadata + - S3 +Title: List all AWS S3 Objects and Metadata \ No newline at end of file diff --git a/queries/aws_s3_object_6.yaml b/queries/aws_s3_object_6.yaml old mode 100755 new mode 100644 index 6423efa7a..a57d67665 --- a/queries/aws_s3_object_6.yaml +++ b/queries/aws_s3_object_6.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.key,\n s.bucket_name,\n s.owner,\n acl_grant ->\ - \ 'Grantee' as grantee,\n acl_grant ->> 'Permission' as permission\nfrom\n aws_s3_object\ - \ as s,\n jsonb_array_elements(aws_s3_object.acl -> 'Grants') as acl_grant\n\ - where\n bucket_name = 'steampipe-test'\n and acl_grant ->> 'Permission' = 'FULL_CONTROL'\n\ - \ and acl_grant -> 'Grantee' ->> 'ID' != aws_s3_object.owner ->> 'ID';" + QueryToExecute: | + SELECT + s.key, + s.bucket_name, + s.owner, + acl_grant -> 'Grantee' AS grantee, + acl_grant ->> 'Permission' AS permission + FROM + aws_s3_object AS s, + jsonb_array_elements(aws_s3_object.acl -> 'Grants') AS acl_grant + WHERE + bucket_name = 'steampipe-test' + AND acl_grant ->> 'Permission' = 'FULL_CONTROL' + AND acl_grant -> 'Grantee' ->> 'ID' != aws_s3_object.owner ->> 'ID'; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List AWS S3 Objects and Retrieve Metadata Details + - S3 +Title: List AWS S3 Objects and Retrieve Metadata Details \ No newline at end of file diff --git a/queries/aws_s3_object_7.yaml b/queries/aws_s3_object_7.yaml old mode 100755 new mode 100644 index d1916c359..076c2efcd --- a/queries/aws_s3_object_7.yaml +++ b/queries/aws_s3_object_7.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n bucket_name,\n object_lock_legal_hold_status\n\ - from\n aws_s3_object\nwhere\n bucket_name = 'steampipe-test'\n and object_lock_legal_hold_status\ - \ = 'ON';" + QueryToExecute: | + SELECT + key, + bucket_name, + object_lock_legal_hold_status + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND object_lock_legal_hold_status = 'ON'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Object Metadata and Details + - S3 +Title: Find all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_8.yaml b/queries/aws_s3_object_8.yaml old mode 100755 new mode 100644 index f42ce20dc..7fc867e20 --- a/queries/aws_s3_object_8.yaml +++ b/queries/aws_s3_object_8.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n key,\n bucket_name,\n object_lock_retain_until_date,\n\ - \ object_lock_mode,\n object_lock_legal_hold_status\nfrom\n aws_s3_object\n\ - where\n bucket_name = 'steampipe-test'\n and object_lock_mode = 'GOVERNANCE';" + QueryToExecute: | + SELECT + key, + bucket_name, + object_lock_retain_until_date, + object_lock_mode, + object_lock_legal_hold_status + FROM + aws_s3_object + WHERE + bucket_name = 'steampipe-test' + AND object_lock_mode = 'GOVERNANCE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: List all AWS S3 Object Metadata and Details + - S3 +Title: List all AWS S3 Object Metadata and Details \ No newline at end of file diff --git a/queries/aws_s3_object_9.yaml b/queries/aws_s3_object_9.yaml old mode 100755 new mode 100644 index 9e5691524..693e2c008 --- a/queries/aws_s3_object_9.yaml +++ b/queries/aws_s3_object_9.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS S3 Objects and retrieve metadata and details - about each object stored in S3 buckets. +Description: Allows users to query AWS S3 Objects and retrieve metadata and details about each object stored in S3 buckets. ID: aws_s3_object_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.key,\n s.bucket_name,\n s.object_lock_retain_until_date,\n\ - \ s.object_lock_mode,\n s.object_lock_legal_hold_status\nfrom\n aws_s3_object\ - \ as s\nwhere\n bucket_name = 'steampipe-test'\n and object_lock_retain_until_date\ - \ > current_date + interval '1 year';" + QueryToExecute: | + SELECT + s.key, + s.bucket_name, + s.object_lock_retain_until_date, + s.object_lock_mode, + s.object_lock_legal_hold_status + FROM + aws_s3_object AS s + WHERE + s.bucket_name = 'steampipe-test' + AND s.object_lock_retain_until_date > CURRENT_DATE + INTERVAL '1 year'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find metadata and details of AWS S3 Objects + - S3 +Title: Find metadata and details of AWS S3 Objects \ No newline at end of file diff --git a/queries/aws_s3_object_version_1.yaml b/queries/aws_s3_object_version_1.yaml old mode 100755 new mode 100644 index cc9ff4733..83a8e320a --- a/queries/aws_s3_object_version_1.yaml +++ b/queries/aws_s3_object_version_1.yaml @@ -1,22 +1,29 @@ -Description: Allows querying information about versions of objects stored in Amazon - S3 buckets. This table provides details such as bucket name, delimiter, encoding - type, version ID marker, prefix, whether the results are truncated, common prefixes, - delete markers, and version information. +Description: Allows querying information about versions of objects stored in Amazon S3 buckets. This table provides details such as bucket name, delimiter, encoding type, version ID marker, prefix, whether the results are truncated, common prefixes, delete markers, and version information. ID: aws_s3_object_version_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n key,\n storage_class,\n version_id,\n\ - \ is_latest,\n size\nfrom\n aws_s3_object_version\nwhere\n bucket_name = 'testbucket';" + QueryToExecute: | + SELECT + bucket_name, + key, + storage_class, + version_id, + is_latest, + size + FROM + aws_s3_object_version + WHERE + bucket_name = 'testbucket'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon S3 -Title: List all AWS S3 Object Versions in Bucket + - Amazon S3 +Title: List all AWS S3 Object Versions in Bucket \ No newline at end of file diff --git a/queries/aws_s3_object_version_2.yaml b/queries/aws_s3_object_version_2.yaml old mode 100755 new mode 100644 index 4a877f15f..f7cd2eec8 --- a/queries/aws_s3_object_version_2.yaml +++ b/queries/aws_s3_object_version_2.yaml @@ -1,23 +1,32 @@ -Description: Allows querying information about versions of objects stored in Amazon - S3 buckets. This table provides details such as bucket name, delimiter, encoding - type, version ID marker, prefix, whether the results are truncated, common prefixes, - delete markers, and version information. +Description: Allows querying information about versions of objects stored in Amazon S3 buckets. This table provides details such as bucket name, delimiter, encoding type, version ID marker, prefix, whether the results are truncated, common prefixes, delete markers, and version information. ID: aws_s3_object_version_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n bucket_name,\n key,\n storage_class,\n version_id,\n\ - \ is_latest,\n size,\n etag,\n owner_id\nfrom\n aws_s3_object_version\nwhere\n\ - \ bucket_name = 'testbucket'\nand\n key = 'test/template.txt';" + QueryToExecute: | + SELECT + bucket_name, + key, + storage_class, + version_id, + is_latest, + size, + etag, + owner_id + FROM + aws_s3_object_version + WHERE + bucket_name = 'testbucket' + AND key = 'test/template.txt'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 -Title: Find all AWS S3 Object Versions in Buckets + - S3 +Title: Find all AWS S3 Object Versions in Buckets \ No newline at end of file diff --git a/queries/aws_s3_object_version_3.yaml b/queries/aws_s3_object_version_3.yaml old mode 100755 new mode 100644 index ae6687142..f0f8273a4 --- a/queries/aws_s3_object_version_3.yaml +++ b/queries/aws_s3_object_version_3.yaml @@ -1,19 +1,33 @@ +Description: Allows querying information about versions of objects stored in Amazon S3 buckets. This table provides details such as bucket name, delimiter, encoding type, version ID marker, prefix, whether the results are truncated, common prefixes, delete markers, and version information. ID: aws_s3_object_version_3 -Title: "Find AWS S3 Object Versions and Details" -Description: "Allows querying information about versions of objects stored in Amazon S3 buckets. This table provides details such as bucket name, delimiter, encoding type, version ID marker, prefix, whether the results are truncated, common prefixes, delete markers, and version information." IntegrationType: [] Query: Engine: "" - QueryToExecute: "" - PrimaryTable: null ListOfTables: [] Parameters: [] + PrimaryTable: null + QueryToExecute: | + SELECT + bucket_name, + delimiter, + encoding_type, + version_id_marker, + prefix, + is_truncated, + common_prefixes, + delete_markers, + version_info + FROM + aws_s3_object_versions + WHERE + bucket_name IS NOT NULL Tags: cloud_asset_management: - - "true" + - "true" cloud_data_security: - - "true" + - "true" cloud_provider: - - aws + - aws cloud_service: - - S3 + - S3 +Title: Find AWS S3 Object Versions and Details \ No newline at end of file diff --git a/queries/aws_sagemaker_app_1.yaml b/queries/aws_sagemaker_app_1.yaml old mode 100755 new mode 100644 index 414bcb3c4..c672d2e71 --- a/queries/aws_sagemaker_app_1.yaml +++ b/queries/aws_sagemaker_app_1.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query AWS SageMaker App data, providing detailed insights - into application configurations, user settings, and associated metadata. +Description: Allows users to query AWS SageMaker App data, providing detailed insights into application configurations, user settings, and associated metadata. ID: aws_sagemaker_app_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status\nfrom\n aws_sagemaker_app;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status + FROM + aws_sagemaker_app; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List all AWS SageMaker App configurations + - SageMaker +Title: List all AWS SageMaker App configurations \ No newline at end of file diff --git a/queries/aws_sagemaker_app_2.yaml b/queries/aws_sagemaker_app_2.yaml old mode 100755 new mode 100644 index 93c353f9d..056a5e6cd --- a/queries/aws_sagemaker_app_2.yaml +++ b/queries/aws_sagemaker_app_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS SageMaker App data, providing detailed insights - into application configurations, user settings, and associated metadata. +Description: Allows users to query AWS SageMaker App data, providing detailed insights into application configurations, user settings, and associated metadata. ID: aws_sagemaker_app_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status,\n failure_reason\n\ - from\n aws_sagemaker_app\nwhere \n status = 'Failed';" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status, + failure_reason + FROM + aws_sagemaker_app + WHERE + status = 'Failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker App -Title: Find AWS SageMaker App Configurations and Metadata + - SageMaker App +Title: Find AWS SageMaker App Configurations and Metadata \ No newline at end of file diff --git a/queries/aws_sagemaker_domain_1.yaml b/queries/aws_sagemaker_domain_1.yaml old mode 100755 new mode 100644 index 96b374f9e..ab20324c2 --- a/queries/aws_sagemaker_domain_1.yaml +++ b/queries/aws_sagemaker_domain_1.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS - SageMaker Studio domains, including domain details, status, and associated metadata. +Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS SageMaker Studio domains, including domain details, status, and associated metadata. ID: aws_sagemaker_domain_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status\nfrom\n aws_sagemaker_domain;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status + FROM + aws_sagemaker_domain; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker Studio -Title: Find AWS SageMaker Domains and Metadata Details + - SageMaker Studio +Title: Find AWS SageMaker Domains and Metadata Details \ No newline at end of file diff --git a/queries/aws_sagemaker_domain_2.yaml b/queries/aws_sagemaker_domain_2.yaml old mode 100755 new mode 100644 index 7f5bf186c..0811c3995 --- a/queries/aws_sagemaker_domain_2.yaml +++ b/queries/aws_sagemaker_domain_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS - SageMaker Studio domains, including domain details, status, and associated metadata. +Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS SageMaker Studio domains, including domain details, status, and associated metadata. ID: aws_sagemaker_domain_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n creation_time,\n home_efs_file_system_id,\n\ - \ kms_key_id\nfrom\n aws_sagemaker_domain\nwhere \n kms_key_id is null;" + QueryToExecute: | + SELECT + name, + creation_time, + home_efs_file_system_id, + kms_key_id + FROM + aws_sagemaker_domain + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List all AWS SageMaker Studio Domain Details and Status + - SageMaker +Title: List all AWS SageMaker Studio Domain Details and Status \ No newline at end of file diff --git a/queries/aws_sagemaker_domain_3.yaml b/queries/aws_sagemaker_domain_3.yaml old mode 100755 new mode 100644 index e99f0b1db..3d3d5be47 --- a/queries/aws_sagemaker_domain_3.yaml +++ b/queries/aws_sagemaker_domain_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS - SageMaker Studio domains, including domain details, status, and associated metadata. +Description: Allows users to query AWS SageMaker Domains to retrieve data about AWS SageMaker Studio domains, including domain details, status, and associated metadata. ID: aws_sagemaker_domain_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n app_network_access_type\n\ - from\n aws_sagemaker_domain\nwhere \n app_network_access_type = 'PublicInternetOnly';" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + app_network_access_type + FROM + aws_sagemaker_domain + WHERE + app_network_access_type = 'PublicInternetOnly'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker Studio -Title: Find AWS SageMaker Domains and Their Details + - SageMaker Studio +Title: Find AWS SageMaker Domains and Their Details \ No newline at end of file diff --git a/queries/aws_sagemaker_endpoint_configuration_1.yaml b/queries/aws_sagemaker_endpoint_configuration_1.yaml old mode 100755 new mode 100644 index 34470ea5a..0ce943e44 --- a/queries/aws_sagemaker_endpoint_configuration_1.yaml +++ b/queries/aws_sagemaker_endpoint_configuration_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS SageMaker Endpoint Configurations to retrieve - detailed information about each endpoint configuration in the AWS SageMaker service. +Description: Allows users to query AWS SageMaker Endpoint Configurations to retrieve detailed information about each endpoint configuration in the AWS SageMaker service. ID: aws_sagemaker_endpoint_configuration_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n kms_key_id,\n creation_time,\n production_variants,\n\ - \ tags\nfrom\n aws_sagemaker_endpoint_configuration;" + QueryToExecute: | + SELECT + name, + arn, + kms_key_id, + creation_time, + production_variants, + tags + FROM + aws_sagemaker_endpoint_configuration; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List all AWS SageMaker Endpoint Configurations with Details + - SageMaker +Title: List all AWS SageMaker Endpoint Configurations with Details \ No newline at end of file diff --git a/queries/aws_sagemaker_endpoint_configuration_2.yaml b/queries/aws_sagemaker_endpoint_configuration_2.yaml old mode 100755 new mode 100644 index 36cc78297..0e793e2df --- a/queries/aws_sagemaker_endpoint_configuration_2.yaml +++ b/queries/aws_sagemaker_endpoint_configuration_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS SageMaker Endpoint Configurations to retrieve - detailed information about each endpoint configuration in the AWS SageMaker service. +Description: Allows users to query AWS SageMaker Endpoint Configurations to retrieve detailed information about each endpoint configuration in the AWS SageMaker service. ID: aws_sagemaker_endpoint_configuration_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n kms_key_id\nfrom\n aws_sagemaker_endpoint_configuration\n\ - where\n kms_key_id is null;" + QueryToExecute: | + SELECT + name, + arn, + kms_key_id + FROM + aws_sagemaker_endpoint_configuration + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: Find AWS SageMaker Endpoint Configuration details + - SageMaker +Title: Find AWS SageMaker Endpoint Configuration details \ No newline at end of file diff --git a/queries/aws_sagemaker_model_1.yaml b/queries/aws_sagemaker_model_1.yaml old mode 100755 new mode 100644 index 8e3b25771..339c5fc80 --- a/queries/aws_sagemaker_model_1.yaml +++ b/queries/aws_sagemaker_model_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS SageMaker Models for detailed information about - each model, including its name, ARN, creation time, execution role, and more. +Description: Allows users to query AWS SageMaker Models for detailed information about each model, including its name, ARN, creation time, execution role, and more. ID: aws_sagemaker_model_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n enable_network_isolation\n\ - from\n aws_sagemaker_model;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + enable_network_isolation + FROM + aws_sagemaker_model; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: Find all AWS SageMaker Models Using SQL + - SageMaker +Title: Find all AWS SageMaker Models Using SQL \ No newline at end of file diff --git a/queries/aws_sagemaker_model_2.yaml b/queries/aws_sagemaker_model_2.yaml old mode 100755 new mode 100644 index dc7064496..39563b12f --- a/queries/aws_sagemaker_model_2.yaml +++ b/queries/aws_sagemaker_model_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS SageMaker Models for detailed information about - each model, including its name, ARN, creation time, execution role, and more. +Description: Allows users to query AWS SageMaker Models for detailed information about each model, including its name, ARN, creation time, execution role, and more. ID: aws_sagemaker_model_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n enable_network_isolation\n\ - from\n aws_sagemaker_model\nwhere\n enable_network_isolation;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + enable_network_isolation + FROM + aws_sagemaker_model + WHERE + enable_network_isolation; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List AWS SageMaker Models with Detailed Information + - SageMaker +Title: List AWS SageMaker Models with Detailed Information \ No newline at end of file diff --git a/queries/aws_sagemaker_notebook_instance_1.yaml b/queries/aws_sagemaker_notebook_instance_1.yaml old mode 100755 new mode 100644 index a885f4900..eca01ce00 --- a/queries/aws_sagemaker_notebook_instance_1.yaml +++ b/queries/aws_sagemaker_notebook_instance_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS SageMaker Notebook Instances to gather information - about their configuration, status, and other related details. +Description: Allows users to query AWS SageMaker Notebook Instances to gather information about their configuration, status, and other related details. ID: aws_sagemaker_notebook_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n instance_type,\n \ - \ notebook_instance_status\nfrom\n aws_sagemaker_notebook_instance;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + instance_type, + notebook_instance_status + FROM + aws_sagemaker_notebook_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: Find all AWS SageMaker Notebook Instances Configuration + - SageMaker +Title: Find all AWS SageMaker Notebook Instances Configuration \ No newline at end of file diff --git a/queries/aws_sagemaker_notebook_instance_2.yaml b/queries/aws_sagemaker_notebook_instance_2.yaml old mode 100755 new mode 100644 index 3e66f0a40..761a4cfa5 --- a/queries/aws_sagemaker_notebook_instance_2.yaml +++ b/queries/aws_sagemaker_notebook_instance_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SageMaker Notebook Instances to gather information - about their configuration, status, and other related details. +Description: Allows users to query AWS SageMaker Notebook Instances to gather information about their configuration, status, and other related details. ID: aws_sagemaker_notebook_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n kms_key_id\nfrom\n aws_sagemaker_notebook_instance\n\ - where\n kms_key_id is null;" + QueryToExecute: | + SELECT + name, + kms_key_id + FROM + aws_sagemaker_notebook_instance + WHERE + kms_key_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS SageMaker -Title: List all AWS SageMaker Notebook Instance details + - AWS SageMaker +Title: List all AWS SageMaker Notebook Instance details \ No newline at end of file diff --git a/queries/aws_sagemaker_notebook_instance_3.yaml b/queries/aws_sagemaker_notebook_instance_3.yaml old mode 100755 new mode 100644 index f42f70bbc..81a5b9baf --- a/queries/aws_sagemaker_notebook_instance_3.yaml +++ b/queries/aws_sagemaker_notebook_instance_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SageMaker Notebook Instances to gather information - about their configuration, status, and other related details. +Description: Allows users to query AWS SageMaker Notebook Instances to gather information about their configuration, status, and other related details. ID: aws_sagemaker_notebook_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n direct_internet_access\nfrom\n aws_sagemaker_notebook_instance\n\ - where\n direct_internet_access = 'Disabled';" + QueryToExecute: | + SELECT + name, + direct_internet_access + FROM + aws_sagemaker_notebook_instance + WHERE + direct_internet_access = 'Disabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List all AWS SageMaker Notebook Instances Configuration + - SageMaker +Title: List all AWS SageMaker Notebook Instances Configuration \ No newline at end of file diff --git a/queries/aws_sagemaker_notebook_instance_4.yaml b/queries/aws_sagemaker_notebook_instance_4.yaml old mode 100755 new mode 100644 index 42cfd8f15..1a2f18537 --- a/queries/aws_sagemaker_notebook_instance_4.yaml +++ b/queries/aws_sagemaker_notebook_instance_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SageMaker Notebook Instances to gather information - about their configuration, status, and other related details. +Description: Allows users to query AWS SageMaker Notebook Instances to gather information about their configuration, status, and other related details. ID: aws_sagemaker_notebook_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n root_access\nfrom\n aws_sagemaker_notebook_instance\n\ - where\n root_access = 'Enabled';" + QueryToExecute: | + SELECT + name, + root_access + FROM + aws_sagemaker_notebook_instance + WHERE + root_access = 'Enabled'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: Find AWS SageMaker Notebook Instances by Configuration + - SageMaker +Title: Find AWS SageMaker Notebook Instances by Configuration \ No newline at end of file diff --git a/queries/aws_sagemaker_training_job_1.yaml b/queries/aws_sagemaker_training_job_1.yaml old mode 100755 new mode 100644 index 18577fa7a..4954d2663 --- a/queries/aws_sagemaker_training_job_1.yaml +++ b/queries/aws_sagemaker_training_job_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS SageMaker Training Jobs to retrieve information - about individual training jobs. +Description: Allows users to query AWS SageMaker Training Jobs to retrieve information about individual training jobs. ID: aws_sagemaker_training_job_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n training_job_status,\n creation_time,\n\ - \ last_modified_time\nfrom\n aws_sagemaker_training_job;" + QueryToExecute: | + SELECT + name, + arn, + training_job_status, + creation_time, + last_modified_time + FROM + aws_sagemaker_training_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List all AWS SageMaker Training Jobs using SQL + - SageMaker +Title: List all AWS SageMaker Training Jobs using SQL \ No newline at end of file diff --git a/queries/aws_sagemaker_training_job_2.yaml b/queries/aws_sagemaker_training_job_2.yaml old mode 100755 new mode 100644 index 51b753479..9057454ee --- a/queries/aws_sagemaker_training_job_2.yaml +++ b/queries/aws_sagemaker_training_job_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS SageMaker Training Jobs to retrieve information - about individual training jobs. +Description: Allows users to query AWS SageMaker Training Jobs to retrieve information about individual training jobs. ID: aws_sagemaker_training_job_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n resource_config ->> 'InstanceType' as\ - \ instance_type,\n resource_config ->> 'InstanceCount' as instance_count,\n \ - \ resource_config ->> 'VolumeKmsKeyId' as volume_kms_id,\n resource_config ->>\ - \ 'VolumeSizeInGB' as volume_size\nfrom\n aws_sagemaker_training_job;" + QueryToExecute: | + SELECT + name, + arn, + resource_config ->> 'InstanceType' AS instance_type, + resource_config ->> 'InstanceCount' AS instance_count, + resource_config ->> 'VolumeKmsKeyId' AS volume_kms_id, + resource_config ->> 'VolumeSizeInGB' AS volume_size + FROM + aws_sagemaker_training_job; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: List AWS SageMaker Training Jobs via SQL + - SageMaker +Title: List AWS SageMaker Training Jobs via SQL \ No newline at end of file diff --git a/queries/aws_sagemaker_training_job_3.yaml b/queries/aws_sagemaker_training_job_3.yaml old mode 100755 new mode 100644 index 72ef83640..83f27bcb7 --- a/queries/aws_sagemaker_training_job_3.yaml +++ b/queries/aws_sagemaker_training_job_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS SageMaker Training Jobs to retrieve information - about individual training jobs. +Description: Allows users to query AWS SageMaker Training Jobs to retrieve information about individual training jobs. ID: aws_sagemaker_training_job_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n training_job_status,\n failure_reason\n\ - from\n aws_sagemaker_training_job\nwhere\n training_job_status = 'Failed';" + QueryToExecute: | + SELECT + name, + arn, + training_job_status, + failure_reason + FROM + aws_sagemaker_training_job + WHERE + training_job_status = 'Failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SageMaker -Title: Find AWS SageMaker Training Jobs with Status Failed + - SageMaker +Title: Find AWS SageMaker Training Jobs with Status Failed \ No newline at end of file diff --git a/queries/aws_secretsmanager_secret_1.yaml b/queries/aws_secretsmanager_secret_1.yaml old mode 100755 new mode 100644 index b872bfd3c..56a18e98e --- a/queries/aws_secretsmanager_secret_1.yaml +++ b/queries/aws_secretsmanager_secret_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Secrets Manager Secret data, including metadata, - versions, rotation configuration, and more. +Description: Allows users to query AWS Secrets Manager Secret data, including metadata, versions, rotation configuration, and more. ID: aws_secretsmanager_secret_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_date,\n description,\n last_accessed_date\n\ - from\n aws_secretsmanager_secret;" + QueryToExecute: | + SELECT + name, + created_date, + description, + last_accessed_date + FROM + aws_secretsmanager_secret; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Secrets Manager -Title: List AWS Secrets Manager Secret Data and Metadata + - Secrets Manager +Title: List AWS Secrets Manager Secret Data and Metadata \ No newline at end of file diff --git a/queries/aws_secretsmanager_secret_2.yaml b/queries/aws_secretsmanager_secret_2.yaml old mode 100755 new mode 100644 index f884dd9ef..d5ab85bb5 --- a/queries/aws_secretsmanager_secret_2.yaml +++ b/queries/aws_secretsmanager_secret_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Secrets Manager Secret data, including metadata, - versions, rotation configuration, and more. +Description: Allows users to query AWS Secrets Manager Secret data, including metadata, versions, rotation configuration, and more. ID: aws_secretsmanager_secret_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_date,\n description,\n rotation_enabled\n\ - from\n aws_secretsmanager_secret\nwhere\n not rotation_enabled;" + QueryToExecute: | + SELECT + name, + created_date, + description, + rotation_enabled + FROM + aws_secretsmanager_secret + WHERE + NOT rotation_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Secrets Manager -Title: List AWS Secrets Manager Secret Data Including Metadata + - Secrets Manager +Title: List AWS Secrets Manager Secret Data Including Metadata \ No newline at end of file diff --git a/queries/aws_secretsmanager_secret_3.yaml b/queries/aws_secretsmanager_secret_3.yaml old mode 100755 new mode 100644 index 9f86333bd..76be407c3 --- a/queries/aws_secretsmanager_secret_3.yaml +++ b/queries/aws_secretsmanager_secret_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Secrets Manager Secret data, including metadata, - versions, rotation configuration, and more. +Description: Allows users to query AWS Secrets Manager Secret data, including metadata, versions, rotation configuration, and more. ID: aws_secretsmanager_secret_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_date,\n description,\n rotation_enabled,\n\ - \ rotation_rules\nfrom\n aws_secretsmanager_secret\nwhere\n rotation_rules\ - \ -> 'AutomaticallyAfterDays' > '7';" + QueryToExecute: | + SELECT + name, + created_date, + description, + rotation_enabled, + rotation_rules + FROM + aws_secretsmanager_secret + WHERE + rotation_rules -> 'AutomaticallyAfterDays' > '7'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Secrets Manager -Title: Find AWS Secrets Manager Secret Data and Metadata + - Secrets Manager +Title: Find AWS Secrets Manager Secret Data and Metadata \ No newline at end of file diff --git a/queries/aws_secretsmanager_secret_4.yaml b/queries/aws_secretsmanager_secret_4.yaml old mode 100755 new mode 100644 index 749431ea3..4816434fd --- a/queries/aws_secretsmanager_secret_4.yaml +++ b/queries/aws_secretsmanager_secret_4.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Secrets Manager Secret data, including metadata, - versions, rotation configuration, and more. +Description: Allows users to query AWS Secrets Manager Secret data, including metadata, versions, rotation configuration, and more. ID: aws_secretsmanager_secret_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n created_date,\n description,\n replication_status\n\ - from\n aws_secretsmanager_secret\nwhere\n replication_status is null;" + QueryToExecute: | + SELECT + name, + created_date, + description, + replication_status + FROM + aws_secretsmanager_secret + WHERE + replication_status IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Secrets Manager -Title: Find AWS Secrets Manager Secret Data + - Secrets Manager +Title: Find AWS Secrets Manager Secret Data \ No newline at end of file diff --git a/queries/aws_secretsmanager_secret_5.yaml b/queries/aws_secretsmanager_secret_5.yaml old mode 100755 new mode 100644 index 94dc1c1d7..efcfbb985 --- a/queries/aws_secretsmanager_secret_5.yaml +++ b/queries/aws_secretsmanager_secret_5.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Secrets Manager Secret data, including metadata, - versions, rotation configuration, and more. +Description: Allows users to query AWS Secrets Manager Secret data, including metadata, versions, rotation configuration, and more. ID: aws_secretsmanager_secret_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_pretty(policy) as policy,\n jsonb_pretty(policy_std)\ - \ as policy_std\nfrom\n aws_secretsmanager_secret;" + QueryToExecute: | + SELECT + name, + jsonb_pretty(policy) AS policy, + jsonb_pretty(policy_std) AS policy_std + FROM + aws_secretsmanager_secret; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Secrets Manager -Title: List AWS Secrets Manager Secret Data and Configuration + - Secrets Manager +Title: List AWS Secrets Manager Secret Data and Configuration \ No newline at end of file diff --git a/queries/aws_securityhub_action_target_1.yaml b/queries/aws_securityhub_action_target_1.yaml old mode 100755 new mode 100644 index 7e21e6930..8ce7d14c0 --- a/queries/aws_securityhub_action_target_1.yaml +++ b/queries/aws_securityhub_action_target_1.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Security Hub Action Targets, providing detailed - information about each action target within AWS Security Hub, including its ARN, - name, and description. +Description: Allows users to query AWS Security Hub Action Targets, providing detailed information about each action target within AWS Security Hub, including its ARN, name, and description. ID: aws_securityhub_action_target_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n region\nfrom\n aws_securityhub_action_target;" + QueryToExecute: | + SELECT + name, + arn, + region + FROM + aws_securityhub_action_target; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Action Targets + - Security Hub +Title: List AWS Security Hub Action Targets \ No newline at end of file diff --git a/queries/aws_securityhub_action_target_2.yaml b/queries/aws_securityhub_action_target_2.yaml old mode 100755 new mode 100644 index dbbadc702..8d603a6ea --- a/queries/aws_securityhub_action_target_2.yaml +++ b/queries/aws_securityhub_action_target_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Security Hub Action Targets, providing detailed - information about each action target within AWS Security Hub, including its ARN, - name, and description. +Description: Allows users to query AWS Security Hub Action Targets, providing detailed information about each action target within AWS Security Hub, including its ARN, name, and description. ID: aws_securityhub_action_target_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n region\nfrom\n aws_securityhub_action_target\n\ - where\n arn = 'arn:aws:securityhub:ap-south-1:*****:action/custom/test';" + QueryToExecute: | + SELECT + name, + arn, + region + FROM + aws_securityhub_action_target + WHERE + arn = 'arn:aws:securityhub:ap-south-1:*****:action/custom/test'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Action Targets with Details + - Security Hub +Title: List AWS Security Hub Action Targets with Details \ No newline at end of file diff --git a/queries/aws_securityhub_enabled_product_subscription_1.yaml b/queries/aws_securityhub_enabled_product_subscription_1.yaml old mode 100755 new mode 100644 index cb7e683e2..97b96f525 --- a/queries/aws_securityhub_enabled_product_subscription_1.yaml +++ b/queries/aws_securityhub_enabled_product_subscription_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query details of enabled product subscriptions in AWS - Security Hub, providing insights into their activation, integration types, and company - information. +Description: Allows users to query details of enabled product subscriptions in AWS Security Hub, providing insights into their activation, integration types, and company information. ID: aws_securityhub_enabled_product_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n title,\n akas\nfrom\n aws_securityhub_enabled_product_subscription;" + QueryToExecute: | + SELECT + arn, + title, + akas + FROM + aws_securityhub_enabled_product_subscription; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Enabled Product Subscriptions + - Security Hub +Title: Find AWS Security Hub Enabled Product Subscriptions \ No newline at end of file diff --git a/queries/aws_securityhub_enabled_product_subscription_2.yaml b/queries/aws_securityhub_enabled_product_subscription_2.yaml old mode 100755 new mode 100644 index be9bcf2ed..effdcaac7 --- a/queries/aws_securityhub_enabled_product_subscription_2.yaml +++ b/queries/aws_securityhub_enabled_product_subscription_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query details of enabled product subscriptions in AWS - Security Hub, providing insights into their activation, integration types, and company - information. +Description: Allows users to query details of enabled product subscriptions in AWS Security Hub, providing insights into their activation, integration types, and company information. ID: aws_securityhub_enabled_product_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.arn as subscription_arn,\n p.product_arn,\n p.name\ - \ as product_name,\n p.company_name as product_company_name,\n p.marketplace_url,\n\ - \ p.integration_types\nfrom\n aws_securityhub_enabled_product_subscription as\ - \ s,\n aws_securityhub_product as p,\n jsonb_array_elements(p.product_subscription_resource_policy\ - \ -> 'Statement') as m\nwhere\n (m ->> 'Resource') = s.arn;" + QueryToExecute: | + SELECT + s.arn AS subscription_arn, + p.product_arn, + p.name AS product_name, + p.company_name AS product_company_name, + p.marketplace_url, + p.integration_types + FROM + aws_securityhub_enabled_product_subscription AS s, + aws_securityhub_product AS p, + jsonb_array_elements(p.product_subscription_resource_policy -> 'Statement') AS m + WHERE + (m ->> 'Resource') = s.arn; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Query AWS Security Hub Enabled Product Subscriptions + - Security Hub +Title: Query AWS Security Hub Enabled Product Subscriptions \ No newline at end of file diff --git a/queries/aws_securityhub_finding_1.yaml b/queries/aws_securityhub_finding_1.yaml old mode 100755 new mode 100644 index 75fd2039c..845bc558a --- a/queries/aws_securityhub_finding_1.yaml +++ b/queries/aws_securityhub_finding_1.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n company_name,\n created_at,\n criticality,\n\ - \ confidence\nfrom\n aws_securityhub_finding;" + QueryToExecute: | + SELECT + title, + id, + company_name, + created_at, + criticality, + confidence + FROM + aws_securityhub_finding; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: 'Find AWS Security Hub Findings: Details and Remediation' + - AWS Security Hub +Title: 'Find AWS Security Hub Findings: Details and Remediation' \ No newline at end of file diff --git a/queries/aws_securityhub_finding_10.yaml b/queries/aws_securityhub_finding_10.yaml old mode 100755 new mode 100644 index 0dfaa48bd..d630eff5f --- a/queries/aws_securityhub_finding_10.yaml +++ b/queries/aws_securityhub_finding_10.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n product_arn,\n product_name,\n workflow_status\n\ - from\n aws_securityhub_finding\nwhere \n workflow_status = 'NOTIFIED';" + QueryToExecute: | + SELECT + title, + id, + product_arn, + product_name, + workflow_status + FROM + aws_securityhub_finding + WHERE + workflow_status = 'NOTIFIED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find all AWS Security Hub Findings with Status Details + - AWS Security Hub +Title: Find all AWS Security Hub Findings with Status Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_11.yaml b/queries/aws_securityhub_finding_11.yaml old mode 100755 new mode 100644 index ff74df92f..4d867d180 --- a/queries/aws_securityhub_finding_11.yaml +++ b/queries/aws_securityhub_finding_11.yaml @@ -1,28 +1,33 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_11 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n network ->> 'DestinationDomain' as network_destination_domain,\n\ - \ network ->> 'DestinationIpV4' as network_destination_ip_v4,\n network ->>\ - \ 'DestinationIpV6' as network_destination_ip_v6,\n network ->> 'DestinationPort'\ - \ as network_destination_port,\n network ->> 'Protocol' as network_protocol,\n\ - \ network ->> 'SourceIpV4' as network_source_ip_v4,\n network ->> 'SourceIpV6'\ - \ as network_source_ip_v6,\n network ->> 'SourcePort' as network_source_port\n\ - from\n aws_securityhub_finding\nwhere \n title = 'EC2 instance involved in SSH\ - \ brute force attacks.';" + QueryToExecute: | + SELECT + title, + id, + network ->> 'DestinationDomain' AS network_destination_domain, + network ->> 'DestinationIpV4' AS network_destination_ip_v4, + network ->> 'DestinationIpV6' AS network_destination_ip_v6, + network ->> 'DestinationPort' AS network_destination_port, + network ->> 'Protocol' AS network_protocol, + network ->> 'SourceIpV4' AS network_source_ip_v4, + network ->> 'SourceIpV6' AS network_source_ip_v6, + network ->> 'SourcePort' AS network_source_port + FROM + aws_securityhub_finding + WHERE + title = 'EC2 instance involved in SSH brute force attacks.'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS EC2 Security Issues with Severity and Status + - Security Hub +Title: Find AWS EC2 Security Issues with Severity and Status \ No newline at end of file diff --git a/queries/aws_securityhub_finding_12.yaml b/queries/aws_securityhub_finding_12.yaml old mode 100755 new mode 100644 index 99b1be6bb..a6faada6f --- a/queries/aws_securityhub_finding_12.yaml +++ b/queries/aws_securityhub_finding_12.yaml @@ -1,34 +1,40 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_12 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n patch_summary ->> 'Id' as patch_id,\n\ - \ patch_summary ->> 'FailedCount' as failed_count,\n patch_summary ->> 'InstalledCount'\ - \ as installed_count,\n patch_summary ->> 'InstalledOtherCount' as installed_other_count,\n\ - \ patch_summary ->> 'InstalledPendingReboot' as installed_pending_reboot,\n \ - \ patch_summary ->> 'InstalledRejectedCount' as installed_rejected_count,\n patch_summary\ - \ ->> 'MissingCount' as missing_count,\n patch_summary ->> 'Operation' as operation,\n\ - \ patch_summary ->> 'OperationEndTime' as operation_end_time,\n patch_summary\ - \ ->> 'OperationStartTime' as operation_start_time,\n patch_summary ->> 'RebootOption'\ - \ as reboot_option\nfrom\n aws_securityhub_finding\nwhere \n title = 'EC2 instance\ - \ involved in SSH brute force attacks.';" + QueryToExecute: | + SELECT + title, + id, + patch_summary ->> 'Id' AS patch_id, + patch_summary ->> 'FailedCount' AS failed_count, + patch_summary ->> 'InstalledCount' AS installed_count, + patch_summary ->> 'InstalledOtherCount' AS installed_other_count, + patch_summary ->> 'InstalledPendingReboot' AS installed_pending_reboot, + patch_summary ->> 'InstalledRejectedCount' AS installed_rejected_count, + patch_summary ->> 'MissingCount' AS missing_count, + patch_summary ->> 'Operation' AS operation, + patch_summary ->> 'OperationEndTime' AS operation_end_time, + patch_summary ->> 'OperationStartTime' AS operation_start_time, + patch_summary ->> 'RebootOption' AS reboot_option + FROM + aws_securityhub_finding + WHERE + title = 'EC2 instance involved in SSH brute force attacks.'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Findings with Details + - Security Hub +Title: List AWS Security Hub Findings with Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_13.yaml b/queries/aws_securityhub_finding_13.yaml old mode 100755 new mode 100644 index d60da0685..5bcf4a95b --- a/queries/aws_securityhub_finding_13.yaml +++ b/queries/aws_securityhub_finding_13.yaml @@ -1,32 +1,39 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_13 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n v ->> 'Id' as vulnerabilitie_id,\n v -> 'Vendor'\ - \ ->> 'Name' as vendor_name,\n v -> 'Vendor' ->> 'Url' as vendor_url,\n v ->\ - \ 'Vendor' ->> 'VendorCreatedAt' as vendor_created_at,\n v -> 'Vendor' ->> 'VendorSeverity'\ - \ as vendor_severity,\n v -> 'Vendor' ->> 'VendorUpdatedAt' as vendor_updated_at,\n\ - \ v ->> 'Cvss' as cvss,\n v ->> 'ReferenceUrls' as reference_urls,\n v ->>\ - \ 'RelatedVulnerabilities' as related_vulnerabilities,\n v ->> 'VulnerablePackages'\ - \ as vulnerable_packages\nfrom\n aws_securityhub_finding,\n jsonb_array_elements(vulnerabilities)\ - \ as v\nwhere \n title = 'EC2 instance involved in SSH brute force attacks.';" + QueryToExecute: | + SELECT + title, + v ->> 'Id' AS vulnerabilitie_id, + v -> 'Vendor' ->> 'Name' AS vendor_name, + v -> 'Vendor' ->> 'Url' AS vendor_url, + v -> 'Vendor' ->> 'VendorCreatedAt' AS vendor_created_at, + v -> 'Vendor' ->> 'VendorSeverity' AS vendor_severity, + v -> 'Vendor' ->> 'VendorUpdatedAt' AS vendor_updated_at, + v ->> 'Cvss' AS cvss, + v ->> 'ReferenceUrls' AS reference_urls, + v ->> 'RelatedVulnerabilities' AS related_vulnerabilities, + v ->> 'VulnerablePackages' AS vulnerable_packages + FROM + aws_securityhub_finding, + jsonb_array_elements(vulnerabilities) AS v + WHERE + title = 'EC2 instance involved in SSH brute force attacks.'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Findings and their Details + - Security Hub +Title: Find AWS Security Hub Findings and their Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_14.yaml b/queries/aws_securityhub_finding_14.yaml old mode 100755 new mode 100644 index f8bb9d06d..30e2e048a --- a/queries/aws_securityhub_finding_14.yaml +++ b/queries/aws_securityhub_finding_14.yaml @@ -1,33 +1,43 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_14 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct i.instance_id,\n i.instance_state,\n i.instance_type,\n\ - \ f.title,\n f.compliance_status,\n f.severity ->> 'Original' as severity_original\n\ - from\n aws_ec2_instance as i,\n aws_securityhub_finding as f,\n jsonb_array_elements(resources)\ - \ as r\nwhere\n compliance_status = 'FAILED'\nand\n r ->> 'Type' = 'AwsEc2Instance'\n\ - and\n i.arn = r ->> 'Id';" + QueryToExecute: | + SELECT DISTINCT + i.instance_id, + i.instance_state, + i.instance_type, + f.title, + f.compliance_status, + f.severity ->> 'Original' AS severity_original + FROM + aws_ec2_instance AS i, + aws_securityhub_finding AS f, + jsonb_array_elements(resources) AS r + WHERE + f.compliance_status = 'FAILED' + AND + r ->> 'Type' = 'AwsEc2Instance' + AND + i.arn = r ->> 'Id'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find all AWS Security Hub Findings and Details + - Security Hub +Title: Find all AWS Security Hub Findings and Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_15.yaml b/queries/aws_securityhub_finding_15.yaml old mode 100755 new mode 100644 index 3c479d847..d7e9e386c --- a/queries/aws_securityhub_finding_15.yaml +++ b/queries/aws_securityhub_finding_15.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_15 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r ->> 'Type' as resource_type,\n count(r ->> 'Type')\n\ - from\n aws_securityhub_finding,\n jsonb_array_elements(resources) as r\ngroup\ - \ by\n r ->> 'Type'\norder by\n count desc;" + QueryToExecute: | + SELECT + r ->> 'Type' AS resource_type, + COUNT(r ->> 'Type') + FROM + aws_securityhub_finding, + jsonb_array_elements(resources) AS r + GROUP BY + r ->> 'Type' + ORDER BY + COUNT DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Findings by Resource Type + - Security Hub +Title: List AWS Security Hub Findings by Resource Type \ No newline at end of file diff --git a/queries/aws_securityhub_finding_16.yaml b/queries/aws_securityhub_finding_16.yaml old mode 100755 new mode 100644 index 622c0ef97..d7f7d8820 --- a/queries/aws_securityhub_finding_16.yaml +++ b/queries/aws_securityhub_finding_16.yaml @@ -1,27 +1,33 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_16 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n company_name,\n created_at,\n criticality,\n\ - \ confidence\nfrom\n aws_securityhub_finding\nwhere\n standards_control_arn\ - \ like '%cis-aws-foundations-benchmark%';" + QueryToExecute: | + SELECT + title, + id, + company_name, + created_at, + criticality, + confidence + FROM + aws_securityhub_finding + WHERE + standards_control_arn LIKE '%cis-aws-foundations-benchmark%' Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Findings Details Including Severity + - Security Hub +Title: Find AWS Security Hub Findings Details Including Severity \ No newline at end of file diff --git a/queries/aws_securityhub_finding_17.yaml b/queries/aws_securityhub_finding_17.yaml old mode 100755 new mode 100644 index 36c7329ae..00e4ebbfa --- a/queries/aws_securityhub_finding_17.yaml +++ b/queries/aws_securityhub_finding_17.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_17 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n f.title,\n f.id,\n f.company_name,\n f.created_at,\n\ - \ f.criticality,\n f.confidence\nfrom \n aws_securityhub_finding as f,\n aws_securityhub_standards_control\ - \ as c\nwhere \n c.arn = f.standards_control_arn\nand\n c.control_id = 'Config.1';" + QueryToExecute: | + SELECT + f.title, + f.id, + f.company_name, + f.created_at, + f.criticality, + f.confidence + FROM + aws_securityhub_finding AS f, + aws_securityhub_standards_control AS c + WHERE + c.arn = f.standards_control_arn + AND c.control_id = 'Config.1'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Findings and Severity Details + - Security Hub +Title: Find AWS Security Hub Findings and Severity Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_18.yaml b/queries/aws_securityhub_finding_18.yaml old mode 100755 new mode 100644 index aabdd23e9..6a3602c3e --- a/queries/aws_securityhub_finding_18.yaml +++ b/queries/aws_securityhub_finding_18.yaml @@ -1,29 +1,35 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_18 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct r ->> 'Id' as resource_arn,\n r ->> 'Type'\ - \ as resource_type,\n f.title,\n f.compliance_status,\n f.severity ->> 'Original'\ - \ as severity_original\nfrom\n aws_securityhub_finding as f,\n jsonb_array_elements(resources)\ - \ as r\nwhere\n f.compliance_status = 'FAILED'\nand\n standards_control_arn\ - \ like '%cis-aws-foundations-benchmark%';" + QueryToExecute: | + SELECT + DISTINCT r ->> 'Id' AS resource_arn, + r ->> 'Type' AS resource_type, + f.title, + f.compliance_status, + f.severity ->> 'Original' AS severity_original + FROM + aws_securityhub_finding AS f, + jsonb_array_elements(resources) AS r + WHERE + f.compliance_status = 'FAILED' + AND + standards_control_arn LIKE '%cis-aws-foundations-benchmark%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Findings for Compliance Failures + - Security Hub +Title: List all AWS Security Hub Findings for Compliance Failures \ No newline at end of file diff --git a/queries/aws_securityhub_finding_19.yaml b/queries/aws_securityhub_finding_19.yaml old mode 100755 new mode 100644 index b07f6265c..c584f63f5 --- a/queries/aws_securityhub_finding_19.yaml +++ b/queries/aws_securityhub_finding_19.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_19 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct r ->> 'Id' as resource_arn,\n r ->> 'Type'\ - \ as resource_type,\n f.title,\n f.compliance_status,\n f.severity ->> 'Original'\ - \ as severity_original\nfrom\n aws_securityhub_finding as f,\n jsonb_array_elements(resources)\ - \ as r\nwhere\n r -> 'Tags' ->> 'Environment' = 'PROD';" + QueryToExecute: | + SELECT + DISTINCT r ->> 'Id' AS resource_arn, + r ->> 'Type' AS resource_type, + f.title, + f.compliance_status, + f.severity ->> 'Original' AS severity_original + FROM + aws_securityhub_finding AS f, + jsonb_array_elements(resources) AS r + WHERE + r -> 'Tags' ->> 'Environment' = 'PROD'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Findings in Production Environment + - Security Hub +Title: Find AWS Security Hub Findings in Production Environment \ No newline at end of file diff --git a/queries/aws_securityhub_finding_2.yaml b/queries/aws_securityhub_finding_2.yaml old mode 100755 new mode 100644 index d816a420c..95a435be3 --- a/queries/aws_securityhub_finding_2.yaml +++ b/queries/aws_securityhub_finding_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n severity ->>\ - \ 'Original' as severity_original\nfrom\n aws_securityhub_finding\nwhere\n severity\ - \ ->> 'Original' = 'HIGH';" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + severity ->> 'Original' AS severity_original + FROM + aws_securityhub_finding + WHERE + severity ->> 'Original' = 'HIGH'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: List AWS Security Hub Findings by Severity + - AWS Security Hub +Title: List AWS Security Hub Findings by Severity \ No newline at end of file diff --git a/queries/aws_securityhub_finding_20.yaml b/queries/aws_securityhub_finding_20.yaml old mode 100755 new mode 100644 index aa9f3b5b7..4cd099794 --- a/queries/aws_securityhub_finding_20.yaml +++ b/queries/aws_securityhub_finding_20.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_20 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r -> 'Tags' ->> 'Environment' as environment,\n count(r\ - \ ->> 'Tags')\nfrom\n aws_securityhub_finding as f,\n jsonb_array_elements(resources)\ - \ as r\ngroup by\n r -> 'Tags' ->> 'Environment'\norder by\n count desc;" + QueryToExecute: | + SELECT + r -> 'Tags' ->> 'Environment' AS environment, + COUNT(r ->> 'Tags') + FROM + aws_securityhub_finding AS f, + jsonb_array_elements(resources) AS r + GROUP BY + r -> 'Tags' ->> 'Environment' + ORDER BY + COUNT DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: List all Security Hub findings with environment tags + - AWS Security Hub +Title: List all Security Hub findings with environment tags \ No newline at end of file diff --git a/queries/aws_securityhub_finding_21.yaml b/queries/aws_securityhub_finding_21.yaml old mode 100755 new mode 100644 index 471fd8c78..dce3a3390 --- a/queries/aws_securityhub_finding_21.yaml +++ b/queries/aws_securityhub_finding_21.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_21 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n f.severity ->> 'Original' as severity,\n r\ - \ ->> 'Type' as resource_type,\n source_account_id\nfrom\n aws_securityhub_finding\ - \ as f,\n jsonb_array_elements(resources) r\nwhere\n source_account_id = '0123456789012';" + QueryToExecute: | + SELECT + title, + f.severity ->> 'Original' AS severity, + r ->> 'Type' AS resource_type, + source_account_id + FROM + aws_securityhub_finding AS f, + jsonb_array_elements(resources) r + WHERE + source_account_id = '0123456789012'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find AWS Security Hub Findings with Details + - AWS Security Hub +Title: Find AWS Security Hub Findings with Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_22.yaml b/queries/aws_securityhub_finding_22.yaml old mode 100755 new mode 100644 index 734c23d25..cf0ac7c94 --- a/queries/aws_securityhub_finding_22.yaml +++ b/queries/aws_securityhub_finding_22.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_22 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n source_account_id,\n count(*) as finding_count\nfrom\n\ - \ aws_securityhub_finding\ngroup by\n source_account_id\norder by\n source_account_id;" + QueryToExecute: | + SELECT + source_account_id, + COUNT(*) AS finding_count + FROM + aws_securityhub_finding + GROUP BY + source_account_id + ORDER BY + source_account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find all Security Hub Findings and Details + - Security Hub +Title: Find all Security Hub Findings and Details \ No newline at end of file diff --git a/queries/aws_securityhub_finding_3.yaml b/queries/aws_securityhub_finding_3.yaml old mode 100755 new mode 100644 index 03f766ef1..26524ca29 --- a/queries/aws_securityhub_finding_3.yaml +++ b/queries/aws_securityhub_finding_3.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n severity ->> 'Original' as severity_original,\n count(severity\ - \ ->> 'Original')\nfrom\n aws_securityhub_finding\ngroup by\n severity ->> 'Original'\n\ - order by\n severity ->> 'Original';" + QueryToExecute: | + SELECT + severity ->> 'Original' AS severity_original, + COUNT(severity ->> 'Original') + FROM + aws_securityhub_finding + GROUP BY + severity ->> 'Original' + ORDER BY + severity ->> 'Original'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Findings and Severity + - Security Hub +Title: List all AWS Security Hub Findings and Severity \ No newline at end of file diff --git a/queries/aws_securityhub_finding_4.yaml b/queries/aws_securityhub_finding_4.yaml old mode 100755 new mode 100644 index 288eb35ea..f49127fcc --- a/queries/aws_securityhub_finding_4.yaml +++ b/queries/aws_securityhub_finding_4.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n compliance\ - \ ->> 'Status' as compliance_status,\n compliance ->> 'StatusReasons' as compliance_status_reasons\n\ - from\n aws_securityhub_finding\nwhere\n compliance ->> 'Status' = 'FAILED';" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + compliance ->> 'Status' AS compliance_status, + compliance ->> 'StatusReasons' AS compliance_status_reasons + FROM + aws_securityhub_finding + WHERE + compliance ->> 'Status' = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Findings with Failed Status + - Security Hub +Title: Find AWS Security Hub Findings with Failed Status \ No newline at end of file diff --git a/queries/aws_securityhub_finding_5.yaml b/queries/aws_securityhub_finding_5.yaml old mode 100755 new mode 100644 index 8f7268f92..737a17744 --- a/queries/aws_securityhub_finding_5.yaml +++ b/queries/aws_securityhub_finding_5.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n malware\n\ - from\n aws_securityhub_finding\nwhere\n malware is not null;" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + malware + FROM + aws_securityhub_finding + WHERE + malware IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find all AWS Security Hub Findings with SQL + - AWS Security Hub +Title: Find all AWS Security Hub Findings with SQL \ No newline at end of file diff --git a/queries/aws_securityhub_finding_6.yaml b/queries/aws_securityhub_finding_6.yaml old mode 100755 new mode 100644 index faa7efc65..8657ada20 --- a/queries/aws_securityhub_finding_6.yaml +++ b/queries/aws_securityhub_finding_6.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n severity ->>\ - \ 'Original' as severity_original\nfrom\n aws_securityhub_finding\nwhere\n severity\ - \ ->> 'Original' = 'CRITICAL'\nand \n created_at >= now() - interval '10' day;" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + severity ->> 'Original' AS severity_original + FROM + aws_securityhub_finding + WHERE + severity ->> 'Original' = 'CRITICAL' + AND created_at >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Findings for Critical Issues + - Security Hub +Title: List AWS Security Hub Findings for Critical Issues \ No newline at end of file diff --git a/queries/aws_securityhub_finding_7.yaml b/queries/aws_securityhub_finding_7.yaml old mode 100755 new mode 100644 index 3fd517641..d4a9a92cf --- a/queries/aws_securityhub_finding_7.yaml +++ b/queries/aws_securityhub_finding_7.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n criticality\n\ - from\n aws_securityhub_finding\norder by \n criticality desc nulls last;" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + criticality + FROM + aws_securityhub_finding + ORDER BY + criticality DESC NULLS LAST; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find all AWS Security Hub Findings with SQL + - AWS Security Hub +Title: Find all AWS Security Hub Findings with SQL \ No newline at end of file diff --git a/queries/aws_securityhub_finding_8.yaml b/queries/aws_securityhub_finding_8.yaml old mode 100755 new mode 100644 index b085a6621..cab87ab86 --- a/queries/aws_securityhub_finding_8.yaml +++ b/queries/aws_securityhub_finding_8.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n id,\n product_arn,\n product_name,\n company_name\n\ - from\n aws_securityhub_finding\nwhere \n company_name = 'Turbot';" + QueryToExecute: | + SELECT + title, + id, + product_arn, + product_name, + company_name + FROM + aws_securityhub_finding + WHERE + company_name = 'Turbot'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find all AWS Security Hub Findings with Issues + - Security Hub +Title: Find all AWS Security Hub Findings with Issues \ No newline at end of file diff --git a/queries/aws_securityhub_finding_9.yaml b/queries/aws_securityhub_finding_9.yaml old mode 100755 new mode 100644 index 181ee7d8c..97604c767 --- a/queries/aws_securityhub_finding_9.yaml +++ b/queries/aws_securityhub_finding_9.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS Security Hub Findings to gather information - about security issues identified within AWS resources. This includes details such - as the severity, status, and description of the finding, the resources affected, - and any remediation steps recommended. +Description: Allows users to query AWS Security Hub Findings to gather information about security issues identified within AWS resources. This includes details such as the severity, status, and description of the finding, the resources affected, and any remediation steps recommended. ID: aws_securityhub_finding_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n product_arn,\n product_name,\n updated_at\n\ - from\n aws_securityhub_finding\nwhere\n updated_at >= now() - interval '30'\ - \ day;" + QueryToExecute: | + SELECT + title, + product_arn, + product_name, + updated_at + FROM + aws_securityhub_finding + WHERE + updated_at >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find all Security Hub Findings within AWS Resources + - Security Hub +Title: Find all Security Hub Findings within AWS Resources \ No newline at end of file diff --git a/queries/aws_securityhub_finding_aggregator_1.yaml b/queries/aws_securityhub_finding_aggregator_1.yaml old mode 100755 new mode 100644 index 089d961fb..41369c04d --- a/queries/aws_securityhub_finding_aggregator_1.yaml +++ b/queries/aws_securityhub_finding_aggregator_1.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Security Hub Finding Aggregator to gather information - about the findings that are generated by the integrated third-party products and - AWS services. +Description: Allows users to query AWS Security Hub Finding Aggregator to gather information about the findings that are generated by the integrated third-party products and AWS services. ID: aws_securityhub_finding_aggregator_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_aggregation_region,\n region_linking_mode\n\ - from\n aws_securityhub_finding_aggregator;" + QueryToExecute: | + SELECT + arn, + finding_aggregation_region, + region_linking_mode + FROM + aws_securityhub_finding_aggregator; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: List all findings in AWS Security Hub Aggregator + - AWS Security Hub +Title: List all findings in AWS Security Hub Aggregator \ No newline at end of file diff --git a/queries/aws_securityhub_finding_aggregator_2.yaml b/queries/aws_securityhub_finding_aggregator_2.yaml old mode 100755 new mode 100644 index aeb467d92..20fd32d4e --- a/queries/aws_securityhub_finding_aggregator_2.yaml +++ b/queries/aws_securityhub_finding_aggregator_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Security Hub Finding Aggregator to gather information - about the findings that are generated by the integrated third-party products and - AWS services. +Description: Allows users to query AWS Security Hub Finding Aggregator to gather information about the findings that are generated by the integrated third-party products and AWS services. ID: aws_securityhub_finding_aggregator_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n finding_aggregation_region,\n region_linking_mode\n\ - from\n aws_securityhub_finding_aggregator\nwhere\n region_linking_mode = 'ALL_REGIONS';" + QueryToExecute: | + SELECT + arn, + finding_aggregation_region, + region_linking_mode + FROM + aws_securityhub_finding_aggregator + WHERE + region_linking_mode = 'ALL_REGIONS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub Finding Aggregator -Title: Find information in AWS Security Hub Finding Aggregator + - Security Hub Finding Aggregator +Title: Find information in AWS Security Hub Finding Aggregator \ No newline at end of file diff --git a/queries/aws_securityhub_finding_aggregator_3.yaml b/queries/aws_securityhub_finding_aggregator_3.yaml old mode 100755 new mode 100644 index 426179771..cc5cbf0e7 --- a/queries/aws_securityhub_finding_aggregator_3.yaml +++ b/queries/aws_securityhub_finding_aggregator_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Security Hub Finding Aggregator to gather information - about the findings that are generated by the integrated third-party products and - AWS services. +Description: Allows users to query AWS Security Hub Finding Aggregator to gather information about the findings that are generated by the integrated third-party products and AWS services. ID: aws_securityhub_finding_aggregator_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n region_linking_mode,\n r as linked_region\n\ - from\n aws_securityhub_finding_aggregator,\n jsonb_array_elements_text(regions)\ - \ as r\nwhere\n region_linking_mode = 'SPECIFIED_REGIONS';" + QueryToExecute: | + SELECT + arn, + region_linking_mode, + r AS linked_region + FROM + aws_securityhub_finding_aggregator, + jsonb_array_elements_text(regions) AS r + WHERE + region_linking_mode = 'SPECIFIED_REGIONS'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find Info About AWS Security Hub Finding Aggregator + - AWS Security Hub +Title: Find Info About AWS Security Hub Finding Aggregator \ No newline at end of file diff --git a/queries/aws_securityhub_finding_aggregator_4.yaml b/queries/aws_securityhub_finding_aggregator_4.yaml old mode 100755 new mode 100644 index a533475a0..093db76ef --- a/queries/aws_securityhub_finding_aggregator_4.yaml +++ b/queries/aws_securityhub_finding_aggregator_4.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Security Hub Finding Aggregator to gather information - about the findings that are generated by the integrated third-party products and - AWS services. +Description: Allows users to query AWS Security Hub Finding Aggregator to gather information about the findings that are generated by the integrated third-party products and AWS services. ID: aws_securityhub_finding_aggregator_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n a.name as linked_region\nfrom\n aws_securityhub_finding_aggregator\ - \ as f,\n aws_region as a,\n jsonb_array_elements_text(f.regions) as r\nwhere\n\ - \ region_linking_mode = 'ALL_REGIONS_EXCEPT_SPECIFIED'\nand\n a.name <> r;" + QueryToExecute: | + SELECT + arn, + a.name AS linked_region + FROM + aws_securityhub_finding_aggregator AS f, + aws_region AS a, + jsonb_array_elements_text(f.regions) AS r + WHERE + region_linking_mode = 'ALL_REGIONS_EXCEPT_SPECIFIED' + AND a.name <> r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find Security Hub Findings Aggregator Details in AWS + - Security Hub +Title: Find Security Hub Findings Aggregator Details in AWS \ No newline at end of file diff --git a/queries/aws_securityhub_hub_1.yaml b/queries/aws_securityhub_hub_1.yaml old mode 100755 new mode 100644 index 0a13b98cb..e3038b6d8 --- a/queries/aws_securityhub_hub_1.yaml +++ b/queries/aws_securityhub_hub_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Security Hub to retrieve information about the - Hub resources. +Description: Allows users to query Security Hub to retrieve information about the Hub resources. ID: aws_securityhub_hub_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hub_arn,\n auto_enable_controls,\n subscribed_at,\n\ - \ region\nfrom\n aws_securityhub_hub;" + QueryToExecute: | + SELECT + hub_arn, + auto_enable_controls, + subscribed_at, + region + FROM + aws_securityhub_hub; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Resources Information + - Security Hub +Title: Find AWS Security Hub Resources Information \ No newline at end of file diff --git a/queries/aws_securityhub_hub_2.yaml b/queries/aws_securityhub_hub_2.yaml old mode 100755 new mode 100644 index 1a52f4be3..34421aeb2 --- a/queries/aws_securityhub_hub_2.yaml +++ b/queries/aws_securityhub_hub_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Security Hub to retrieve information about the - Hub resources. +Description: Allows users to query Security Hub to retrieve information about the Hub resources. ID: aws_securityhub_hub_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hub_arn,\n auto_enable_controls\nfrom\n aws_securityhub_hub\n\ - where\n not auto_enable_controls;" + QueryToExecute: | + SELECT + hub_arn, + auto_enable_controls + FROM + aws_securityhub_hub + WHERE + NOT auto_enable_controls; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all Hub resources from AWS Security Hub + - Security Hub +Title: List all Hub resources from AWS Security Hub \ No newline at end of file diff --git a/queries/aws_securityhub_hub_3.yaml b/queries/aws_securityhub_hub_3.yaml old mode 100755 new mode 100644 index 8d259aa82..5e8df8bbb --- a/queries/aws_securityhub_hub_3.yaml +++ b/queries/aws_securityhub_hub_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query Security Hub to retrieve information about the - Hub resources. +Description: Allows users to query Security Hub to retrieve information about the Hub resources. ID: aws_securityhub_hub_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n hub_arn,\n auto_enable_controls,\n administrator_account\ - \ ->> 'AccountId' as administrator_account_id,\n administrator_account ->> 'InvitationId'\ - \ as administrator_invitation_id,\n administrator_account ->> 'InvitedAt' as\ - \ administrator_invitation_time,\n administrator_account ->> 'MemberStatus' as\ - \ administrator_status\nfrom\n aws_securityhub_hub\nwhere\n administrator_account\ - \ is not null;" + QueryToExecute: | + SELECT + hub_arn, + auto_enable_controls, + administrator_account ->> 'AccountId' AS administrator_account_id, + administrator_account ->> 'InvitationId' AS administrator_invitation_id, + administrator_account ->> 'InvitedAt' AS administrator_invitation_time, + administrator_account ->> 'MemberStatus' AS administrator_status + FROM + aws_securityhub_hub + WHERE + administrator_account IS NOT NULL; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find Administrator Account Info in AWS Security Hub + - Security Hub +Title: Find Administrator Account Info in AWS Security Hub \ No newline at end of file diff --git a/queries/aws_securityhub_insight_1.yaml b/queries/aws_securityhub_insight_1.yaml old mode 100755 new mode 100644 index 73def41cd..43d7e7d4c --- a/queries/aws_securityhub_insight_1.yaml +++ b/queries/aws_securityhub_insight_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n group_by_attribute,\n region\nfrom\n\ - \ aws_securityhub_insight;" + QueryToExecute: | + SELECT + name, + arn, + group_by_attribute, + region + FROM + aws_securityhub_insight; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find Insights in AWS Security Hub with SQL + - Security Hub +Title: Find Insights in AWS Security Hub with SQL \ No newline at end of file diff --git a/queries/aws_securityhub_insight_10.yaml b/queries/aws_securityhub_insight_10.yaml old mode 100755 new mode 100644 index f218b7247..6f20da0ec --- a/queries/aws_securityhub_insight_10.yaml +++ b/queries/aws_securityhub_insight_10.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'RecordState' as record_state\n\ - from\n aws_securityhub_insight\nwhere\n name = 'sp';" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'RecordState' AS record_state + FROM + aws_securityhub_insight + WHERE + name = 'sp'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Insights Details Using SQL + - Security Hub +Title: Find AWS Security Hub Insights Details Using SQL \ No newline at end of file diff --git a/queries/aws_securityhub_insight_2.yaml b/queries/aws_securityhub_insight_2.yaml old mode 100755 new mode 100644 index 68e12cb5b..ac77a2017 --- a/queries/aws_securityhub_insight_2.yaml +++ b/queries/aws_securityhub_insight_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n group_by_attribute,\n region\nfrom\n\ - \ aws_securityhub_insight\nwhere\n group_by_attribute = 'ResourceId';" + QueryToExecute: | + SELECT + name, + arn, + group_by_attribute, + region + FROM + aws_securityhub_insight + WHERE + group_by_attribute = 'ResourceId'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Insights with Details + - Security Hub +Title: List all AWS Security Hub Insights with Details \ No newline at end of file diff --git a/queries/aws_securityhub_insight_3.yaml b/queries/aws_securityhub_insight_3.yaml old mode 100755 new mode 100644 index 831608313..3d4b2640d --- a/queries/aws_securityhub_insight_3.yaml +++ b/queries/aws_securityhub_insight_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'WorkflowStatus' as workflow_status\n\ - from\n aws_securityhub_insight;" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'WorkflowStatus' AS workflow_status + FROM + aws_securityhub_insight; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Insights Details using SQL + - Security Hub +Title: Find AWS Security Hub Insights Details using SQL \ No newline at end of file diff --git a/queries/aws_securityhub_insight_4.yaml b/queries/aws_securityhub_insight_4.yaml old mode 100755 new mode 100644 index 1c31924b0..3b8162782 --- a/queries/aws_securityhub_insight_4.yaml +++ b/queries/aws_securityhub_insight_4.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'SeverityLabel' as severity_label\n\ - from\n aws_securityhub_insight;" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'SeverityLabel' AS severity_label + FROM + aws_securityhub_insight; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Insights with Severity Filters + - Security Hub +Title: Find AWS Security Hub Insights with Severity Filters \ No newline at end of file diff --git a/queries/aws_securityhub_insight_5.yaml b/queries/aws_securityhub_insight_5.yaml old mode 100755 new mode 100644 index bced30772..3dc170c6f --- a/queries/aws_securityhub_insight_5.yaml +++ b/queries/aws_securityhub_insight_5.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'SeverityLabel' as severity\n\ - from\n aws_securityhub_insight\nwhere\n filters ->> 'SeverityLabel' = '{\"Comparison\"\ - : \"EQUALS\", \"Value\": \"CRITICAL\"}'" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'SeverityLabel' AS severity + FROM + aws_securityhub_insight + WHERE + filters ->> 'SeverityLabel' = '{"Comparison": "EQUALS", "Value": "CRITICAL"}' Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Insights with Critical Severity + - Security Hub +Title: Find AWS Security Hub Insights with Critical Severity \ No newline at end of file diff --git a/queries/aws_securityhub_insight_6.yaml b/queries/aws_securityhub_insight_6.yaml old mode 100755 new mode 100644 index fe12574c5..d84158104 --- a/queries/aws_securityhub_insight_6.yaml +++ b/queries/aws_securityhub_insight_6.yaml @@ -1,25 +1,28 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'ThreatIntelIndicatorType'\ - \ as threat_intelligence_details\nfrom\n aws_securityhub_insight\nwhere\n filters\ - \ ->> 'ThreatIntelIndicatorType' = '{\"Comparison\": \"EQUALS\", \"Value\": \"\ - IPV4_ADDRESS\"}'" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'ThreatIntelIndicatorType' AS threat_intelligence_details + FROM + aws_securityhub_insight + WHERE + filters ->> 'ThreatIntelIndicatorType' = '{"Comparison": "EQUALS", "Value": "IPV4_ADDRESS"}' Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: List all AWS Security Hub Insights with Filters and Grouping + - AWS Security Hub +Title: List all AWS Security Hub Insights with Filters and Grouping \ No newline at end of file diff --git a/queries/aws_securityhub_insight_7.yaml b/queries/aws_securityhub_insight_7.yaml old mode 100755 new mode 100644 index a9777783b..eb6b47a93 --- a/queries/aws_securityhub_insight_7.yaml +++ b/queries/aws_securityhub_insight_7.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'ComplianceStatus' as compliance_status\n\ - from\n aws_securityhub_insight\nwhere\n filters ->> 'ComplianceStatus' = '{\"\ - Comparison\": \"EQUALS\", \"Value\": \"FAILED\"}'" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'ComplianceStatus' AS compliance_status + FROM + aws_securityhub_insight + WHERE + filters ->> 'ComplianceStatus' = '{"Comparison": "EQUALS", "Value": "FAILED"}' Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find All AWS Security Hub Insights with SQL Query + - Security Hub +Title: Find All AWS Security Hub Insights with SQL Query \ No newline at end of file diff --git a/queries/aws_securityhub_insight_8.yaml b/queries/aws_securityhub_insight_8.yaml old mode 100755 new mode 100644 index 9bf16cd53..c3d70f0bb --- a/queries/aws_securityhub_insight_8.yaml +++ b/queries/aws_securityhub_insight_8.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'MalwareName' as malware_name,\n\ - \ filters ->> 'MalwarePath' as malware_path,\n filters ->> 'MalwareType' as\ - \ malware_type\nfrom\n aws_securityhub_insight;" + QueryToExecute: | + SELECT + name, + arn, + filters ->> 'MalwareName' AS malware_name, + filters ->> 'MalwarePath' AS malware_path, + filters ->> 'MalwareType' AS malware_type + FROM + aws_securityhub_insight; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Insights with Details + - Security Hub +Title: List all AWS Security Hub Insights with Details \ No newline at end of file diff --git a/queries/aws_securityhub_insight_9.yaml b/queries/aws_securityhub_insight_9.yaml old mode 100755 new mode 100644 index 0637cdb58..84e186ecc --- a/queries/aws_securityhub_insight_9.yaml +++ b/queries/aws_securityhub_insight_9.yaml @@ -1,30 +1,35 @@ -Description: Allows users to query AWS Security Hub Insights to retrieve information - about the insights in AWS Security Hub. This includes details such as insight ARN, - name, filters, group by attributes, and more. +Description: Allows users to query AWS Security Hub Insights to retrieve information about the insights in AWS Security Hub. This includes details such as insight ARN, name, filters, group by attributes, and more. ID: aws_securityhub_insight_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n filters ->> 'NetworkSourceDomain' as\ - \ network_source_domain,\n filters ->> 'NetworkDestinationDomain' as network_destination_domain,\n\ - \ filters ->> 'NetworkSourceIpV4' as network_source_ip_v4,\n filters ->> 'NetworkDestinationIpV4'\ - \ as network_destination_ip_v4,\n filters ->> 'NetworkSourceIpV6' as network_source_ip_v6,\n\ - \ filters ->> 'NetworkDestinationIpV6' as network_destination_ip_v6,\n filters\ - \ ->> 'NetworkSourcePort' as network_source_port,\n filters ->> 'NetworkDestinationPort'\ - \ as network_destination_port\nfrom\n aws_securityhub_insight;" + QueryToExecute: | + SELECT + NAME, + ARN, + FILTERS ->> 'NetworkSourceDomain' AS network_source_domain, + FILTERS ->> 'NetworkDestinationDomain' AS network_destination_domain, + FILTERS ->> 'NetworkSourceIpV4' AS network_source_ip_v4, + FILTERS ->> 'NetworkDestinationIpV4' AS network_destination_ip_v4, + FILTERS ->> 'NetworkSourceIpV6' AS network_source_ip_v6, + FILTERS ->> 'NetworkDestinationIpV6' AS network_destination_ip_v6, + FILTERS ->> 'NetworkSourcePort' AS network_source_port, + FILTERS ->> 'NetworkDestinationPort' AS network_destination_port + FROM + aws_securityhub_insight; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Insights and Network Attributes + - Security Hub +Title: Find AWS Security Hub Insights and Network Attributes \ No newline at end of file diff --git a/queries/aws_securityhub_member_1.yaml b/queries/aws_securityhub_member_1.yaml old mode 100755 new mode 100644 index 45e487102..28e9d3350 --- a/queries/aws_securityhub_member_1.yaml +++ b/queries/aws_securityhub_member_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Security Hub Members for detailed information - about each member''s account, including its ID, email, status, and more. +Description: Allows users to query AWS Security Hub Members for detailed information about each member's account, including its ID, email, status, and more. ID: aws_securityhub_member_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n email,\n administrator_id,\n \ - \ member_status,\n updated_at\nfrom\n aws_securityhub_member;" + QueryToExecute: | + SELECT + member_account_id, + email, + administrator_id, + member_status, + updated_at + FROM + aws_securityhub_member; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Members for Detailed Information + - Security Hub +Title: Find AWS Security Hub Members for Detailed Information \ No newline at end of file diff --git a/queries/aws_securityhub_member_2.yaml b/queries/aws_securityhub_member_2.yaml old mode 100755 new mode 100644 index 06c54730f..7a91549bf --- a/queries/aws_securityhub_member_2.yaml +++ b/queries/aws_securityhub_member_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Security Hub Members for detailed information - about each member''s account, including its ID, email, status, and more. +Description: Allows users to query AWS Security Hub Members for detailed information about each member's account, including its ID, email, status, and more. ID: aws_securityhub_member_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n email,\n administrator_id,\n \ - \ member_status,\n updated_at,\n invited_at\nfrom\n aws_securityhub_member\n\ - where\n member_status = 'Enabled';" + QueryToExecute: | + SELECT + member_account_id, + email, + administrator_id, + member_status, + updated_at, + invited_at + FROM + aws_securityhub_member + WHERE + member_status = 'Enabled'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Members with Detailed Info + - Security Hub +Title: Find AWS Security Hub Members with Detailed Info \ No newline at end of file diff --git a/queries/aws_securityhub_member_3.yaml b/queries/aws_securityhub_member_3.yaml old mode 100755 new mode 100644 index c95198f89..1138eb323 --- a/queries/aws_securityhub_member_3.yaml +++ b/queries/aws_securityhub_member_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Security Hub Members for detailed information - about each member''s account, including its ID, email, status, and more. +Description: Allows users to query AWS Security Hub Members for detailed information about each member's account, including its ID, email, status, and more. ID: aws_securityhub_member_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n email,\n administrator_id,\n \ - \ member_status,\n updated_at\nfrom\n aws_securityhub_member\nwhere\n member_status\ - \ = 'Created';" + QueryToExecute: | + SELECT + member_account_id, + email, + administrator_id, + member_status, + updated_at + FROM + aws_securityhub_member + WHERE + member_status = 'Created'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Members with Detailed Information + - Security Hub +Title: List all AWS Security Hub Members with Detailed Information \ No newline at end of file diff --git a/queries/aws_securityhub_member_4.yaml b/queries/aws_securityhub_member_4.yaml old mode 100755 new mode 100644 index 6f60f9614..78209afe4 --- a/queries/aws_securityhub_member_4.yaml +++ b/queries/aws_securityhub_member_4.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS Security Hub Members for detailed information - about each member''s account, including its ID, email, status, and more. +Description: Allows users to query AWS Security Hub Members for detailed information about each member's account, including its ID, email, status, and more. ID: aws_securityhub_member_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n member_account_id,\n email,\n administrator_id,\n \ - \ member_status,\n updated_at,\n invited_at\nfrom\n aws_securityhub_member\n\ - where\n member_status = 'Enabled'\nand\n invited_at <= (now() - interval '10'\ - \ day);" + QueryToExecute: | + SELECT + member_account_id, + email, + administrator_id, + member_status, + updated_at, + invited_at + FROM + aws_securityhub_member + WHERE + member_status = 'Enabled' + AND + invited_at <= (NOW() - INTERVAL '10' DAY); Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Members with details + - Security Hub +Title: List all AWS Security Hub Members with details \ No newline at end of file diff --git a/queries/aws_securityhub_product_1.yaml b/queries/aws_securityhub_product_1.yaml old mode 100755 new mode 100644 index 9b46a1491..ecb41916e --- a/queries/aws_securityhub_product_1.yaml +++ b/queries/aws_securityhub_product_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Security Hub Product details for comprehensive - security and compliance insights. +Description: Allows users to query AWS Security Hub Product details for comprehensive security and compliance insights. ID: aws_securityhub_product_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n product_arn,\n company_name,\n description\n\ - from\n aws_securityhub_product;" + QueryToExecute: | + SELECT + name, + product_arn, + company_name, + description + FROM + aws_securityhub_product; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Product Details for Security Insights + - Security Hub +Title: Find AWS Security Hub Product Details for Security Insights \ No newline at end of file diff --git a/queries/aws_securityhub_product_2.yaml b/queries/aws_securityhub_product_2.yaml old mode 100755 new mode 100644 index f8daba435..997c192a1 --- a/queries/aws_securityhub_product_2.yaml +++ b/queries/aws_securityhub_product_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Security Hub Product details for comprehensive - security and compliance insights. +Description: Allows users to query AWS Security Hub Product details for comprehensive security and compliance insights. ID: aws_securityhub_product_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n company_name,\n description\nfrom\n aws_securityhub_product\n\ - where\n company_name = 'AWS';" + QueryToExecute: | + SELECT + name, + company_name, + description + FROM + aws_securityhub_product + WHERE + company_name = 'AWS'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Product Details + - Security Hub +Title: Find AWS Security Hub Product Details \ No newline at end of file diff --git a/queries/aws_securityhub_product_3.yaml b/queries/aws_securityhub_product_3.yaml old mode 100755 new mode 100644 index 88bd5f18f..1f823a95b --- a/queries/aws_securityhub_product_3.yaml +++ b/queries/aws_securityhub_product_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Security Hub Product details for comprehensive - security and compliance insights. +Description: Allows users to query AWS Security Hub Product details for comprehensive security and compliance insights. ID: aws_securityhub_product_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n product_arn,\n company_name\nfrom\n aws_securityhub_product,\n\ - \ jsonb_array_elements_text(integration_types) as i\nwhere\n i = 'SEND_FINDINGS_TO_SECURITY_HUB';" + QueryToExecute: | + SELECT + name, + product_arn, + company_name + FROM + aws_securityhub_product, + jsonb_array_elements_text(integration_types) AS i + WHERE + i = 'SEND_FINDINGS_TO_SECURITY_HUB'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Products for Security Insights + - Security Hub +Title: Find AWS Security Hub Products for Security Insights \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_1.yaml b/queries/aws_securityhub_standards_control_1.yaml old mode 100755 new mode 100644 index b848ccea3..4e9d758c2 --- a/queries/aws_securityhub_standards_control_1.yaml +++ b/queries/aws_securityhub_standards_control_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n control_status,\n severity_rating\nfrom\n\ - \ aws_securityhub_standards_control;" + QueryToExecute: | + SELECT + control_id, + control_status, + severity_rating + FROM + aws_securityhub_standards_control; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Standards Control Data + - Security Hub +Title: Find AWS Security Hub Standards Control Data \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_2.yaml b/queries/aws_securityhub_standards_control_2.yaml old mode 100755 new mode 100644 index acbd2367e..5133d45d6 --- a/queries/aws_securityhub_standards_control_2.yaml +++ b/queries/aws_securityhub_standards_control_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n control_status,\n severity_rating\nfrom\n\ - \ aws_securityhub_standards_control\nwhere\n control_status = 'DISABLED';" + QueryToExecute: | + SELECT + control_id, + control_status, + severity_rating + FROM + aws_securityhub_standards_control + WHERE + control_status = 'DISABLED'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub Standards Control -Title: List details of AWS Security Hub Standards Controls + - Security Hub Standards Control +Title: List details of AWS Security Hub Standards Controls \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_3.yaml b/queries/aws_securityhub_standards_control_3.yaml old mode 100755 new mode 100644 index 4c2037f5a..693013aca --- a/queries/aws_securityhub_standards_control_3.yaml +++ b/queries/aws_securityhub_standards_control_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n severity_rating,\n count(severity_rating)\nfrom\n aws_securityhub_standards_control\n\ - group by\n severity_rating\norder by\n severity_rating;" + QueryToExecute: | + SELECT + severity_rating, + COUNT(severity_rating) + FROM + aws_securityhub_standards_control + GROUP BY + severity_rating + ORDER BY + severity_rating; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List AWS Security Hub Standards Control Data Details + - Security Hub +Title: List AWS Security Hub Standards Control Data Details \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_4.yaml b/queries/aws_securityhub_standards_control_4.yaml old mode 100755 new mode 100644 index f1532bdb1..51b4e1bbc --- a/queries/aws_securityhub_standards_control_4.yaml +++ b/queries/aws_securityhub_standards_control_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n control_status,\n severity_rating\nfrom\n\ - \ aws_securityhub_standards_control\nwhere\n severity_rating = 'HIGH';" + QueryToExecute: | + SELECT + control_id, + control_status, + severity_rating + FROM + aws_securityhub_standards_control + WHERE + severity_rating = 'HIGH'; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Standards Control with High Severity + - Security Hub +Title: Find AWS Security Hub Standards Control with High Severity \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_5.yaml b/queries/aws_securityhub_standards_control_5.yaml old mode 100755 new mode 100644 index 7c3e4783e..1f4614cef --- a/queries/aws_securityhub_standards_control_5.yaml +++ b/queries/aws_securityhub_standards_control_5.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n control_status,\n severity_rating\nfrom\n\ - \ aws_securityhub_standards_control\nwhere\n control_status_updated_at >= (now()\ - \ - interval '30' day);" + QueryToExecute: | + SELECT + control_id, + control_status, + severity_rating + FROM + aws_securityhub_standards_control + WHERE + control_status_updated_at >= (NOW() - INTERVAL '30' DAY); Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find details of AWS Security Hub Standards Control + - Security Hub +Title: Find details of AWS Security Hub Standards Control \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_6.yaml b/queries/aws_securityhub_standards_control_6.yaml old mode 100755 new mode 100644 index e54868890..d72bb05bc --- a/queries/aws_securityhub_standards_control_6.yaml +++ b/queries/aws_securityhub_standards_control_6.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n control_status,\n severity_rating\nfrom\n\ - \ aws_securityhub_standards_control\nwhere\n severity_rating = 'CRITICAL'\n\ - \ and arn like '%cis-aws-foundations-benchmark%';" + QueryToExecute: | + SELECT + control_id, + control_status, + severity_rating + FROM + aws_securityhub_standards_control + WHERE + severity_rating = 'CRITICAL' + AND arn LIKE '%cis-aws-foundations-benchmark%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: List AWS Security Hub Standards Control Data + - AWS Security Hub +Title: List AWS Security Hub Standards Control Data \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_7.yaml b/queries/aws_securityhub_standards_control_7.yaml old mode 100755 new mode 100644 index 0f6707b1e..b5423bc55 --- a/queries/aws_securityhub_standards_control_7.yaml +++ b/queries/aws_securityhub_standards_control_7.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n control_id,\n r as related_requirements\nfrom\n aws_securityhub_standards_control,\n\ - \ jsonb_array_elements_text(related_requirements) as r\nwhere\n control_id like\ - \ '%S3%'\ngroup by\n control_id, r\norder by\n control_id, r;" + QueryToExecute: | + SELECT + control_id, + r AS related_requirements + FROM + aws_securityhub_standards_control, + jsonb_array_elements_text(related_requirements) AS r + WHERE + control_id LIKE '%S3%' + GROUP BY + control_id, r + ORDER BY + control_id, r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Standards Control Details + - Security Hub +Title: Find AWS Security Hub Standards Control Details \ No newline at end of file diff --git a/queries/aws_securityhub_standards_control_8.yaml b/queries/aws_securityhub_standards_control_8.yaml old mode 100755 new mode 100644 index 582583ca3..bed7fdd1d --- a/queries/aws_securityhub_standards_control_8.yaml +++ b/queries/aws_securityhub_standards_control_8.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Security Hub Standards Control data including - details about each security standard control available in an AWS account. +Description: Allows users to query AWS Security Hub Standards Control data including details about each security standard control available in an AWS account. ID: aws_securityhub_standards_control_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r as related_requirements,\n control_id\nfrom\n aws_securityhub_standards_control,\n\ - \ jsonb_array_elements_text(related_requirements) as r\nwhere\n r like '%PCI%'\n\ - group by\n r, control_id\norder by\n r, control_id;" + QueryToExecute: | + SELECT + r AS related_requirements, + control_id + FROM + aws_securityhub_standards_control, + jsonb_array_elements_text(related_requirements) AS r + WHERE + r LIKE '%PCI%' + GROUP BY + r, control_id + ORDER BY + r, control_id; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Standards Control Data + - Security Hub +Title: Find AWS Security Hub Standards Control Data \ No newline at end of file diff --git a/queries/aws_securityhub_standards_subscription_1.yaml b/queries/aws_securityhub_standards_subscription_1.yaml old mode 100755 new mode 100644 index ba7913e62..495eeb106 --- a/queries/aws_securityhub_standards_subscription_1.yaml +++ b/queries/aws_securityhub_standards_subscription_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Security Hub Standards Subscriptions, providing - detailed information about each standard subscription in AWS Security Hub. +Description: Allows users to query AWS Security Hub Standards Subscriptions, providing detailed information about each standard subscription in AWS Security Hub. ID: aws_securityhub_standards_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n standards_arn,\n description,\n region\nfrom\n\ - \ aws_securityhub_standards_subscription;" + QueryToExecute: | + SELECT + name, + standards_arn, + description, + region + FROM + aws_securityhub_standards_subscription; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub Standards -Title: Find AWS Security Hub Standards Subscription Details + - Security Hub Standards +Title: Find AWS Security Hub Standards Subscription Details \ No newline at end of file diff --git a/queries/aws_securityhub_standards_subscription_2.yaml b/queries/aws_securityhub_standards_subscription_2.yaml old mode 100755 new mode 100644 index cef4c64cb..25995530c --- a/queries/aws_securityhub_standards_subscription_2.yaml +++ b/queries/aws_securityhub_standards_subscription_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Security Hub Standards Subscriptions, providing - detailed information about each standard subscription in AWS Security Hub. +Description: Allows users to query AWS Security Hub Standards Subscriptions, providing detailed information about each standard subscription in AWS Security Hub. ID: aws_securityhub_standards_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n standards_arn,\n enabled_by_default\nfrom\n\ - \ aws_securityhub_standards_subscription\nwhere\n enabled_by_default;" + QueryToExecute: | + SELECT + name, + standards_arn, + enabled_by_default + FROM + aws_securityhub_standards_subscription + WHERE + enabled_by_default; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: List all AWS Security Hub Standards Subscriptions + - Security Hub +Title: List all AWS Security Hub Standards Subscriptions \ No newline at end of file diff --git a/queries/aws_securityhub_standards_subscription_3.yaml b/queries/aws_securityhub_standards_subscription_3.yaml old mode 100755 new mode 100644 index 2ecd940ef..618cb96e5 --- a/queries/aws_securityhub_standards_subscription_3.yaml +++ b/queries/aws_securityhub_standards_subscription_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Security Hub Standards Subscriptions, providing - detailed information about each standard subscription in AWS Security Hub. +Description: Allows users to query AWS Security Hub Standards Subscriptions, providing detailed information about each standard subscription in AWS Security Hub. ID: aws_securityhub_standards_subscription_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n standards_arn,\n standards_subscription_arn,\n\ - \ standards_status,\n standards_status_reason_code\nfrom\n aws_securityhub_standards_subscription\n\ - where\n standards_status <> 'READY';" + QueryToExecute: | + SELECT + name, + standards_arn, + standards_subscription_arn, + standards_status, + standards_status_reason_code + FROM + aws_securityhub_standards_subscription + WHERE + standards_status <> 'READY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Hub -Title: Find AWS Security Hub Standard Subscriptions Details + - Security Hub +Title: Find AWS Security Hub Standard Subscriptions Details \ No newline at end of file diff --git a/queries/aws_securityhub_standards_subscription_4.yaml b/queries/aws_securityhub_standards_subscription_4.yaml old mode 100755 new mode 100644 index 0a6e62882..cad5ac9fe --- a/queries/aws_securityhub_standards_subscription_4.yaml +++ b/queries/aws_securityhub_standards_subscription_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Security Hub Standards Subscriptions, providing - detailed information about each standard subscription in AWS Security Hub. +Description: Allows users to query AWS Security Hub Standards Subscriptions, providing detailed information about each standard subscription in AWS Security Hub. ID: aws_securityhub_standards_subscription_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n standards_arn,\n standards_managed_by ->> 'Company'\ - \ as standards_managed_by_company\nfrom\n aws_securityhub_standards_subscription\n\ - where\n standards_managed_by ->> 'Company' <> 'AWS';" + QueryToExecute: | + SELECT + name, + standards_arn, + standards_managed_by ->> 'Company' AS standards_managed_by_company + FROM + aws_securityhub_standards_subscription + WHERE + standards_managed_by ->> 'Company' <> 'AWS'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Hub -Title: Find all AWS Security Hub Standards Subscriptions + - AWS Security Hub +Title: Find all AWS Security Hub Standards Subscriptions \ No newline at end of file diff --git a/queries/aws_securitylake_data_lake_1.yaml b/queries/aws_securitylake_data_lake_1.yaml old mode 100755 new mode 100644 index 92f4b42cc..e914f92a8 --- a/queries/aws_securitylake_data_lake_1.yaml +++ b/queries/aws_securitylake_data_lake_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Lake Formation Data Lakes for information such - as the Data Lake name, creation time, last modified time, and more. +Description: Allows users to query AWS Lake Formation Data Lakes for information such as the Data Lake name, creation time, last modified time, and more. ID: aws_securitylake_data_lake_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_key,\n replication_role_arn,\n s3_bucket_arn,\n\ - \ status\nfrom\n aws_securitylake_data_lake;" + QueryToExecute: | + SELECT + encryption_key, + replication_role_arn, + s3_bucket_arn, + status + FROM + aws_securitylake_data_lake; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lake Formation -Title: List all AWS Lake Formation Data Lakes Information + - Lake Formation +Title: List all AWS Lake Formation Data Lakes Information \ No newline at end of file diff --git a/queries/aws_securitylake_data_lake_2.yaml b/queries/aws_securitylake_data_lake_2.yaml old mode 100755 new mode 100644 index 59760b73e..8c99b33ed --- a/queries/aws_securitylake_data_lake_2.yaml +++ b/queries/aws_securitylake_data_lake_2.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Lake Formation Data Lakes for information such - as the Data Lake name, creation time, last modified time, and more. +Description: Allows users to query AWS Lake Formation Data Lakes for information such as the Data Lake name, creation time, last modified time, and more. ID: aws_securitylake_data_lake_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct b.name as bucket_name,\n l.s3_bucket_arn,\n\ - \ b.creation_date,\n b.bucket_policy_is_public,\n b.versioning_enabled,\n \ - \ b.block_public_acls\nfrom\n aws_securitylake_data_lake as l,\n aws_s3_bucket\ - \ as b\nwhere\n l.s3_bucket_arn = b.arn;" + QueryToExecute: | + SELECT + DISTINCT b.name AS bucket_name, + l.s3_bucket_arn, + b.creation_date, + b.bucket_policy_is_public, + b.versioning_enabled, + b.block_public_acls + FROM + aws_securitylake_data_lake AS l, + aws_s3_bucket AS b + WHERE + l.s3_bucket_arn = b.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lake Formation -Title: Find all AWS Lake Formation Data Lakes with Details + - Lake Formation +Title: Find all AWS Lake Formation Data Lakes with Details \ No newline at end of file diff --git a/queries/aws_securitylake_data_lake_3.yaml b/queries/aws_securitylake_data_lake_3.yaml old mode 100755 new mode 100644 index dc9f4853e..d8aa63a8f --- a/queries/aws_securitylake_data_lake_3.yaml +++ b/queries/aws_securitylake_data_lake_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Lake Formation Data Lakes for information such - as the Data Lake name, creation time, last modified time, and more. +Description: Allows users to query AWS Lake Formation Data Lakes for information such as the Data Lake name, creation time, last modified time, and more. ID: aws_securitylake_data_lake_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n l.encryption_key,\n l.replication_role_arn,\n l.s3_bucket_arn,\n\ - \ l.status,\n r ->> 'RetentionPeriod' as retention_period,\n r ->> 'StorageClass'\ - \ as storage_class\nfrom\n aws_securitylake_data_lake as l,\n jsonb_array_elements(retention_settings)\ - \ as r;" + QueryToExecute: | + SELECT + l.encryption_key, + l.replication_role_arn, + l.s3_bucket_arn, + l.status, + r ->> 'RetentionPeriod' AS retention_period, + r ->> 'StorageClass' AS storage_class + FROM + aws_securitylake_data_lake AS l, + jsonb_array_elements(retention_settings) AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lake Formation -Title: List AWS Lake Formation Data Lakes with Key Details + - Lake Formation +Title: List AWS Lake Formation Data Lakes with Key Details \ No newline at end of file diff --git a/queries/aws_securitylake_data_lake_4.yaml b/queries/aws_securitylake_data_lake_4.yaml old mode 100755 new mode 100644 index 8aa395a6a..a467e7b2b --- a/queries/aws_securitylake_data_lake_4.yaml +++ b/queries/aws_securitylake_data_lake_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Lake Formation Data Lakes for information such - as the Data Lake name, creation time, last modified time, and more. +Description: Allows users to query AWS Lake Formation Data Lakes for information such as the Data Lake name, creation time, last modified time, and more. ID: aws_securitylake_data_lake_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n encryption_key,\n replication_role_arn,\n s3_bucket_arn,\n\ - \ status\nfrom\n aws_securitylake_data_lake\nwhere\n status = 'PENDING';" + QueryToExecute: | + SELECT + encryption_key, + replication_role_arn, + s3_bucket_arn, + status + FROM + aws_securitylake_data_lake + WHERE + status = 'PENDING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Lake Formation -Title: List all AWS Lake Formation Data Lakes and Details + - Lake Formation +Title: List all AWS Lake Formation Data Lakes and Details \ No newline at end of file diff --git a/queries/aws_securitylake_subscriber_1.yaml b/queries/aws_securitylake_subscriber_1.yaml old mode 100755 new mode 100644 index ca956ac9b..10a12a348 --- a/queries/aws_securitylake_subscriber_1.yaml +++ b/queries/aws_securitylake_subscriber_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Security Lake Subscriber data, providing information - about each subscriber''s details in the AWS Security Lake service. This includes - subscriber status, endpoint type, and subscription creation time. +Description: Allows users to query AWS Security Lake Subscriber data, providing information about each subscriber's details in the AWS Security Lake service. This includes subscriber status, endpoint type, and subscription creation time. ID: aws_securitylake_subscriber_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subscriber_name,\n subscription_id,\n created_at,\n\ - \ role_arn,\n s3_bucket_arn,\n subscription_endpoint\nfrom\n aws_securitylake_subscriber;" + QueryToExecute: | + SELECT + subscriber_name, + subscription_id, + created_at, + role_arn, + s3_bucket_arn, + subscription_endpoint + FROM + aws_securitylake_subscriber; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Lake -Title: List AWS Security Lake Subscriber Details + - AWS Security Lake +Title: List AWS Security Lake Subscriber Details \ No newline at end of file diff --git a/queries/aws_securitylake_subscriber_2.yaml b/queries/aws_securitylake_subscriber_2.yaml old mode 100755 new mode 100644 index 5f66f9a5b..93679bf95 --- a/queries/aws_securitylake_subscriber_2.yaml +++ b/queries/aws_securitylake_subscriber_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Security Lake Subscriber data, providing information - about each subscriber''s details in the AWS Security Lake service. This includes - subscriber status, endpoint type, and subscription creation time. +Description: Allows users to query AWS Security Lake Subscriber data, providing information about each subscriber's details in the AWS Security Lake service. This includes subscriber status, endpoint type, and subscription creation time. ID: aws_securitylake_subscriber_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subscriber_name,\n subscription_id,\n created_at,\n\ - \ role_arn,\n s3_bucket_arn,\n subscription_endpoint\nfrom\n aws_securitylake_subscriber\n\ - where\n created_at <= created_at - interval '30' day;" + QueryToExecute: | + SELECT + subscriber_name, + subscription_id, + created_at, + role_arn, + s3_bucket_arn, + subscription_endpoint + FROM + aws_securitylake_subscriber + WHERE + created_at <= created_at - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Lake -Title: List all AWS Security Lake Subscriber details + - AWS Security Lake +Title: List all AWS Security Lake Subscriber details \ No newline at end of file diff --git a/queries/aws_securitylake_subscriber_3.yaml b/queries/aws_securitylake_subscriber_3.yaml old mode 100755 new mode 100644 index 3d8f2ad70..66ce224ee --- a/queries/aws_securitylake_subscriber_3.yaml +++ b/queries/aws_securitylake_subscriber_3.yaml @@ -1,27 +1,34 @@ -Description: Allows users to query AWS Security Lake Subscriber data, providing information - about each subscriber''s details in the AWS Security Lake service. This includes - subscriber status, endpoint type, and subscription creation time. +Description: Allows users to query AWS Security Lake Subscriber data, providing information about each subscriber''s details in the AWS Security Lake service. This includes subscriber status, endpoint type, and subscription creation time. ID: aws_securitylake_subscriber_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.subscriber_name,\n s.subscription_id,\n r.arn,\n\ - \ r.inline_policies,\n r.attached_policy_arns,\n r.assume_role_policy\nfrom\n\ - \ aws_securitylake_subscriber as s,\n aws_iam_role as r\nwhere\n s.role_arn\ - \ = r.arn;" + QueryToExecute: | + SELECT + s.subscriber_name, + s.subscription_id, + r.arn, + r.inline_policies, + r.attached_policy_arns, + r.assume_role_policy + FROM + aws_securitylake_subscriber AS s, + aws_iam_role AS r + WHERE + s.role_arn = r.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Lake -Title: List AWS Security Lake Subscriber Details and Roles + - Security Lake +Title: List AWS Security Lake Subscriber Details and Roles \ No newline at end of file diff --git a/queries/aws_securitylake_subscriber_4.yaml b/queries/aws_securitylake_subscriber_4.yaml old mode 100755 new mode 100644 index 7e067472a..8c7c270c5 --- a/queries/aws_securitylake_subscriber_4.yaml +++ b/queries/aws_securitylake_subscriber_4.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS Security Lake Subscriber data, providing information - about each subscriber''s details in the AWS Security Lake service. This includes - subscriber status, endpoint type, and subscription creation time. +Description: Allows users to query AWS Security Lake Subscriber data, providing information about each subscriber's details in the AWS Security Lake service. This includes subscriber status, endpoint type, and subscription creation time. ID: aws_securitylake_subscriber_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.subscriber_name,\n s.subscription_id,\n b.arn,\n\ - \ b.event_notification_configuration,\n b.server_side_encryption_configuration,\n\ - \ b.acl\nfrom\n aws_securitylake_subscriber as s,\n aws_s3_bucket as b\nwhere\n\ - \ s.s3_bucket_arn = b.arn;" + QueryToExecute: | + SELECT + s.subscriber_name, + s.subscription_id, + b.arn, + b.event_notification_configuration, + b.server_side_encryption_configuration, + b.acl + FROM + aws_securitylake_subscriber AS s, + aws_s3_bucket AS b + WHERE + s.s3_bucket_arn = b.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Lake -Title: Find all subscribers in AWS Security Lake with details + - Security Lake +Title: Find all subscribers in AWS Security Lake with details \ No newline at end of file diff --git a/queries/aws_securitylake_subscriber_5.yaml b/queries/aws_securitylake_subscriber_5.yaml old mode 100755 new mode 100644 index 04469719b..76871858d --- a/queries/aws_securitylake_subscriber_5.yaml +++ b/queries/aws_securitylake_subscriber_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Security Lake Subscriber data, providing information - about each subscriber''s details in the AWS Security Lake service. This includes - subscriber status, endpoint type, and subscription creation time. +Description: Allows users to query AWS Security Lake Subscriber data, providing information about each subscriber's details in the AWS Security Lake service. This includes subscriber status, endpoint type, and subscription creation time. ID: aws_securitylake_subscriber_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subscriber_name,\n created_at,\n subscription_status,\n\ - \ s3_bucket_arn,\n sns_arn\nfrom\n aws_securitylake_subscriber\nwhere\n subscription_status\ - \ <> 'ACTIVE';" + QueryToExecute: | + SELECT + subscriber_name, + created_at, + subscription_status, + s3_bucket_arn, + sns_arn + FROM + aws_securitylake_subscriber + WHERE + subscription_status <> 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Lake -Title: List all AWS Security Lake Subscriber Details + - AWS Security Lake +Title: List all AWS Security Lake Subscriber Details \ No newline at end of file diff --git a/queries/aws_serverlessapplicationrepository_application_1.yaml b/queries/aws_serverlessapplicationrepository_application_1.yaml old mode 100755 new mode 100644 index fc486bc55..be705874c --- a/queries/aws_serverlessapplicationrepository_application_1.yaml +++ b/queries/aws_serverlessapplicationrepository_application_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Serverless Application Repository Applications - to fetch details like application name, status, author, description, labels, license - URL, creation time, and more. +Description: Allows users to query AWS Serverless Application Repository Applications to fetch details like application name, status, author, description, labels, license URL, creation time, and more. ID: aws_serverlessapplicationrepository_application_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n author,\n creation_time,\n description\n\ - from\n aws_serverlessapplicationrepository_application;" + QueryToExecute: | + SELECT + name, + arn, + author, + creation_time, + description + FROM + aws_serverlessapplicationrepository_application; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Serverless Application Repository -Title: List AWS Serverless Application Repository Applications + - Serverless Application Repository +Title: List AWS Serverless Application Repository Applications \ No newline at end of file diff --git a/queries/aws_serverlessapplicationrepository_application_2.yaml b/queries/aws_serverlessapplicationrepository_application_2.yaml old mode 100755 new mode 100644 index 2b4860420..e9f7a2ac8 --- a/queries/aws_serverlessapplicationrepository_application_2.yaml +++ b/queries/aws_serverlessapplicationrepository_application_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Serverless Application Repository Applications - to fetch details like application name, status, author, description, labels, license - URL, creation time, and more. +Description: Allows users to query AWS Serverless Application Repository Applications to fetch details like application name, status, author, description, labels, license URL, creation time, and more. ID: aws_serverlessapplicationrepository_application_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n author,\n is_verified_author\nfrom\n\ - \ aws_serverlessapplicationrepository_application\nwhere\n is_verified_author;" + QueryToExecute: | + SELECT + name, + arn, + author, + is_verified_author + FROM + aws_serverlessapplicationrepository_application + WHERE + is_verified_author; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Serverless Application Repository -Title: List AWS Serverless App Repo Applications by Verified Author + - Serverless Application Repository +Title: List AWS Serverless App Repo Applications by Verified Author \ No newline at end of file diff --git a/queries/aws_serverlessapplicationrepository_application_3.yaml b/queries/aws_serverlessapplicationrepository_application_3.yaml old mode 100755 new mode 100644 index 0b58bf9b8..da3c3ba10 --- a/queries/aws_serverlessapplicationrepository_application_3.yaml +++ b/queries/aws_serverlessapplicationrepository_application_3.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS Serverless Application Repository Applications - to fetch details like application name, status, author, description, labels, license - URL, creation time, and more. +Description: Allows users to query AWS Serverless Application Repository Applications to fetch details like application name, status, author, description, labels, license URL, creation time, and more. ID: aws_serverlessapplicationrepository_application_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n jsonb_pretty(statement -> 'Actions') as actions,\n\ - \ jsonb_pretty(statement -> 'PrincipalOrgIDs') as principal_org_ids,\n jsonb_pretty(statement\ - \ -> 'Principals') as principals,\n statement ->> 'StatementId' as statement_id\n\ - from\n aws_serverlessapplicationrepository_application,\n jsonb_array_elements(statements)\ - \ as statement;" + QueryToExecute: | + SELECT + name, + JSONB_PRETTY(statement -> 'Actions') AS actions, + JSONB_PRETTY(statement -> 'PrincipalOrgIDs') AS principal_org_ids, + JSONB_PRETTY(statement -> 'Principals') AS principals, + statement ->> 'StatementId' AS statement_id + FROM + aws_serverlessapplicationrepository_application, + JSONB_ARRAY_ELEMENTS(statements) AS statement; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Serverless Application Repository -Title: List all AWS Serverless Application Repository Applications + - AWS Serverless Application Repository +Title: List all AWS Serverless Application Repository Applications \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_1.yaml b/queries/aws_service_discovery_instance_1.yaml old mode 100755 new mode 100644 index a625e55cc..c0608835d --- a/queries/aws_service_discovery_instance_1.yaml +++ b/queries/aws_service_discovery_instance_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n service_id,\n ec2_instance_id,\n attributes\n\ - from\n aws_service_discovery_instance;" + QueryToExecute: | + SELECT + id, + service_id, + ec2_instance_id, + attributes + FROM + aws_service_discovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: Find AWS Cloud Map Service Instances and Health Information + - Cloud Map +Title: Find AWS Cloud Map Service Instances and Health Information \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_2.yaml b/queries/aws_service_discovery_instance_2.yaml old mode 100755 new mode 100644 index df40831cb..d6a4f2e9c --- a/queries/aws_service_discovery_instance_2.yaml +++ b/queries/aws_service_discovery_instance_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n service_id,\n init_health_status\nfrom\n aws_service_discovery_instance\n\ - where\n init_health_status = 'UNHEALTHY';" + QueryToExecute: | + SELECT + id, + service_id, + init_health_status + FROM + aws_service_discovery_instance + WHERE + init_health_status = 'UNHEALTHY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map Service -Title: Find Unhealthy AWS Cloud Map Service Instances + - Cloud Map Service +Title: Find Unhealthy AWS Cloud Map Service Instances \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_3.yaml b/queries/aws_service_discovery_instance_3.yaml old mode 100755 new mode 100644 index 66fd98111..497a02fc5 --- a/queries/aws_service_discovery_instance_3.yaml +++ b/queries/aws_service_discovery_instance_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_id,\n count(id)\nfrom\n aws_service_discovery_instance\n\ - group by\n service_id;" + QueryToExecute: | + SELECT + service_id, + COUNT(id) + FROM + aws_service_discovery_instance + GROUP BY + service_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cloud Map -Title: List all AWS Cloud Map Service Instances with Details + - AWS Cloud Map +Title: List all AWS Cloud Map Service Instances with Details \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_4.yaml b/queries/aws_service_discovery_instance_4.yaml old mode 100755 new mode 100644 index 60a136d29..8abbb2c1d --- a/queries/aws_service_discovery_instance_4.yaml +++ b/queries/aws_service_discovery_instance_4.yaml @@ -1,27 +1,34 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.id,\n i.service_id,\n s.name as service_name,\n \ - \ s.create_date as service_create_date,\n s.namespace_id,\n s.type\nfrom\n \ - \ aws_service_discovery_instance as i,\n aws_service_discovery_service as s\n\ - where\n s.id = i.service_id;" + QueryToExecute: | + SELECT + i.id, + i.service_id, + s.name AS service_name, + s.create_date AS service_create_date, + s.namespace_id, + s.type + FROM + aws_service_discovery_instance AS i, + aws_service_discovery_service AS s + WHERE + s.id = i.service_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Cloud Map -Title: List all AWS Cloud Map Service Instances with Details + - AWS Cloud Map +Title: List all AWS Cloud Map Service Instances with Details \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_5.yaml b/queries/aws_service_discovery_instance_5.yaml old mode 100755 new mode 100644 index 061c774b5..39facb048 --- a/queries/aws_service_discovery_instance_5.yaml +++ b/queries/aws_service_discovery_instance_5.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.id,\n i.service_id,\n i.ec2_instance_id,\n ei.instance_type,\n\ - \ ei.instance_state,\n ei.launch_time\nfrom\n aws_service_discovery_instance\ - \ as i,\n aws_ec2_instance as ei\nwhere\n i.ec2_instance_id is not null\nand\n\ - \ ei.instance_id = i.ec2_instance_id;" + QueryToExecute: | + SELECT + i.id, + i.service_id, + i.ec2_instance_id, + ei.instance_type, + ei.instance_state, + ei.launch_time + FROM + aws_service_discovery_instance AS i, + aws_ec2_instance AS ei + WHERE + i.ec2_instance_id IS NOT NULL + AND + ei.instance_id = i.ec2_instance_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: List AWS Cloud Map Service Instances and Health Status + - Cloud Map +Title: List AWS Cloud Map Service Instances and Health Status \ No newline at end of file diff --git a/queries/aws_service_discovery_instance_6.yaml b/queries/aws_service_discovery_instance_6.yaml old mode 100755 new mode 100644 index cd4eaa44b..58e1ab5b2 --- a/queries/aws_service_discovery_instance_6.yaml +++ b/queries/aws_service_discovery_instance_6.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed - information about each instance associated with a specified service. This information - includes the instance ID, instance attributes, and the health status of the instance. +Description: Allows users to query AWS Cloud Map Service Instances and retrieve detailed information about each instance associated with a specified service. This information includes the instance ID, instance attributes, and the health status of the instance. ID: aws_service_discovery_instance_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n service_id,\n ec2_instance_id,\n instance_ipv4,\n\ - \ instance_ipv6,\n instance_port\nfrom\n aws_service_discovery_instance;" + QueryToExecute: | + SELECT + id, + service_id, + ec2_instance_id, + instance_ipv4, + instance_ipv6, + instance_port + FROM + aws_service_discovery_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: Find AWS Cloud Map Service Instances and Their Details + - Cloud Map +Title: Find AWS Cloud Map Service Instances and Their Details \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_1.yaml b/queries/aws_service_discovery_namespace_1.yaml old mode 100755 new mode 100644 index 54013a380..67fe8eadd --- a/queries/aws_service_discovery_namespace_1.yaml +++ b/queries/aws_service_discovery_namespace_1.yaml @@ -1,19 +1,26 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n region\nfrom\n aws_service_discovery_namespace;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + region + FROM + aws_service_discovery_namespace; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: Find AWS Cloud Map Service Discovery Namespaces + - Cloud Map +Title: Find AWS Cloud Map Service Discovery Namespaces \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_2.yaml b/queries/aws_service_discovery_namespace_2.yaml old mode 100755 new mode 100644 index 9dcba1d8f..309d68f40 --- a/queries/aws_service_discovery_namespace_2.yaml +++ b/queries/aws_service_discovery_namespace_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n service_count\nfrom\n\ - \ aws_service_discovery_namespace\nwhere\n type ilike '%private%';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + service_count + FROM + aws_service_discovery_namespace + WHERE + type ILIKE '%private%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: Find AWS Cloud Map Service Discovery Namespace Details + - Cloud Map +Title: Find AWS Cloud Map Service Discovery Namespace Details \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_3.yaml b/queries/aws_service_discovery_namespace_3.yaml old mode 100755 new mode 100644 index 4a6dbd96d..280b0bdb3 --- a/queries/aws_service_discovery_namespace_3.yaml +++ b/queries/aws_service_discovery_namespace_3.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n service_count\nfrom\n\ - \ aws_service_discovery_namespace\nwhere\n type = 'HTTP';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + service_count + FROM + aws_service_discovery_namespace + WHERE + type = 'HTTP'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: List all AWS Cloud Map Service Discovery Namespaces + - Cloud Map +Title: List all AWS Cloud Map Service Discovery Namespaces \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_4.yaml b/queries/aws_service_discovery_namespace_4.yaml old mode 100755 new mode 100644 index 25b83f994..88323cfef --- a/queries/aws_service_discovery_namespace_4.yaml +++ b/queries/aws_service_discovery_namespace_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n description,\n create_date\nfrom\n \ - \ aws_service_discovery_namespace\nwhere\n create_date >= now() - interval '30'\ - \ day;" + QueryToExecute: | + SELECT + name, + id, + description, + create_date + FROM + aws_service_discovery_namespace + WHERE + create_date >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map Service Discovery -Title: List all AWS Cloud Map Service Discovery Namespaces + - Cloud Map Service Discovery +Title: List all AWS Cloud Map Service Discovery Namespaces \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_5.yaml b/queries/aws_service_discovery_namespace_5.yaml old mode 100755 new mode 100644 index 656a83cc0..50837c18f --- a/queries/aws_service_discovery_namespace_5.yaml +++ b/queries/aws_service_discovery_namespace_5.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n http_properties ->> 'HttpName' as http_name\n\ - from\n aws_service_discovery_namespace\nwhere\n type = 'HTTP';" + QueryToExecute: | + SELECT + name, + id, + http_properties ->> 'HttpName' AS http_name + FROM + aws_service_discovery_namespace + WHERE + type = 'HTTP'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: List AWS Cloud Map Service Discovery Namespace Details + - Cloud Map +Title: List AWS Cloud Map Service Discovery Namespace Details \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_6.yaml b/queries/aws_service_discovery_namespace_6.yaml old mode 100755 new mode 100644 index d2d843f5c..df4b7bdf3 --- a/queries/aws_service_discovery_namespace_6.yaml +++ b/queries/aws_service_discovery_namespace_6.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n dns_properties ->> 'HostedZoneId' as\ - \ HostedZoneId,\n dns_properties -> 'SOA' ->> 'TTL' as ttl\nfrom\n aws_service_discovery_namespace\n\ - where\n type = 'DNS_PRIVATE';" + QueryToExecute: | + SELECT + name, + id, + dns_properties ->> 'HostedZoneId' AS HostedZoneId, + dns_properties -> 'SOA' ->> 'TTL' AS ttl + FROM + aws_service_discovery_namespace + WHERE + type = 'DNS_PRIVATE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map -Title: List AWS Cloud Map Service Discovery Namespaces + - Cloud Map +Title: List AWS Cloud Map Service Discovery Namespaces \ No newline at end of file diff --git a/queries/aws_service_discovery_namespace_7.yaml b/queries/aws_service_discovery_namespace_7.yaml old mode 100755 new mode 100644 index e799d8baf..3c183e3e2 --- a/queries/aws_service_discovery_namespace_7.yaml +++ b/queries/aws_service_discovery_namespace_7.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve - details about the namespaces in AWS Cloud Map. +Description: Allows users to query AWS Cloud Map Service Discovery Namespace to retrieve details about the namespaces in AWS Cloud Map. ID: aws_service_discovery_namespace_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n type,\n count(type)\nfrom\n aws_service_discovery_namespace\n\ - group by\n type;" + QueryToExecute: | + SELECT + type, + COUNT(type) + FROM + aws_service_discovery_namespace + GROUP BY + type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Cloud Map Service Discovery -Title: List all AWS Cloud Map Service Discovery Namespaces + - Cloud Map Service Discovery +Title: List all AWS Cloud Map Service Discovery Namespaces \ No newline at end of file diff --git a/queries/aws_service_discovery_service_1.yaml b/queries/aws_service_discovery_service_1.yaml old mode 100755 new mode 100644 index afb80b715..7b1ab992f --- a/queries/aws_service_discovery_service_1.yaml +++ b/queries/aws_service_discovery_service_1.yaml @@ -1,19 +1,26 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n region\nfrom\n aws_service_discovery_service;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + region + FROM + aws_service_discovery_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Service Discovery Service -Title: Find AWS Service Discovery Services and Details + - AWS Service Discovery Service +Title: Find AWS Service Discovery Services and Details \ No newline at end of file diff --git a/queries/aws_service_discovery_service_2.yaml b/queries/aws_service_discovery_service_2.yaml old mode 100755 new mode 100644 index bbc0670a9..052da97f1 --- a/queries/aws_service_discovery_service_2.yaml +++ b/queries/aws_service_discovery_service_2.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n create_date\nfrom\n\ - \ aws_service_discovery_service\nwhere\n type ilike '%dns%';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + create_date + FROM + aws_service_discovery_service + WHERE + type ILIKE '%dns%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Service Discovery -Title: Find AWS Service Discovery Services registered with Cloud Map + - AWS Service Discovery +Title: Find AWS Service Discovery Services registered with Cloud Map \ No newline at end of file diff --git a/queries/aws_service_discovery_service_3.yaml b/queries/aws_service_discovery_service_3.yaml old mode 100755 new mode 100644 index 2c4e94ba0..fde3a9c1f --- a/queries/aws_service_discovery_service_3.yaml +++ b/queries/aws_service_discovery_service_3.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n description\nfrom\n\ - \ aws_service_discovery_service\nwhere\n type = 'HTTP';" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + description + FROM + aws_service_discovery_service + WHERE + type = 'HTTP'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Discovery -Title: Find all AWS Cloud Map resources by type + - Service Discovery +Title: Find all AWS Cloud Map resources by type \ No newline at end of file diff --git a/queries/aws_service_discovery_service_4.yaml b/queries/aws_service_discovery_service_4.yaml old mode 100755 new mode 100644 index 1388d32b2..173f878a8 --- a/queries/aws_service_discovery_service_4.yaml +++ b/queries/aws_service_discovery_service_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n description,\n create_date\nfrom\n \ - \ aws_service_discovery_service\nwhere\n create_date >= now() - interval '30'\ - \ day;" + QueryToExecute: | + SELECT + name, + id, + description, + create_date + FROM + aws_service_discovery_service + WHERE + create_date >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Discovery -Title: List all AWS Service Discovery Resources in Last 30 Days + - Service Discovery +Title: List all AWS Service Discovery Resources in Last 30 Days \ No newline at end of file diff --git a/queries/aws_service_discovery_service_5.yaml b/queries/aws_service_discovery_service_5.yaml old mode 100755 new mode 100644 index 64bcdda89..caa300c4f --- a/queries/aws_service_discovery_service_5.yaml +++ b/queries/aws_service_discovery_service_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n type,\n count(type)\nfrom\n aws_service_discovery_service\n\ - group by\n type;" + QueryToExecute: | + SELECT + type, + COUNT(type) + FROM + aws_service_discovery_service + GROUP BY + type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Discovery -Title: Find Details of Registered AWS resources Using SQL + - Service Discovery +Title: Find Details of Registered AWS resources Using SQL \ No newline at end of file diff --git a/queries/aws_service_discovery_service_6.yaml b/queries/aws_service_discovery_service_6.yaml old mode 100755 new mode 100644 index c6985c1c0..b7bc6128d --- a/queries/aws_service_discovery_service_6.yaml +++ b/queries/aws_service_discovery_service_6.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n health_check_config ->> 'Type' as health_check_type,\n\ - \ health_check_config ->> 'FailureThreshold' as failure_threshold,\n health_check_config\ - \ ->> 'ResourcePath' as resource_path\nfrom\n aws_service_discovery_service;" + QueryToExecute: | + SELECT + name, + id, + health_check_config ->> 'Type' AS health_check_type, + health_check_config ->> 'FailureThreshold' AS failure_threshold, + health_check_config ->> 'ResourcePath' AS resource_path + FROM + aws_service_discovery_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Discovery -Title: Find all AWS resources registered with Cloud Map + - Service Discovery +Title: Find all AWS resources registered with Cloud Map \ No newline at end of file diff --git a/queries/aws_service_discovery_service_7.yaml b/queries/aws_service_discovery_service_7.yaml old mode 100755 new mode 100644 index 79d81457c..fa08e0f14 --- a/queries/aws_service_discovery_service_7.yaml +++ b/queries/aws_service_discovery_service_7.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n health_check_custom_config ->> 'FailureThreshold'\ - \ as failure_threshold\nfrom\n aws_service_discovery_service;" + QueryToExecute: | + SELECT + name, + id, + health_check_custom_config ->> 'FailureThreshold' AS failure_threshold + FROM + aws_service_discovery_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Discovery -Title: Find AWS Service Discovery Service Resource Details + - Service Discovery +Title: Find AWS Service Discovery Service Resource Details \ No newline at end of file diff --git a/queries/aws_service_discovery_service_8.yaml b/queries/aws_service_discovery_service_8.yaml old mode 100755 new mode 100644 index 89c901fff..8cce4633f --- a/queries/aws_service_discovery_service_8.yaml +++ b/queries/aws_service_discovery_service_8.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Service Discovery Service to retrieve detailed - information about AWS resources that are registered with AWS Cloud Map. +Description: Allows users to query AWS Service Discovery Service to retrieve detailed information about AWS resources that are registered with AWS Cloud Map. ID: aws_service_discovery_service_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.name,\n s.id,\n s.namespace_id,\n n.service_count,\n\ - \ n.type as namespace_type,\n n.dns_properties\nfrom\n aws_service_discovery_service\ - \ as s,\n aws_service_discovery_namespace as n;" + QueryToExecute: | + SELECT + s.name, + s.id, + s.namespace_id, + n.service_count, + n.type AS namespace_type, + n.dns_properties + FROM + aws_service_discovery_service AS s, + aws_service_discovery_namespace AS n; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Service Discovery -Title: List all AWS Service Discovery resources using SQL + - AWS Service Discovery +Title: List all AWS Service Discovery resources using SQL \ No newline at end of file diff --git a/queries/aws_servicecatalog_portfolio_1.yaml b/queries/aws_servicecatalog_portfolio_1.yaml old mode 100755 new mode 100644 index 876c7307b..ff6e59377 --- a/queries/aws_servicecatalog_portfolio_1.yaml +++ b/queries/aws_servicecatalog_portfolio_1.yaml @@ -1,27 +1,28 @@ -Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio - table in Steampipe provides information about portfolios within AWS Service Catalog. - This table allows DevOps engineers to query portfolio-specific details, including - owner, description, created time, and associated metadata. Users can utilize this - table to gather insights on portfolios, such as portfolio details, associated products, - and more. The schema outlines the various attributes of the portfolio, including - the portfolio ARN, creation date, and associated tags. +Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio table in Steampipe provides information about portfolios within AWS Service Catalog. This table allows DevOps engineers to query portfolio-specific details, including owner, description, created time, and associated metadata. Users can utilize this table to gather insights on portfolios, such as portfolio details, associated products, and more. The schema outlines the various attributes of the portfolio, including the portfolio ARN, creation date, and associated tags. ID: aws_servicecatalog_portfolio_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n display_name,\n id,\n arn,\n region,\n akas\nfrom\n\ - \ aws_servicecatalog_portfolio;" + QueryToExecute: | + SELECT + display_name, + id, + arn, + region, + akas + FROM + aws_servicecatalog_portfolio; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Service Catalog -Title: List Service Catalog Portfolios in AWS + - AWS Service Catalog +Title: List Service Catalog Portfolios in AWS \ No newline at end of file diff --git a/queries/aws_servicecatalog_portfolio_2.yaml b/queries/aws_servicecatalog_portfolio_2.yaml old mode 100755 new mode 100644 index 5772ad7ff..5f09714d1 --- a/queries/aws_servicecatalog_portfolio_2.yaml +++ b/queries/aws_servicecatalog_portfolio_2.yaml @@ -1,27 +1,29 @@ -Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio - table in Steampipe provides information about portfolios within AWS Service Catalog. - This table allows DevOps engineers to query portfolio-specific details, including - owner, description, created time, and associated metadata. Users can utilize this - table to gather insights on portfolios, such as portfolio details, associated products, - and more. The schema outlines the various attributes of the portfolio, including - the portfolio ARN, creation date, and associated tags. +Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio table in Steampipe provides information about portfolios within AWS Service Catalog. This table allows DevOps engineers to query portfolio-specific details, including owner, description, created time, and associated metadata. Users can utilize this table to gather insights on portfolios, such as portfolio details, associated products, and more. The schema outlines the various attributes of the portfolio, including the portfolio ARN, creation date, and associated tags. ID: aws_servicecatalog_portfolio_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n display_name,\n id,\n description,\n provider_name\n\ - from\n aws_servicecatalog_portfolio\nwhere\n provider_name = 'my-portfolio';" + QueryToExecute: | + SELECT + display_name, + id, + description, + provider_name + FROM + aws_servicecatalog_portfolio + WHERE + provider_name = 'my-portfolio'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find AWS Service Catalog Portfolio Details + - Service Catalog +Title: Find AWS Service Catalog Portfolio Details \ No newline at end of file diff --git a/queries/aws_servicecatalog_portfolio_3.yaml b/queries/aws_servicecatalog_portfolio_3.yaml old mode 100755 new mode 100644 index 12ba5c0a6..8e47f667c --- a/queries/aws_servicecatalog_portfolio_3.yaml +++ b/queries/aws_servicecatalog_portfolio_3.yaml @@ -1,28 +1,29 @@ -Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio - table in Steampipe provides information about portfolios within AWS Service Catalog. - This table allows DevOps engineers to query portfolio-specific details, including - owner, description, created time, and associated metadata. Users can utilize this - table to gather insights on portfolios, such as portfolio details, associated products, - and more. The schema outlines the various attributes of the portfolio, including - the portfolio ARN, creation date, and associated tags. +Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio table in Steampipe provides information about portfolios within AWS Service Catalog. This table allows DevOps engineers to query portfolio-specific details, including owner, description, created time, and associated metadata. Users can utilize this table to gather insights on portfolios, such as portfolio details, associated products, and more. The schema outlines the various attributes of the portfolio, including the portfolio ARN, creation date, and associated tags. ID: aws_servicecatalog_portfolio_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n display_name,\n id,\n description,\n created_time\n\ - from\n aws_servicecatalog_portfolio\nwhere\n created_time >= now() - interval\ - \ '30' day;" + QueryToExecute: | + SELECT + display_name, + id, + description, + created_time + FROM + aws_servicecatalog_portfolio + WHERE + created_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find AWS Service Catalog Portfolio Details in Last 30 Days + - Service Catalog +Title: Find AWS Service Catalog Portfolio Details in Last 30 Days \ No newline at end of file diff --git a/queries/aws_servicecatalog_portfolio_4.yaml b/queries/aws_servicecatalog_portfolio_4.yaml old mode 100755 new mode 100644 index 190136ca5..50a176bcc --- a/queries/aws_servicecatalog_portfolio_4.yaml +++ b/queries/aws_servicecatalog_portfolio_4.yaml @@ -1,28 +1,27 @@ -Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio - table in Steampipe provides information about portfolios within AWS Service Catalog. - This table allows DevOps engineers to query portfolio-specific details, including - owner, description, created time, and associated metadata. Users can utilize this - table to gather insights on portfolios, such as portfolio details, associated products, - and more. The schema outlines the various attributes of the portfolio, including - the portfolio ARN, creation date, and associated tags. +Description: Allows users to query AWS Service Catalog Portfolios. The aws_servicecatalog_portfolio table in Steampipe provides information about portfolios within AWS Service Catalog. This table allows DevOps engineers to query portfolio-specific details, including owner, description, created time, and associated metadata. Users can utilize this table to gather insights on portfolios, such as portfolio details, associated products, and more. The schema outlines the various attributes of the portfolio, including the portfolio ARN, creation date, and associated tags. ID: aws_servicecatalog_portfolio_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n sp.display_name,\n sp.id,\n b ->> 'BudgetName' as budget_name\n\ - from\n aws_servicecatalog_portfolio as sp,\n jsonb_array_elements(budgets) as\ - \ b;" + QueryToExecute: | + SELECT + sp.display_name, + sp.id, + b ->> 'BudgetName' AS budget_name + FROM + aws_servicecatalog_portfolio AS sp, + jsonb_array_elements(budgets) AS b; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find AWS Service Catalog Portfolio Details Using SQL + - Service Catalog +Title: Find AWS Service Catalog Portfolio Details Using SQL \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_1.yaml b/queries/aws_servicecatalog_product_1.yaml old mode 100755 new mode 100644 index 8e8e7590d..448325f48 --- a/queries/aws_servicecatalog_product_1.yaml +++ b/queries/aws_servicecatalog_product_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n product_id,\n type,\n akas,\n support_url,\n\ - \ support_email\nfrom\n aws_servicecatalog_product;" + QueryToExecute: | + SELECT + name, + id, + product_id, + type, + akas, + support_url, + support_email + FROM + aws_servicecatalog_product; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List all AWS Service Catalog Product Details and Metadata + - Service Catalog +Title: List all AWS Service Catalog Product Details and Metadata \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_2.yaml b/queries/aws_servicecatalog_product_2.yaml old mode 100755 new mode 100644 index ece2d8af9..8b268aaa1 --- a/queries/aws_servicecatalog_product_2.yaml +++ b/queries/aws_servicecatalog_product_2.yaml @@ -1,20 +1,30 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n product_id,\n type,\n distributor,\n\ - \ owner,\n has_default_path\nfrom\n aws_servicecatalog_product\nwhere\n has_default_path;" + QueryToExecute: | + SELECT + name, + id, + product_id, + type, + distributor, + owner, + has_default_path + FROM + aws_servicecatalog_product + WHERE + has_default_path; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find all AWS Service Catalog Product Details + - Service Catalog +Title: Find all AWS Service Catalog Product Details \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_3.yaml b/queries/aws_servicecatalog_product_3.yaml old mode 100755 new mode 100644 index c0dddbf17..92f60f907 --- a/queries/aws_servicecatalog_product_3.yaml +++ b/queries/aws_servicecatalog_product_3.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n product_id,\n type,\n support_url,\n\ - \ support_description\nfrom\n aws_servicecatalog_product\nwhere\n type = 'MARKETPLACE';" + QueryToExecute: | + SELECT + name, + id, + product_id, + type, + support_url, + support_description + FROM + aws_servicecatalog_product + WHERE + type = 'MARKETPLACE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find all AWS Service Catalog Product Details with Metadata + - Service Catalog +Title: Find all AWS Service Catalog Product Details with Metadata \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_4.yaml b/queries/aws_servicecatalog_product_4.yaml old mode 100755 new mode 100644 index 67338c61d..ebd4190df --- a/queries/aws_servicecatalog_product_4.yaml +++ b/queries/aws_servicecatalog_product_4.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n sp.name,\n sp.id,\n sp.owner,\n sp.product_id,\n \ - \ sp.short_description,\n b ->> 'BudgetName' as budget_name\nfrom\n aws_servicecatalog_product\ - \ as sp,\n jsonb_array_elements(budgets) as b;" + QueryToExecute: | + SELECT + sp.name, + sp.id, + sp.owner, + sp.product_id, + sp.short_description, + b ->> 'BudgetName' AS budget_name + FROM + aws_servicecatalog_product AS sp, + jsonb_array_elements(budgets) AS b; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List all AWS Service Catalog Product details + - Service Catalog +Title: List all AWS Service Catalog Product details \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_5.yaml b/queries/aws_servicecatalog_product_5.yaml old mode 100755 new mode 100644 index 3b9c98973..a37dc6657 --- a/queries/aws_servicecatalog_product_5.yaml +++ b/queries/aws_servicecatalog_product_5.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n owner,\n short_description,\n l ->>\ - \ 'Id' as launch_path_id,\n l ->> 'Name' as launch_path_name\nfrom\n aws_servicecatalog_product,\n\ - \ jsonb_array_elements(launch_paths) as l;" + QueryToExecute: | + SELECT + name, + id, + owner, + short_description, + l ->> 'Id' AS launch_path_id, + l ->> 'Name' AS launch_path_name + FROM + aws_servicecatalog_product, + jsonb_array_elements(launch_paths) AS l; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List all AWS Service Catalog Product Details + - Service Catalog +Title: List all AWS Service Catalog Product Details \ No newline at end of file diff --git a/queries/aws_servicecatalog_product_6.yaml b/queries/aws_servicecatalog_product_6.yaml old mode 100755 new mode 100644 index 4e8a87957..3b697b005 --- a/queries/aws_servicecatalog_product_6.yaml +++ b/queries/aws_servicecatalog_product_6.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Service Catalog Product data including product - details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_product_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n p ->> 'Id' as provisioning_artifact_id,\n\ - \ p ->> 'Name' as provisioning_artifact_name,\n p ->> 'CreatedTime' as provisioning_artifact_created_time,\n\ - \ p ->> 'Description' as provisioning_artifact_description,\n p ->> 'Guidance'\ - \ as provisioning_artifact_guidance\nfrom\n aws_servicecatalog_product,\n jsonb_array_elements(provisioning_artifacts)\ - \ as p;" + QueryToExecute: | + SELECT + name, + id, + p ->> 'Id' AS provisioning_artifact_id, + p ->> 'Name' AS provisioning_artifact_name, + p ->> 'CreatedTime' AS provisioning_artifact_created_time, + p ->> 'Description' AS provisioning_artifact_description, + p ->> 'Guidance' AS provisioning_artifact_guidance + FROM + aws_servicecatalog_product, + jsonb_array_elements(provisioning_artifacts) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List AWS Service Catalog Product Data Including Details and Metadata + - Service Catalog +Title: List AWS Service Catalog Product Data Including Details and Metadata \ No newline at end of file diff --git a/queries/aws_servicecatalog_provisioned_product_1.yaml b/queries/aws_servicecatalog_provisioned_product_1.yaml old mode 100755 new mode 100644 index c90ef4c4c..783a2c60b --- a/queries/aws_servicecatalog_provisioned_product_1.yaml +++ b/queries/aws_servicecatalog_provisioned_product_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS Service Catalog Provisioned Product data including - product details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Provisioned Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_provisioned_product_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n product_id,\n status,\n\ - \ created_time,\n last_provisioning_record_id\nfrom\n aws_servicecatalog_provisioned_product;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + product_id, + status, + created_time, + last_provisioning_record_id + FROM + aws_servicecatalog_provisioned_product; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find AWS Service Catalog Provisioned Product Details + - Service Catalog +Title: Find AWS Service Catalog Provisioned Product Details \ No newline at end of file diff --git a/queries/aws_servicecatalog_provisioned_product_2.yaml b/queries/aws_servicecatalog_provisioned_product_2.yaml old mode 100755 new mode 100644 index 46ff9e13b..504b91e3f --- a/queries/aws_servicecatalog_provisioned_product_2.yaml +++ b/queries/aws_servicecatalog_provisioned_product_2.yaml @@ -1,23 +1,35 @@ -Description: Allows users to query AWS Service Catalog Provisioned Product data including - product details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Provisioned Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_provisioned_product_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n product_id,\n status,\n\ - \ created_time,\n last_provisioning_record_id\nfrom\n aws_servicecatalog_provisioned_product\n\ - where\n created_time >= (current_date - interval '7' day)\norder by\n created_time;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + product_id, + status, + created_time, + last_provisioning_record_id + FROM + aws_servicecatalog_provisioned_product + WHERE + created_time >= (CURRENT_DATE - INTERVAL '7' DAY) + ORDER BY + created_time; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: Find all AWS Service Catalog Provisioned Product details + - Service Catalog +Title: Find all AWS Service Catalog Provisioned Product details \ No newline at end of file diff --git a/queries/aws_servicecatalog_provisioned_product_3.yaml b/queries/aws_servicecatalog_provisioned_product_3.yaml old mode 100755 new mode 100644 index 6faf14b57..673c237e1 --- a/queries/aws_servicecatalog_provisioned_product_3.yaml +++ b/queries/aws_servicecatalog_provisioned_product_3.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS Service Catalog Provisioned Product data including - product details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Provisioned Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_provisioned_product_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n product_id,\n status,\n\ - \ created_time,\n last_provisioning_record_id\nfrom\n aws_servicecatalog_provisioned_product\n\ - where\n last_successful_provisioning_record_id is not null;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + product_id, + status, + created_time, + last_provisioning_record_id + FROM + aws_servicecatalog_provisioned_product + WHERE + last_successful_provisioning_record_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List AWS Service Catalog Provisioned Products with Details + - Service Catalog +Title: List AWS Service Catalog Provisioned Products with Details \ No newline at end of file diff --git a/queries/aws_servicecatalog_provisioned_product_4.yaml b/queries/aws_servicecatalog_provisioned_product_4.yaml old mode 100755 new mode 100644 index 1f05d0313..0d691849d --- a/queries/aws_servicecatalog_provisioned_product_4.yaml +++ b/queries/aws_servicecatalog_provisioned_product_4.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS Service Catalog Provisioned Product data including - product details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Provisioned Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_provisioned_product_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n pr.id as provisioning_id,\n p.name as product_name,\n\ - \ p.id as product_view_id,\n p.product_id,\n p.type as product_type,\n p.support_url\ - \ as product_support_url,\n p.support_email as product_support_email\nfrom\n\ - \ aws_servicecatalog_provisioned_product as pr,\n aws_servicecatalog_product\ - \ as p\nwhere\n pr.product_id = p.product_id\n and last_successful_provisioning_record_id\ - \ is not null;" + QueryToExecute: | + SELECT + pr.id AS provisioning_id, + p.name AS product_name, + p.id AS product_view_id, + p.product_id, + p.type AS product_type, + p.support_url AS product_support_url, + p.support_email AS product_support_email + FROM + aws_servicecatalog_provisioned_product AS pr, + aws_servicecatalog_product AS p + WHERE + pr.product_id = p.product_id + AND last_successful_provisioning_record_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List all AWS Service Catalog Provisioned Product details + - Service Catalog +Title: List all AWS Service Catalog Provisioned Product details \ No newline at end of file diff --git a/queries/aws_servicecatalog_provisioned_product_5.yaml b/queries/aws_servicecatalog_provisioned_product_5.yaml old mode 100755 new mode 100644 index e06f72c67..f62074354 --- a/queries/aws_servicecatalog_provisioned_product_5.yaml +++ b/queries/aws_servicecatalog_provisioned_product_5.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Service Catalog Provisioned Product data including - product details, owner, type, and associated metadata. +Description: Allows users to query AWS Service Catalog Provisioned Product data including product details, owner, type, and associated metadata. ID: aws_servicecatalog_provisioned_product_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n arn,\n type,\n product_id,\n status,\n\ - \ created_time,\n last_provisioning_record_id\nfrom\n aws_servicecatalog_provisioned_product\n\ - where\n type = 'CFN_STACK'\n and last_successful_provisioning_record_id is not\ - \ null;" + QueryToExecute: | + SELECT + name, + id, + arn, + type, + product_id, + status, + created_time, + last_provisioning_record_id + FROM + aws_servicecatalog_provisioned_product + WHERE + type = 'CFN_STACK' + AND last_successful_provisioning_record_id IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Catalog -Title: List AWS Service Catalog Provisioned Product Details + - Service Catalog +Title: List AWS Service Catalog Provisioned Product Details \ No newline at end of file diff --git a/queries/aws_servicequotas_default_service_quota_1.yaml b/queries/aws_servicequotas_default_service_quota_1.yaml old mode 100755 new mode 100644 index a321aabc1..6fc9f0f97 --- a/queries/aws_servicequotas_default_service_quota_1.yaml +++ b/queries/aws_servicequotas_default_service_quota_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve - information about the default values of service quotas for AWS services. +Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve information about the default values of service quotas for AWS services. ID: aws_servicequotas_default_service_quota_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_default_service_quota;" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_default_service_quota; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: List all AWS Service Quotas Default Values + - Service Quotas +Title: List all AWS Service Quotas Default Values \ No newline at end of file diff --git a/queries/aws_servicequotas_default_service_quota_2.yaml b/queries/aws_servicequotas_default_service_quota_2.yaml old mode 100755 new mode 100644 index 0368872e8..d59723a03 --- a/queries/aws_servicequotas_default_service_quota_2.yaml +++ b/queries/aws_servicequotas_default_service_quota_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve - information about the default values of service quotas for AWS services. +Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve information about the default values of service quotas for AWS services. ID: aws_servicequotas_default_service_quota_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_default_service_quota\nwhere\n\ - \ global_quota;" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_default_service_quota + WHERE + global_quota; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: List all Default AWS Service Quotas using SQL + - Service Quotas +Title: List all Default AWS Service Quotas using SQL \ No newline at end of file diff --git a/queries/aws_servicequotas_default_service_quota_3.yaml b/queries/aws_servicequotas_default_service_quota_3.yaml old mode 100755 new mode 100644 index e0ff0872d..1ea8eddf7 --- a/queries/aws_servicequotas_default_service_quota_3.yaml +++ b/queries/aws_servicequotas_default_service_quota_3.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve - information about the default values of service quotas for AWS services. +Description: Allows users to query AWS Service Quotas Default Service Quota to retrieve information about the default values of service quotas for AWS services. ID: aws_servicequotas_default_service_quota_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_default_service_quota\nwhere\n\ - \ service_code = 'athena';" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_default_service_quota + WHERE + service_code = 'athena'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find AWS Default Service Quotas for Services + - Service Quotas +Title: Find AWS Default Service Quotas for Services \ No newline at end of file diff --git a/queries/aws_servicequotas_service_1.yaml b/queries/aws_servicequotas_service_1.yaml old mode 100755 new mode 100644 index 9eca1b021..d1abad907 --- a/queries/aws_servicequotas_service_1.yaml +++ b/queries/aws_servicequotas_service_1.yaml @@ -1,19 +1,23 @@ -Description: Allows users to query AWS Service Quotas services, providing detailed - information about each service''s code and name. +Description: Allows users to query AWS Service Quotas services, providing detailed information about each service's code and name. ID: aws_servicequotas_service_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select distinct\n service_code,\n service_name\nfrom\n aws_servicequotas_service;" + QueryToExecute: | + SELECT DISTINCT + service_code, + service_name + FROM + aws_servicequotas_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: List all AWS Service Quotas with detailed service info + - Service Quotas +Title: List all AWS Service Quotas with detailed service info \ No newline at end of file diff --git a/queries/aws_servicequotas_service_2.yaml b/queries/aws_servicequotas_service_2.yaml old mode 100755 new mode 100644 index 698e2674b..7059c96f6 --- a/queries/aws_servicequotas_service_2.yaml +++ b/queries/aws_servicequotas_service_2.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query AWS Service Quotas services, providing detailed - information about each service''s code and name. +Description: Allows users to query AWS Service Quotas services, providing detailed information about each service's code and name. ID: aws_servicequotas_service_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select distinct\n service_code\nfrom\n aws_servicequotas_service\n\ - where\n service_name = 'AWS CloudTrail';" + QueryToExecute: | + SELECT DISTINCT + service_code + FROM + aws_servicequotas_service + WHERE + service_name = 'AWS CloudTrail'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find AWS Service Quota Service Codes for CloudTrail + - Service Quotas +Title: Find AWS Service Quota Service Codes for CloudTrail \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_1.yaml b/queries/aws_servicequotas_service_quota_1.yaml old mode 100755 new mode 100644 index 3b1b4b4f7..fb37946b6 --- a/queries/aws_servicequotas_service_quota_1.yaml +++ b/queries/aws_servicequotas_service_quota_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Service Quotas, providing detailed information - about each quota''s value, default value, and whether it''s adjustable. +Description: Allows users to query AWS Service Quotas, providing detailed information about each quota's value, default value, and whether it's adjustable. ID: aws_servicequotas_service_quota_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_service_quota;" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_service_quota; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: List all AWS Service Quotas with Values and Details + - Service Quotas +Title: List all AWS Service Quotas with Values and Details \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_2.yaml b/queries/aws_servicequotas_service_quota_2.yaml old mode 100755 new mode 100644 index d79ab97ec..aee973d19 --- a/queries/aws_servicequotas_service_quota_2.yaml +++ b/queries/aws_servicequotas_service_quota_2.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS Service Quotas, providing detailed information - about each quota''s value, default value, and whether it''s adjustable. +Description: Allows users to query AWS Service Quotas, providing detailed information about each quota's value, default value, and whether it's adjustable. ID: aws_servicequotas_service_quota_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_service_quota\nwhere\n global_quota;" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_service_quota + WHERE + global_quota; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find AWS Service Quotas with Details on Values + - Service Quotas +Title: Find AWS Service Quotas with Details on Values \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_3.yaml b/queries/aws_servicequotas_service_quota_3.yaml old mode 100755 new mode 100644 index 95664734a..42ffca8b7 --- a/queries/aws_servicequotas_service_quota_3.yaml +++ b/queries/aws_servicequotas_service_quota_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Service Quotas, providing detailed information - about each quota''s value, default value, and whether it''s adjustable. +Description: Allows users to query AWS Service Quotas, providing detailed information about each quota's value, default value, and whether it's adjustable. ID: aws_servicequotas_service_quota_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n quota_name,\n quota_code,\n quota_arn,\n service_name,\n\ - \ service_code,\n value\nfrom\n aws_servicequotas_service_quota\nwhere\n service_code\ - \ = 'athena';" + QueryToExecute: | + SELECT + quota_name, + quota_code, + quota_arn, + service_name, + service_code, + value + FROM + aws_servicequotas_service_quota + WHERE + service_code = 'athena'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find AWS Service Quotas for Specific Services + - Service Quotas +Title: Find AWS Service Quotas for Specific Services \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_change_request_1.yaml b/queries/aws_servicequotas_service_quota_change_request_1.yaml old mode 100755 new mode 100644 index e47ef719e..9e681f367 --- a/queries/aws_servicequotas_service_quota_change_request_1.yaml +++ b/queries/aws_servicequotas_service_quota_change_request_1.yaml @@ -1,19 +1,27 @@ Description: Allows users to query AWS Service Quotas change requests. ID: aws_servicequotas_service_quota_change_request_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n case_id,\n status,\n quota_name,\n quota_code,\n\ - \ desired_value\nfrom\n aws_servicequotas_service_quota_change_request;" + QueryToExecute: | + SELECT + id, + case_id, + status, + quota_name, + quota_code, + desired_value + FROM + aws_servicequotas_service_quota_change_request; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find All AWS Service Quotas Change Requests + - Service Quotas +Title: Find All AWS Service Quotas Change Requests \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_change_request_2.yaml b/queries/aws_servicequotas_service_quota_change_request_2.yaml old mode 100755 new mode 100644 index 6f0681ab7..a367b29e6 --- a/queries/aws_servicequotas_service_quota_change_request_2.yaml +++ b/queries/aws_servicequotas_service_quota_change_request_2.yaml @@ -1,20 +1,29 @@ Description: Allows users to query AWS Service Quotas change requests. ID: aws_servicequotas_service_quota_change_request_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n case_id,\n status,\n quota_name,\n quota_code,\n\ - \ desired_value\nfrom\n aws_servicequotas_service_quota_change_request\nwhere\n\ - \ status = 'DENIED';" + QueryToExecute: | + SELECT + id, + case_id, + status, + quota_name, + quota_code, + desired_value + FROM + aws_servicequotas_service_quota_change_request + WHERE + status = 'DENIED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find AWS Service Quota Change Requests Statuses + - Service Quotas +Title: Find AWS Service Quota Change Requests Statuses \ No newline at end of file diff --git a/queries/aws_servicequotas_service_quota_change_request_3.yaml b/queries/aws_servicequotas_service_quota_change_request_3.yaml old mode 100755 new mode 100644 index 2cd4a35de..10f560209 --- a/queries/aws_servicequotas_service_quota_change_request_3.yaml +++ b/queries/aws_servicequotas_service_quota_change_request_3.yaml @@ -1,20 +1,29 @@ Description: Allows users to query AWS Service Quotas change requests. ID: aws_servicequotas_service_quota_change_request_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n case_id,\n status,\n quota_name,\n quota_code,\n\ - \ desired_value\nfrom\n aws_servicequotas_service_quota_change_request\nwhere\n\ - \ service_code = 'athena';" + QueryToExecute: | + SELECT + id, + case_id, + status, + quota_name, + quota_code, + desired_value + FROM + aws_servicequotas_service_quota_change_request + WHERE + service_code = 'athena'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Service Quotas -Title: Find all AWS Service Quotas change requests + - Service Quotas +Title: Find all AWS Service Quotas change requests \ No newline at end of file diff --git a/queries/aws_ses_domain_identity_1.yaml b/queries/aws_ses_domain_identity_1.yaml old mode 100755 new mode 100644 index e13b475de..f2e84fe2a --- a/queries/aws_ses_domain_identity_1.yaml +++ b/queries/aws_ses_domain_identity_1.yaml @@ -1,25 +1,25 @@ -Description: Allows users to query Amazon Simple Email Service Domain Identities. - The aws_ses_domain_identity table in Steampipe provides information about domain - identities within Amazon Simple Email Service (SES). This table allows DevOps engineers - to query domain-specific details, including verification status, DKIM attributes, - and associated metadata. Users can utilize this table to gather insights on domain - identities, such as verification status, DKIM tokens, and more. The schema outlines - the various attributes of the SES domain identity, including the identity name, - verification status, DKIM enabled status, and DKIM tokens. +Description: Allows users to query Amazon Simple Email Service Domain Identities. The aws_ses_domain_identity table in Steampipe provides information about domain identities within Amazon Simple Email Service (SES). This table allows DevOps engineers to query domain-specific details, including verification status, DKIM attributes, and associated metadata. Users can utilize this table to gather insights on domain identities, such as verification status, DKIM tokens, and more. The schema outlines the various attributes of the SES domain identity, including the identity name, verification status, DKIM enabled status, and DKIM tokens. ID: aws_ses_domain_identity_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity,\n arn,\n region,\n akas\nfrom\n aws_ses_domain_identity;" + QueryToExecute: | + SELECT + identity, + arn, + region, + akas + FROM + aws_ses_domain_identity; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Simple Email Service -Title: List all Amazon SES Domain Identities and Their Details + - Amazon Simple Email Service +Title: List all Amazon SES Domain Identities and Their Details \ No newline at end of file diff --git a/queries/aws_ses_domain_identity_2.yaml b/queries/aws_ses_domain_identity_2.yaml old mode 100755 new mode 100644 index 4f2574948..0935185d3 --- a/queries/aws_ses_domain_identity_2.yaml +++ b/queries/aws_ses_domain_identity_2.yaml @@ -1,28 +1,28 @@ -Description: Allows users to query Amazon Simple Email Service Domain Identities. - The aws_ses_domain_identity table in Steampipe provides information about domain - identities within Amazon Simple Email Service (SES). This table allows DevOps engineers - to query domain-specific details, including verification status, DKIM attributes, - and associated metadata. Users can utilize this table to gather insights on domain - identities, such as verification status, DKIM tokens, and more. The schema outlines - the various attributes of the SES domain identity, including the identity name, - verification status, DKIM enabled status, and DKIM tokens. +Description: Allows users to query Amazon Simple Email Service Domain Identities. The aws_ses_domain_identity table in Steampipe provides information about domain identities within Amazon Simple Email Service (SES). This table allows DevOps engineers to query domain-specific details, including verification status, DKIM attributes, and associated metadata. Users can utilize this table to gather insights on domain identities, such as verification status, DKIM tokens, and more. The schema outlines the various attributes of the SES domain identity, including the identity name, verification status, DKIM enabled status, and DKIM tokens. ID: aws_ses_domain_identity_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity,\n region,\n verification_status\nfrom\n \ - \ aws_ses_domain_identity\nwhere\n verification_status = 'Failed';" + QueryToExecute: | + SELECT + identity, + region, + verification_status + FROM + aws_ses_domain_identity + WHERE + verification_status = 'Failed'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Simple Email Service -Title: Find AWS SES Domain Identities with Verification Status Failed + - Amazon Simple Email Service +Title: Find AWS SES Domain Identities with Verification Status Failed \ No newline at end of file diff --git a/queries/aws_ses_email_identity_1.yaml b/queries/aws_ses_email_identity_1.yaml old mode 100755 new mode 100644 index 4c0d32b15..9bc25ca89 --- a/queries/aws_ses_email_identity_1.yaml +++ b/queries/aws_ses_email_identity_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SES Email Identity to retrieve information - about the email identities (domains and email addresses) that you have verified - with Amazon SES. +Description: Allows users to query AWS SES Email Identity to retrieve information about the email identities (domains and email addresses) that you have verified with Amazon SES. ID: aws_ses_email_identity_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity,\n arn,\n region,\n akas\nfrom\n aws_ses_email_identity;" + QueryToExecute: | + SELECT + identity, + arn, + region, + akas + FROM + aws_ses_email_identity; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SES -Title: List All AWS SES Email Identities and Details + - SES +Title: List All AWS SES Email Identities and Details \ No newline at end of file diff --git a/queries/aws_ses_email_identity_2.yaml b/queries/aws_ses_email_identity_2.yaml old mode 100755 new mode 100644 index 17966d938..4263c4342 --- a/queries/aws_ses_email_identity_2.yaml +++ b/queries/aws_ses_email_identity_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS SES Email Identity to retrieve information - about the email identities (domains and email addresses) that you have verified - with Amazon SES. +Description: Allows users to query AWS SES Email Identity to retrieve information about the email identities (domains and email addresses) that you have verified with Amazon SES. ID: aws_ses_email_identity_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n identity,\n region,\n verification_status\nfrom\n \ - \ aws_ses_email_identity\nwhere\n verification_status = 'Failed';" + QueryToExecute: | + SELECT + identity, + region, + verification_status + FROM + aws_ses_email_identity + WHERE + verification_status = 'Failed'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SES -Title: List AWS SES Email Identities and Their Verification Status + - SES +Title: List AWS SES Email Identities and Their Verification Status \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_1.yaml b/queries/aws_sfn_state_machine_1.yaml old mode 100755 new mode 100644 index 9f920c074..05238dc5c --- a/queries/aws_sfn_state_machine_1.yaml +++ b/queries/aws_sfn_state_machine_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Step Functions State Machines to retrieve detailed - information about each state machine. +Description: Allows users to query AWS Step Functions State Machines to retrieve detailed information about each state machine. ID: aws_sfn_state_machine_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status,\n type,\n role_arn\nfrom\n\ - \ aws_sfn_state_machine;" + QueryToExecute: | + SELECT + name, + arn, + status, + type, + role_arn + FROM + aws_sfn_state_machine; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Step Functions -Title: Find all AWS Step Functions State Machines in SQL + - Step Functions +Title: Find all AWS Step Functions State Machines in SQL \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_2.yaml b/queries/aws_sfn_state_machine_2.yaml old mode 100755 new mode 100644 index 769fe014f..92bfcb250 --- a/queries/aws_sfn_state_machine_2.yaml +++ b/queries/aws_sfn_state_machine_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Step Functions State Machines to retrieve detailed - information about each state machine. +Description: Allows users to query AWS Step Functions State Machines to retrieve detailed information about each state machine. ID: aws_sfn_state_machine_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n status\nfrom\n aws_sfn_state_machine\n\ - where\n status = 'ACTIVE';" + QueryToExecute: | + SELECT + name, + arn, + status + FROM + aws_sfn_state_machine + WHERE + status = 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Step Functions -Title: Find AWS Step Functions State Machines Details + - Step Functions +Title: Find AWS Step Functions State Machines Details \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_execution_1.yaml b/queries/aws_sfn_state_machine_execution_1.yaml old mode 100755 new mode 100644 index 4aafd2719..3411812ea --- a/queries/aws_sfn_state_machine_execution_1.yaml +++ b/queries/aws_sfn_state_machine_execution_1.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Step Functions State Machine Execution data, - including execution status, start and end times, and associated state machine details. +Description: Allows users to query AWS Step Functions State Machine Execution data, including execution status, start and end times, and associated state machine details. ID: aws_sfn_state_machine_execution_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n execution_arn,\n status,\n state_machine_arn\n\ - from\n aws_sfn_state_machine_execution;" + QueryToExecute: | + SELECT + name, + execution_arn, + status, + state_machine_arn + FROM + aws_sfn_state_machine_execution; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Step Functions -Title: List all AWS Step Functions Execution details + - Step Functions +Title: List all AWS Step Functions Execution details \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_execution_2.yaml b/queries/aws_sfn_state_machine_execution_2.yaml old mode 100755 new mode 100644 index 3047813ab..c523451cd --- a/queries/aws_sfn_state_machine_execution_2.yaml +++ b/queries/aws_sfn_state_machine_execution_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Step Functions State Machine Execution data, - including execution status, start and end times, and associated state machine details. +Description: Allows users to query AWS Step Functions State Machine Execution data, including execution status, start and end times, and associated state machine details. ID: aws_sfn_state_machine_execution_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n execution_arn,\n status,\n state_machine_arn\n\ - from\n aws_sfn_state_machine_execution\nwhere\n status = 'FAILED';" + QueryToExecute: | + SELECT + name, + execution_arn, + status, + state_machine_arn + FROM + aws_sfn_state_machine_execution + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Step Functions -Title: Find AWS Step Functions Execution Status and Details + - Step Functions +Title: Find AWS Step Functions Execution Status and Details \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_execution_history_1.yaml b/queries/aws_sfn_state_machine_execution_history_1.yaml old mode 100755 new mode 100644 index a0bd90453..b33211ee2 --- a/queries/aws_sfn_state_machine_execution_history_1.yaml +++ b/queries/aws_sfn_state_machine_execution_history_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Step Functions State Machine Execution History - to fetch information about the execution history of a state machine. +Description: Allows users to query AWS Step Functions State Machine Execution History to fetch information about the execution history of a state machine. ID: aws_sfn_state_machine_execution_history_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n execution_arn,\n previous_event_id,\n timestamp,\n\ - \ type\nfrom\n aws_sfn_state_machine_execution_history;" + QueryToExecute: | + SELECT + id, + execution_arn, + previous_event_id, + timestamp, + type + FROM + aws_sfn_state_machine_execution_history; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Step Functions -Title: Find AWS Step Functions State Machine Execution History + - AWS Step Functions +Title: Find AWS Step Functions State Machine Execution History \ No newline at end of file diff --git a/queries/aws_sfn_state_machine_execution_history_2.yaml b/queries/aws_sfn_state_machine_execution_history_2.yaml old mode 100755 new mode 100644 index dc74ee36d..da1427faf --- a/queries/aws_sfn_state_machine_execution_history_2.yaml +++ b/queries/aws_sfn_state_machine_execution_history_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Step Functions State Machine Execution History - to fetch information about the execution history of a state machine. +Description: Allows users to query AWS Step Functions State Machine Execution History to fetch information about the execution history of a state machine. ID: aws_sfn_state_machine_execution_history_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n execution_arn,\n execution_started_event_details\ - \ -> 'Input' as event_input,\n execution_started_event_details -> 'InputDetails'\ - \ as event_input_details,\n execution_started_event_details ->> 'RoleArn' as\ - \ event_role_arn\nfrom\n aws_sfn_state_machine_execution_history\nwhere\n type\ - \ = 'ExecutionStarted';" + QueryToExecute: | + SELECT + id, + execution_arn, + execution_started_event_details -> 'Input' AS event_input, + execution_started_event_details -> 'InputDetails' AS event_input_details, + execution_started_event_details ->> 'RoleArn' AS event_role_arn + FROM + aws_sfn_state_machine_execution_history + WHERE + type = 'ExecutionStarted'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Step Functions -Title: Find AWS Step Functions State Machine Execution Details + - Step Functions +Title: Find AWS Step Functions State Machine Execution Details \ No newline at end of file diff --git a/queries/aws_simspaceweaver_simulation_1.yaml b/queries/aws_simspaceweaver_simulation_1.yaml old mode 100755 new mode 100644 index 9b11c21e9..f26a66088 --- a/queries/aws_simspaceweaver_simulation_1.yaml +++ b/queries/aws_simspaceweaver_simulation_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS SimSpace Simulation data. This table provides - information about simulations within AWS SimSpace. Engineers can use it to query - simulation-specific details, including simulation status, configuration, and associated - metadata. +Description: Allows users to query AWS SimSpace Simulation data. This table provides information about simulations within AWS SimSpace. Engineers can use it to query simulation-specific details, including simulation status, configuration, and associated metadata. ID: aws_simspaceweaver_simulation_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status,\n execution_id,\n\ - \ schema_error\nfrom\n aws_simspaceweaver_simulation;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status, + execution_id, + schema_error + FROM + aws_simspaceweaver_simulation; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SimSpaceWeaver Simulation -Title: List all AWS SimSpace Simulation with details + - SimSpaceWeaver Simulation +Title: List all AWS SimSpace Simulation with details \ No newline at end of file diff --git a/queries/aws_simspaceweaver_simulation_2.yaml b/queries/aws_simspaceweaver_simulation_2.yaml old mode 100755 new mode 100644 index c7c08a4d6..40b72453b --- a/queries/aws_simspaceweaver_simulation_2.yaml +++ b/queries/aws_simspaceweaver_simulation_2.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS SimSpace Simulation data. This table provides - information about simulations within AWS SimSpace. Engineers can use it to query - simulation-specific details, including simulation status, configuration, and associated - metadata. +Description: Allows users to query AWS SimSpace Simulation data. This table provides information about simulations within AWS SimSpace. Engineers can use it to query simulation-specific details, including simulation status, configuration, and associated metadata. ID: aws_simspaceweaver_simulation_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status\nfrom\n aws_simspaceweaver_simulation\n\ - where\n creation_time >= now() - interval '30' day;" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status + FROM + aws_simspaceweaver_simulation + WHERE + creation_time >= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SimSpace -Title: List all AWS SimSpace Simulations from the past 30 days + - SimSpace +Title: List all AWS SimSpace Simulations from the past 30 days \ No newline at end of file diff --git a/queries/aws_simspaceweaver_simulation_3.yaml b/queries/aws_simspaceweaver_simulation_3.yaml old mode 100755 new mode 100644 index 54be5c0bd..eb57b05f7 --- a/queries/aws_simspaceweaver_simulation_3.yaml +++ b/queries/aws_simspaceweaver_simulation_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SimSpace Simulation data. This table provides - information about simulations within AWS SimSpace. Engineers can use it to query - simulation-specific details, including simulation status, configuration, and associated - metadata. +Description: Allows users to query AWS SimSpace Simulation data. This table provides information about simulations within AWS SimSpace. Engineers can use it to query simulation-specific details, including simulation status, configuration, and associated metadata. ID: aws_simspaceweaver_simulation_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n creation_time,\n status\nfrom\n aws_simspaceweaver_simulation\n\ - where\n status = 'FAILED';" + QueryToExecute: | + SELECT + name, + arn, + creation_time, + status + FROM + aws_simspaceweaver_simulation + WHERE + status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SimSpace Simulation -Title: List all AWS SimSpace Simulation details with SQL + - SimSpace Simulation +Title: List all AWS SimSpace Simulation details with SQL \ No newline at end of file diff --git a/queries/aws_simspaceweaver_simulation_4.yaml b/queries/aws_simspaceweaver_simulation_4.yaml old mode 100755 new mode 100644 index 241d8045a..d6d3a1def --- a/queries/aws_simspaceweaver_simulation_4.yaml +++ b/queries/aws_simspaceweaver_simulation_4.yaml @@ -1,22 +1,25 @@ -Description: Allows users to query AWS SimSpace Simulation data. This table provides - information about simulations within AWS SimSpace. Engineers can use it to query - simulation-specific details, including simulation status, configuration, and associated - metadata. +Description: Allows users to query AWS SimSpace Simulation data. This table provides information about simulations within AWS SimSpace. Engineers can use it to query simulation-specific details, including simulation status, configuration, and associated metadata. ID: aws_simspaceweaver_simulation_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n jsonb_pretty(d)\nfrom\n aws_simspaceweaver_simulation,\n\ - \ jsonb_array_elements(logging_configuration -> 'Destinations') as d;" + QueryToExecute: | + SELECT + name, + arn, + jsonb_pretty(d) + FROM + aws_simspaceweaver_simulation, + JSONB_ARRAY_ELEMENTS(logging_configuration -> 'Destinations') AS d; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SimSpace Simulation -Title: List AWS SimSpace Simulations and Details + - SimSpace Simulation +Title: List AWS SimSpace Simulations and Details \ No newline at end of file diff --git a/queries/aws_simspaceweaver_simulation_5.yaml b/queries/aws_simspaceweaver_simulation_5.yaml old mode 100755 new mode 100644 index eb877090a..021762227 --- a/queries/aws_simspaceweaver_simulation_5.yaml +++ b/queries/aws_simspaceweaver_simulation_5.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS SimSpace Simulation data. This table provides - information about simulations within AWS SimSpace. Engineers can use it to query - simulation-specific details, including simulation status, configuration, and associated - metadata. +Description: Allows users to query AWS SimSpace Simulation data. This table provides information about simulations within AWS SimSpace. Engineers can use it to query simulation-specific details, including simulation status, configuration, and associated metadata. ID: aws_simspaceweaver_simulation_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.name,\n s.arn,\n s.schema_s3_location ->> 'BucketName'\ - \ as bucket_name,\n s.schema_s3_location ->> 'ObjectKey' as object_key,\n b.versioning_enabled,\n\ - \ b.block_public_acls,\n b.acl\nfrom\n aws_simspaceweaver_simulation as s,\n\ - \ aws_s3_bucket as b\nwhere\n s.schema_s3_location ->> 'BucketName' = b.name;" + QueryToExecute: | + SELECT + s.name, + s.arn, + s.schema_s3_location ->> 'BucketName' AS bucket_name, + s.schema_s3_location ->> 'ObjectKey' AS object_key, + b.versioning_enabled, + b.block_public_acls, + b.acl + FROM + aws_simspaceweaver_simulation AS s, + aws_s3_bucket AS b + WHERE + s.schema_s3_location ->> 'BucketName' = b.name; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SimSpace Weaver -Title: Find AWS SimSpace Simulation Specific Details + - SimSpace Weaver +Title: Find AWS SimSpace Simulation Specific Details \ No newline at end of file diff --git a/queries/aws_sns_subscription_1.yaml b/queries/aws_sns_subscription_1.yaml old mode 100755 new mode 100644 index a8bdcb3bd..129331bd2 --- a/queries/aws_sns_subscription_1.yaml +++ b/queries/aws_sns_subscription_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n redrive_policy\nfrom\n aws_sns_subscription\n\ - where\n redrive_policy is null;" + QueryToExecute: | + SELECT + title, + redrive_policy + FROM + aws_sns_subscription + WHERE + redrive_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Notification Service -Title: List all AWS SNS Topic Subscriptions Details + - Simple Notification Service +Title: List all AWS SNS Topic Subscriptions Details \ No newline at end of file diff --git a/queries/aws_sns_subscription_2.yaml b/queries/aws_sns_subscription_2.yaml old mode 100755 new mode 100644 index 6115418fb..64986a74e --- a/queries/aws_sns_subscription_2.yaml +++ b/queries/aws_sns_subscription_2.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n filter_policy\nfrom\n aws_sns_subscription\n\ - where\n filter_policy is null;" + QueryToExecute: | + SELECT + title, + filter_policy + FROM + aws_sns_subscription + WHERE + filter_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Notification Service -Title: List all AWS SNS Topic Subscriptions Details + - Simple Notification Service +Title: List all AWS SNS Topic Subscriptions Details \ No newline at end of file diff --git a/queries/aws_sns_subscription_3.yaml b/queries/aws_sns_subscription_3.yaml old mode 100755 new mode 100644 index bf457f316..2adada3ec --- a/queries/aws_sns_subscription_3.yaml +++ b/queries/aws_sns_subscription_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_subscription_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n count(subscription_arn) as subscription_count\n\ - from\n aws_sns_subscription\ngroup by\n title;" + QueryToExecute: | + SELECT + title, + COUNT(subscription_arn) AS subscription_count + FROM + aws_sns_subscription + GROUP BY + title; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Notification Service -Title: List AWS SNS Topic Subscription Details with SQL + - Simple Notification Service +Title: List AWS SNS Topic Subscription Details with SQL \ No newline at end of file diff --git a/queries/aws_sns_topic_1.yaml b/queries/aws_sns_topic_1.yaml old mode 100755 new mode 100644 index 865723561..e42b7ef8e --- a/queries/aws_sns_topic_1.yaml +++ b/queries/aws_sns_topic_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n kms_master_key_id\nfrom\n aws_sns_topic\n\ - where\n kms_master_key_id is null;" + QueryToExecute: | + SELECT + title, + kms_master_key_id + FROM + aws_sns_topic + WHERE + kms_master_key_id IS NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: Find AWS SNS Topics and Their Information + - SNS +Title: Find AWS SNS Topics and Their Information \ No newline at end of file diff --git a/queries/aws_sns_topic_2.yaml b/queries/aws_sns_topic_2.yaml old mode 100755 new mode 100644 index 02b2b5da4..3d0ebd038 --- a/queries/aws_sns_topic_2.yaml +++ b/queries/aws_sns_topic_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n kms_master_key_id\nfrom\n aws_sns_topic\n\ - where\n kms_master_key_id = 'alias/aws/sns';" + QueryToExecute: | + SELECT + title, + kms_master_key_id + FROM + aws_sns_topic + WHERE + kms_master_key_id = 'alias/aws/sns'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: Find AWS SNS Topics with KMS Key Information + - SNS +Title: Find AWS SNS Topics with KMS Key Information \ No newline at end of file diff --git a/queries/aws_sns_topic_3.yaml b/queries/aws_sns_topic_3.yaml old mode 100755 new mode 100644 index f820626d3..1af612518 --- a/queries/aws_sns_topic_3.yaml +++ b/queries/aws_sns_topic_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n tags\nfrom\n aws_sns_topic\nwhere\n not tags\ - \ :: JSONB ? 'owner';" + QueryToExecute: | + SELECT + title, + tags + FROM + aws_sns_topic + WHERE + NOT tags :: JSONB ? 'owner'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: List all AWS SNS Topics and their details + - SNS +Title: List all AWS SNS Topics and their details \ No newline at end of file diff --git a/queries/aws_sns_topic_4.yaml b/queries/aws_sns_topic_4.yaml old mode 100755 new mode 100644 index 06d461a94..ba5d69efb --- a/queries/aws_sns_topic_4.yaml +++ b/queries/aws_sns_topic_4.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_sns_topic,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a\nwhere\n p = '*'\n \ - \ and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s->>'Effect' AS effect, + s->'Condition' AS conditions + FROM + aws_sns_topic, + jsonb_array_elements(policy_std->'Statement') AS s, + jsonb_array_elements_text(s->'Principal'->'AWS') AS p, + jsonb_array_elements_text(s->'Action') AS a + WHERE + p = '*' + AND s->>'Effect' = 'Allow'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS Topics -Title: Find AWS SNS Topics and Details + - SNS Topics +Title: Find AWS SNS Topics and Details \ No newline at end of file diff --git a/queries/aws_sns_topic_5.yaml b/queries/aws_sns_topic_5.yaml old mode 100755 new mode 100644 index 74a18d515..a5cb0f695 --- a/queries/aws_sns_topic_5.yaml +++ b/queries/aws_sns_topic_5.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_sns_topic,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a\nwhere\n s ->> 'Effect'\ - \ = 'Allow'\n and a in ('*', 'sns:*');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_sns_topic, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND a IN ('*', 'sns:*'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: List all AWS SNS Topics and their relevant details + - SNS +Title: List all AWS SNS Topics and their relevant details \ No newline at end of file diff --git a/queries/aws_sns_topic_6.yaml b/queries/aws_sns_topic_6.yaml old mode 100755 new mode 100644 index c842055dd..315314619 --- a/queries/aws_sns_topic_6.yaml +++ b/queries/aws_sns_topic_6.yaml @@ -1,25 +1,39 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title\nfrom\n aws_sns_topic\nwhere\n title not in (\n\ - \ select\n title\n from\n aws_sns_topic,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a,\n jsonb_array_elements_text(\n\ - \ s -> 'Condition' -> 'Bool' -> 'aws:securetransport'\n ) as ssl\n\ - \ where\n p = '*'\n and s ->> 'Effect' = 'Deny'\n and ssl ::\ - \ bool = false\n );" + QueryToExecute: | + SELECT + title + FROM + aws_sns_topic + WHERE + title NOT IN ( + SELECT + title + FROM + aws_sns_topic, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a, + jsonb_array_elements_text( + s -> 'Condition' -> 'Bool' -> 'aws:securetransport' + ) AS ssl + WHERE + p = '*' + AND s ->> 'Effect' = 'Deny' + AND ssl::bool = false + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: List all details for AWS SNS Topics + - SNS +Title: List all details for AWS SNS Topics \ No newline at end of file diff --git a/queries/aws_sns_topic_7.yaml b/queries/aws_sns_topic_7.yaml old mode 100755 new mode 100644 index 06640dcec..2f08e303c --- a/queries/aws_sns_topic_7.yaml +++ b/queries/aws_sns_topic_7.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS SNS Topics to gather information about each - topic, including its name, owner, ARN, and other related data. +Description: Allows users to query AWS SNS Topics to gather information about each topic, including its name, owner, ARN, and other related data. ID: aws_sns_topic_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n topic_arn,\n region\nfrom \n aws_sns_topic\n\ - where\n application_failure_feedback_role_arn is null and\n firehose_failure_feedback_role_arn\ - \ is null and\n http_failure_feedback_role_arn is null and\n lambda_failure_feedback_role_arn\ - \ is null and\n sqs_failure_feedback_role_arn is null;" + QueryToExecute: | + SELECT + title, + topic_arn, + region + FROM + aws_sns_topic + WHERE + application_failure_feedback_role_arn IS NULL AND + firehose_failure_feedback_role_arn IS NULL AND + http_failure_feedback_role_arn IS NULL AND + lambda_failure_feedback_role_arn IS NULL AND + sqs_failure_feedback_role_arn IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: Find AWS SNS Topics Without Failure Feedback Roles + - SNS +Title: Find AWS SNS Topics Without Failure Feedback Roles \ No newline at end of file diff --git a/queries/aws_sns_topic_subscription_1.yaml b/queries/aws_sns_topic_subscription_1.yaml old mode 100755 new mode 100644 index 87ea8b5f8..f917f837a --- a/queries/aws_sns_topic_subscription_1.yaml +++ b/queries/aws_sns_topic_subscription_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_topic_subscription_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n redrive_policy\nfrom\n aws_sns_topic_subscription\n\ - where\n redrive_policy is null;" + QueryToExecute: | + SELECT + title, + redrive_policy + FROM + aws_sns_topic_subscription + WHERE + redrive_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SNS -Title: Find AWS SNS Topic Subscriptions with No Redrive Policy + - SNS +Title: Find AWS SNS Topic Subscriptions with No Redrive Policy \ No newline at end of file diff --git a/queries/aws_sns_topic_subscription_2.yaml b/queries/aws_sns_topic_subscription_2.yaml old mode 100755 new mode 100644 index a849ba2fe..a9a4db362 --- a/queries/aws_sns_topic_subscription_2.yaml +++ b/queries/aws_sns_topic_subscription_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_topic_subscription_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n filter_policy\nfrom\n aws_sns_topic_subscription\n\ - where\n filter_policy is null;" + QueryToExecute: | + SELECT + title, + filter_policy + FROM + aws_sns_topic_subscription + WHERE + filter_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Notification Service -Title: List all AWS SNS Topic Subscriptions and Details + - Simple Notification Service +Title: List all AWS SNS Topic Subscriptions and Details \ No newline at end of file diff --git a/queries/aws_sns_topic_subscription_3.yaml b/queries/aws_sns_topic_subscription_3.yaml old mode 100755 new mode 100644 index d28de912c..d4e942cff --- a/queries/aws_sns_topic_subscription_3.yaml +++ b/queries/aws_sns_topic_subscription_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed - information about each subscription, including subscription ARN, owner, protocol, - endpoint, and more. +Description: Allows users to query AWS SNS Topic Subscriptions to obtain detailed information about each subscription, including subscription ARN, owner, protocol, endpoint, and more. ID: aws_sns_topic_subscription_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n count(subscription_arn) as subscription_count\n\ - from\n aws_sns_topic_subscription\ngroup by\n title;" + QueryToExecute: | + SELECT + title, + COUNT(subscription_arn) AS subscription_count + FROM + aws_sns_topic_subscription + GROUP BY + title; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Notification Service -Title: Find AWS SNS Topic Subscriptions Detailed Information + - Simple Notification Service +Title: Find AWS SNS Topic Subscriptions Detailed Information \ No newline at end of file diff --git a/queries/aws_sqs_queue_1.yaml b/queries/aws_sqs_queue_1.yaml old mode 100755 new mode 100644 index fe66d19f8..207dcea06 --- a/queries/aws_sqs_queue_1.yaml +++ b/queries/aws_sqs_queue_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n delay_seconds,\n max_message_size,\n receive_wait_time_seconds,\n\ - \ message_retention_seconds,\n visibility_timeout_seconds\nfrom\n aws_sqs_queue;" + QueryToExecute: | + SELECT + title, + delay_seconds, + max_message_size, + receive_wait_time_seconds, + message_retention_seconds, + visibility_timeout_seconds + FROM + aws_sqs_queue; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: List All AWS SQS Queues with Detailed Information + - Simple Queue Service +Title: List All AWS SQS Queues with Detailed Information \ No newline at end of file diff --git a/queries/aws_sqs_queue_10.yaml b/queries/aws_sqs_queue_10.yaml old mode 100755 new mode 100644 index d01874c4d..573b895c0 --- a/queries/aws_sqs_queue_10.yaml +++ b/queries/aws_sqs_queue_10.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_10 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_sqs_queue,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a\nwhere\n s ->> 'Effect'\ - \ = 'Allow'\n and a in ('*', 'sqs:*');" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_sqs_queue, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND a IN ('*', 'sqs:*'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service (SQS) -Title: List AWS SQS Queues with Detailed Information + - Simple Queue Service (SQS) +Title: List AWS SQS Queues with Detailed Information \ No newline at end of file diff --git a/queries/aws_sqs_queue_2.yaml b/queries/aws_sqs_queue_2.yaml old mode 100755 new mode 100644 index f7e335e05..e78ed426d --- a/queries/aws_sqs_queue_2.yaml +++ b/queries/aws_sqs_queue_2.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n kms_master_key_id,\n sqs_managed_sse_enabled\n\ - from\n aws_sqs_queue\nwhere\n kms_master_key_id is null\n and not sqs_managed_sse_enabled;" + QueryToExecute: | + SELECT + title, + kms_master_key_id, + sqs_managed_sse_enabled + FROM + aws_sqs_queue + WHERE + kms_master_key_id IS NULL + AND NOT sqs_managed_sse_enabled; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: Find AWS SQS Queue Details with SQL + - Simple Queue Service +Title: Find AWS SQS Queue Details with SQL \ No newline at end of file diff --git a/queries/aws_sqs_queue_3.yaml b/queries/aws_sqs_queue_3.yaml old mode 100755 new mode 100644 index 7e06dbcdd..ec5e824cc --- a/queries/aws_sqs_queue_3.yaml +++ b/queries/aws_sqs_queue_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n kms_master_key_id,\n sqs_managed_sse_enabled\n\ - from\n aws_sqs_queue\nwhere\n kms_master_key_id is not null;" + QueryToExecute: | + SELECT + title, + kms_master_key_id, + sqs_managed_sse_enabled + FROM + aws_sqs_queue + WHERE + kms_master_key_id IS NOT NULL; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: Find AWS SQS Queues with KMS Key Details + - Simple Queue Service +Title: Find AWS SQS Queues with KMS Key Details \ No newline at end of file diff --git a/queries/aws_sqs_queue_4.yaml b/queries/aws_sqs_queue_4.yaml old mode 100755 new mode 100644 index 67b94cc6c..b99942211 --- a/queries/aws_sqs_queue_4.yaml +++ b/queries/aws_sqs_queue_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n kms_master_key_id,\n sqs_managed_sse_enabled\n\ - from\n aws_sqs_queue\nwhere\n sqs_managed_sse_enabled;" + QueryToExecute: | + SELECT + title, + kms_master_key_id, + sqs_managed_sse_enabled + FROM + aws_sqs_queue + WHERE + sqs_managed_sse_enabled; Tags: cloud_data_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: Find SQS queues with server-side encryption enabled + - Simple Queue Service +Title: Find SQS queues with server-side encryption enabled \ No newline at end of file diff --git a/queries/aws_sqs_queue_5.yaml b/queries/aws_sqs_queue_5.yaml old mode 100755 new mode 100644 index a8c1e08d4..0654c2f32 --- a/queries/aws_sqs_queue_5.yaml +++ b/queries/aws_sqs_queue_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n message_retention_seconds\nfrom\n aws_sqs_queue\n\ - where\n message_retention_seconds < '604800';" + QueryToExecute: | + SELECT + title, + message_retention_seconds + FROM + aws_sqs_queue + WHERE + message_retention_seconds < '604800'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: List all SQS queues with retention < 7 days in AWS + - Simple Queue Service +Title: List all SQS queues with retention < 7 days in AWS \ No newline at end of file diff --git a/queries/aws_sqs_queue_6.yaml b/queries/aws_sqs_queue_6.yaml old mode 100755 new mode 100644 index f2e7176ec..5939cc5bd --- a/queries/aws_sqs_queue_6.yaml +++ b/queries/aws_sqs_queue_6.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n redrive_policy\nfrom\n aws_sqs_queue\nwhere\n\ - \ redrive_policy is null;" + QueryToExecute: | + SELECT + title, + redrive_policy + FROM + aws_sqs_queue + WHERE + redrive_policy IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: List all AWS SQS queues without a redrive policy + - Simple Queue Service +Title: List all AWS SQS queues without a redrive policy \ No newline at end of file diff --git a/queries/aws_sqs_queue_7.yaml b/queries/aws_sqs_queue_7.yaml old mode 100755 new mode 100644 index 768ef6061..e0c0ce91a --- a/queries/aws_sqs_queue_7.yaml +++ b/queries/aws_sqs_queue_7.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n fifo_queue\nfrom\n aws_sqs_queue\nwhere\n\ - \ fifo_queue;" + QueryToExecute: | + SELECT + title, + fifo_queue + FROM + aws_sqs_queue + WHERE + fifo_queue; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service (SQS) -Title: List all AWS SQS queues with details + - Simple Queue Service (SQS) +Title: List all AWS SQS queues with details \ No newline at end of file diff --git a/queries/aws_sqs_queue_8.yaml b/queries/aws_sqs_queue_8.yaml old mode 100755 new mode 100644 index d16788d77..630e38e6f --- a/queries/aws_sqs_queue_8.yaml +++ b/queries/aws_sqs_queue_8.yaml @@ -1,26 +1,38 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_sqs_queue,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n string_to_array(p, ':') as pa,\n jsonb_array_elements_text(s -> 'Action')\ - \ as a\nwhere\n s ->> 'Effect' = 'Allow'\n and (\n pa[5] != account_id\n\ - \ or p = '*'\n );" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_sqs_queue, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + string_to_array(p, ':') AS pa, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + s ->> 'Effect' = 'Allow' + AND ( + pa[5] != account_id + OR p = '*' + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: Query AWS SQS for Detailed Queue Information + - Simple Queue Service +Title: Query AWS SQS for Detailed Queue Information \ No newline at end of file diff --git a/queries/aws_sqs_queue_9.yaml b/queries/aws_sqs_queue_9.yaml old mode 100755 new mode 100644 index fd43609b4..1ec49fd45 --- a/queries/aws_sqs_queue_9.yaml +++ b/queries/aws_sqs_queue_9.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed - information about each queue. +Description: Allows users to query AWS Simple Queue Service (SQS) to retrieve detailed information about each queue. ID: aws_sqs_queue_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n title,\n p as principal,\n a as action,\n s ->> 'Effect'\ - \ as effect,\n s -> 'Condition' as conditions\nfrom\n aws_sqs_queue,\n jsonb_array_elements(policy_std\ - \ -> 'Statement') as s,\n jsonb_array_elements_text(s -> 'Principal' -> 'AWS')\ - \ as p,\n jsonb_array_elements_text(s -> 'Action') as a\nwhere\n p = '*'\n \ - \ and s ->> 'Effect' = 'Allow';" + QueryToExecute: | + SELECT + title, + p AS principal, + a AS action, + s ->> 'Effect' AS effect, + s -> 'Condition' AS conditions + FROM + aws_sqs_queue, + jsonb_array_elements(policy_std -> 'Statement') AS s, + jsonb_array_elements_text(s -> 'Principal' -> 'AWS') AS p, + jsonb_array_elements_text(s -> 'Action') AS a + WHERE + p = '*' + AND s ->> 'Effect' = 'Allow'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Simple Queue Service -Title: Find all AWS SQS Queues and Their Policies + - Simple Queue Service +Title: Find all AWS SQS Queues and Their Policies \ No newline at end of file diff --git a/queries/aws_ssm_association_1.yaml b/queries/aws_ssm_association_1.yaml old mode 100755 new mode 100644 index 03d63b82a..d996231e9 --- a/queries/aws_ssm_association_1.yaml +++ b/queries/aws_ssm_association_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS SSM Associations for detailed information about - the AWS Systems Manager associations, including their status, targets, and parameters. +Description: Allows users to query AWS SSM Associations for detailed information about the AWS Systems Manager associations, including their status, targets, and parameters. ID: aws_ssm_association_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n association_id,\n association_name,\n arn,\n association_version,\n\ - \ last_execution_date,\n document_name,\n compliance_severity,\n region\n\ - from\n aws_ssm_association;" + QueryToExecute: | + SELECT + association_id, + association_name, + arn, + association_version, + last_execution_date, + document_name, + compliance_severity, + region + FROM + aws_ssm_association; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: Find AWS SSM Association Details including Parameters + - AWS Systems Manager +Title: Find AWS SSM Association Details including Parameters \ No newline at end of file diff --git a/queries/aws_ssm_association_2.yaml b/queries/aws_ssm_association_2.yaml old mode 100755 new mode 100644 index 86eb3843b..e502289cf --- a/queries/aws_ssm_association_2.yaml +++ b/queries/aws_ssm_association_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS SSM Associations for detailed information about - the AWS Systems Manager associations, including their status, targets, and parameters. +Description: Allows users to query AWS SSM Associations for detailed information about the AWS Systems Manager associations, including their status, targets, and parameters. ID: aws_ssm_association_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n association_id,\n overview ->> 'AssociationStatusAggregatedCount'\ - \ as association_status_aggregated_count,\n overview ->> 'DetailedStatus' as\ - \ detailed_status,\n overview ->> 'Status' as status\nfrom\n aws_ssm_association\n\ - where\n overview ->> 'Status' = 'Failed';" + QueryToExecute: | + SELECT + association_id, + overview ->> 'AssociationStatusAggregatedCount' AS association_status_aggregated_count, + overview ->> 'DetailedStatus' AS detailed_status, + overview ->> 'Status' AS status + FROM + aws_ssm_association + WHERE + overview ->> 'Status' = 'Failed'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: List all AWS SSM Associations with Failed Status + - AWS Systems Manager +Title: List all AWS SSM Associations with Failed Status \ No newline at end of file diff --git a/queries/aws_ssm_association_3.yaml b/queries/aws_ssm_association_3.yaml old mode 100755 new mode 100644 index fb3fc6c88..39d1b8a81 --- a/queries/aws_ssm_association_3.yaml +++ b/queries/aws_ssm_association_3.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS SSM Associations for detailed information about - the AWS Systems Manager associations, including their status, targets, and parameters. +Description: Allows users to query AWS SSM Associations for detailed information about the AWS Systems Manager associations, including their status, targets, and parameters. ID: aws_ssm_association_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n association.association_id as association_id,\n target\ - \ ->> 'Key' as target_key,\n target ->> 'Values' as target_value,\n instances\n\ - from\n aws_ssm_association as association,\n jsonb_array_elements(targets) as\ - \ target,\n jsonb_array_elements_text(target -> 'Values') as instances\nwhere\n\ - \ target ->> 'Key' = 'InstanceIds';" + QueryToExecute: | + SELECT + association.association_id AS association_id, + target ->> 'Key' AS target_key, + target ->> 'Values' AS target_value, + instances + FROM + aws_ssm_association AS association, + jsonb_array_elements(targets) AS target, + jsonb_array_elements_text(target -> 'Values') AS instances + WHERE + target ->> 'Key' = 'InstanceIds'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: List AWS SSM Associations with Status and Targets + - AWS Systems Manager +Title: List AWS SSM Associations with Status and Targets \ No newline at end of file diff --git a/queries/aws_ssm_association_4.yaml b/queries/aws_ssm_association_4.yaml old mode 100755 new mode 100644 index b95c807db..10cdaac59 --- a/queries/aws_ssm_association_4.yaml +++ b/queries/aws_ssm_association_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS SSM Associations for detailed information about - the AWS Systems Manager associations, including their status, targets, and parameters. +Description: Allows users to query AWS SSM Associations for detailed information about the AWS Systems Manager associations, including their status, targets, and parameters. ID: aws_ssm_association_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n association_id,\n association_name,\n targets,\n document_name\n\ - from\n aws_ssm_association\nwhere\n compliance_severity = 'CRITICAL';" + QueryToExecute: | + SELECT + association_id, + association_name, + targets, + document_name + FROM + aws_ssm_association + WHERE + compliance_severity = 'CRITICAL'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: Find AWS SSM Associations and Their Details + - AWS Systems Manager +Title: Find AWS SSM Associations and Their Details \ No newline at end of file diff --git a/queries/aws_ssm_document_1.yaml b/queries/aws_ssm_document_1.yaml old mode 100755 new mode 100644 index a4b4decbc..d8dd1f686 --- a/queries/aws_ssm_document_1.yaml +++ b/queries/aws_ssm_document_1.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS SSM Documents and retrieve detailed information - about each document, including its name, version, owner, status, and permissions, - among others. +Description: Allows users to query AWS SSM Documents and retrieve detailed information about each document, including its name, version, owner, status, and permissions, among others. ID: aws_ssm_document_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n document_version,\n status,\n owner,\n document_format,\n\ - \ document_type,\n platform_types,\n region\nfrom\n aws_ssm_document;" + QueryToExecute: | + SELECT + name, + document_version, + status, + owner, + document_format, + document_type, + platform_types, + region + FROM + aws_ssm_document; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Documents -Title: List all AWS SSM Documents with detailed information + - SSM Documents +Title: List all AWS SSM Documents with detailed information \ No newline at end of file diff --git a/queries/aws_ssm_document_2.yaml b/queries/aws_ssm_document_2.yaml old mode 100755 new mode 100644 index 2b020e34e..75c30143c --- a/queries/aws_ssm_document_2.yaml +++ b/queries/aws_ssm_document_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS SSM Documents and retrieve detailed information - about each document, including its name, version, owner, status, and permissions, - among others. +Description: Allows users to query AWS SSM Documents and retrieve detailed information about each document, including its name, version, owner, status, and permissions, among others. ID: aws_ssm_document_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n owner,\n document_version,\n status,\n document_format,\n\ - \ document_type\nfrom\n aws_ssm_document\nwhere\n owner_type = 'Self';" + QueryToExecute: | + SELECT + name, + owner, + document_version, + status, + document_format, + document_type + FROM + aws_ssm_document + WHERE + owner_type = 'Self'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM -Title: List AWS SSM Documents with Details using SQL + - SSM +Title: List AWS SSM Documents with Details using SQL \ No newline at end of file diff --git a/queries/aws_ssm_document_3.yaml b/queries/aws_ssm_document_3.yaml old mode 100755 new mode 100644 index 31e1e800e..9c39936d9 --- a/queries/aws_ssm_document_3.yaml +++ b/queries/aws_ssm_document_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS SSM Documents and retrieve detailed information - about each document, including its name, version, owner, status, and permissions, - among others. +Description: Allows users to query AWS SSM Documents and retrieve detailed information about each document, including its name, version, owner, status, and permissions, among others. ID: aws_ssm_document_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n owner,\n document_version,\n status,\n document_format,\n\ - \ document_type\nfrom\n aws_ssm_document\nwhere\n owner_type != 'Amazon';" + QueryToExecute: | + SELECT + name, + owner, + document_version, + status, + document_format, + document_type + FROM + aws_ssm_document + WHERE + owner_type != 'Amazon'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM -Title: Find AWS SSM Documents with Various Attributes + - SSM +Title: Find AWS SSM Documents with Various Attributes \ No newline at end of file diff --git a/queries/aws_ssm_document_4.yaml b/queries/aws_ssm_document_4.yaml old mode 100755 new mode 100644 index 04b59786c..6911983c9 --- a/queries/aws_ssm_document_4.yaml +++ b/queries/aws_ssm_document_4.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS SSM Documents and retrieve detailed information - about each document, including its name, version, owner, status, and permissions, - among others. +Description: Allows users to query AWS SSM Documents and retrieve detailed information about each document, including its name, version, owner, status, and permissions, among others. ID: aws_ssm_document_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n owner,\n account_ids\nfrom\n aws_ssm_document\n\ - where\n owner_type = 'Self'\n and account_ids :: jsonb ? 'all';" + QueryToExecute: | + SELECT + name, + owner, + account_ids + FROM + aws_ssm_document + WHERE + owner_type = 'Self' + AND account_ids::jsonb ? 'all'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Document -Title: Find AWS SSM Documents and Retrieve Detailed Information + - SSM Document +Title: Find AWS SSM Documents and Retrieve Detailed Information \ No newline at end of file diff --git a/queries/aws_ssm_document_5.yaml b/queries/aws_ssm_document_5.yaml old mode 100755 new mode 100644 index b8521e09e..f3abae308 --- a/queries/aws_ssm_document_5.yaml +++ b/queries/aws_ssm_document_5.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS SSM Documents and retrieve detailed information - about each document, including its name, version, owner, status, and permissions, - among others. +Description: Allows users to query AWS SSM Documents and retrieve detailed information about each document, including its name, version, owner, status, and permissions, among others. ID: aws_ssm_document_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n approved_version,\n created_date,\n\ - \ document_type\nfrom\n aws_ssm_document\nwhere\n arn = 'arn:aws:ssm:ap-south-1:112233445566:document/AWS-ASGEnterStandby';" + QueryToExecute: | + SELECT + name, + arn, + approved_version, + created_date, + document_type + FROM + aws_ssm_document + WHERE + arn = 'arn:aws:ssm:ap-south-1:112233445566:document/AWS-ASGEnterStandby'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM -Title: Find all AWS SSM Document Details with SQL + - SSM +Title: Find all AWS SSM Document Details with SQL \ No newline at end of file diff --git a/queries/aws_ssm_document_permission_1.yaml b/queries/aws_ssm_document_permission_1.yaml old mode 100755 new mode 100644 index e28026a4f..61e0e950f --- a/queries/aws_ssm_document_permission_1.yaml +++ b/queries/aws_ssm_document_permission_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS SSM Document Permissions, providing detailed - information about the permissions associated with Systems Manager (SSM) documents. +Description: Allows users to query AWS SSM Document Permissions, providing detailed information about the permissions associated with Systems Manager (SSM) documents. ID: aws_ssm_document_permission_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n document_name,\n shared_account_id,\n shared_document_version,\n\ - \ account_ids,\n title\nfrom\n aws_ssm_document_permission\nwhere\n document_name\ - \ = 'ConfigureS3BucketLogging';" + QueryToExecute: | + SELECT + document_name, + shared_account_id, + shared_document_version, + account_ids, + title + FROM + aws_ssm_document_permission + WHERE + document_name = 'ConfigureS3BucketLogging'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: Find AWS SSM Document Permissions with Details + - Systems Manager +Title: Find AWS SSM Document Permissions with Details \ No newline at end of file diff --git a/queries/aws_ssm_document_permission_2.yaml b/queries/aws_ssm_document_permission_2.yaml old mode 100755 new mode 100644 index 2361291be..868ac7b5d --- a/queries/aws_ssm_document_permission_2.yaml +++ b/queries/aws_ssm_document_permission_2.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS SSM Document Permissions, providing detailed - information about the permissions associated with Systems Manager (SSM) documents. +Description: Allows users to query AWS SSM Document Permissions, providing detailed information about the permissions associated with Systems Manager (SSM) documents. ID: aws_ssm_document_permission_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n p.document_name,\n p.shared_account_id,\n p.shared_document_version,\n\ - \ d.approved_version,\n d.attachments_information,\n d.created_date,\n d.default_version\n\ - from\n aws_ssm_document_permission as p,\n aws_ssm_document as d\nwhere\n p.document_name\ - \ = 'ConfigureS3BucketLogging';" + QueryToExecute: | + SELECT + p.document_name, + p.shared_account_id, + p.shared_document_version, + d.approved_version, + d.attachments_information, + d.created_date, + d.default_version + FROM + aws_ssm_document_permission AS p, + aws_ssm_document AS d + WHERE + p.document_name = 'ConfigureS3BucketLogging'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: Find AWS SSM Document Permissions Information + - Systems Manager +Title: Find AWS SSM Document Permissions Information \ No newline at end of file diff --git a/queries/aws_ssm_inventory_1.yaml b/queries/aws_ssm_inventory_1.yaml old mode 100755 new mode 100644 index 894bc93e2..9e2578a8b --- a/queries/aws_ssm_inventory_1.yaml +++ b/queries/aws_ssm_inventory_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Systems Manager Inventory, providing information - about managed instances in AWS Systems Manager. +Description: Allows users to query AWS Systems Manager Inventory, providing information about managed instances in AWS Systems Manager. ID: aws_ssm_inventory_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n type_name,\n capture_time,\n schema_version,\n\ - \ content,\n region\nfrom\n aws_ssm_inventory;" + QueryToExecute: | + SELECT + id, + type_name, + capture_time, + schema_version, + content, + region + FROM + aws_ssm_inventory; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: List all Managed Instances in AWS Systems Manager Inventory + - AWS Systems Manager +Title: List all Managed Instances in AWS Systems Manager Inventory \ No newline at end of file diff --git a/queries/aws_ssm_inventory_2.yaml b/queries/aws_ssm_inventory_2.yaml old mode 100755 new mode 100644 index b2c216621..a328a2c57 --- a/queries/aws_ssm_inventory_2.yaml +++ b/queries/aws_ssm_inventory_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Systems Manager Inventory, providing information - about managed instances in AWS Systems Manager. +Description: Allows users to query AWS Systems Manager Inventory, providing information about managed instances in AWS Systems Manager. ID: aws_ssm_inventory_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n si.id,\n c ->> 'AgentType' as agent_type,\n c ->> 'IpAddress'\ - \ as ip_address,\n c ->> 'AgentVersion' as agent_version,\n c ->> 'ComputerName'\ - \ as computer_name,\n c ->> 'PlatformName' as platform_name,\n c ->> 'PlatformType'\ - \ as platform_type,\n c ->> 'ResourceType' as resource_type,\n c ->> 'InstanceStatus'\ - \ as instance_status,\n c ->> 'PlatformVersion' as platform_version\nfrom\n \ - \ aws_ssm_inventory as si,\n jsonb_array_elements(content) as c\nwhere\n id\ - \ = 'i-0665a65b1a1c2b47g';" + QueryToExecute: | + SELECT + si.id, + c ->> 'AgentType' AS agent_type, + c ->> 'IpAddress' AS ip_address, + c ->> 'AgentVersion' AS agent_version, + c ->> 'ComputerName' AS computer_name, + c ->> 'PlatformName' AS platform_name, + c ->> 'PlatformType' AS platform_type, + c ->> 'ResourceType' AS resource_type, + c ->> 'InstanceStatus' AS instance_status, + c ->> 'PlatformVersion' AS platform_version + FROM + aws_ssm_inventory AS si, + jsonb_array_elements(content) AS c + WHERE + id = 'i-0665a65b1a1c2b47g'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS Systems Manager Inventory details + - Systems Manager +Title: List all AWS Systems Manager Inventory details \ No newline at end of file diff --git a/queries/aws_ssm_inventory_3.yaml b/queries/aws_ssm_inventory_3.yaml old mode 100755 new mode 100644 index 2d0e149dd..f652874be --- a/queries/aws_ssm_inventory_3.yaml +++ b/queries/aws_ssm_inventory_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Systems Manager Inventory, providing information - about managed instances in AWS Systems Manager. +Description: Allows users to query AWS Systems Manager Inventory, providing information about managed instances in AWS Systems Manager. ID: aws_ssm_inventory_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n s ->> 'Version' as schema_version,\n s ->> 'TypeName'\ - \ as type_name,\n s ->> 'DisplayName' as display_name,\n jsonb_pretty(s -> 'Attributes')\ - \ as attributes\nfrom\n aws_ssm_inventory,\n jsonb_array_elements(schema) as\ - \ s\norder by \n id;" + QueryToExecute: | + SELECT + id, + s ->> 'Version' AS schema_version, + s ->> 'TypeName' AS type_name, + s ->> 'DisplayName' AS display_name, + jsonb_pretty(s -> 'Attributes') AS attributes + FROM + aws_ssm_inventory, + jsonb_array_elements(schema) AS s + ORDER BY + id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS Systems Manager Inventory Details + - Systems Manager +Title: List all AWS Systems Manager Inventory Details \ No newline at end of file diff --git a/queries/aws_ssm_inventory_4.yaml b/queries/aws_ssm_inventory_4.yaml old mode 100755 new mode 100644 index 01a5b5eec..1eaa1c74b --- a/queries/aws_ssm_inventory_4.yaml +++ b/queries/aws_ssm_inventory_4.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Systems Manager Inventory, providing information - about managed instances in AWS Systems Manager. +Description: Allows users to query AWS Systems Manager Inventory, providing information about managed instances in AWS Systems Manager. ID: aws_ssm_inventory_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n type_name,\n capture_time,\n schema_version,\n\ - \ content\nfrom\n aws_ssm_inventory\nwhere\n capture_time >= now() - interval\ - \ '10' day;" + QueryToExecute: | + SELECT + id, + type_name, + capture_time, + schema_version, + content + FROM + aws_ssm_inventory + WHERE + capture_time >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: Find all AWS Systems Manager managed instances inventory + - AWS Systems Manager +Title: Find all AWS Systems Manager managed instances inventory \ No newline at end of file diff --git a/queries/aws_ssm_inventory_5.yaml b/queries/aws_ssm_inventory_5.yaml old mode 100755 new mode 100644 index 7d6054bb6..81e47fac6 --- a/queries/aws_ssm_inventory_5.yaml +++ b/queries/aws_ssm_inventory_5.yaml @@ -1,26 +1,39 @@ -Description: Allows users to query AWS Systems Manager Inventory, providing information - about managed instances in AWS Systems Manager. +Description: Allows users to query AWS Systems Manager Inventory, providing information about managed instances in AWS Systems Manager. ID: aws_ssm_inventory_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n v.id,\n i.instance_state,\n i.instance_type,\n c ->>\ - \ 'AgentType' as agent_type,\n c ->> 'IpAddress' as ip_address,\n c ->> 'AgentVersion'\ - \ as agent_version,\n c ->> 'ComputerName' as computer_name,\n c ->> 'PlatformName'\ - \ as platform_name,\n c ->> 'PlatformType' as platform_type,\n c ->> 'ResourceType'\ - \ as resource_type,\n c ->> 'InstanceStatus' as instance_status,\n c ->> 'PlatformVersion'\ - \ as platform_version\nfrom\n aws_ssm_inventory as v,\n aws_ec2_instance as\ - \ i,\n jsonb_array_elements(content) as c\nwhere\n v.id = i.instance_id\nand\n\ - \ i.instance_state = 'running';" + QueryToExecute: | + SELECT + v.id, + i.instance_state, + i.instance_type, + c ->> 'AgentType' AS agent_type, + c ->> 'IpAddress' AS ip_address, + c ->> 'AgentVersion' AS agent_version, + c ->> 'ComputerName' AS computer_name, + c ->> 'PlatformName' AS platform_name, + c ->> 'PlatformType' AS platform_type, + c ->> 'ResourceType' AS resource_type, + c ->> 'InstanceStatus' AS instance_status, + c ->> 'PlatformVersion' AS platform_version + FROM + aws_ssm_inventory AS v, + aws_ec2_instance AS i, + jsonb_array_elements(content) AS c + WHERE + v.id = i.instance_id + AND + i.instance_state = 'running'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List AWS Systems Manager Inventory Managed Instances + - Systems Manager +Title: List AWS Systems Manager Inventory Managed Instances \ No newline at end of file diff --git a/queries/aws_ssm_inventory_entry_1.yaml b/queries/aws_ssm_inventory_entry_1.yaml old mode 100755 new mode 100644 index 477576481..005b61ed3 --- a/queries/aws_ssm_inventory_entry_1.yaml +++ b/queries/aws_ssm_inventory_entry_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information - about the inventory entries of managed instances. The table provides details such - as instance ID, type name, schema version, capture time, and inventory data. +Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information about the inventory entries of managed instances. The table provides details such as instance ID, type name, schema version, capture time, and inventory data. ID: aws_ssm_inventory_entry_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n type_name,\n capture_time,\n schema_version,\n\ - \ entries\nfrom\n aws_ssm_inventory_entry;" + QueryToExecute: | + SELECT + instance_id, + type_name, + capture_time, + schema_version, + entries + FROM + aws_ssm_inventory_entry; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS Systems Manager Inventory Entries + - Systems Manager +Title: List all AWS Systems Manager Inventory Entries \ No newline at end of file diff --git a/queries/aws_ssm_inventory_entry_2.yaml b/queries/aws_ssm_inventory_entry_2.yaml old mode 100755 new mode 100644 index ad709edc6..5561ce78d --- a/queries/aws_ssm_inventory_entry_2.yaml +++ b/queries/aws_ssm_inventory_entry_2.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information - about the inventory entries of managed instances. The table provides details such - as instance ID, type name, schema version, capture time, and inventory data. +Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information about the inventory entries of managed instances. The table provides details such as instance ID, type name, schema version, capture time, and inventory data. ID: aws_ssm_inventory_entry_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n type_name,\n capture_time,\n schema_version,\n\ - \ entries\nfrom\n aws_ssm_inventory_entry\nwhere\n capture_time >= time() -\ - \ interval '30 day';" + QueryToExecute: | + SELECT + instance_id, + type_name, + capture_time, + schema_version, + entries + FROM + aws_ssm_inventory_entry + WHERE + capture_time >= time() - INTERVAL '30 day'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS Systems Manager Inventory Entries + - Systems Manager +Title: List all AWS Systems Manager Inventory Entries \ No newline at end of file diff --git a/queries/aws_ssm_inventory_entry_3.yaml b/queries/aws_ssm_inventory_entry_3.yaml old mode 100755 new mode 100644 index fe0033673..70c6ff131 --- a/queries/aws_ssm_inventory_entry_3.yaml +++ b/queries/aws_ssm_inventory_entry_3.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information - about the inventory entries of managed instances. The table provides details such - as instance ID, type name, schema version, capture time, and inventory data. +Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information about the inventory entries of managed instances. The table provides details such as instance ID, type name, schema version, capture time, and inventory data. ID: aws_ssm_inventory_entry_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.instance_id,\n e.type_name,\n i.schema_version,\n\ - \ i.schema\nfrom\n aws_ssm_inventory_entry as e,\n aws_ssm_inventory as i\n\ - where\n i.id = e.instance_id;" + QueryToExecute: | + SELECT + e.instance_id, + e.type_name, + i.schema_version, + i.schema + FROM + aws_ssm_inventory_entry AS e, + aws_ssm_inventory AS i + WHERE + i.id = e.instance_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List AWS SSM Inventory Entry Details by Instance + - Systems Manager +Title: List AWS SSM Inventory Entry Details by Instance \ No newline at end of file diff --git a/queries/aws_ssm_inventory_entry_4.yaml b/queries/aws_ssm_inventory_entry_4.yaml old mode 100755 new mode 100644 index af3813f71..409625cb9 --- a/queries/aws_ssm_inventory_entry_4.yaml +++ b/queries/aws_ssm_inventory_entry_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information - about the inventory entries of managed instances. The table provides details such - as instance ID, type name, schema version, capture time, and inventory data. +Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information about the inventory entries of managed instances. The table provides details such as instance ID, type name, schema version, capture time, and inventory data. ID: aws_ssm_inventory_entry_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.instance_id,\n e.type_name,\n i.resource_type,\n\ - \ i.association_status,\n i.computer_name,\n i.ip_address,\n i.is_latest_version\n\ - from\n aws_ssm_inventory_entry as e,\n aws_ssm_managed_instance as i\nwhere\n\ - \ i.instance_id = e.instance_id;" + QueryToExecute: | + SELECT + e.instance_id, + e.type_name, + i.resource_type, + i.association_status, + i.computer_name, + i.ip_address, + i.is_latest_version + FROM + aws_ssm_inventory_entry AS e, + aws_ssm_managed_instance AS i + WHERE + i.instance_id = e.instance_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: Find AWS Systems Manager Inventory Entries + - AWS Systems Manager +Title: Find AWS Systems Manager Inventory Entries \ No newline at end of file diff --git a/queries/aws_ssm_inventory_entry_5.yaml b/queries/aws_ssm_inventory_entry_5.yaml old mode 100755 new mode 100644 index edbb74ec6..78121b2f2 --- a/queries/aws_ssm_inventory_entry_5.yaml +++ b/queries/aws_ssm_inventory_entry_5.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information - about the inventory entries of managed instances. The table provides details such - as instance ID, type name, schema version, capture time, and inventory data. +Description: Allows users to query AWS Systems Manager Inventory Entry to fetch information about the inventory entries of managed instances. The table provides details such as instance ID, type name, schema version, capture time, and inventory data. ID: aws_ssm_inventory_entry_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n type_name,\n capture_time,\n schema_version,\n\ - \ entries\nfrom\n aws_ssm_inventory_entry\nwhere\n instance_id = 'i-1234567890abcwd4f'\n\ - and\n type_name like 'Custom%';" + QueryToExecute: | + SELECT + instance_id, + type_name, + capture_time, + schema_version, + entries + FROM + aws_ssm_inventory_entry + WHERE + instance_id = 'i-1234567890abcwd4f' + AND + type_name LIKE 'Custom%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS Systems Manager Inventory Entries + - Systems Manager +Title: List all AWS Systems Manager Inventory Entries \ No newline at end of file diff --git a/queries/aws_ssm_maintenance_window_1.yaml b/queries/aws_ssm_maintenance_window_1.yaml old mode 100755 new mode 100644 index 11479c8c8..d1b84e415 --- a/queries/aws_ssm_maintenance_window_1.yaml +++ b/queries/aws_ssm_maintenance_window_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve - details about scheduled maintenance tasks for AWS resources. +Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve details about scheduled maintenance tasks for AWS resources. ID: aws_ssm_maintenance_window_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n window_id,\n enabled,\n schedule,\n tags_src,\n\ - \ region\nfrom\n aws_ssm_maintenance_window;" + QueryToExecute: | + SELECT + name, + window_id, + enabled, + schedule, + tags_src, + region + FROM + aws_ssm_maintenance_window; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List AWS Systems Manager Maintenance Windows Details + - Systems Manager +Title: List AWS Systems Manager Maintenance Windows Details \ No newline at end of file diff --git a/queries/aws_ssm_maintenance_window_2.yaml b/queries/aws_ssm_maintenance_window_2.yaml old mode 100755 new mode 100644 index bfb2a3846..4147f4124 --- a/queries/aws_ssm_maintenance_window_2.yaml +++ b/queries/aws_ssm_maintenance_window_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve - details about scheduled maintenance tasks for AWS resources. +Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve details about scheduled maintenance tasks for AWS resources. ID: aws_ssm_maintenance_window_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p ->> 'WindowTargetId' as window_target_id,\n\ - \ p ->> 'ResourceType' as resource_type,\n p ->> 'Name' as target_name\nfrom\n\ - \ aws_ssm_maintenance_window,\n jsonb_array_elements(targets) as p;" + QueryToExecute: | + SELECT + name, + p ->> 'WindowTargetId' AS window_target_id, + p ->> 'ResourceType' AS resource_type, + p ->> 'Name' AS target_name + FROM + aws_ssm_maintenance_window, + jsonb_array_elements(targets) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: Find AWS Systems Manager Maintenance Windows Details + - Systems Manager +Title: Find AWS Systems Manager Maintenance Windows Details \ No newline at end of file diff --git a/queries/aws_ssm_maintenance_window_3.yaml b/queries/aws_ssm_maintenance_window_3.yaml old mode 100755 new mode 100644 index 6b7b571bd..094c9918f --- a/queries/aws_ssm_maintenance_window_3.yaml +++ b/queries/aws_ssm_maintenance_window_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve - details about scheduled maintenance tasks for AWS resources. +Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve details about scheduled maintenance tasks for AWS resources. ID: aws_ssm_maintenance_window_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n p ->> 'WindowTaskId' as window_task_id,\n p\ - \ ->> 'ServiceRoleArn' as service_role_arn,\n p ->> 'Name' as task_name\nfrom\n\ - \ aws_ssm_maintenance_window,\n jsonb_array_elements(tasks) as p;" + QueryToExecute: | + SELECT + name, + p ->> 'WindowTaskId' AS window_task_id, + p ->> 'ServiceRoleArn' AS service_role_arn, + p ->> 'Name' AS task_name + FROM + aws_ssm_maintenance_window, + jsonb_array_elements(tasks) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List All Maintenance Windows in AWS Systems Manager + - Systems Manager +Title: List All Maintenance Windows in AWS Systems Manager \ No newline at end of file diff --git a/queries/aws_ssm_maintenance_window_4.yaml b/queries/aws_ssm_maintenance_window_4.yaml old mode 100755 new mode 100644 index f931e1d8b..2cd10c57a --- a/queries/aws_ssm_maintenance_window_4.yaml +++ b/queries/aws_ssm_maintenance_window_4.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve - details about scheduled maintenance tasks for AWS resources. +Description: Allows users to query AWS Systems Manager Maintenance Windows to retrieve details about scheduled maintenance tasks for AWS resources. ID: aws_ssm_maintenance_window_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n window_id,\n enabled\nfrom\n aws_ssm_maintenance_window\n\ - where\n enabled;" + QueryToExecute: | + SELECT + name, + window_id, + enabled + FROM + aws_ssm_maintenance_window + WHERE + enabled; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: List all AWS Systems Manager Maintenance Windows + - AWS Systems Manager +Title: List all AWS Systems Manager Maintenance Windows \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_1.yaml b/queries/aws_ssm_managed_instance_1.yaml old mode 100755 new mode 100644 index 2fb6c8ce0..28b3624b6 --- a/queries/aws_ssm_managed_instance_1.yaml +++ b/queries/aws_ssm_managed_instance_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration - and status information. +Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration and status information. ID: aws_ssm_managed_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n arn,\n resource_type,\n association_status,\n\ - \ agent_version,\n platform_type\nfrom\n aws_ssm_managed_instance;" + QueryToExecute: | + SELECT + instance_id, + arn, + resource_type, + association_status, + agent_version, + platform_type + FROM + aws_ssm_managed_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Managed Instances -Title: List all AWS SSM Managed Instances Configuration and Status + - SSM Managed Instances +Title: List all AWS SSM Managed Instances Configuration and Status \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_2.yaml b/queries/aws_ssm_managed_instance_2.yaml old mode 100755 new mode 100644 index 350f47a8f..c4a55db78 --- a/queries/aws_ssm_managed_instance_2.yaml +++ b/queries/aws_ssm_managed_instance_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration - and status information. +Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration and status information. ID: aws_ssm_managed_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n arn,\n resource_type,\n association_status\n\ - from\n aws_ssm_managed_instance\nwhere\n association_status is null;" + QueryToExecute: | + SELECT + instance_id, + arn, + resource_type, + association_status + FROM + aws_ssm_managed_instance + WHERE + association_status IS NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Managed Instances -Title: Find AWS SSM Managed Instances with Config and Status + - SSM Managed Instances +Title: Find AWS SSM Managed Instances with Config and Status \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_3.yaml b/queries/aws_ssm_managed_instance_3.yaml old mode 100755 new mode 100644 index 38f3c1ff8..a2aa0169b --- a/queries/aws_ssm_managed_instance_3.yaml +++ b/queries/aws_ssm_managed_instance_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration - and status information. +Description: Allows users to query AWS SSM Managed Instances to retrieve their configuration and status information. ID: aws_ssm_managed_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.instance_id,\n i.arn,\n m.instance_id is not null\ - \ as ssm_managed\nfrom\n aws_ec2_instance i\nleft join aws_ssm_managed_instance\ - \ m on m.instance_id = i.instance_id\nwhere \n m.instance_id is null;" + QueryToExecute: | + SELECT + i.instance_id, + i.arn, + m.instance_id IS NOT NULL AS ssm_managed + FROM + aws_ec2_instance i + LEFT JOIN + aws_ssm_managed_instance m + ON m.instance_id = i.instance_id + WHERE + m.instance_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Managed Instance -Title: List all AWS SSM Managed Instances with Configurations + - SSM Managed Instance +Title: List all AWS SSM Managed Instances with Configurations \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_compliance_1.yaml b/queries/aws_ssm_managed_instance_compliance_1.yaml old mode 100755 new mode 100644 index 4a7c69607..425710cc6 --- a/queries/aws_ssm_managed_instance_compliance_1.yaml +++ b/queries/aws_ssm_managed_instance_compliance_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS SSM Managed Instance Compliance data, providing - details on compliance status, compliance type, and related metadata. +Description: Allows users to query AWS SSM Managed Instance Compliance data, providing details on compliance status, compliance type, and related metadata. ID: aws_ssm_managed_instance_compliance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n resource_id,\n status,\n compliance_type,\n\ - \ severity\nfrom\n aws_ssm_managed_instance_compliance\nwhere\n resource_id\ - \ = 'i-2a3dc8b11ed9d37a';" + QueryToExecute: | + SELECT + id, + name, + resource_id, + status, + compliance_type, + severity + FROM + aws_ssm_managed_instance_compliance + WHERE + resource_id = 'i-2a3dc8b11ed9d37a'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Managed Instance Compliance -Title: List AWS SSM Managed Instance Compliance Details + - SSM Managed Instance Compliance +Title: List AWS SSM Managed Instance Compliance Details \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_compliance_2.yaml b/queries/aws_ssm_managed_instance_compliance_2.yaml old mode 100755 new mode 100644 index f974ffa5e..8133576b5 --- a/queries/aws_ssm_managed_instance_compliance_2.yaml +++ b/queries/aws_ssm_managed_instance_compliance_2.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS SSM Managed Instance Compliance data, providing - details on compliance status, compliance type, and related metadata. +Description: Allows users to query AWS SSM Managed Instance Compliance data, providing details on compliance status, compliance type, and related metadata. ID: aws_ssm_managed_instance_compliance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n resource_id as instance_id,\n status,\n\ - \ compliance_type,\n severity\nfrom\n aws_ssm_managed_instance_compliance\n\ - where\n resource_id = 'i-2a3dc8b11ed9d37a'\n and compliance_type = 'Association'\n\ - \ and status <> 'COMPLIANT';" + QueryToExecute: | + SELECT + id, + name, + resource_id AS instance_id, + status, + compliance_type, + severity + FROM + aws_ssm_managed_instance_compliance + WHERE + resource_id = 'i-2a3dc8b11ed9d37a' + AND compliance_type = 'Association' + AND status <> 'COMPLIANT'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM -Title: Find AWS SSM Managed Instance Compliance Details + - SSM +Title: Find AWS SSM Managed Instance Compliance Details \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_compliance_3.yaml b/queries/aws_ssm_managed_instance_compliance_3.yaml old mode 100755 new mode 100644 index 5d2e277f8..d42c11f1f --- a/queries/aws_ssm_managed_instance_compliance_3.yaml +++ b/queries/aws_ssm_managed_instance_compliance_3.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS SSM Managed Instance Compliance data, providing - details on compliance status, compliance type, and related metadata. +Description: Allows users to query AWS SSM Managed Instance Compliance data, providing details on compliance status, compliance type, and related metadata. ID: aws_ssm_managed_instance_compliance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n resource_id as instance_id,\n status,\n\ - \ compliance_type,\n severity\nfrom\n aws_ssm_managed_instance_compliance\n\ - where\n resource_id = 'i-2a3dc8b11ed9d37a'\n and compliance_type = 'Patch'\n\ - \ and status <> 'COMPLIANT';" + QueryToExecute: | + SELECT + id, + name, + resource_id AS instance_id, + status, + compliance_type, + severity + FROM + aws_ssm_managed_instance_compliance + WHERE + resource_id = 'i-2a3dc8b11ed9d37a' + AND compliance_type = 'Patch' + AND status <> 'COMPLIANT'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS SSM -Title: Find AWS SSM Managed Instance Compliance Data + - AWS SSM +Title: Find AWS SSM Managed Instance Compliance Data \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_compliance_4.yaml b/queries/aws_ssm_managed_instance_compliance_4.yaml old mode 100755 new mode 100644 index b520b2126..00eb56860 --- a/queries/aws_ssm_managed_instance_compliance_4.yaml +++ b/queries/aws_ssm_managed_instance_compliance_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS SSM Managed Instance Compliance data, providing - details on compliance status, compliance type, and related metadata. +Description: Allows users to query AWS SSM Managed Instance Compliance data, providing details on compliance status, compliance type, and related metadata. ID: aws_ssm_managed_instance_compliance_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n c.resource_id as instance_id,\n id,\n status\nfrom\n\ - \ aws_ssm_managed_instance i,\n aws_ssm_managed_instance_compliance c\nwhere\n\ - \ i.instance_id = c.resource_id;" + QueryToExecute: | + SELECT + c.resource_id AS instance_id, + id, + status + FROM + aws_ssm_managed_instance i, + aws_ssm_managed_instance_compliance c + WHERE + i.instance_id = c.resource_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM -Title: List all AWS SSM Managed Instance Compliance Details + - SSM +Title: List all AWS SSM Managed Instance Compliance Details \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_1.yaml b/queries/aws_ssm_managed_instance_patch_state_1.yaml old mode 100755 new mode 100644 index dbccb92f4..b72fc3f8a --- a/queries/aws_ssm_managed_instance_patch_state_1.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n operation,\n patch_group,\n\ - \ failed_count,\n installed_count,\n installed_other_count\nfrom\n aws_ssm_managed_instance_patch_state;" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + operation, + patch_group, + failed_count, + installed_count, + installed_other_count + FROM + aws_ssm_managed_instance_patch_state; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager Managed Instance -Title: Find AWS Managed Instance Patch States in SSM + - Systems Manager Managed Instance +Title: Find AWS Managed Instance Patch States in SSM \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_2.yaml b/queries/aws_ssm_managed_instance_patch_state_2.yaml old mode 100755 new mode 100644 index 4a25eb3d4..b124772ea --- a/queries/aws_ssm_managed_instance_patch_state_2.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_2.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n installed_count\nfrom\n\ - \ aws_ssm_managed_instance_patch_state;" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + installed_count + FROM + aws_ssm_managed_instance_patch_state; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: Find AWS Systems Manager Managed Instance Patch State Details + - AWS Systems Manager +Title: Find AWS Systems Manager Managed Instance Patch State Details \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_3.yaml b/queries/aws_ssm_managed_instance_patch_state_3.yaml old mode 100755 new mode 100644 index c8950f01b..d6cc7e9aa --- a/queries/aws_ssm_managed_instance_patch_state_3.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n installed_other_count\n\ - from\n aws_ssm_managed_instance_patch_state;" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + installed_other_count + FROM + aws_ssm_managed_instance_patch_state; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: List all AWS SSM Managed Instance Patch State + - Systems Manager +Title: List all AWS SSM Managed Instance Patch State \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_4.yaml b/queries/aws_ssm_managed_instance_patch_state_4.yaml old mode 100755 new mode 100644 index d91840a61..b6ff13823 --- a/queries/aws_ssm_managed_instance_patch_state_4.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_4.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n security_non_compliant_count\n\ - from\n aws_ssm_managed_instance_patch_state;" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + security_non_compliant_count + FROM + aws_ssm_managed_instance_patch_state; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: Find AWS Systems Manager Managed Instance Patch State + - Systems Manager +Title: Find AWS Systems Manager Managed Instance Patch State \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_5.yaml b/queries/aws_ssm_managed_instance_patch_state_5.yaml old mode 100755 new mode 100644 index c81bc4aba..b859bc641 --- a/queries/aws_ssm_managed_instance_patch_state_5.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_5.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n operation,\n operation_end_time,\n\ - \ operation_start_time\nfrom\n aws_ssm_managed_instance_patch_state\nwhere\n\ - \ operation_end_time >= now() - interval '10' day;" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + operation, + operation_end_time, + operation_start_time + FROM + aws_ssm_managed_instance_patch_state + WHERE + operation_end_time >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager -Title: List AWS SSM Managed Instance Patch States + - AWS Systems Manager +Title: List AWS SSM Managed Instance Patch States \ No newline at end of file diff --git a/queries/aws_ssm_managed_instance_patch_state_6.yaml b/queries/aws_ssm_managed_instance_patch_state_6.yaml old mode 100755 new mode 100644 index 2ec273c5e..ddfaff80a --- a/queries/aws_ssm_managed_instance_patch_state_6.yaml +++ b/queries/aws_ssm_managed_instance_patch_state_6.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Systems Manager Managed Instance Patch State - to gather information about the patch state of managed instances. This includes - the instance ID, patch group, owner information, installed patches, and more. +Description: Allows users to query AWS Systems Manager Managed Instance Patch State to gather information about the patch state of managed instances. This includes the instance ID, patch group, owner information, installed patches, and more. ID: aws_ssm_managed_instance_patch_state_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n instance_id,\n baseline_id,\n operation\nfrom\n aws_ssm_managed_instance_patch_state\n\ - where\n operation = 'Scan';" + QueryToExecute: | + SELECT + instance_id, + baseline_id, + operation + FROM + aws_ssm_managed_instance_patch_state + WHERE + operation = 'Scan'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager -Title: Find AWS Systems Manager Managed Instance Patch State + - Systems Manager +Title: Find AWS Systems Manager Managed Instance Patch State \ No newline at end of file diff --git a/queries/aws_ssm_parameter_1.yaml b/queries/aws_ssm_parameter_1.yaml old mode 100755 new mode 100644 index 9ead18113..44c483cb7 --- a/queries/aws_ssm_parameter_1.yaml +++ b/queries/aws_ssm_parameter_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Systems Manager Parameter Store to retrieve - information about parameters, their types, values, and associated metadata. +Description: Allows users to query AWS Systems Manager Parameter Store to retrieve information about parameters, their types, values, and associated metadata. ID: aws_ssm_parameter_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n type,\n data_type,\n tier,\n region\nfrom\n\ - \ aws_ssm_parameter;" + QueryToExecute: | + SELECT + name, + type, + data_type, + tier, + region + FROM + aws_ssm_parameter; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager Parameter Store -Title: Find AWS Systems Manager Parameters and Metadata + - Systems Manager Parameter Store +Title: Find AWS Systems Manager Parameters and Metadata \ No newline at end of file diff --git a/queries/aws_ssm_parameter_2.yaml b/queries/aws_ssm_parameter_2.yaml old mode 100755 new mode 100644 index c52bbd378..5e8f76e81 --- a/queries/aws_ssm_parameter_2.yaml +++ b/queries/aws_ssm_parameter_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Systems Manager Parameter Store to retrieve - information about parameters, their types, values, and associated metadata. +Description: Allows users to query AWS Systems Manager Parameter Store to retrieve information about parameters, their types, values, and associated metadata. ID: aws_ssm_parameter_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n tier,\n p ->> 'PolicyType' as policy_type,\n\ - \ p ->> 'PolicyStatus' as Policy_status,\n p ->> 'PolicyText' as policy_text\n\ - from\n aws_ssm_parameter,\n jsonb_array_elements(policies) as p;" + QueryToExecute: | + SELECT + name, + tier, + p ->> 'PolicyType' AS policy_type, + p ->> 'PolicyStatus' AS policy_status, + p ->> 'PolicyText' AS policy_text + FROM + aws_ssm_parameter, + jsonb_array_elements(policies) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Systems Manager Parameter Store -Title: List AWS SSM Parameters with Details + - AWS Systems Manager Parameter Store +Title: List AWS SSM Parameters with Details \ No newline at end of file diff --git a/queries/aws_ssm_parameter_3.yaml b/queries/aws_ssm_parameter_3.yaml old mode 100755 new mode 100644 index 5947f1a16..193e328e8 --- a/queries/aws_ssm_parameter_3.yaml +++ b/queries/aws_ssm_parameter_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Systems Manager Parameter Store to retrieve - information about parameters, their types, values, and associated metadata. +Description: Allows users to query AWS Systems Manager Parameter Store to retrieve information about parameters, their types, values, and associated metadata. ID: aws_ssm_parameter_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name\nfrom\n aws_ssm_parameter\nwhere\n tags -> 'owner'\ - \ is null\n or tags -> 'app_id' is null;" + QueryToExecute: | + SELECT + name + FROM + aws_ssm_parameter + WHERE + tags -> 'owner' IS NULL + OR tags -> 'app_id' IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Systems Manager Parameter Store -Title: List all AWS SSM Parameters missing owner or app_id + - Systems Manager Parameter Store +Title: List all AWS SSM Parameters missing owner or app_id \ No newline at end of file diff --git a/queries/aws_ssm_patch_baseline_1.yaml b/queries/aws_ssm_patch_baseline_1.yaml old mode 100755 new mode 100644 index 8fc4edcb5..16bcabbeb --- a/queries/aws_ssm_patch_baseline_1.yaml +++ b/queries/aws_ssm_patch_baseline_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS SSM Patch Baseline data to retrieve information - about each patch baseline in your AWS account. +Description: Allows users to query AWS SSM Patch Baseline data to retrieve information about each patch baseline in your AWS account. ID: aws_ssm_patch_baseline_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n baseline_id,\n name,\n description,\n operating_system,\n\ - \ created_date,\n region\nfrom\n aws_ssm_patch_baseline;" + QueryToExecute: | + SELECT + baseline_id, + name, + description, + operating_system, + created_date, + region + FROM + aws_ssm_patch_baseline; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Patch -Title: List all AWS SSM Patch Baselines with Details + - SSM Patch +Title: List all AWS SSM Patch Baselines with Details \ No newline at end of file diff --git a/queries/aws_ssm_patch_baseline_2.yaml b/queries/aws_ssm_patch_baseline_2.yaml old mode 100755 new mode 100644 index 833bef826..b45ba844c --- a/queries/aws_ssm_patch_baseline_2.yaml +++ b/queries/aws_ssm_patch_baseline_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS SSM Patch Baseline data to retrieve information - about each patch baseline in your AWS account. +Description: Allows users to query AWS SSM Patch Baseline data to retrieve information about each patch baseline in your AWS account. ID: aws_ssm_patch_baseline_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n baseline_id,\n name,\n description,\n created_date,\n\ - \ region\nfrom\n aws_ssm_patch_baseline\nwhere\n operating_system = 'UBUNTU';" + QueryToExecute: | + SELECT + baseline_id, + name, + description, + created_date, + region + FROM + aws_ssm_patch_baseline + WHERE + operating_system = 'UBUNTU'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Patch Baseline -Title: Find AWS SSM Patch Baseline details including creation dates + - SSM Patch Baseline +Title: Find AWS SSM Patch Baseline details including creation dates \ No newline at end of file diff --git a/queries/aws_ssm_patch_baseline_3.yaml b/queries/aws_ssm_patch_baseline_3.yaml old mode 100755 new mode 100644 index 2428ed292..9fe140cfb --- a/queries/aws_ssm_patch_baseline_3.yaml +++ b/queries/aws_ssm_patch_baseline_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS SSM Patch Baseline data to retrieve information - about each patch baseline in your AWS account. +Description: Allows users to query AWS SSM Patch Baseline data to retrieve information about each patch baseline in your AWS account. ID: aws_ssm_patch_baseline_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n baseline_id,\n name,\n description,\n operating_system,\n\ - \ created_date,\n rejected_patches,\n region\nfrom\n aws_ssm_patch_baseline\n\ - where\n rejected_patches != '[]';" + QueryToExecute: | + SELECT + baseline_id, + name, + description, + operating_system, + created_date, + rejected_patches, + region + FROM + aws_ssm_patch_baseline + WHERE + rejected_patches != '[]'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Patch Baseline -Title: List all AWS SSM Patch Baseline Details + - SSM Patch Baseline +Title: List all AWS SSM Patch Baseline Details \ No newline at end of file diff --git a/queries/aws_ssm_patch_baseline_4.yaml b/queries/aws_ssm_patch_baseline_4.yaml old mode 100755 new mode 100644 index 9fbb87587..ece9c34c4 --- a/queries/aws_ssm_patch_baseline_4.yaml +++ b/queries/aws_ssm_patch_baseline_4.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS SSM Patch Baseline data to retrieve information - about each patch baseline in your AWS account. +Description: Allows users to query AWS SSM Patch Baseline data to retrieve information about each patch baseline in your AWS account. ID: aws_ssm_patch_baseline_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n baseline_id,\n p ->> 'ApproveAfterDays' as approve_after_days,\n\ - \ p ->> 'ApproveUntilDate' as approve_until_date,\n p ->> 'ComplianceLevel'\ - \ as compliance_level,\n p -> 'PatchFilterGroup' ->> 'PatchFilters' as patch_filters\n\ - from\n aws_ssm_patch_baseline,\n jsonb_array_elements(approval_rules -> 'PatchRules')\ - \ as p;" + QueryToExecute: | + SELECT + baseline_id, + p ->> 'ApproveAfterDays' AS approve_after_days, + p ->> 'ApproveUntilDate' AS approve_until_date, + p ->> 'ComplianceLevel' AS compliance_level, + p -> 'PatchFilterGroup' ->> 'PatchFilters' AS patch_filters + FROM + aws_ssm_patch_baseline, + jsonb_array_elements(approval_rules -> 'PatchRules') AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Patch Baseline -Title: Find all AWS SSM Patch Baselines and Approval Rules + - SSM Patch Baseline +Title: Find all AWS SSM Patch Baselines and Approval Rules \ No newline at end of file diff --git a/queries/aws_ssmincidents_response_plan_1.yaml b/queries/aws_ssmincidents_response_plan_1.yaml old mode 100755 new mode 100644 index 8c771f444..00e5ab636 --- a/queries/aws_ssmincidents_response_plan_1.yaml +++ b/queries/aws_ssmincidents_response_plan_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve - information about each resource plan in your AWS account. +Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve information about each resource plan in your AWS account. ID: aws_ssmincidents_response_plan_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n chat_channel,\n incident_template,\n\ - \ integrations,\n title\nfrom\n aws_ssmincidents_response_plan;" + QueryToExecute: | + SELECT + name, + arn, + display_name, + chat_channel, + incident_template, + integrations, + title + FROM + aws_ssmincidents_response_plan; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Incidents -Title: List AWS SSM Incidents Response Plan Data + - SSM Incidents +Title: List AWS SSM Incidents Response Plan Data \ No newline at end of file diff --git a/queries/aws_ssmincidents_response_plan_2.yaml b/queries/aws_ssmincidents_response_plan_2.yaml old mode 100755 new mode 100644 index baec603f3..57b899f3f --- a/queries/aws_ssmincidents_response_plan_2.yaml +++ b/queries/aws_ssmincidents_response_plan_2.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve - information about each resource plan in your AWS account. +Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve information about each resource plan in your AWS account. ID: aws_ssmincidents_response_plan_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n chat_channel,\n incident_template,\n\ - \ integrations,\n title\nfrom\n aws_ssmincidents_response_plan\nwhere\n chat_channel\ - \ is not null;" + QueryToExecute: | + SELECT + name, + arn, + display_name, + chat_channel, + incident_template, + integrations, + title + FROM + aws_ssmincidents_response_plan + WHERE + chat_channel IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Incidents -Title: List all AWS SSM Incident Response Plan Data + - SSM Incidents +Title: List all AWS SSM Incident Response Plan Data \ No newline at end of file diff --git a/queries/aws_ssmincidents_response_plan_3.yaml b/queries/aws_ssmincidents_response_plan_3.yaml old mode 100755 new mode 100644 index cebec5360..19afb29c1 --- a/queries/aws_ssmincidents_response_plan_3.yaml +++ b/queries/aws_ssmincidents_response_plan_3.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve - information about each resource plan in your AWS account. +Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve information about each resource plan in your AWS account. ID: aws_ssmincidents_response_plan_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n incident_template ->\ - \ 'Impact' as incident_template_impact,\n incident_template -> 'Title' as incident_template_title,\n\ - \ incident_template -> 'DedupeString',\n incident_template -> 'IncidentTags'\ - \ as incident_template_tags,\n incident_template -> 'NotificationTargets' as\ - \ incident_notification_targets,\n incident_template -> 'Summary' as incident_template_summary,\n\ - \ title\nfrom\n aws_ssmincidents_response_plan\nwhere\n incident_template is\ - \ not null\n and arn = 'arn:aws:ssm-incidents::111111111111:response-plan/response-plan-test';" + QueryToExecute: | + SELECT + name, + arn, + display_name, + incident_template -> 'Impact' AS incident_template_impact, + incident_template -> 'Title' AS incident_template_title, + incident_template -> 'DedupeString', + incident_template -> 'IncidentTags' AS incident_template_tags, + incident_template -> 'NotificationTargets' AS incident_notification_targets, + incident_template -> 'Summary' AS incident_template_summary, + title + FROM + aws_ssmincidents_response_plan + WHERE + incident_template IS NOT NULL + AND arn = 'arn:aws:ssm-incidents::111111111111:response-plan/response-plan-test'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Incidents -Title: Find all Information on AWS SSM Incidents Response Plans + - SSM Incidents +Title: Find all Information on AWS SSM Incidents Response Plans \ No newline at end of file diff --git a/queries/aws_ssmincidents_response_plan_4.yaml b/queries/aws_ssmincidents_response_plan_4.yaml old mode 100755 new mode 100644 index 0ccb3727c..a985c89cf --- a/queries/aws_ssmincidents_response_plan_4.yaml +++ b/queries/aws_ssmincidents_response_plan_4.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve - information about each resource plan in your AWS account. +Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve information about each resource plan in your AWS account. ID: aws_ssmincidents_response_plan_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n jsonb_pretty(integrations),\n\ - \ title\nfrom\n aws_ssmincidents_response_plan\nwhere\n integrations is not\ - \ null;" + QueryToExecute: | + SELECT + name, + arn, + display_name, + jsonb_pretty(integrations), + title + FROM + aws_ssmincidents_response_plan + WHERE + integrations IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Incidents -Title: Find AWS SSM Incident Response Plans with Integrations + - SSM Incidents +Title: Find AWS SSM Incident Response Plans with Integrations \ No newline at end of file diff --git a/queries/aws_ssmincidents_response_plan_5.yaml b/queries/aws_ssmincidents_response_plan_5.yaml old mode 100755 new mode 100644 index d262092f0..9fbe8cf19 --- a/queries/aws_ssmincidents_response_plan_5.yaml +++ b/queries/aws_ssmincidents_response_plan_5.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve - information about each resource plan in your AWS account. +Description: Allows users to query AWS SSM Incidents Response Plan data to retrieve information about each resource plan in your AWS account. ID: aws_ssmincidents_response_plan_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n display_name,\n jsonb_pretty(engagements),\n\ - \ title\nfrom\n aws_ssmincidents_response_plan\nwhere\n engagements is not\ - \ null;" + QueryToExecute: | + SELECT + name, + arn, + display_name, + JSONB_PRETTY(engagements), + title + FROM + aws_ssmincidents_response_plan + WHERE + engagements IS NOT NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSM Incidents -Title: Find AWS SSM Incidents Response Plan Information + - SSM Incidents +Title: Find AWS SSM Incidents Response Plan Information \ No newline at end of file diff --git a/queries/aws_ssoadmin_account_assignment_1.yaml b/queries/aws_ssoadmin_account_assignment_1.yaml old mode 100755 new mode 100644 index 2080d4570..c29a2a31b --- a/queries/aws_ssoadmin_account_assignment_1.yaml +++ b/queries/aws_ssoadmin_account_assignment_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS SSO Admin Account Assignments. This table provides - information about each AWS SSO admin account assignment within an AWS account. +Description: Allows users to query AWS SSO Admin Account Assignments. This table provides information about each AWS SSO admin account assignment within an AWS account. ID: aws_ssoadmin_account_assignment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n permission_set_arn,\n target_account_id,\n principal_type,\n\ - \ principal_id\nfrom\n aws_ssoadmin_account_assignment\nwhere\n permission_set_arn\ - \ = 'arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef'\n\ - \ and target_account_id = '012347678910';" + QueryToExecute: | + SELECT + permission_set_arn, + target_account_id, + principal_type, + principal_id + FROM + aws_ssoadmin_account_assignment + WHERE + permission_set_arn = 'arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef' + AND target_account_id = '012347678910'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS SSO Admin -Title: Find AWS SSO Admin Account Assignments + - AWS SSO Admin +Title: Find AWS SSO Admin Account Assignments \ No newline at end of file diff --git a/queries/aws_ssoadmin_account_assignment_2.yaml b/queries/aws_ssoadmin_account_assignment_2.yaml old mode 100755 new mode 100644 index e7328d495..d02eb5324 --- a/queries/aws_ssoadmin_account_assignment_2.yaml +++ b/queries/aws_ssoadmin_account_assignment_2.yaml @@ -1,29 +1,55 @@ -Description: Allows users to query AWS SSO Admin Account Assignments. This table provides - information about each AWS SSO admin account assignment within an AWS account. +Description: Allows users to query AWS SSO Admin Account Assignments. This table provides information about each AWS SSO admin account assignment within an AWS account. ID: aws_ssoadmin_account_assignment_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with aws_ssoadmin_principal as\n(\n select\n i.arn as instance_arn,\n\ - \ 'GROUP' as \"type\",\n g.id,\n g.title\n from\n aws_ssoadmin_instance\ - \ i\n left join\n aws_identitystore_group g\n on i.identity_store_id\ - \ = g.identity_store_id\n union\n select\n i.arn as instance_arn,\n\ - \ 'USER' as \"type\",\n u.id,\n u.title\n from\n aws_ssoadmin_instance\ - \ i\n left join\n aws_identitystore_user u\n on i.identity_store_id\ - \ = u.identity_store_id\n)\nselect\n a.target_account_id,\n a.principal_type,\n\ - \ p.title as principal_title\nfrom\n aws_ssoadmin_account_assignment a\n left\ - \ join\n aws_ssoadmin_principal p\n on a.principal_type = p.type\n and\ - \ a.principal_id = p.id\n and a.instance_arn = p.instance_arn\nwhere\n a.target_account_id\ - \ = '012345678901' and a.permission_set_arn = 'arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef';" + QueryToExecute: | + WITH aws_ssoadmin_principal AS ( + SELECT + i.arn AS instance_arn, + 'GROUP' AS "type", + g.id, + g.title + FROM + aws_ssoadmin_instance i + LEFT JOIN aws_identitystore_group g + ON i.identity_store_id = g.identity_store_id + + UNION + + SELECT + i.arn AS instance_arn, + 'USER' AS "type", + u.id, + u.title + FROM + aws_ssoadmin_instance i + LEFT JOIN aws_identitystore_user u + ON i.identity_store_id = u.identity_store_id + ) + + SELECT + a.target_account_id, + a.principal_type, + p.title AS principal_title + FROM + aws_ssoadmin_account_assignment a + LEFT JOIN aws_ssoadmin_principal p + ON a.principal_type = p.type + AND a.principal_id = p.id + AND a.instance_arn = p.instance_arn + WHERE + a.target_account_id = '012345678901' + AND a.permission_set_arn = 'arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSO Admin -Title: Find All AWS SSO Admin Account Assignments with SQL + - SSO Admin +Title: Find All AWS SSO Admin Account Assignments with SQL \ No newline at end of file diff --git a/queries/aws_ssoadmin_instance_1.yaml b/queries/aws_ssoadmin_instance_1.yaml old mode 100755 new mode 100644 index f8eb2857c..29a116e89 --- a/queries/aws_ssoadmin_instance_1.yaml +++ b/queries/aws_ssoadmin_instance_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS SSO Admin Instance, providing information about - each AWS SSO instance in your AWS account. +Description: Allows users to query AWS SSO Admin Instance, providing information about each AWS SSO instance in your AWS account. ID: aws_ssoadmin_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n identity_store_id\nfrom\n aws_ssoadmin_instance" + QueryToExecute: | + SELECT + arn, + identity_store_id + FROM + aws_ssoadmin_instance Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS SSO Admin -Title: Find All AWS SSO Admin Instances and Identity Stores + - AWS SSO Admin +Title: Find All AWS SSO Admin Instances and Identity Stores \ No newline at end of file diff --git a/queries/aws_ssoadmin_managed_policy_attachment_1.yaml b/queries/aws_ssoadmin_managed_policy_attachment_1.yaml old mode 100755 new mode 100644 index c1f7c1da4..1cd6de9a0 --- a/queries/aws_ssoadmin_managed_policy_attachment_1.yaml +++ b/queries/aws_ssoadmin_managed_policy_attachment_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS SSO Managed Policy Attachments, providing information - about the managed policy attachments of AWS SSO permission sets. +Description: Allows users to query AWS SSO Managed Policy Attachments, providing information about the managed policy attachments of AWS SSO permission sets. ID: aws_ssoadmin_managed_policy_attachment_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n mpa.managed_policy_arn,\n mpa.name\nfrom\n aws_ssoadmin_managed_policy_attachment\ - \ as mpa\njoin\n aws_ssoadmin_permission_set as ps on mpa.permission_set_arn\ - \ = ps.arn;" + QueryToExecute: | + SELECT + mpa.managed_policy_arn, + mpa.name + FROM + aws_ssoadmin_managed_policy_attachment AS mpa + JOIN + aws_ssoadmin_permission_set AS ps + ON + mpa.permission_set_arn = ps.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS SSO -Title: List All AWS SSO Managed Policy Attachments + - AWS SSO +Title: List All AWS SSO Managed Policy Attachments \ No newline at end of file diff --git a/queries/aws_ssoadmin_permission_set_1.yaml b/queries/aws_ssoadmin_permission_set_1.yaml old mode 100755 new mode 100644 index 8dba75dbc..6da452e3d --- a/queries/aws_ssoadmin_permission_set_1.yaml +++ b/queries/aws_ssoadmin_permission_set_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS SSO Admin Permission Set to retrieve data related - to the permissions sets of AWS Single Sign-On (SSO) service. +Description: Allows users to query AWS SSO Admin Permission Set to retrieve data related to the permissions sets of AWS Single Sign-On (SSO) service. ID: aws_ssoadmin_permission_set_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n created_date,\n description,\n relay_state,\n\ - \ session_duration,\n tags\nfrom\n aws_ssoadmin_permission_set;" + QueryToExecute: | + SELECT + name, + arn, + created_date, + description, + relay_state, + session_duration, + tags + FROM + aws_ssoadmin_permission_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - SSO Admin -Title: List all AWS SSO Permission Sets and their Details + - SSO Admin +Title: List all AWS SSO Permission Sets and their Details \ No newline at end of file diff --git a/queries/aws_sts_caller_identity_1.yaml b/queries/aws_sts_caller_identity_1.yaml old mode 100755 new mode 100644 index 326b601e1..199a1704a --- a/queries/aws_sts_caller_identity_1.yaml +++ b/queries/aws_sts_caller_identity_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Security Token Service Caller Identity to retrieve - details about the IAM user or role whose credentials are used to call the operation. +Description: Allows users to query AWS Security Token Service Caller Identity to retrieve details about the IAM user or role whose credentials are used to call the operation. ID: aws_sts_caller_identity_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n user_id,\n title,\n account_id,\n akas\nfrom\n\ - \ aws_sts_caller_identity;" + QueryToExecute: | + SELECT + arn, + user_id, + title, + account_id, + akas + FROM + aws_sts_caller_identity; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Token Service -Title: Find IAM User or Role Details in AWS STS Caller Identity + - Security Token Service +Title: Find IAM User or Role Details in AWS STS Caller Identity \ No newline at end of file diff --git a/queries/aws_sts_caller_identity_2.yaml b/queries/aws_sts_caller_identity_2.yaml old mode 100755 new mode 100644 index 37fa7922e..ee0d02382 --- a/queries/aws_sts_caller_identity_2.yaml +++ b/queries/aws_sts_caller_identity_2.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Security Token Service Caller Identity to retrieve - details about the IAM user or role whose credentials are used to call the operation. +Description: Allows users to query AWS Security Token Service Caller Identity to retrieve details about the IAM user or role whose credentials are used to call the operation. ID: aws_sts_caller_identity_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n caller_identity.arn,\n caller_identity.user_id,\n caller_identity.title,\n\ - \ caller_identity.account_id,\n u.name,\n u.create_date,\n u.password_last_used\n\ - from\n aws_sts_caller_identity as caller_identity,\n aws_iam_user as u\nwhere\n\ - \ caller_identity.user_id = u.user_id\n and caller_identity.arn like '%assumed%';" + QueryToExecute: | + SELECT + caller_identity.arn, + caller_identity.user_id, + caller_identity.title, + caller_identity.account_id, + u.name, + u.create_date, + u.password_last_used + FROM + aws_sts_caller_identity AS caller_identity, + aws_iam_user AS u + WHERE + caller_identity.user_id = u.user_id + AND caller_identity.arn LIKE '%assumed%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Security Token Service -Title: Find AWS STS Caller Identity Details Using SQL + - AWS Security Token Service +Title: Find AWS STS Caller Identity Details Using SQL \ No newline at end of file diff --git a/queries/aws_sts_caller_identity_3.yaml b/queries/aws_sts_caller_identity_3.yaml old mode 100755 new mode 100644 index 099e8645b..51bab4590 --- a/queries/aws_sts_caller_identity_3.yaml +++ b/queries/aws_sts_caller_identity_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Security Token Service Caller Identity to retrieve - details about the IAM user or role whose credentials are used to call the operation. +Description: Allows users to query AWS Security Token Service Caller Identity to retrieve details about the IAM user or role whose credentials are used to call the operation. ID: aws_sts_caller_identity_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n caller_identity.arn,\n caller_identity.user_id,\n caller_identity.title,\n\ - \ caller_identity.account_id,\n u.name,\n u.create_date,\n u.password_last_used\n\ - from\n aws_sts_caller_identity as caller_identity,\n aws_iam_user as u\nwhere\n\ - \ caller_identity.user_id = u.user_id\n and caller_identity.arn like '%federated%';" + QueryToExecute: | + SELECT + caller_identity.arn, + caller_identity.user_id, + caller_identity.title, + caller_identity.account_id, + u.name, + u.create_date, + u.password_last_used + FROM + aws_sts_caller_identity AS caller_identity, + aws_iam_user AS u + WHERE + caller_identity.user_id = u.user_id + AND caller_identity.arn LIKE '%federated%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Security Token Service -Title: Find AWS Security Token Service Caller Identity Details + - Security Token Service +Title: Find AWS Security Token Service Caller Identity Details \ No newline at end of file diff --git a/queries/aws_tagging_resource_1.yaml b/queries/aws_tagging_resource_1.yaml old mode 100755 new mode 100644 index 0e72eadd7..f95988a54 --- a/queries/aws_tagging_resource_1.yaml +++ b/queries/aws_tagging_resource_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Resource Tagging API to get details about resources - and their associated tags. +Description: Allows users to query AWS Resource Tagging API to get details about resources and their associated tags. ID: aws_tagging_resource_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n compliance_status,\n tags,\n region\n\ - from\n aws_tagging_resource;" + QueryToExecute: | + SELECT + name, + arn, + compliance_status, + tags, + region + FROM + aws_tagging_resource; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Resource Tagging API -Title: List AWS Resource Tagging API Details with SQL + - AWS Resource Tagging API +Title: List AWS Resource Tagging API Details with SQL \ No newline at end of file diff --git a/queries/aws_tagging_resource_2.yaml b/queries/aws_tagging_resource_2.yaml old mode 100755 new mode 100644 index 0470844fd..7a644b29c --- a/queries/aws_tagging_resource_2.yaml +++ b/queries/aws_tagging_resource_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Resource Tagging API to get details about resources - and their associated tags. +Description: Allows users to query AWS Resource Tagging API to get details about resources and their associated tags. ID: aws_tagging_resource_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n tags,\n compliance_status\nfrom\n \ - \ aws_tagging_resource\nwhere\n compliance_status;" + QueryToExecute: | + SELECT + name, + arn, + tags, + compliance_status + FROM + aws_tagging_resource + WHERE + compliance_status; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Resource Tagging API -Title: List all AWS Resource Tagging API details with SQL + - Resource Tagging API +Title: List all AWS Resource Tagging API details with SQL \ No newline at end of file diff --git a/queries/aws_timestreamwrite_database_1.yaml b/queries/aws_timestreamwrite_database_1.yaml old mode 100755 new mode 100644 index 94bc8dd00..632694f5b --- a/queries/aws_timestreamwrite_database_1.yaml +++ b/queries/aws_timestreamwrite_database_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Timestream databases, providing detailed information - on database configurations, statuses, and associated tables. +Description: Allows users to query AWS Timestream databases, providing detailed information on database configurations, statuses, and associated tables. ID: aws_timestreamwrite_database_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n arn,\n creation_time,\n region,\n\ - \ kms_key_id\nfrom\n aws_timestreamwrite_database;" + QueryToExecute: | + SELECT + database_name, + arn, + creation_time, + region, + kms_key_id + FROM + aws_timestreamwrite_database; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream database configurations and statuses + - Timestream +Title: List all AWS Timestream database configurations and statuses \ No newline at end of file diff --git a/queries/aws_timestreamwrite_database_2.yaml b/queries/aws_timestreamwrite_database_2.yaml old mode 100755 new mode 100644 index 79dceb18e..37b9140b8 --- a/queries/aws_timestreamwrite_database_2.yaml +++ b/queries/aws_timestreamwrite_database_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Timestream databases, providing detailed information - on database configurations, statuses, and associated tables. +Description: Allows users to query AWS Timestream databases, providing detailed information on database configurations, statuses, and associated tables. ID: aws_timestreamwrite_database_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n arn,\n kms_key_id\nfrom\n aws_timestreamwrite_database\n\ - where\n kms_key_id = 'your-kms-key-id';" + QueryToExecute: | + SELECT + database_name, + arn, + kms_key_id + FROM + aws_timestreamwrite_database + WHERE + kms_key_id = 'your-kms-key-id'; Tags: cloud_data_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: Find all AWS Timestream Databases with Configurations + - Timestream +Title: Find all AWS Timestream Databases with Configurations \ No newline at end of file diff --git a/queries/aws_timestreamwrite_database_3.yaml b/queries/aws_timestreamwrite_database_3.yaml old mode 100755 new mode 100644 index de7c7c1e3..e8f46fa1a --- a/queries/aws_timestreamwrite_database_3.yaml +++ b/queries/aws_timestreamwrite_database_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Timestream databases, providing detailed information - on database configurations, statuses, and associated tables. +Description: Allows users to query AWS Timestream databases, providing detailed information on database configurations, statuses, and associated tables. ID: aws_timestreamwrite_database_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n arn,\n creation_time\nfrom\n aws_timestreamwrite_database\n\ - order by\n creation_time desc;" + QueryToExecute: | + SELECT + database_name, + arn, + creation_time + FROM + aws_timestreamwrite_database + ORDER BY + creation_time DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream Database Configurations, Statuses + - Timestream +Title: List all AWS Timestream Database Configurations, Statuses \ No newline at end of file diff --git a/queries/aws_timestreamwrite_database_4.yaml b/queries/aws_timestreamwrite_database_4.yaml old mode 100755 new mode 100644 index 7970a8c27..d183cc194 --- a/queries/aws_timestreamwrite_database_4.yaml +++ b/queries/aws_timestreamwrite_database_4.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Timestream databases, providing detailed information - on database configurations, statuses, and associated tables. +Description: Allows users to query AWS Timestream databases, providing detailed information on database configurations, statuses, and associated tables. ID: aws_timestreamwrite_database_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n arn,\n table_count\nfrom\n aws_timestreamwrite_database\n\ - order by\n table_count desc;" + QueryToExecute: | + SELECT + database_name, + arn, + table_count + FROM + aws_timestreamwrite_database + ORDER BY + table_count DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream Databases and Table Counts + - Timestream +Title: List all AWS Timestream Databases and Table Counts \ No newline at end of file diff --git a/queries/aws_timestreamwrite_database_5.yaml b/queries/aws_timestreamwrite_database_5.yaml old mode 100755 new mode 100644 index 91f6643d2..86bbae74a --- a/queries/aws_timestreamwrite_database_5.yaml +++ b/queries/aws_timestreamwrite_database_5.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Timestream databases, providing detailed information - on database configurations, statuses, and associated tables. +Description: Allows users to query AWS Timestream databases, providing detailed information on database configurations, statuses, and associated tables. ID: aws_timestreamwrite_database_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n database_name,\n arn,\n last_updated_time,\n region\n\ - from\n aws_timestreamwrite_database;" + QueryToExecute: | + SELECT + database_name, + arn, + last_updated_time, + region + FROM + aws_timestreamwrite_database; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream Databases with Details + - Timestream +Title: List all AWS Timestream Databases with Details \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_1.yaml b/queries/aws_timestreamwrite_table_1.yaml old mode 100755 new mode 100644 index e39ec6382..493d4635d --- a/queries/aws_timestreamwrite_table_1.yaml +++ b/queries/aws_timestreamwrite_table_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n table_status,\n creation_time,\n\ - \ last_updated_time,\n region\nfrom\n aws_timestreamwrite_table;" + QueryToExecute: | + SELECT + table_name, + arn, + table_status, + creation_time, + last_updated_time, + region + FROM + aws_timestreamwrite_table; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream Tables with Configurations and Statuses + - Timestream +Title: List all AWS Timestream Tables with Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_2.yaml b/queries/aws_timestreamwrite_table_2.yaml old mode 100755 new mode 100644 index 44b37a3ee..de33f79bb --- a/queries/aws_timestreamwrite_table_2.yaml +++ b/queries/aws_timestreamwrite_table_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n table_status\nfrom\n aws_timestreamwrite_table\n\ - where\n table_status = 'ACTIVE';" + QueryToExecute: | + SELECT + table_name, + arn, + table_status + FROM + aws_timestreamwrite_table + WHERE + table_status = 'ACTIVE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List AWS Timestream Table Configurations and Statuses + - Timestream +Title: List AWS Timestream Table Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_3.yaml b/queries/aws_timestreamwrite_table_3.yaml old mode 100755 new mode 100644 index 1829e0ddc..c4c741138 --- a/queries/aws_timestreamwrite_table_3.yaml +++ b/queries/aws_timestreamwrite_table_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n retention_properties\nfrom\n \ - \ aws_timestreamwrite_table\nwhere\n retention_properties ->> 'MemoryStoreRetentionPeriodInHours'\ - \ = '24'\n and retention_properties ->> 'MagneticStoreRetentionPeriodInDays'\ - \ = '7';" + QueryToExecute: | + SELECT + table_name, + arn, + retention_properties + FROM + aws_timestreamwrite_table + WHERE + retention_properties ->> 'MemoryStoreRetentionPeriodInHours' = '24' + AND retention_properties ->> 'MagneticStoreRetentionPeriodInDays' = '7'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: Find AWS Timestream Table Configurations and Statuses + - Timestream +Title: Find AWS Timestream Table Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_4.yaml b/queries/aws_timestreamwrite_table_4.yaml old mode 100755 new mode 100644 index 5ead69ddf..e8237f225 --- a/queries/aws_timestreamwrite_table_4.yaml +++ b/queries/aws_timestreamwrite_table_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n magnetic_store_write_properties\n\ - from\n aws_timestreamwrite_table\nwhere\n magnetic_store_write_properties ->>\ - \ 'EnableMagneticStoreWrites' = 'true';" + QueryToExecute: | + SELECT + table_name, + arn, + magnetic_store_write_properties + FROM + aws_timestreamwrite_table + WHERE + magnetic_store_write_properties ->> 'EnableMagneticStoreWrites' = 'true'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List AWS Timestream Tables with Specific Write Properties + - Timestream +Title: List AWS Timestream Tables with Specific Write Properties \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_5.yaml b/queries/aws_timestreamwrite_table_5.yaml old mode 100755 new mode 100644 index 1851570d6..17a45452d --- a/queries/aws_timestreamwrite_table_5.yaml +++ b/queries/aws_timestreamwrite_table_5.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n creation_time\nfrom\n aws_timestreamwrite_table\n\ - order by\n creation_time desc;" + QueryToExecute: | + SELECT + table_name, + arn, + creation_time + FROM + aws_timestreamwrite_table + ORDER BY + creation_time DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List all AWS Timestream Tables and Configurations + - Timestream +Title: List all AWS Timestream Tables and Configurations \ No newline at end of file diff --git a/queries/aws_timestreamwrite_table_6.yaml b/queries/aws_timestreamwrite_table_6.yaml old mode 100755 new mode 100644 index 75afa98ce..0b01065ad --- a/queries/aws_timestreamwrite_table_6.yaml +++ b/queries/aws_timestreamwrite_table_6.yaml @@ -1,19 +1,24 @@ -Description: Allows users to query AWS Timestream tables, providing detailed information - on table configurations, statuses, and retention properties. +Description: Allows users to query AWS Timestream tables, providing detailed information on table configurations, statuses, and retention properties. ID: aws_timestreamwrite_table_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n table_name,\n arn,\n schema\nfrom\n aws_timestreamwrite_table;" + QueryToExecute: | + SELECT + table_name, + arn, + schema + FROM + aws_timestreamwrite_table; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Timestream -Title: List All AWS Timestream Table Configurations and Statuses + - Timestream +Title: List All AWS Timestream Table Configurations and Statuses \ No newline at end of file diff --git a/queries/aws_top_services_by_daily_cost_usage.yaml b/queries/aws_top_services_by_daily_cost_usage.yaml new file mode 100644 index 000000000..892e84017 --- /dev/null +++ b/queries/aws_top_services_by_daily_cost_usage.yaml @@ -0,0 +1,25 @@ +Description: Allows users to query AWS Cost Explorer Service daily usage type to fetch detailed data about AWS service usage and costs. +ID: aws_cost_by_service_usage_type_daily_3 +IntegrationType: + - aws_cloud_account +Query: + Engine: CloudQL-v0.0.1 + ListOfTables: [] + Parameters: [] + PrimaryTable: null + QueryToExecute: | + SELECT + service, + usage_type, + SUM(unblended_cost_amount)::NUMERIC::MONEY AS sum, + AVG(unblended_cost_amount)::NUMERIC::MONEY AS average + FROM + aws_cost_by_service_usage_type_daily + GROUP BY + service, + usage_type + ORDER BY + average DESC + LIMIT 10; +Tags: {} +Title: 'Top 10 AWS Services by Daily Cost & Usage' \ No newline at end of file diff --git a/queries/aws_transfer_server_1.yaml b/queries/aws_transfer_server_1.yaml old mode 100755 new mode 100644 index b16bb5a70..da1bcb2c9 --- a/queries/aws_transfer_server_1.yaml +++ b/queries/aws_transfer_server_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n domain,\n identity_provider_type,\n endpoint_type\n\ - from\n aws_transfer_server;" + QueryToExecute: | + SELECT + server_id, + domain, + identity_provider_type, + endpoint_type + FROM + aws_transfer_server; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: Find all AWS SFTP Servers and their Details + - AWS Transfer +Title: Find all AWS SFTP Servers and their Details \ No newline at end of file diff --git a/queries/aws_transfer_server_2.yaml b/queries/aws_transfer_server_2.yaml old mode 100755 new mode 100644 index 6226add8a..d08179b8e --- a/queries/aws_transfer_server_2.yaml +++ b/queries/aws_transfer_server_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n domain,\n identity_provider_type,\n endpoint_type,\n\ - \ state\nfrom\n aws_transfer_server\nwhere\n state = 'OFFLINE';" + QueryToExecute: | + SELECT + server_id, + domain, + identity_provider_type, + endpoint_type, + state + FROM + aws_transfer_server + WHERE + state = 'OFFLINE'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: List all Offline SFTP Servers in AWS Transfer + - AWS Transfer +Title: List all Offline SFTP Servers in AWS Transfer \ No newline at end of file diff --git a/queries/aws_transfer_server_3.yaml b/queries/aws_transfer_server_3.yaml old mode 100755 new mode 100644 index b93a0b063..588cb9d58 --- a/queries/aws_transfer_server_3.yaml +++ b/queries/aws_transfer_server_3.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n user_count\nfrom\n aws_transfer_server\n\ - order by\n user_count desc;" + QueryToExecute: | + SELECT + server_id, + user_count + FROM + aws_transfer_server + ORDER BY + user_count DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: Find all SFTP Servers and User Count in AWS Transfer + - AWS Transfer +Title: Find all SFTP Servers and User Count in AWS Transfer \ No newline at end of file diff --git a/queries/aws_transfer_server_4.yaml b/queries/aws_transfer_server_4.yaml old mode 100755 new mode 100644 index fae26b1be..b3575990c --- a/queries/aws_transfer_server_4.yaml +++ b/queries/aws_transfer_server_4.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n domain,\n identity_provider_type,\n endpoint_type,\n\ - \ workflow_details ->> 'OnUpload' as on_upload_workflow\nfrom\n aws_transfer_server;" + QueryToExecute: | + SELECT + server_id, + domain, + identity_provider_type, + endpoint_type, + workflow_details ->> 'OnUpload' AS on_upload_workflow + FROM + aws_transfer_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: List all AWS SFTP Servers and Details + - AWS Transfer +Title: List all AWS SFTP Servers and Details \ No newline at end of file diff --git a/queries/aws_transfer_server_5.yaml b/queries/aws_transfer_server_5.yaml old mode 100755 new mode 100644 index 9ab3125da..ef763c819 --- a/queries/aws_transfer_server_5.yaml +++ b/queries/aws_transfer_server_5.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n domain,\n identity_provider_type,\n endpoint_type,\n\ - \ structured_log_destinations\nfrom\n aws_transfer_server;" + QueryToExecute: | + SELECT + server_id, + domain, + identity_provider_type, + endpoint_type, + structured_log_destinations + FROM + aws_transfer_server; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer for SFTP -Title: Find all AWS Transfer SFTP Servers and Details + - AWS Transfer for SFTP +Title: Find all AWS Transfer SFTP Servers and Details \ No newline at end of file diff --git a/queries/aws_transfer_server_6.yaml b/queries/aws_transfer_server_6.yaml old mode 100755 new mode 100644 index 4d895a4d8..ad245c92c --- a/queries/aws_transfer_server_6.yaml +++ b/queries/aws_transfer_server_6.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed - information about SFTP servers in their AWS account. +Description: Allows users to query AWS Transfer for SFTP Servers and retrieve detailed information about SFTP servers in their AWS account. ID: aws_transfer_server_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.server_id,\n c.certificate_arn,\n c.status as certificate_status,\n\ - \ c.key_algorithm\nfrom\n aws_transfer_server as s,\n aws_acm_certificate as\ - \ c\nwhere\n s.certificate = c.certificate_arn;" + QueryToExecute: | + SELECT + s.server_id, + c.certificate_arn, + c.status AS certificate_status, + c.key_algorithm + FROM + aws_transfer_server AS s, + aws_acm_certificate AS c + WHERE + s.certificate = c.certificate_arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer for SFTP -Title: Find all SFTP Servers in AWS Transfer + - AWS Transfer for SFTP +Title: Find all SFTP Servers in AWS Transfer \ No newline at end of file diff --git a/queries/aws_transfer_user_1.yaml b/queries/aws_transfer_user_1.yaml old mode 100755 new mode 100644 index 8f712e059..ad0bab2a3 --- a/queries/aws_transfer_user_1.yaml +++ b/queries/aws_transfer_user_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Transfer for users in a server, equivalent - to list/describe user functions. +Description: Allows users to query AWS Transfer for users in a server, equivalent to list/describe user functions. ID: aws_transfer_user_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n server_id,\n user_name\nfrom\n aws_transfer_user;\n\ - where\n server_id = \"s-xxxxxxxxxxxxxxxxx\";" + QueryToExecute: | + SELECT + arn, + server_id, + user_name + FROM + aws_transfer_user + WHERE + server_id = "s-xxxxxxxxxxxxxxxxx"; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: List all Users in AWS Transfer Server + - AWS Transfer +Title: List all Users in AWS Transfer Server \ No newline at end of file diff --git a/queries/aws_transfer_user_2.yaml b/queries/aws_transfer_user_2.yaml old mode 100755 new mode 100644 index 8fe3555a4..e753cc43b --- a/queries/aws_transfer_user_2.yaml +++ b/queries/aws_transfer_user_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Transfer for users in a server, equivalent - to list/describe user functions. +Description: Allows users to query AWS Transfer for users in a server, equivalent to list/describe user functions. ID: aws_transfer_user_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n arn,\n server_id,\n user_name,\n ssh_public_key_count\n\ - from\n aws_transfer_user;\nwhere\n server_id = \"s-xxxxxxxxxxxxxxxxx\"\norder\ - \ by\n ssh_public_key_count desc;" + QueryToExecute: | + SELECT + arn, + server_id, + user_name, + ssh_public_key_count + FROM + aws_transfer_user + WHERE + server_id = "s-xxxxxxxxxxxxxxxxx" + ORDER BY + ssh_public_key_count DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: List all AWS Transfer users in a server + - AWS Transfer +Title: List all AWS Transfer users in a server \ No newline at end of file diff --git a/queries/aws_transfer_user_3.yaml b/queries/aws_transfer_user_3.yaml old mode 100755 new mode 100644 index f558fff48..5366f7b13 --- a/queries/aws_transfer_user_3.yaml +++ b/queries/aws_transfer_user_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS Transfer for users in a server, equivalent - to list/describe user functions. +Description: Allows users to query AWS Transfer for users in a server, equivalent to list/describe user functions. ID: aws_transfer_user_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n server_id,\n user_name,\n arn\nfrom\n aws_transfer_user\n\ - where\n server_id in (select server_id from aws_transfer_server)\nand\n user_name\ - \ = 'my_user_to_search';" + QueryToExecute: | + SELECT + server_id, + user_name, + arn + FROM + aws_transfer_user + WHERE + server_id IN (SELECT server_id FROM aws_transfer_server) + AND + user_name = 'my_user_to_search'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: Find all AWS Transfer users within a server using SQL + - AWS Transfer +Title: Find all AWS Transfer users within a server using SQL \ No newline at end of file diff --git a/queries/aws_transfer_user_4.yaml b/queries/aws_transfer_user_4.yaml old mode 100755 new mode 100644 index bd58d50ae..17785ed7a --- a/queries/aws_transfer_user_4.yaml +++ b/queries/aws_transfer_user_4.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Transfer for users in a server, equivalent - to list/describe user functions. +Description: Allows users to query AWS Transfer for users in a server, equivalent to list/describe user functions. ID: aws_transfer_user_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(*) as total_users,\n server_id\nfrom\n aws_transfer_user\n\ - group by\n server_id\norder by\n total_users desc;" + QueryToExecute: | + SELECT + COUNT(*) AS total_users, + server_id + FROM + aws_transfer_user + GROUP BY + server_id + ORDER BY + total_users DESC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Transfer -Title: List all AWS Transfer users in a server + - AWS Transfer +Title: List all AWS Transfer users in a server \ No newline at end of file diff --git a/queries/aws_trusted_advisor_check_summary_1.yaml b/queries/aws_trusted_advisor_check_summary_1.yaml old mode 100755 new mode 100644 index 808081a79..d6a3b438b --- a/queries/aws_trusted_advisor_check_summary_1.yaml +++ b/queries/aws_trusted_advisor_check_summary_1.yaml @@ -1,29 +1,36 @@ -Description: A Trusted Advisor check is a specific evaluation or assessment performed - by Trusted Advisor in different categories. These checks cover various areas, including - cost optimization, security, performance, and fault tolerance. Each check examines - a specific aspect of your AWS resources and provides recommendations for improvement. +Description: A Trusted Advisor check is a specific evaluation or assessment performed by Trusted Advisor in different categories. These checks cover various areas, including cost optimization, security, performance, and fault tolerance. Each check examines a specific aspect of your AWS resources and provides recommendations for improvement. ID: aws_trusted_advisor_check_summary_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n check_id,\n category,\n description,\n status,\n\ - \ timestamp,\n resources_flagged\nfrom\n aws_trusted_advisor_check_summary\n\ - where\n language = 'en';" + QueryToExecute: | + SELECT + name, + check_id, + category, + description, + status, + timestamp, + resources_flagged + FROM + aws_trusted_advisor_check_summary + WHERE + language = 'en'; Tags: cloud_data_security: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Trusted Advisor -Title: List Trusted Advisor Check Summaries in AWS + - Trusted Advisor +Title: List Trusted Advisor Check Summaries in AWS \ No newline at end of file diff --git a/queries/aws_trusted_advisor_check_summary_2.yaml b/queries/aws_trusted_advisor_check_summary_2.yaml old mode 100755 new mode 100644 index 527268129..4de74dc83 --- a/queries/aws_trusted_advisor_check_summary_2.yaml +++ b/queries/aws_trusted_advisor_check_summary_2.yaml @@ -1,26 +1,32 @@ -Description: A Trusted Advisor check is a specific evaluation or assessment performed - by Trusted Advisor in different categories. These checks cover various areas, including - cost optimization, security, performance, and fault tolerance. Each check examines - a specific aspect of your AWS resources and provides recommendations for improvement. +Description: A Trusted Advisor check is a specific evaluation or assessment performed by Trusted Advisor in different categories. These checks cover various areas, including cost optimization, security, performance, and fault tolerance. Each check examines a specific aspect of your AWS resources and provides recommendations for improvement. ID: aws_trusted_advisor_check_summary_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n check_id,\n category,\n status\nfrom\n aws_trusted_advisor_check_summary\n\ - where\n language = 'en'\nand\n status = 'error';" + QueryToExecute: | + SELECT + name, + check_id, + category, + status + FROM + aws_trusted_advisor_check_summary + WHERE + language = 'en' + AND status = 'error'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Trusted Advisor -Title: List Trusted Advisor Check Summaries with Errors in AWS + - Trusted Advisor +Title: List Trusted Advisor Check Summaries with Errors in AWS \ No newline at end of file diff --git a/queries/aws_trusted_advisor_check_summary_3.yaml b/queries/aws_trusted_advisor_check_summary_3.yaml old mode 100755 new mode 100644 index 067aa8ba4..ead1313a5 --- a/queries/aws_trusted_advisor_check_summary_3.yaml +++ b/queries/aws_trusted_advisor_check_summary_3.yaml @@ -1,23 +1,30 @@ -Description: A Trusted Advisor check is a specific evaluation or assessment performed - by Trusted Advisor in different categories. These checks cover various areas, including - cost optimization, security, performance, and fault tolerance. Each check examines - a specific aspect of your AWS resources and provides recommendations for improvement. +Description: A Trusted Advisor check is a specific evaluation or assessment performed by Trusted Advisor in different categories. These checks cover various areas, including cost optimization, security, performance, and fault tolerance. Each check examines a specific aspect of your AWS resources and provides recommendations for improvement. ID: aws_trusted_advisor_check_summary_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n check_id,\n description,\n status,\n timestamp\n\ - from\n aws_trusted_advisor_check_summary\nwhere\n language = 'en'\nand\n timestamp\ - \ >= now() - interval '5 day';" + QueryToExecute: | + SELECT + name, + check_id, + description, + status, + timestamp + FROM + aws_trusted_advisor_check_summary + WHERE + language = 'en' + AND + timestamp >= NOW() - INTERVAL '5 day'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Trusted Advisor -Title: List Trusted Advisor Check Summaries for AWS + - Trusted Advisor +Title: List Trusted Advisor Check Summaries for AWS \ No newline at end of file diff --git a/queries/aws_trusted_advisor_check_summary_4.yaml b/queries/aws_trusted_advisor_check_summary_4.yaml old mode 100755 new mode 100644 index 1e4917e3a..c23f91e7e --- a/queries/aws_trusted_advisor_check_summary_4.yaml +++ b/queries/aws_trusted_advisor_check_summary_4.yaml @@ -1,27 +1,33 @@ -Description: A Trusted Advisor check is a specific evaluation or assessment performed - by Trusted Advisor in different categories. These checks cover various areas, including - cost optimization, security, performance, and fault tolerance. Each check examines - a specific aspect of your AWS resources and provides recommendations for improvement. +Description: A Trusted Advisor check is a specific evaluation or assessment performed by Trusted Advisor in different categories. These checks cover various areas, including cost optimization, security, performance, and fault tolerance. Each check examines a specific aspect of your AWS resources and provides recommendations for improvement. ID: aws_trusted_advisor_check_summary_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n check_id,\n resources_flagged,\n resources_ignored,\n\ - \ resources_processed,\n resources_suppressed\nfrom\n aws_trusted_advisor_check_summary\n\ - where\n language = 'en';" + QueryToExecute: | + SELECT + name, + check_id, + resources_flagged, + resources_ignored, + resources_processed, + resources_suppressed + FROM + aws_trusted_advisor_check_summary + WHERE + language = 'en'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_finops: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Trusted Advisor -Title: List all AWS Trusted Advisor Check Summaries + - Trusted Advisor +Title: List all AWS Trusted Advisor Check Summaries \ No newline at end of file diff --git a/queries/aws_upcoming_health_events.yaml b/queries/aws_upcoming_health_events.yaml new file mode 100644 index 000000000..e853bb6f5 --- /dev/null +++ b/queries/aws_upcoming_health_events.yaml @@ -0,0 +1,25 @@ +Description: Allows users to query AWS Health Events to retrieve information about events that affect your AWS services and accounts. +ID: aws_health_event_2 +IntegrationType: + - aws_cloud_account +Query: + Engine: CloudQL-v0.0.1 + ListOfTables: [] + Parameters: [] + PrimaryTable: null + QueryToExecute: | + SELECT + arn, + start_time, + end_time, + event_type_category, + event_type_code, + event_scope_code, + status_code, + service + FROM + aws_health_event + WHERE + status_code = 'upcoming'; +Tags: {} +Title: 'Upcoming AWS Health Events' \ No newline at end of file diff --git a/queries/aws_vpc_1.yaml b/queries/aws_vpc_1.yaml old mode 100755 new mode 100644 index 1bbf412be..4141ee8ff --- a/queries/aws_vpc_1.yaml +++ b/queries/aws_vpc_1.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query VPCs within AWS. It provides information about - each VPC''s configuration, including its ID, state, CIDR block, and whether it is - the default VPC. +Description: Allows users to query VPCs within AWS. It provides information about each VPC's configuration, including its ID, state, CIDR block, and whether it is the default VPC. ID: aws_vpc_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n is_default,\n cidr_block,\n state,\n account_id,\n\ - \ region\nfrom\n aws_vpc\nwhere\n is_default;" + QueryToExecute: | + SELECT + vpc_id, + is_default, + cidr_block, + state, + account_id, + region + FROM + aws_vpc + WHERE + is_default; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPCs and their configurations + - VPC +Title: List all AWS VPCs and their configurations \ No newline at end of file diff --git a/queries/aws_vpc_2.yaml b/queries/aws_vpc_2.yaml old mode 100755 new mode 100644 index c3565f20a..d65ee49b8 --- a/queries/aws_vpc_2.yaml +++ b/queries/aws_vpc_2.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query VPCs within AWS. It provides information about - each VPC''s configuration, including its ID, state, CIDR block, and whether it is - the default VPC. +Description: Allows users to query VPCs within AWS. It provides information about each VPC's configuration, including its ID, state, CIDR block, and whether it is the default VPC. ID: aws_vpc_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n cidr_block,\n host(cidr_block),\n broadcast(cidr_block),\n\ - \ netmask(cidr_block),\n network(cidr_block)\nfrom\n aws_vpc;" + QueryToExecute: | + SELECT + vpc_id, + cidr_block, + HOST(cidr_block), + BROADCAST(cidr_block), + NETMASK(cidr_block), + NETWORK(cidr_block) + FROM + aws_vpc; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPCs and their configurations + - VPC +Title: List all AWS VPCs and their configurations \ No newline at end of file diff --git a/queries/aws_vpc_3.yaml b/queries/aws_vpc_3.yaml old mode 100755 new mode 100644 index 0d7aab2cb..6471c3116 --- a/queries/aws_vpc_3.yaml +++ b/queries/aws_vpc_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query VPCs within AWS. It provides information about - each VPC''s configuration, including its ID, state, CIDR block, and whether it is - the default VPC. +Description: Allows users to query VPCs within AWS. It provides information about each VPC's configuration, including its ID, state, CIDR block, and whether it is the default VPC. ID: aws_vpc_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n cidr_block,\n state,\n region\nfrom\n aws_vpc\n\ - where\n not cidr_block <<= '10.0.0.0/8'\n and not cidr_block <<= '192.168.0.0/16'\n\ - \ and not cidr_block <<= '172.16.0.0/12';" + QueryToExecute: | + SELECT + vpc_id, + cidr_block, + state, + region + FROM + aws_vpc + WHERE + NOT cidr_block <<= '10.0.0.0/8' + AND NOT cidr_block <<= '192.168.0.0/16' + AND NOT cidr_block <<= '172.16.0.0/12'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find all AWS VPCs and Their Configurations + - VPC +Title: Find all AWS VPCs and Their Configurations \ No newline at end of file diff --git a/queries/aws_vpc_customer_gateway_1.yaml b/queries/aws_vpc_customer_gateway_1.yaml old mode 100755 new mode 100644 index ebc882cb8..1b0f7e135 --- a/queries/aws_vpc_customer_gateway_1.yaml +++ b/queries/aws_vpc_customer_gateway_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS VPC Customer Gateway, providing detailed information - about each Customer Gateway in a Virtual Private Cloud (VPC). +Description: Allows users to query AWS VPC Customer Gateway, providing detailed information about each Customer Gateway in a Virtual Private Cloud (VPC). ID: aws_vpc_customer_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n customer_gateway_id,\n type,\n state,\n bgp_asn,\n\ - \ certificate_arn,\n device_name,\n ip_address\nfrom\n aws_vpc_customer_gateway;" + QueryToExecute: | + SELECT + customer_gateway_id, + type, + state, + bgp_asn, + certificate_arn, + device_name, + ip_address + FROM + aws_vpc_customer_gateway; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find all Customer Gateways in AWS VPC + - VPC +Title: Find all Customer Gateways in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_customer_gateway_2.yaml b/queries/aws_vpc_customer_gateway_2.yaml old mode 100755 new mode 100644 index 2a04a8221..f7f3d3f45 --- a/queries/aws_vpc_customer_gateway_2.yaml +++ b/queries/aws_vpc_customer_gateway_2.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS VPC Customer Gateway, providing detailed information - about each Customer Gateway in a Virtual Private Cloud (VPC). +Description: Allows users to query AWS VPC Customer Gateway, providing detailed information about each Customer Gateway in a Virtual Private Cloud (VPC). ID: aws_vpc_customer_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n type,\n count(customer_gateway_id) as customer_gateway_id_count\n\ - from\n aws_vpc_customer_gateway\ngroup by\n type;" + QueryToExecute: | + SELECT + type, + COUNT(customer_gateway_id) AS customer_gateway_id_count + FROM + aws_vpc_customer_gateway + GROUP BY + type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Virtual Private Cloud -Title: List all AWS VPC Customer Gateway details in VPC + - AWS Virtual Private Cloud +Title: List all AWS VPC Customer Gateway details in VPC \ No newline at end of file diff --git a/queries/aws_vpc_dhcp_options_1.yaml b/queries/aws_vpc_dhcp_options_1.yaml old mode 100755 new mode 100644 index f599366ff..99f92f5ed --- a/queries/aws_vpc_dhcp_options_1.yaml +++ b/queries/aws_vpc_dhcp_options_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query DHCP Options associated with Virtual Private Cloud - (VPC) in AWS. +Description: Allows users to query DHCP Options associated with Virtual Private Cloud (VPC) in AWS. ID: aws_vpc_dhcp_options_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n dhcp_options_id,\n domain_name,\n domain_name_servers,\n\ - \ netbios_name_servers,\n netbios_node_type,\n ntp_servers\nfrom\n aws_vpc_dhcp_options;" + QueryToExecute: | + SELECT + dhcp_options_id, + domain_name, + domain_name_servers, + netbios_name_servers, + netbios_node_type, + ntp_servers + FROM + aws_vpc_dhcp_options; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud -Title: List all DHCP Options associated with AWS VPC + - Virtual Private Cloud +Title: List all DHCP Options associated with AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_dhcp_options_2.yaml b/queries/aws_vpc_dhcp_options_2.yaml old mode 100755 new mode 100644 index c833cd1f4..bff530595 --- a/queries/aws_vpc_dhcp_options_2.yaml +++ b/queries/aws_vpc_dhcp_options_2.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query DHCP Options associated with Virtual Private Cloud - (VPC) in AWS. +Description: Allows users to query DHCP Options associated with Virtual Private Cloud (VPC) in AWS. ID: aws_vpc_dhcp_options_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n dhcp_options_id,\n domain_name,\n domain_name_servers\n\ - from\n aws_vpc_dhcp_options\nwhere\n domain_name_servers ? 'AmazonProvidedDNS';" + QueryToExecute: | + SELECT + dhcp_options_id, + domain_name, + domain_name_servers + FROM + aws_vpc_dhcp_options + WHERE + domain_name_servers ? 'AmazonProvidedDNS'; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List AWS VPC DHCP Options with Domain Name Servers + - VPC +Title: List AWS VPC DHCP Options with Domain Name Servers \ No newline at end of file diff --git a/queries/aws_vpc_dhcp_options_3.yaml b/queries/aws_vpc_dhcp_options_3.yaml old mode 100755 new mode 100644 index b17a511bf..064ede921 --- a/queries/aws_vpc_dhcp_options_3.yaml +++ b/queries/aws_vpc_dhcp_options_3.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query DHCP Options associated with Virtual Private Cloud - (VPC) in AWS. +Description: Allows users to query DHCP Options associated with Virtual Private Cloud (VPC) in AWS. ID: aws_vpc_dhcp_options_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n dhcp_options_id,\n netbios_node_type\nfrom\n aws_vpc_dhcp_options\n\ - \ cross join jsonb_array_elements_text(netbios_node_type) as i\nwhere\n not\ - \ i.value :: int in (2);" + QueryToExecute: | + SELECT + dhcp_options_id, + netbios_node_type + FROM + aws_vpc_dhcp_options + CROSS JOIN + jsonb_array_elements_text(netbios_node_type) AS i + WHERE + NOT i.value::INT IN (2); Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC DHCP Options -Title: Find AWS VPC DHCP Options with Specific NetBIOS Types + - VPC DHCP Options +Title: Find AWS VPC DHCP Options with Specific NetBIOS Types \ No newline at end of file diff --git a/queries/aws_vpc_egress_only_internet_gateway_1.yaml b/queries/aws_vpc_egress_only_internet_gateway_1.yaml old mode 100755 new mode 100644 index f2ff33437..8f2c87ac9 --- a/queries/aws_vpc_egress_only_internet_gateway_1.yaml +++ b/queries/aws_vpc_egress_only_internet_gateway_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide - egress only access for IPv6 traffic from the VPC to the internet. +Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide egress only access for IPv6 traffic from the VPC to the internet. ID: aws_vpc_egress_only_internet_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n att ->> 'State' as state,\n att ->> 'VpcId' as\ - \ vpc_id,\n tags,\n region\nfrom\n aws_vpc_egress_only_internet_gateway\n \ - \ cross join jsonb_array_elements(attachments) as att;" + QueryToExecute: | + SELECT + id, + att ->> 'State' AS state, + att ->> 'VpcId' AS vpc_id, + tags, + region + FROM + aws_vpc_egress_only_internet_gateway + CROSS JOIN + jsonb_array_elements(attachments) AS att; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find all AWS VPC Egress Only Internet Gateways + - VPC +Title: Find all AWS VPC Egress Only Internet Gateways \ No newline at end of file diff --git a/queries/aws_vpc_egress_only_internet_gateway_2.yaml b/queries/aws_vpc_egress_only_internet_gateway_2.yaml old mode 100755 new mode 100644 index 8fda92d6b..d7c700d1b --- a/queries/aws_vpc_egress_only_internet_gateway_2.yaml +++ b/queries/aws_vpc_egress_only_internet_gateway_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide - egress only access for IPv6 traffic from the VPC to the internet. +Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide egress only access for IPv6 traffic from the VPC to the internet. ID: aws_vpc_egress_only_internet_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n attachments\nfrom\n aws_vpc_egress_only_internet_gateway\n\ - where\n attachments is null;" + QueryToExecute: | + SELECT + id, + attachments + FROM + aws_vpc_egress_only_internet_gateway + WHERE + attachments IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Egress Only Internet Gateways + - VPC +Title: Find AWS VPC Egress Only Internet Gateways \ No newline at end of file diff --git a/queries/aws_vpc_egress_only_internet_gateway_3.yaml b/queries/aws_vpc_egress_only_internet_gateway_3.yaml old mode 100755 new mode 100644 index 461fb522a..60dd3269e --- a/queries/aws_vpc_egress_only_internet_gateway_3.yaml +++ b/queries/aws_vpc_egress_only_internet_gateway_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide - egress only access for IPv6 traffic from the VPC to the internet. +Description: Allows users to query AWS VPC Egress Only Internet Gateways, which provide egress only access for IPv6 traffic from the VPC to the internet. ID: aws_vpc_egress_only_internet_gateway_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vig.id,\n vpc.is_default\nfrom\n aws_vpc_egress_only_internet_gateway\ - \ as vig\n cross join jsonb_array_elements(attachments) as i\n join aws_vpc\ - \ vpc on i ->> 'VpcId' = vpc.vpc_id\nwhere\n vpc.is_default = true;" + QueryToExecute: | + SELECT + vig.id, + vpc.is_default + FROM + aws_vpc_egress_only_internet_gateway AS vig + CROSS JOIN + jsonb_array_elements(attachments) AS i + JOIN + aws_vpc vpc ON i ->> 'VpcId' = vpc.vpc_id + WHERE + vpc.is_default = TRUE; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Egress Only Internet Gateways + - VPC +Title: Find AWS VPC Egress Only Internet Gateways \ No newline at end of file diff --git a/queries/aws_vpc_eip_1.yaml b/queries/aws_vpc_eip_1.yaml old mode 100755 new mode 100644 index 6858415bf..be6310813 --- a/queries/aws_vpc_eip_1.yaml +++ b/queries/aws_vpc_eip_1.yaml @@ -1,21 +1,28 @@ Description: Allows users to query AWS VPC Elastic IP Addresses ID: aws_vpc_eip_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n public_ip,\n domain association_id\nfrom\n aws_vpc_eip\n\ - where\n association_id is null;" + QueryToExecute: | + SELECT + public_ip, + domain, + association_id + FROM + aws_vpc_eip + WHERE + association_id IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: Find all AWS VPC Elastic IP Addresses + - Amazon VPC +Title: Find all AWS VPC Elastic IP Addresses \ No newline at end of file diff --git a/queries/aws_vpc_eip_2.yaml b/queries/aws_vpc_eip_2.yaml old mode 100755 new mode 100644 index eb8becd98..157dd1989 --- a/queries/aws_vpc_eip_2.yaml +++ b/queries/aws_vpc_eip_2.yaml @@ -1,21 +1,27 @@ Description: Allows users to query AWS VPC Elastic IP Addresses ID: aws_vpc_eip_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n public_ipv4_pool,\n count(public_ip) as elastic_ips\n\ - from\n aws_vpc_eip\ngroup by\n public_ipv4_pool;" + QueryToExecute: | + SELECT + public_ipv4_pool, + COUNT(public_ip) AS elastic_ips + FROM + aws_vpc_eip + GROUP BY + public_ipv4_pool; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Elastic IP Addresses + - VPC +Title: Find AWS VPC Elastic IP Addresses \ No newline at end of file diff --git a/queries/aws_vpc_eip_address_transfer_1.yaml b/queries/aws_vpc_eip_address_transfer_1.yaml old mode 100755 new mode 100644 index c32864c91..d864b13ea --- a/queries/aws_vpc_eip_address_transfer_1.yaml +++ b/queries/aws_vpc_eip_address_transfer_1.yaml @@ -1,21 +1,28 @@ Description: Allows users to query Elastic IP Address Transfers in AWS VPC. ID: aws_vpc_eip_address_transfer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n allocation_id,\n address_transfer_status,\n public_ip,\n\ - \ transfer_account_id,\n transfer_offer_accepted_timestamp\nfrom\n aws_vpc_eip_address_transfer;" + QueryToExecute: | + SELECT + allocation_id, + address_transfer_status, + public_ip, + transfer_account_id, + transfer_offer_accepted_timestamp + FROM + aws_vpc_eip_address_transfer; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Elastic IP Address Transfers + - VPC +Title: List all AWS VPC Elastic IP Address Transfers \ No newline at end of file diff --git a/queries/aws_vpc_eip_address_transfer_2.yaml b/queries/aws_vpc_eip_address_transfer_2.yaml old mode 100755 new mode 100644 index de5ed5ca4..4a76f3346 --- a/queries/aws_vpc_eip_address_transfer_2.yaml +++ b/queries/aws_vpc_eip_address_transfer_2.yaml @@ -1,20 +1,28 @@ Description: Allows users to query Elastic IP Address Transfers in AWS VPC. ID: aws_vpc_eip_address_transfer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n allocation_id,\n address_transfer_status,\n public_ip,\n\ - \ transfer_account_id,\n transfer_offer_accepted_timestamp\nfrom\n aws_vpc_eip_address_transfer\n\ - where\n transfer_offer_accepted_timestamp >= now() - interval '30' day;" + QueryToExecute: | + SELECT + allocation_id, + address_transfer_status, + public_ip, + transfer_account_id, + transfer_offer_accepted_timestamp + FROM + aws_vpc_eip_address_transfer + WHERE + transfer_offer_accepted_timestamp >= NOW() - INTERVAL '30' DAY; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all Elastic IP Address Transfers in AWS VPC + - VPC +Title: List all Elastic IP Address Transfers in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_eip_address_transfer_3.yaml b/queries/aws_vpc_eip_address_transfer_3.yaml old mode 100755 new mode 100644 index 99da496f5..f24914501 --- a/queries/aws_vpc_eip_address_transfer_3.yaml +++ b/queries/aws_vpc_eip_address_transfer_3.yaml @@ -1,22 +1,30 @@ Description: Allows users to query Elastic IP Address Transfers in AWS VPC. ID: aws_vpc_eip_address_transfer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n allocation_id,\n address_transfer_status,\n public_ip,\n\ - \ transfer_account_id,\n transfer_offer_expiration_timestamp\nfrom\n aws_vpc_eip_address_transfer\n\ - where\n transfer_offer_expiration_timestamp >= now() - interval '10' day;" + QueryToExecute: | + SELECT + allocation_id, + address_transfer_status, + public_ip, + transfer_account_id, + transfer_offer_expiration_timestamp + FROM + aws_vpc_eip_address_transfer + WHERE + transfer_offer_expiration_timestamp >= NOW() - INTERVAL '10' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS Elastic IP Address Transfers in VPC using SQL + - VPC +Title: Find AWS Elastic IP Address Transfers in VPC using SQL \ No newline at end of file diff --git a/queries/aws_vpc_eip_address_transfer_4.yaml b/queries/aws_vpc_eip_address_transfer_4.yaml old mode 100755 new mode 100644 index cfce9a3d2..4e4cadf59 --- a/queries/aws_vpc_eip_address_transfer_4.yaml +++ b/queries/aws_vpc_eip_address_transfer_4.yaml @@ -1,26 +1,39 @@ Description: Allows users to query Elastic IP Address Transfers in AWS VPC. ID: aws_vpc_eip_address_transfer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n t.allocation_id,\n t.address_transfer_status,\n t.transfer_account_id,\n\ - \ i.vpc_id,\n v.cidr_block,\n v.state,\n v.is_default\nfrom\n aws_vpc_eip\ - \ eip,\n aws_ec2_instance i,\n aws_vpc_eip_address_transfer t,\n aws_vpc v\n\ - where\n eip.instance_id = i.instance_id\n and t.allocation_id = eip.allocation_id\n\ - \ and v.vpc_id = i.vpc_id;" + QueryToExecute: | + SELECT + t.allocation_id, + t.address_transfer_status, + t.transfer_account_id, + i.vpc_id, + v.cidr_block, + v.state, + v.is_default + FROM + aws_vpc_eip eip, + aws_ec2_instance i, + aws_vpc_eip_address_transfer t, + aws_vpc v + WHERE + eip.instance_id = i.instance_id + AND t.allocation_id = eip.allocation_id + AND v.vpc_id = i.vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Elastic IP Address Transfers + - VPC +Title: Find AWS VPC Elastic IP Address Transfers \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_1.yaml b/queries/aws_vpc_endpoint_1.yaml old mode 100755 new mode 100644 index 25b848725..615bf3209 --- a/queries/aws_vpc_endpoint_1.yaml +++ b/queries/aws_vpc_endpoint_1.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS VPC Endpoints and retrieve information about - each endpoint''s configuration, type, status, and related resources such as network - interfaces, DNS entries, and security groups. +Description: Allows users to query AWS VPC Endpoints and retrieve information about each endpoint's configuration, type, status, and related resources such as network interfaces, DNS entries, and security groups. ID: aws_vpc_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_endpoint_id,\n vpc_id,\n service_name\nfrom\n \ - \ aws_vpc_endpoint;" + QueryToExecute: | + SELECT + vpc_endpoint_id, + vpc_id, + service_name + FROM + aws_vpc_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint -Title: List AWS VPC Endpoints with Configuration and Status + - VPC Endpoint +Title: List AWS VPC Endpoints with Configuration and Status \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_2.yaml b/queries/aws_vpc_endpoint_2.yaml old mode 100755 new mode 100644 index 95214d889..9dcc39c6f --- a/queries/aws_vpc_endpoint_2.yaml +++ b/queries/aws_vpc_endpoint_2.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query AWS VPC Endpoints and retrieve information about - each endpoint''s configuration, type, status, and related resources such as network - interfaces, DNS entries, and security groups. +Description: Allows users to query AWS VPC Endpoints and retrieve information about each endpoint's configuration, type, status, and related resources such as network interfaces, DNS entries, and security groups. ID: aws_vpc_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_endpoint_id,\n jsonb_array_length(subnet_ids) as\ - \ subnet_id_count\nfrom\n aws_vpc_endpoint;" + QueryToExecute: | + SELECT + vpc_endpoint_id, + JSONB_ARRAY_LENGTH(subnet_ids) AS subnet_id_count + FROM + aws_vpc_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint -Title: List all AWS VPC Endpoints and retrieve configuration details + - VPC Endpoint +Title: List all AWS VPC Endpoints and retrieve configuration details \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_3.yaml b/queries/aws_vpc_endpoint_3.yaml old mode 100755 new mode 100644 index 3ed136b41..76210d1cb --- a/queries/aws_vpc_endpoint_3.yaml +++ b/queries/aws_vpc_endpoint_3.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS VPC Endpoints and retrieve information about - each endpoint''s configuration, type, status, and related resources such as network - interfaces, DNS entries, and security groups. +Description: Allows users to query AWS VPC Endpoints and retrieve information about each endpoint's configuration, type, status, and related resources such as network interfaces, DNS entries, and security groups. ID: aws_vpc_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_endpoint_id,\n vpc_id,\n jsonb_array_elements(subnet_ids)\ - \ as subnet_ids,\n jsonb_array_elements(network_interface_ids) as network_interface_ids,\n\ - \ jsonb_array_elements(route_table_ids) as route_table_ids,\n sg ->> 'GroupName'\ - \ as sg_name\nfrom\n aws_vpc_endpoint\n cross join jsonb_array_elements(groups)\ - \ as sg;" + QueryToExecute: | + SELECT + vpc_endpoint_id, + vpc_id, + JSONB_ARRAY_ELEMENTS(subnet_ids) AS subnet_ids, + JSONB_ARRAY_ELEMENTS(network_interface_ids) AS network_interface_ids, + JSONB_ARRAY_ELEMENTS(route_table_ids) AS route_table_ids, + sg ->> 'GroupName' AS sg_name + FROM + aws_vpc_endpoint + CROSS JOIN JSONB_ARRAY_ELEMENTS(groups) AS sg; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Endpoints and Related Information + - VPC +Title: List all AWS VPC Endpoints and Related Information \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_4.yaml b/queries/aws_vpc_endpoint_4.yaml old mode 100755 new mode 100644 index 4e5a31cc4..ec473ef9c --- a/queries/aws_vpc_endpoint_4.yaml +++ b/queries/aws_vpc_endpoint_4.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS VPC Endpoints and retrieve information about - each endpoint''s configuration, type, status, and related resources such as network - interfaces, DNS entries, and security groups. +Description: Allows users to query AWS VPC Endpoints and retrieve information about each endpoint's configuration, type, status, and related resources such as network interfaces, DNS entries, and security groups. ID: aws_vpc_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_endpoint_id,\n private_dns_enabled,\n dns ->> 'DnsName'\ - \ as dns_name,\n dns ->> 'HostedZoneId' as hosted_zone_id\nfrom\n aws_vpc_endpoint\n\ - \ cross join jsonb_array_elements(dns_entries) as dns;" + QueryToExecute: | + SELECT + vpc_endpoint_id, + private_dns_enabled, + dns ->> 'DnsName' AS dns_name, + dns ->> 'HostedZoneId' AS hosted_zone_id + FROM + aws_vpc_endpoint + CROSS JOIN + jsonb_array_elements(dns_entries) AS dns; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint -Title: Find AWS VPC Endpoints with Configurations and Status + - VPC Endpoint +Title: Find AWS VPC Endpoints with Configurations and Status \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_5.yaml b/queries/aws_vpc_endpoint_5.yaml old mode 100755 new mode 100644 index 2107d4244..dd846fbe0 --- a/queries/aws_vpc_endpoint_5.yaml +++ b/queries/aws_vpc_endpoint_5.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS VPC Endpoints and retrieve information about - each endpoint''s configuration, type, status, and related resources such as network - interfaces, DNS entries, and security groups. +Description: Allows users to query AWS VPC Endpoints and retrieve information about each endpoint's configuration, type, status, and related resources such as network interfaces, DNS entries, and security groups. ID: aws_vpc_endpoint_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n count(vpc_endpoint_id) as vpc_endpoint_count\n\ - from\n aws_vpc_endpoint\ngroup by\n vpc_id;" + QueryToExecute: | + SELECT + vpc_id, + COUNT(vpc_endpoint_id) AS vpc_endpoint_count + FROM + aws_vpc_endpoint + GROUP BY + vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Endpoints and their configurations + - VPC +Title: List all AWS VPC Endpoints and their configurations \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_1.yaml b/queries/aws_vpc_endpoint_service_1.yaml old mode 100755 new mode 100644 index 3d7dc8d7f..dcadd3a27 --- a/queries/aws_vpc_endpoint_service_1.yaml +++ b/queries/aws_vpc_endpoint_service_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n base_endpoint_dns_names,\n\ - \ private_dns_name\nfrom\n aws_vpc_endpoint_service;" + QueryToExecute: | + SELECT + service_name, + service_id, + base_endpoint_dns_names, + private_dns_name + FROM + aws_vpc_endpoint_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Services -Title: List All AWS VPC Endpoint Services and Details + - VPC Endpoint Services +Title: List All AWS VPC Endpoint Services and Details \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_2.yaml b/queries/aws_vpc_endpoint_service_2.yaml old mode 100755 new mode 100644 index f5817b67b..74ed94d52 --- a/queries/aws_vpc_endpoint_service_2.yaml +++ b/queries/aws_vpc_endpoint_service_2.yaml @@ -1,23 +1,25 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n jsonb_array_length(availability_zones)\ - \ as availability_zone_count\nfrom\n aws_vpc_endpoint_service;" + QueryToExecute: | + SELECT + service_name, + JSONB_ARRAY_LENGTH(availability_zones) AS availability_zone_count + FROM + aws_vpc_endpoint_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Service -Title: List all AWS VPC Endpoint Services with Details + - VPC Endpoint Service +Title: List all AWS VPC Endpoint Services with Details \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_3.yaml b/queries/aws_vpc_endpoint_service_3.yaml old mode 100755 new mode 100644 index fff8787c3..ec5a1600a --- a/queries/aws_vpc_endpoint_service_3.yaml +++ b/queries/aws_vpc_endpoint_service_3.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n base_endpoint_dns_names,\n\ - \ private_dns_name\nfrom\n aws_vpc_endpoint_service;" + QueryToExecute: | + SELECT + service_name, + service_id, + base_endpoint_dns_names, + private_dns_name + FROM + aws_vpc_endpoint_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Service -Title: Find AWS VPC Endpoint Service Details + - VPC Endpoint Service +Title: Find AWS VPC Endpoint Service Details \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_4.yaml b/queries/aws_vpc_endpoint_service_4.yaml old mode 100755 new mode 100644 index 4828b7e97..69d9b9daa --- a/queries/aws_vpc_endpoint_service_4.yaml +++ b/queries/aws_vpc_endpoint_service_4.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n type ->> 'ServiceType'\ - \ as service_type\nfrom\n aws_vpc_endpoint_service\n cross join jsonb_array_elements(service_type)\ - \ as type;" + QueryToExecute: | + SELECT + service_name, + service_id, + type ->> 'ServiceType' AS service_type + FROM + aws_vpc_endpoint_service + CROSS JOIN + jsonb_array_elements(service_type) AS type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS VPC Endpoint Services -Title: List AWS VPC Endpoint Services with Details + - AWS VPC Endpoint Services +Title: List AWS VPC Endpoint Services with Details \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_5.yaml b/queries/aws_vpc_endpoint_service_5.yaml old mode 100755 new mode 100644 index 1a3dfc48a..c843fc327 --- a/queries/aws_vpc_endpoint_service_5.yaml +++ b/queries/aws_vpc_endpoint_service_5.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n vpc_endpoint_policy_supported\n\ - from\n aws_vpc_endpoint_service\nwhere\n not vpc_endpoint_policy_supported;" + QueryToExecute: | + SELECT + service_name, + service_id, + vpc_endpoint_policy_supported + FROM + aws_vpc_endpoint_service + WHERE + NOT vpc_endpoint_policy_supported; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Service -Title: List all Non-Policy Supported AWS VPC Endpoint Services + - VPC Endpoint Service +Title: List all Non-Policy Supported AWS VPC Endpoint Services \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_6.yaml b/queries/aws_vpc_endpoint_service_6.yaml old mode 100755 new mode 100644 index 6f36c7b77..5aa4569f1 --- a/queries/aws_vpc_endpoint_service_6.yaml +++ b/queries/aws_vpc_endpoint_service_6.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n jsonb_pretty(vpc_endpoint_service_permissions)\ - \ as allowed_principals\nfrom\n aws_vpc_endpoint_service;" + QueryToExecute: | + SELECT + service_name, + service_id, + JSONB_PRETTY(vpc_endpoint_service_permissions) AS allowed_principals + FROM + aws_vpc_endpoint_service; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Services -Title: List all AWS VPC Endpoint Services + - VPC Endpoint Services +Title: List all AWS VPC Endpoint Services \ No newline at end of file diff --git a/queries/aws_vpc_endpoint_service_7.yaml b/queries/aws_vpc_endpoint_service_7.yaml old mode 100755 new mode 100644 index 59556421b..6e631cbd9 --- a/queries/aws_vpc_endpoint_service_7.yaml +++ b/queries/aws_vpc_endpoint_service_7.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed - information about each service, including service name, service type, and whether - or not the service is private. +Description: Allows users to query AWS VPC Endpoint Services to retrieve detailed information about each service, including service name, service type, and whether or not the service is private. ID: aws_vpc_endpoint_service_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n service_name,\n service_id,\n c ->> 'VpcEndpointId'\ - \ as vpc_endpoint_id,\n c ->> 'VpcEndpointOwner' as vpc_endpoint_owner,\n c\ - \ ->> 'VpcEndpointState' as vpc_endpoint_state,\n jsonb_array_elements_text(c\ - \ -> 'NetworkLoadBalancerArns') as network_loadBalancer_arns\nfrom\n aws_vpc_endpoint_service,\n\ - \ jsonb_array_elements(vpc_endpoint_connections) as c" + QueryToExecute: | + SELECT + service_name, + service_id, + c ->> 'VpcEndpointId' AS vpc_endpoint_id, + c ->> 'VpcEndpointOwner' AS vpc_endpoint_owner, + c ->> 'VpcEndpointState' AS vpc_endpoint_state, + jsonb_array_elements_text(c -> 'NetworkLoadBalancerArns') AS network_loadBalancer_arns + FROM + aws_vpc_endpoint_service, + jsonb_array_elements(vpc_endpoint_connections) AS c Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Endpoint Service -Title: List all AWS VPC Endpoint Services Information + - VPC Endpoint Service +Title: List all AWS VPC Endpoint Services Information \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_1.yaml b/queries/aws_vpc_flow_log_1.yaml old mode 100755 new mode 100644 index e413c9ae5..757bbdeaf --- a/queries/aws_vpc_flow_log_1.yaml +++ b/queries/aws_vpc_flow_log_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS VPC Flow Logs, providing detailed information - about IP traffic going to and from network interfaces in a VPC. +Description: Allows users to query AWS VPC Flow Logs, providing detailed information about IP traffic going to and from network interfaces in a VPC. ID: aws_vpc_flow_log_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n flow_log_id,\n resource_id\nfrom\n aws_vpc_flow_log;" + QueryToExecute: | + SELECT + flow_log_id, + resource_id + FROM + aws_vpc_flow_log; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find AWS VPC Flow Logs Information with SQL Query + - VPC Flow Logs +Title: Find AWS VPC Flow Logs Information with SQL Query \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_2.yaml b/queries/aws_vpc_flow_log_2.yaml old mode 100755 new mode 100644 index 6927b003b..0f11859c9 --- a/queries/aws_vpc_flow_log_2.yaml +++ b/queries/aws_vpc_flow_log_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS VPC Flow Logs, providing detailed information - about IP traffic going to and from network interfaces in a VPC. +Description: Allows users to query AWS VPC Flow Logs, providing detailed information about IP traffic going to and from network interfaces in a VPC. ID: aws_vpc_flow_log_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n flow_log_id,\n resource_id,\n deliver_logs_error_message,\n\ - \ deliver_logs_status\nfrom\n aws_vpc_flow_log\nwhere\n deliver_logs_status\ - \ = 'FAILED';" + QueryToExecute: | + SELECT + flow_log_id, + resource_id, + deliver_logs_error_message, + deliver_logs_status + FROM + aws_vpc_flow_log + WHERE + deliver_logs_status = 'FAILED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find Failed Logs in AWS VPC Flow + - VPC Flow Logs +Title: Find Failed Logs in AWS VPC Flow \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_3.yaml b/queries/aws_vpc_flow_log_3.yaml old mode 100755 new mode 100644 index accc0335f..d2229462a --- a/queries/aws_vpc_flow_log_3.yaml +++ b/queries/aws_vpc_flow_log_3.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS VPC Flow Logs, providing detailed information - about IP traffic going to and from network interfaces in a VPC. +Description: Allows users to query AWS VPC Flow Logs, providing detailed information about IP traffic going to and from network interfaces in a VPC. ID: aws_vpc_flow_log_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n flow_log_id,\n log_destination_type,\n log_destination,\n\ - \ log_group_name,\n bucket_name\nfrom\n aws_vpc_flow_log;" + QueryToExecute: | + SELECT + flow_log_id, + log_destination_type, + log_destination, + log_group_name, + bucket_name + FROM + aws_vpc_flow_log; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Log -Title: Find AWS VPC Flow Logs and IP Traffic Details + - VPC Flow Log +Title: Find AWS VPC Flow Logs and IP Traffic Details \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_4.yaml b/queries/aws_vpc_flow_log_4.yaml old mode 100755 new mode 100644 index 976f17d3d..f9a2c86c2 --- a/queries/aws_vpc_flow_log_4.yaml +++ b/queries/aws_vpc_flow_log_4.yaml @@ -1,19 +1,23 @@ -Description: Allows users to query AWS VPC Flow Logs, providing detailed information - about IP traffic going to and from network interfaces in a VPC. +Description: Allows users to query AWS VPC Flow Logs, providing detailed information about IP traffic going to and from network interfaces in a VPC. ID: aws_vpc_flow_log_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n flow_log_id,\n traffic_type\nfrom\n aws_vpc_flow_log;" + QueryToExecute: | + SELECT + flow_log_id, + traffic_type + FROM + aws_vpc_flow_log; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find AWS VPC Flow Log Details with SQL Queries + - VPC Flow Logs +Title: Find AWS VPC Flow Log Details with SQL Queries \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_1.yaml b/queries/aws_vpc_flow_log_event_1.yaml old mode 100755 new mode 100644 index 8d1b25408..e36184e54 --- a/queries/aws_vpc_flow_log_event_1.yaml +++ b/queries/aws_vpc_flow_log_event_1.yaml @@ -1,24 +1,36 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n log_status,\n\ - \ action,\n ingestion_time,\n timestamp,\n interface_id,\n interface_account_id,\n\ - \ src_addr,\n region\nfrom\n aws_vpc_flow_log_event\nwhere\n log_group_name\ - \ = 'vpc-log-group-name'\n and timestamp >= now() - interval '5 minutes';" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + log_status, + action, + ingestion_time, + timestamp, + interface_id, + interface_account_id, + src_addr, + region + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND timestamp >= NOW() - INTERVAL '5 minutes'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find AWS VPC Flow Log Event Details in Last 5 Minutes + - VPC Flow Logs +Title: Find AWS VPC Flow Log Event Details in Last 5 Minutes \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_2.yaml b/queries/aws_vpc_flow_log_event_2.yaml old mode 100755 new mode 100644 index 9a34d5dd8..0b6211a29 --- a/queries/aws_vpc_flow_log_event_2.yaml +++ b/queries/aws_vpc_flow_log_event_2.yaml @@ -1,27 +1,40 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n log_status,\n\ - \ action,\n ingestion_time,\n timestamp,\n interface_id,\n interface_account_id,\n\ - \ src_addr,\n region\nfrom\n aws_vpc_flow_log_event\nwhere\n log_group_name\ - \ = 'vpc-log-group-name'\n and timestamp between (now() - interval '10 minutes')\ - \ and (now() - interval '5 minutes')\norder by\n timestamp asc;" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + log_status, + action, + ingestion_time, + timestamp, + interface_id, + interface_account_id, + src_addr, + region + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND timestamp BETWEEN (NOW() - INTERVAL '10 minutes') AND (NOW() - INTERVAL '5 minutes') + ORDER BY + timestamp ASC; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: List all AWS VPC Flow Log Events and IP Traffic Details + - VPC Flow Logs +Title: List all AWS VPC Flow Log Events and IP Traffic Details \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_3.yaml b/queries/aws_vpc_flow_log_event_3.yaml old mode 100755 new mode 100644 index c3608eaef..d85875a31 --- a/queries/aws_vpc_flow_log_event_3.yaml +++ b/queries/aws_vpc_flow_log_event_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n distinct(interface_id)\nfrom\n aws_vpc_flow_log_event\n\ - where\n log_group_name = 'vpc-log-group-name'\n and timestamp >= now() - interval\ - \ '1 hour';" + QueryToExecute: | + SELECT + DISTINCT(interface_id) + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND timestamp >= NOW() - INTERVAL '1 hour'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: List all IP traffic from AWS VPC Flow Logs + - VPC Flow Logs +Title: List all IP traffic from AWS VPC Flow Logs \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_4.yaml b/queries/aws_vpc_flow_log_event_4.yaml old mode 100755 new mode 100644 index a93c08bb0..2d35e7c30 --- a/queries/aws_vpc_flow_log_event_4.yaml +++ b/queries/aws_vpc_flow_log_event_4.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_stream_name,\n timestamp,\n interface_id,\n interface_account_id,\n\ - \ src_addr,\n src_port,\n dst_addr,\n dst_port\nfrom\n aws_vpc_flow_log_event\n\ - where\n log_group_name = 'vpc-log-group-name'\n and action = 'REJECT'\n and\ - \ timestamp >= now() - interval '1 hour';" + QueryToExecute: | + SELECT + log_stream_name, + timestamp, + interface_id, + interface_account_id, + src_addr, + src_port, + dst_addr, + dst_port + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND action = 'REJECT' + AND timestamp >= NOW() - INTERVAL '1 hour'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find all AWS VPC Flow Log Events Using SQL + - VPC Flow Logs +Title: Find all AWS VPC Flow Log Events Using SQL \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_5.yaml b/queries/aws_vpc_flow_log_event_5.yaml old mode 100755 new mode 100644 index 9ac945eb0..bfe1e4f94 --- a/queries/aws_vpc_flow_log_event_5.yaml +++ b/queries/aws_vpc_flow_log_event_5.yaml @@ -1,26 +1,40 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n log_status,\n\ - \ action,\n ingestion_time,\n timestamp,\n interface_id,\n interface_account_id,\n\ - \ src_addr,\n region\nfrom\n aws_vpc_flow_log_event\nwhere\n log_group_name\ - \ = 'vpc-log-group-name'\n and log_stream_name = 'eni-1d47d21d-all'\n and (src_addr\ - \ = '10.85.14.210' or dst_addr = '10.85.14.213')\n and timestamp >= now() - interval\ - \ '1 hour'\norder by\n timestamp;" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + log_status, + action, + ingestion_time, + timestamp, + interface_id, + interface_account_id, + src_addr, + region + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND log_stream_name = 'eni-1d47d21d-all' + AND (src_addr = '10.85.14.210' OR dst_addr = '10.85.14.213') + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find AWS VPC Flow Log Events and IP Traffic Details + - VPC Flow Logs +Title: Find AWS VPC Flow Log Events and IP Traffic Details \ No newline at end of file diff --git a/queries/aws_vpc_flow_log_event_6.yaml b/queries/aws_vpc_flow_log_event_6.yaml old mode 100755 new mode 100644 index 893a5a98f..ec95cec91 --- a/queries/aws_vpc_flow_log_event_6.yaml +++ b/queries/aws_vpc_flow_log_event_6.yaml @@ -1,24 +1,38 @@ -Description: Allows users to query AWS VPC Flow Logs and retrieve information about - the IP traffic going to and from network interfaces in their VPC. +Description: Allows users to query AWS VPC Flow Logs and retrieve information about the IP traffic going to and from network interfaces in their VPC. ID: aws_vpc_flow_log_event_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n log_group_name,\n log_stream_name,\n log_status,\n\ - \ action,\n ingestion_time,\n timestamp,\n interface_id,\n interface_account_id,\n\ - \ src_addr,\n region\nfrom\n aws_vpc_flow_log_event\nwhere\n log_group_name\ - \ = 'vpc-log-group-name'\n and log_stream_name = 'eni-1d47d21d-all'\n and src_addr\ - \ << '10.0.0.0/8'::inet\n and timestamp >= now() - interval '1 hour'\norder by\n\ - \ timestamp;" + QueryToExecute: | + SELECT + log_group_name, + log_stream_name, + log_status, + action, + ingestion_time, + timestamp, + interface_id, + interface_account_id, + src_addr, + region + FROM + aws_vpc_flow_log_event + WHERE + log_group_name = 'vpc-log-group-name' + AND log_stream_name = 'eni-1d47d21d-all' + AND src_addr << '10.0.0.0/8'::inet + AND timestamp >= NOW() - INTERVAL '1 hour' + ORDER BY + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Flow Logs -Title: Find all AWS VPC Flow Logs and IP Traffic Information + - VPC Flow Logs +Title: Find all AWS VPC Flow Logs and IP Traffic Information \ No newline at end of file diff --git a/queries/aws_vpc_internet_gateway_1.yaml b/queries/aws_vpc_internet_gateway_1.yaml old mode 100755 new mode 100644 index 4527fe625..7ba05e87a --- a/queries/aws_vpc_internet_gateway_1.yaml +++ b/queries/aws_vpc_internet_gateway_1.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS VPC Internet Gateway data. This table can be - used to gain insights into the Internet Gateways attached to your VPCs, including - their state, attached VPCs, and associated tags. +Description: Allows users to query AWS VPC Internet Gateway data. This table can be used to gain insights into the Internet Gateways attached to your VPCs, including their state, attached VPCs, and associated tags. ID: aws_vpc_internet_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n internet_gateway_id,\n attachments\nfrom\n aws_vpc_internet_gateway\n\ - where\n attachments is null;" + QueryToExecute: | + SELECT + internet_gateway_id, + attachments + FROM + aws_vpc_internet_gateway + WHERE + attachments IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Internet Gateway -Title: List all AWS VPC Internet Gateway data insights + - VPC Internet Gateway +Title: List all AWS VPC Internet Gateway data insights \ No newline at end of file diff --git a/queries/aws_vpc_internet_gateway_2.yaml b/queries/aws_vpc_internet_gateway_2.yaml old mode 100755 new mode 100644 index 06aad1629..213e14a6b --- a/queries/aws_vpc_internet_gateway_2.yaml +++ b/queries/aws_vpc_internet_gateway_2.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS VPC Internet Gateway data. This table can be - used to gain insights into the Internet Gateways attached to your VPCs, including - their state, attached VPCs, and associated tags. +Description: Allows users to query AWS VPC Internet Gateway data. This table can be used to gain insights into the Internet Gateways attached to your VPCs, including their state, attached VPCs, and associated tags. ID: aws_vpc_internet_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n internet_gateway_id,\n att ->> 'VpcId' as vpc_id\nfrom\n\ - \ aws_vpc_internet_gateway\n cross join jsonb_array_elements(attachments) as\ - \ att;" + QueryToExecute: | + SELECT + internet_gateway_id, + att ->> 'VpcId' AS vpc_id + FROM + aws_vpc_internet_gateway + CROSS JOIN + jsonb_array_elements(attachments) AS att; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Internet Gateway -Title: Find AWS VPC Internet Gateway Details and States + - VPC Internet Gateway +Title: Find AWS VPC Internet Gateway Details and States \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_1.yaml b/queries/aws_vpc_nat_gateway_1.yaml old mode 100755 new mode 100644 index c80b76a0c..44d136151 --- a/queries/aws_vpc_nat_gateway_1.yaml +++ b/queries/aws_vpc_nat_gateway_1.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud - (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each - NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, - such as their state, subnet association, and associated Elastic IP addresses. +Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, such as their state, subnet association, and associated Elastic IP addresses. ID: aws_vpc_nat_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nat_gateway_id,\n address ->> 'PrivateIp' as private_ip,\n\ - \ address ->> 'PublicIp' as public_ip,\n address ->> 'NetworkInterfaceId' as\ - \ nic_id,\n address ->> 'AllocationId' as allocation_id\nfrom\n aws_vpc_nat_gateway\n\ - \ cross join jsonb_array_elements(nat_gateway_addresses) as address;" + QueryToExecute: | + SELECT + nat_gateway_id, + address ->> 'PrivateIp' AS private_ip, + address ->> 'PublicIp' AS public_ip, + address ->> 'NetworkInterfaceId' AS nic_id, + address ->> 'AllocationId' AS allocation_id + FROM + aws_vpc_nat_gateway + CROSS JOIN + jsonb_array_elements(nat_gateway_addresses) AS address; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud -Title: List all details of AWS VPC NAT Gateways with SQL + - Amazon Virtual Private Cloud +Title: List all details of AWS VPC NAT Gateways with SQL \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_2.yaml b/queries/aws_vpc_nat_gateway_2.yaml old mode 100755 new mode 100644 index a19cc7123..7aec3a667 --- a/queries/aws_vpc_nat_gateway_2.yaml +++ b/queries/aws_vpc_nat_gateway_2.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud - (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each - NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, - such as their state, subnet association, and associated Elastic IP addresses. +Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, such as their state, subnet association, and associated Elastic IP addresses. ID: aws_vpc_nat_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nat_gateway_id,\n vpc_id,\n subnet_id\nfrom\n aws_vpc_nat_gateway;" + QueryToExecute: | + SELECT + nat_gateway_id, + vpc_id, + subnet_id + FROM + aws_vpc_nat_gateway; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud (VPC) -Title: Find AWS VPC NAT Gateways and Subnet Details + - Amazon Virtual Private Cloud (VPC) +Title: Find AWS VPC NAT Gateways and Subnet Details \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_3.yaml b/queries/aws_vpc_nat_gateway_3.yaml old mode 100755 new mode 100644 index 073212e9e..97d285f6d --- a/queries/aws_vpc_nat_gateway_3.yaml +++ b/queries/aws_vpc_nat_gateway_3.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud - (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each - NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, - such as their state, subnet association, and associated Elastic IP addresses. +Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, such as their state, subnet association, and associated Elastic IP addresses. ID: aws_vpc_nat_gateway_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nat_gateway_id,\n tags\nfrom\n aws_vpc_nat_gateway\n\ - where\n not tags :: JSONB ? 'application';" + QueryToExecute: | + SELECT + nat_gateway_id, + tags + FROM + aws_vpc_nat_gateway + WHERE + NOT tags::JSONB ? 'application'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud (VPC) -Title: Find AWS VPC NAT Gateways and Their Details + - Amazon Virtual Private Cloud (VPC) +Title: Find AWS VPC NAT Gateways and Their Details \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_4.yaml b/queries/aws_vpc_nat_gateway_4.yaml old mode 100755 new mode 100644 index 075459bc3..5aa38db16 --- a/queries/aws_vpc_nat_gateway_4.yaml +++ b/queries/aws_vpc_nat_gateway_4.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud - (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each - NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, - such as their state, subnet association, and associated Elastic IP addresses. +Description: Allows users to query NAT Gateways within Amazon Virtual Private Cloud (VPC). The `aws_vpc_nat_gateway` table in Steampipe provides information about each NAT Gateway within a VPC. This table can be used to gather insights on NAT Gateways, such as their state, subnet association, and associated Elastic IP addresses. ID: aws_vpc_nat_gateway_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n count(nat_gateway_id) as nat_gateway_id\n\ - from\n aws_vpc_nat_gateway\ngroup by\n vpc_id;" + QueryToExecute: | + SELECT + vpc_id, + COUNT(nat_gateway_id) AS nat_gateway_id + FROM + aws_vpc_nat_gateway + GROUP BY + vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: List All AWS VPC NAT Gateways and Their Subnet Associations + - Amazon VPC +Title: List All AWS VPC NAT Gateways and Their Subnet Associations \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_1.yaml b/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_1.yaml old mode 100755 new mode 100644 index a0585574b..7b089d065 --- a/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_1.yaml +++ b/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_1.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS NAT Gateway metrics for bytes sent to the destination - from the NAT gateway. The table provides information about the number of bytes sent - out to the destination per NAT gateway in a VPC. +Description: Allows users to query AWS NAT Gateway metrics for bytes sent to the destination from the NAT gateway. The table provides information about the number of bytes sent out to the destination per NAT gateway in a VPC. ID: aws_vpc_nat_gateway_metric_bytes_out_to_destination_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n nat_gateway_id,\n timestamp,\n minimum,\n maximum,\n\ - \ average,\n sample_count\nfrom\n aws_vpc_nat_gateway_metric_bytes_out_to_destination\n\ - order by\n nat_gateway_id,\n timestamp;" + QueryToExecute: | + SELECT + nat_gateway_id, + timestamp, + minimum, + maximum, + average, + sample_count + FROM + aws_vpc_nat_gateway_metric_bytes_out_to_destination + ORDER BY + nat_gateway_id, + timestamp; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - NAT Gateway -Title: List all AWS NAT Gateway Metrics for Bytes Sent Out + - NAT Gateway +Title: List all AWS NAT Gateway Metrics for Bytes Sent Out \ No newline at end of file diff --git a/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_2.yaml b/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_2.yaml old mode 100755 new mode 100644 index 944afa0ae..ceca9861a --- a/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_2.yaml +++ b/queries/aws_vpc_nat_gateway_metric_bytes_out_to_destination_2.yaml @@ -1,25 +1,36 @@ -Description: Allows users to query AWS NAT Gateway metrics for bytes sent to the destination - from the NAT gateway. The table provides information about the number of bytes sent - out to the destination per NAT gateway in a VPC. +Description: Allows users to query AWS NAT Gateway metrics for bytes sent to the destination from the NAT gateway. The table provides information about the number of bytes sent out to the destination per NAT gateway in a VPC. ID: aws_vpc_nat_gateway_metric_bytes_out_to_destination_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n g.nat_gateway_id,\n vpc_id,\n subnet_id\nfrom\n aws_vpc_nat_gateway\ - \ as g\n left join aws_vpc_nat_gateway_metric_bytes_out_to_destination as d\n\ - \ on g.nat_gateway_id = d.nat_gateway_id\ngroup by\n g.nat_gateway_id,\n vpc_id,\n\ - \ subnet_id\nhaving\n sum(average) = 0;" + QueryToExecute: | + SELECT + g.nat_gateway_id, + vpc_id, + subnet_id + FROM + aws_vpc_nat_gateway AS g + LEFT JOIN + aws_vpc_nat_gateway_metric_bytes_out_to_destination AS d + ON + g.nat_gateway_id = d.nat_gateway_id + GROUP BY + g.nat_gateway_id, + vpc_id, + subnet_id + HAVING + SUM(average) = 0; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - CloudWatch -Title: Find AWS NAT Gateway Metrics for Bytes Sent to Destination + - CloudWatch +Title: Find AWS NAT Gateway Metrics for Bytes Sent to Destination \ No newline at end of file diff --git a/queries/aws_vpc_network_acl_1.yaml b/queries/aws_vpc_network_acl_1.yaml old mode 100755 new mode 100644 index f39892b42..8e0d70f95 --- a/queries/aws_vpc_network_acl_1.yaml +++ b/queries/aws_vpc_network_acl_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information - about network access control lists in a specific AWS VPC. +Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information about network access control lists in a specific AWS VPC. ID: aws_vpc_network_acl_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_acl_id,\n arn,\n vpc_id\nfrom\n aws_vpc_network_acl;" + QueryToExecute: | + SELECT + network_acl_id, + arn, + vpc_id + FROM + aws_vpc_network_acl; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Network ACL -Title: Find AWS VPC Network ACLs Information + - VPC Network ACL +Title: Find AWS VPC Network ACLs Information \ No newline at end of file diff --git a/queries/aws_vpc_network_acl_2.yaml b/queries/aws_vpc_network_acl_2.yaml old mode 100755 new mode 100644 index b546a2d57..d54714c5c --- a/queries/aws_vpc_network_acl_2.yaml +++ b/queries/aws_vpc_network_acl_2.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information - about network access control lists in a specific AWS VPC. +Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information about network access control lists in a specific AWS VPC. ID: aws_vpc_network_acl_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_acl_id,\n vpc_id,\n is_default\nfrom\n aws_vpc_network_acl\n\ - where\n is_default = true;" + QueryToExecute: | + SELECT + network_acl_id, + vpc_id, + is_default + FROM + aws_vpc_network_acl + WHERE + is_default = TRUE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Network ACL -Title: Find AWS VPC Network ACLs in a Specific VPC + - VPC Network ACL +Title: Find AWS VPC Network ACLs in a Specific VPC \ No newline at end of file diff --git a/queries/aws_vpc_network_acl_3.yaml b/queries/aws_vpc_network_acl_3.yaml old mode 100755 new mode 100644 index 7dae6e48e..81ddc18ef --- a/queries/aws_vpc_network_acl_3.yaml +++ b/queries/aws_vpc_network_acl_3.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information - about network access control lists in a specific AWS VPC. +Description: Allows users to query AWS VPC Network ACLs to retrieve detailed information about network access control lists in a specific AWS VPC. ID: aws_vpc_network_acl_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n network_acl_id,\n vpc_id,\n association ->> 'SubnetId'\ - \ as subnet_id,\n association ->> 'NetworkAclAssociationId' as network_acl_association_id\n\ - from\n aws_vpc_network_acl\n cross join jsonb_array_elements(associations) as\ - \ association;" + QueryToExecute: | + SELECT + network_acl_id, + vpc_id, + association ->> 'SubnetId' AS subnet_id, + association ->> 'NetworkAclAssociationId' AS network_acl_association_id + FROM + aws_vpc_network_acl + CROSS JOIN + jsonb_array_elements(associations) AS association; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Network ACL -Title: Find AWS VPC Network ACL Details + - VPC Network ACL +Title: Find AWS VPC Network ACL Details \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_1.yaml b/queries/aws_vpc_peering_connection_1.yaml old mode 100755 new mode 100644 index c2c748407..cae01ca4c --- a/queries/aws_vpc_peering_connection_1.yaml +++ b/queries/aws_vpc_peering_connection_1.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n accepter_owner_id,\n accepter_region,\n accepter_vpc_id,\n\ - \ expiration_time,\n requester_owner_id,\n requester_region,\n requester_vpc_id\n\ - from\n aws_vpc_peering_connection;" + QueryToExecute: | + SELECT + id, + accepter_owner_id, + accepter_region, + accepter_vpc_id, + expiration_time, + requester_owner_id, + requester_region, + requester_vpc_id + FROM + aws_vpc_peering_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud -Title: List AWS VPC Peering Connections using SQL + - Amazon Virtual Private Cloud +Title: List AWS VPC Peering Connections using SQL \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_2.yaml b/queries/aws_vpc_peering_connection_2.yaml old mode 100755 new mode 100644 index b24ff07ff..562a7448a --- a/queries/aws_vpc_peering_connection_2.yaml +++ b/queries/aws_vpc_peering_connection_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n accepter_vpc_id,\n requester_vpc_id,\n status_code,\n\ - \ status_message\nfrom\n aws_vpc_peering_connection\nwhere\n status_code =\ - \ 'pending-acceptance';" + QueryToExecute: | + SELECT + id, + accepter_vpc_id, + requester_vpc_id, + status_code, + status_message + FROM + aws_vpc_peering_connection + WHERE + status_code = 'pending-acceptance'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: Find Pending AWS VPC Peering Connections + - Amazon VPC +Title: Find Pending AWS VPC Peering Connections \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_3.yaml b/queries/aws_vpc_peering_connection_3.yaml old mode 100755 new mode 100644 index a082b345e..59900d587 --- a/queries/aws_vpc_peering_connection_3.yaml +++ b/queries/aws_vpc_peering_connection_3.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n requester_cidr_block,\n requester_owner_id,\n\ - \ requester_region,\n requester_vpc_id,\n jsonb_pretty(requester_cidr_block_set)\ - \ as requester_cidr_block_set,\n jsonb_pretty(requester_ipv6_cidr_block_set)\ - \ as requester_ipv6_cidr_block_set,\n jsonb_pretty(requester_peering_options)\ - \ as requester_peering_options\nfrom\n aws_vpc_peering_connection;" + QueryToExecute: | + SELECT + id, + requester_cidr_block, + requester_owner_id, + requester_region, + requester_vpc_id, + jsonb_pretty(requester_cidr_block_set) AS requester_cidr_block_set, + jsonb_pretty(requester_ipv6_cidr_block_set) AS requester_ipv6_cidr_block_set, + jsonb_pretty(requester_peering_options) AS requester_peering_options + FROM + aws_vpc_peering_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: Query All AWS VPC Peering Connections + - Amazon VPC +Title: Query All AWS VPC Peering Connections \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_4.yaml b/queries/aws_vpc_peering_connection_4.yaml old mode 100755 new mode 100644 index 32dda77a3..5bf522ae1 --- a/queries/aws_vpc_peering_connection_4.yaml +++ b/queries/aws_vpc_peering_connection_4.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n accepter_cidr_block,\n accepter_owner_id,\n \ - \ accepter_region,\n accepter_vpc_id,\n jsonb_pretty(accepter_cidr_block_set)\ - \ as accepter_cidr_block_set,\n jsonb_pretty(accepter_ipv6_cidr_block_set) as\ - \ accepter_ipv6_cidr_block_set,\n jsonb_pretty(accepter_peering_options) as accepter_peering_options\n\ - from\n aws_vpc_peering_connection;" + QueryToExecute: | + SELECT + id, + accepter_cidr_block, + accepter_owner_id, + accepter_region, + accepter_vpc_id, + JSONB_PRETTY(accepter_cidr_block_set) AS accepter_cidr_block_set, + JSONB_PRETTY(accepter_ipv6_cidr_block_set) AS accepter_ipv6_cidr_block_set, + JSONB_PRETTY(accepter_peering_options) AS accepter_peering_options + FROM + aws_vpc_peering_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud (VPC) -Title: List all AWS VPC Peering Connections + - Virtual Private Cloud (VPC) +Title: List all AWS VPC Peering Connections \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_5.yaml b/queries/aws_vpc_peering_connection_5.yaml old mode 100755 new mode 100644 index be804a4da..4d130638a --- a/queries/aws_vpc_peering_connection_5.yaml +++ b/queries/aws_vpc_peering_connection_5.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n accepter_owner_id,\n accepter_region,\n accepter_vpc_id,\n\ - \ expiration_time,\n requester_owner_id,\n requester_region,\n requester_vpc_id\n\ - from\n aws_vpc_peering_connection\nwhere\n id in ('pcx-0a0403619dd2f3b24', 'pcx-048825e2c43ffd99e');" + QueryToExecute: | + SELECT + id, + accepter_owner_id, + accepter_region, + accepter_vpc_id, + expiration_time, + requester_owner_id, + requester_region, + requester_vpc_id + FROM + aws_vpc_peering_connection + WHERE + id IN ('pcx-0a0403619dd2f3b24', 'pcx-048825e2c43ffd99e'); Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: List all VPC Peering Connections in AWS + - Amazon VPC +Title: List all VPC Peering Connections in AWS \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_6.yaml b/queries/aws_vpc_peering_connection_6.yaml old mode 100755 new mode 100644 index 42475a23e..fd85bff53 --- a/queries/aws_vpc_peering_connection_6.yaml +++ b/queries/aws_vpc_peering_connection_6.yaml @@ -1,20 +1,24 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n jsonb_pretty(tags) as tags,\n jsonb_pretty(tags_src)\ - \ as tags_src\nfrom\n aws_vpc_peering_connection;" + QueryToExecute: | + SELECT + id, + JSONB_PRETTY(tags) AS tags, + JSONB_PRETTY(tags_src) AS tags_src + FROM + aws_vpc_peering_connection; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud -Title: Find all VPC Peering Connections in AWS VPC + - Amazon Virtual Private Cloud +Title: Find all VPC Peering Connections in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_7.yaml b/queries/aws_vpc_peering_connection_7.yaml old mode 100755 new mode 100644 index 80c57c9d8..ffe88cd51 --- a/queries/aws_vpc_peering_connection_7.yaml +++ b/queries/aws_vpc_peering_connection_7.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n tags ->> 'Name' as name\nfrom\n aws_vpc_peering_connection;" + QueryToExecute: | + SELECT + id, + tags ->> 'Name' AS name + FROM + aws_vpc_peering_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud (VPC) -Title: Find AWS VPC Peering Connections in Amazon VPC + - Amazon Virtual Private Cloud (VPC) +Title: Find AWS VPC Peering Connections in Amazon VPC \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_8.yaml b/queries/aws_vpc_peering_connection_8.yaml old mode 100755 new mode 100644 index dce3af623..0f638749a --- a/queries/aws_vpc_peering_connection_8.yaml +++ b/queries/aws_vpc_peering_connection_8.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n v.id,\n jsonb_pretty(tags) as tags\nfrom\n aws_vpc_peering_connection\ - \ as v,\n jsonb_each(tags)\nwhere\n key = 'turbot:TurbotCreatedPeeringConnection';" + QueryToExecute: | + SELECT + v.id, + JSONB_PRETTY(tags) AS tags + FROM + aws_vpc_peering_connection AS v, + JSONB_EACH(tags) + WHERE + key = 'turbot:TurbotCreatedPeeringConnection'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud (VPC) -Title: List all VPC Peering Connections in AWS VPC + - Amazon Virtual Private Cloud (VPC) +Title: List all VPC Peering Connections in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_peering_connection_9.yaml b/queries/aws_vpc_peering_connection_9.yaml old mode 100755 new mode 100644 index 862ef2643..5497181e0 --- a/queries/aws_vpc_peering_connection_9.yaml +++ b/queries/aws_vpc_peering_connection_9.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query VPC Peering Connections in Amazon Virtual Private - Cloud (VPC). +Description: Allows users to query VPC Peering Connections in Amazon Virtual Private Cloud (VPC). ID: aws_vpc_peering_connection_9 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n jsonb_pretty(tags) as tags\nfrom\n aws_vpc_peering_connection\n\ - where\n tags @> '{\"Name\": \"vpc-0639e12347e5b6bfb <=> vpc-8e1234f5\"}';" + QueryToExecute: | + SELECT + id, + jsonb_pretty(tags) AS tags + FROM + aws_vpc_peering_connection + WHERE + tags @> '{"Name": "vpc-0639e12347e5b6bfb <=> vpc-8e1234f5"}'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud -Title: Find AWS VPC Peering Connections in Amazon VPC + - Amazon Virtual Private Cloud +Title: Find AWS VPC Peering Connections in Amazon VPC \ No newline at end of file diff --git a/queries/aws_vpc_route_1.yaml b/queries/aws_vpc_route_1.yaml old mode 100755 new mode 100644 index 9e4481a31..4c2b5fd72 --- a/queries/aws_vpc_route_1.yaml +++ b/queries/aws_vpc_route_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS VPC Routes to retrieve detailed information - about each route in a route table within a VPC. +Description: Allows users to query AWS VPC Routes to retrieve detailed information about each route in a route table within a VPC. ID: aws_vpc_route_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_table_id,\n gateway_id\nfrom\n aws_vpc_route\n\ - where\n gateway_id ilike 'igw%'\n and destination_cidr_block = '0.0.0.0/0';" + QueryToExecute: | + SELECT + route_table_id, + gateway_id + FROM + aws_vpc_route + WHERE + gateway_id ILIKE 'igw%' + AND destination_cidr_block = '0.0.0.0/0'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Routes Information using SQL + - VPC +Title: List all AWS VPC Routes Information using SQL \ No newline at end of file diff --git a/queries/aws_vpc_route_2.yaml b/queries/aws_vpc_route_2.yaml old mode 100755 new mode 100644 index 532327d87..8abbb9651 --- a/queries/aws_vpc_route_2.yaml +++ b/queries/aws_vpc_route_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS VPC Routes to retrieve detailed information - about each route in a route table within a VPC. +Description: Allows users to query AWS VPC Routes to retrieve detailed information about each route in a route table within a VPC. ID: aws_vpc_route_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_table_id,\n state\nfrom\n aws_vpc_route\nwhere\n\ - \ state = 'blackhole';" + QueryToExecute: | + SELECT + route_table_id, + state + FROM + aws_vpc_route + WHERE + state = 'blackhole'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Routes for Specific Route Table States + - VPC +Title: Find AWS VPC Routes for Specific Route Table States \ No newline at end of file diff --git a/queries/aws_vpc_route_3.yaml b/queries/aws_vpc_route_3.yaml old mode 100755 new mode 100644 index 079e033a5..57cbbaa6f --- a/queries/aws_vpc_route_3.yaml +++ b/queries/aws_vpc_route_3.yaml @@ -1,25 +1,36 @@ -Description: Allows users to query AWS VPC Routes to retrieve detailed information - about each route in a route table within a VPC. +Description: Allows users to query AWS VPC Routes to retrieve detailed information about each route in a route table within a VPC. ID: aws_vpc_route_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_table_id,\n state,\n destination_cidr_block,\n\ - \ destination_ipv6_cidr_block,\n carrier_gateway_id,\n destination_prefix_list_id,\n\ - \ egress_only_internet_gateway_id,\n gateway_id,\n instance_id,\n nat_gateway_id,\n\ - \ network_interface_id,\n transit_gateway_id,\n vpc_peering_connection_id\n\ - from\n aws_vpc_route;" + QueryToExecute: | + SELECT + route_table_id, + state, + destination_cidr_block, + destination_ipv6_cidr_block, + carrier_gateway_id, + destination_prefix_list_id, + egress_only_internet_gateway_id, + gateway_id, + instance_id, + nat_gateway_id, + network_interface_id, + transit_gateway_id, + vpc_peering_connection_id + FROM + aws_vpc_route; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Routes and Retrieve Route Information + - VPC +Title: Find AWS VPC Routes and Retrieve Route Information \ No newline at end of file diff --git a/queries/aws_vpc_route_table_1.yaml b/queries/aws_vpc_route_table_1.yaml old mode 100755 new mode 100644 index 259a1f74a..0b45f2367 --- a/queries/aws_vpc_route_table_1.yaml +++ b/queries/aws_vpc_route_table_1.yaml @@ -1,20 +1,25 @@ -Description: Allows users to query AWS VPC Route Tables and obtain detailed information - about each route table, including its associations, routes, and tags. +Description: Allows users to query AWS VPC Route Tables and obtain detailed information about each route table, including its associations, routes, and tags. ID: aws_vpc_route_table_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n count(route_table_id) as route_table_count\n\ - from\n aws_vpc_route_table\ngroup by\n vpc_id;" + QueryToExecute: | + SELECT + vpc_id, + COUNT(route_table_id) AS route_table_count + FROM + aws_vpc_route_table + GROUP BY + vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Route Tables -Title: Find all AWS VPC Route Tables and their Details + - VPC Route Tables +Title: Find all AWS VPC Route Tables and their Details \ No newline at end of file diff --git a/queries/aws_vpc_route_table_2.yaml b/queries/aws_vpc_route_table_2.yaml old mode 100755 new mode 100644 index 96234cba6..f41b9f5c8 --- a/queries/aws_vpc_route_table_2.yaml +++ b/queries/aws_vpc_route_table_2.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS VPC Route Tables and obtain detailed information - about each route table, including its associations, routes, and tags. +Description: Allows users to query AWS VPC Route Tables and obtain detailed information about each route table, including its associations, routes, and tags. ID: aws_vpc_route_table_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_table_id,\n associations_detail -> 'AssociationState'\ - \ ->> 'State' as state,\n associations_detail -> 'GatewayId' as gateway_id,\n\ - \ associations_detail -> 'SubnetId' as subnet_id,\n associations_detail -> 'RouteTableAssociationId'\ - \ as route_table_association_id,\n associations_detail -> 'Main' as main_route_table\n\ - from\n aws_vpc_route_table\n cross join jsonb_array_elements(associations) as\ - \ associations_detail;" + QueryToExecute: | + SELECT + route_table_id, + associations_detail -> 'AssociationState' ->> 'State' AS state, + associations_detail -> 'GatewayId' AS gateway_id, + associations_detail -> 'SubnetId' AS subnet_id, + associations_detail -> 'RouteTableAssociationId' AS route_table_association_id, + associations_detail -> 'Main' AS main_route_table + FROM + aws_vpc_route_table + CROSS JOIN jsonb_array_elements(associations) AS associations_detail; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Route Tables and Their Associations + - VPC +Title: List all AWS VPC Route Tables and Their Associations \ No newline at end of file diff --git a/queries/aws_vpc_route_table_3.yaml b/queries/aws_vpc_route_table_3.yaml old mode 100755 new mode 100644 index 3440772be..8114f5373 --- a/queries/aws_vpc_route_table_3.yaml +++ b/queries/aws_vpc_route_table_3.yaml @@ -1,31 +1,38 @@ -Description: Allows users to query AWS VPC Route Tables and obtain detailed information - about each route table, including its associations, routes, and tags. +Description: Allows users to query AWS VPC Route Tables and obtain detailed information about each route table, including its associations, routes, and tags. ID: aws_vpc_route_table_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n route_table_id,\n route_detail -> 'CarrierGatewayId'\ - \ ->> 'State' as carrier_gateway_id,\n route_detail -> 'DestinationCidrBlock'\ - \ as destination_CIDR_block,\n route_detail -> 'DestinationIpv6CidrBlock' as\ - \ destination_ipv6_CIDR_block,\n route_detail -> 'EgressOnlyInternetGatewayId'\ - \ as egress_only_internet_gateway,\n route_detail -> 'GatewayId' as gateway_id,\n\ - \ route_detail -> 'InstanceId' as instance_id,\n route_detail -> 'InstanceOwnerId'\ - \ as instance_owner_id,\n route_detail -> 'LocalGatewayId' as local_gateway_id,\n\ - \ route_detail -> 'NatGatewayId' as nat_gateway_id,\n route_detail -> 'NetworkInterfaceId'\ - \ as network_interface_id,\n route_detail -> 'TransitGatewayId' as transit_gateway_id,\n\ - \ route_detail -> 'VpcPeeringConnectionId' as vpc_peering_connection_id\nfrom\n\ - \ aws_vpc_route_table\n cross join jsonb_array_elements(routes) as route_detail;" + QueryToExecute: | + SELECT + route_table_id, + route_detail -> 'CarrierGatewayId' ->> 'State' AS carrier_gateway_id, + route_detail -> 'DestinationCidrBlock' AS destination_CIDR_block, + route_detail -> 'DestinationIpv6CidrBlock' AS destination_ipv6_CIDR_block, + route_detail -> 'EgressOnlyInternetGatewayId' AS egress_only_internet_gateway, + route_detail -> 'GatewayId' AS gateway_id, + route_detail -> 'InstanceId' AS instance_id, + route_detail -> 'InstanceOwnerId' AS instance_owner_id, + route_detail -> 'LocalGatewayId' AS local_gateway_id, + route_detail -> 'NatGatewayId' AS nat_gateway_id, + route_detail -> 'NetworkInterfaceId' AS network_interface_id, + route_detail -> 'TransitGatewayId' AS transit_gateway_id, + route_detail -> 'VpcPeeringConnectionId' AS vpc_peering_connection_id + FROM + aws_vpc_route_table + CROSS JOIN + jsonb_array_elements(routes) AS route_detail; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Route Tables with Detailed Info + - VPC +Title: List all AWS VPC Route Tables with Detailed Info \ No newline at end of file diff --git a/queries/aws_vpc_security_group_1.yaml b/queries/aws_vpc_security_group_1.yaml old mode 100755 new mode 100644 index 6e78fd9dc..a7564b174 --- a/queries/aws_vpc_security_group_1.yaml +++ b/queries/aws_vpc_security_group_1.yaml @@ -1,28 +1,33 @@ -Description: Allows users to query AWS VPC Security Groups and retrieve data such - as group ID, name, description, owner ID, and associated VPC ID. This table can - be used to gain insights on security group configurations, policies, and related - metadata. +Description: Allows users to query AWS VPC Security Groups and retrieve data such as group ID, name, description, owner ID, and associated VPC ID. This table can be used to gain insights on security group configurations, policies, and related metadata. ID: aws_vpc_security_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n vpc_id,\n perm ->> 'FromPort' as from_port,\n\ - \ perm ->> 'ToPort' as to_port,\n perm ->> 'IpProtocol' as ip_protocol,\n perm\ - \ ->> 'IpRanges' as ip_ranges,\n perm ->> 'Ipv6Ranges' as ipv6_ranges,\n perm\ - \ ->> 'UserIdGroupPairs' as user_id_group_pairs,\n perm ->> 'PrefixListIds' as\ - \ prefix_list_ids\nfrom\n aws_vpc_security_group as sg\n cross join jsonb_array_elements(ip_permissions)\ - \ as perm;" + QueryToExecute: | + SELECT + group_name, + vpc_id, + perm ->> 'FromPort' AS from_port, + perm ->> 'ToPort' AS to_port, + perm ->> 'IpProtocol' AS ip_protocol, + perm ->> 'IpRanges' AS ip_ranges, + perm ->> 'Ipv6Ranges' AS ipv6_ranges, + perm ->> 'UserIdGroupPairs' AS user_id_group_pairs, + perm ->> 'PrefixListIds' AS prefix_list_ids + FROM + aws_vpc_security_group AS sg + CROSS JOIN jsonb_array_elements(ip_permissions) AS perm; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Security Groups with SQL Queries + - VPC +Title: List all AWS VPC Security Groups with SQL Queries \ No newline at end of file diff --git a/queries/aws_vpc_security_group_2.yaml b/queries/aws_vpc_security_group_2.yaml old mode 100755 new mode 100644 index 51e406271..8ee2d24e2 --- a/queries/aws_vpc_security_group_2.yaml +++ b/queries/aws_vpc_security_group_2.yaml @@ -1,30 +1,40 @@ -Description: Allows users to query AWS VPC Security Groups and retrieve data such - as group ID, name, description, owner ID, and associated VPC ID. This table can - be used to gain insights on security group configurations, policies, and related - metadata. +Description: Allows users to query AWS VPC Security Groups and retrieve data such as group ID, name, description, owner ID, and associated VPC ID. This table can be used to gain insights on security group configurations, policies, and related metadata. ID: aws_vpc_security_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n sg.group_name,\n sg.group_id,\n sgr.type,\n sgr.ip_protocol,\n\ - \ sgr.from_port,\n sgr.to_port,\n cidr_ip\nfrom\n aws_vpc_security_group as\ - \ sg\n join aws_vpc_security_group_rule as sgr on sg.group_name = sgr.group_name\n\ - where\n sgr.type = 'ingress'\n and sgr.cidr_ip = '0.0.0.0/0'\n and (\n (\n\ - \ sgr.ip_protocol = '-1' -- all traffic\n and sgr.from_port is null\n\ - \ )\n or (\n sgr.from_port <= 22\n and sgr.to_port >= 22\n \ - \ )\n or (\n sgr.from_port <= 3389\n and sgr.to_port >= 3389\n \ - \ )\n );" + QueryToExecute: | + SELECT + sg.group_name, + sg.group_id, + sgr.type, + sgr.ip_protocol, + sgr.from_port, + sgr.to_port, + sgr.cidr_ip + FROM + aws_vpc_security_group AS sg + JOIN aws_vpc_security_group_rule AS sgr + ON sg.group_name = sgr.group_name + WHERE + sgr.type = 'ingress' + AND sgr.cidr_ip = '0.0.0.0/0' + AND ( + (sgr.ip_protocol = '-1' AND sgr.from_port IS NULL) + OR (sgr.from_port <= 22 AND sgr.to_port >= 22) + OR (sgr.from_port <= 3389 AND sgr.to_port >= 3389) + ); Tags: cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Security Groups and Their Configurations + - VPC +Title: Find AWS VPC Security Groups and Their Configurations \ No newline at end of file diff --git a/queries/aws_vpc_security_group_3.yaml b/queries/aws_vpc_security_group_3.yaml old mode 100755 new mode 100644 index b021e10f1..177313228 --- a/queries/aws_vpc_security_group_3.yaml +++ b/queries/aws_vpc_security_group_3.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS VPC Security Groups and retrieve data such - as group ID, name, description, owner ID, and associated VPC ID. This table can - be used to gain insights on security group configurations, policies, and related - metadata. +Description: Allows users to query AWS VPC Security Groups and retrieve data such as group ID, name, description, owner ID, and associated VPC ID. This table can be used to gain insights on security group configurations, policies, and related metadata. ID: aws_vpc_security_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n count(vpc_id) as count\nfrom\n aws_vpc_security_group\n\ - group by\n vpc_id;" + QueryToExecute: | + SELECT + vpc_id, + COUNT(vpc_id) AS count + FROM + aws_vpc_security_group + GROUP BY + vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Security Group -Title: List all AWS VPC Security Groups with Configurations + - VPC Security Group +Title: List all AWS VPC Security Groups with Configurations \ No newline at end of file diff --git a/queries/aws_vpc_security_group_4.yaml b/queries/aws_vpc_security_group_4.yaml old mode 100755 new mode 100644 index 924fa74d4..06c95b52e --- a/queries/aws_vpc_security_group_4.yaml +++ b/queries/aws_vpc_security_group_4.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS VPC Security Groups and retrieve data such - as group ID, name, description, owner ID, and associated VPC ID. This table can - be used to gain insights on security group configurations, policies, and related - metadata. +Description: Allows users to query AWS VPC Security Groups and retrieve data such as group ID, name, description, owner ID, and associated VPC ID. This table can be used to gain insights on security group configurations, policies, and related metadata. ID: aws_vpc_security_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n group_name,\n group_id\nfrom\n aws_vpc_security_group\n\ - where\n group_name like '%launch-wizard%';" + QueryToExecute: | + SELECT + group_name, + group_id + FROM + aws_vpc_security_group + WHERE + group_name LIKE '%launch-wizard%'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Security Groups and Metadata + - VPC +Title: List all AWS VPC Security Groups and Metadata \ No newline at end of file diff --git a/queries/aws_vpc_security_group_rule_1.yaml b/queries/aws_vpc_security_group_rule_1.yaml old mode 100755 new mode 100644 index ac6e31035..2fdc74ae9 --- a/queries/aws_vpc_security_group_rule_1.yaml +++ b/queries/aws_vpc_security_group_rule_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS VPC Security Group Rule, providing detailed - information about security group rules within Amazon Virtual Private Cloud (VPC). +Description: Allows users to query AWS VPC Security Group Rule, providing detailed information about security group rules within Amazon Virtual Private Cloud (VPC). ID: aws_vpc_security_group_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n security_group_rule_id,\n group_id,\n ip_protocol,\n\ - \ from_port,\n to_port\nfrom\n aws_vpc_security_group_rule\nwhere\n cidr_ipv4\ - \ = '0.0.0.0/0'\n and not is_egress;" + QueryToExecute: | + SELECT + security_group_rule_id, + group_id, + ip_protocol, + from_port, + to_port + FROM + aws_vpc_security_group_rule + WHERE + cidr_ipv4 = '0.0.0.0/0' + AND NOT is_egress; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: List AWS VPC Security Group Rules using SQL + - Amazon VPC +Title: List AWS VPC Security Group Rules using SQL \ No newline at end of file diff --git a/queries/aws_vpc_security_group_rule_2.yaml b/queries/aws_vpc_security_group_rule_2.yaml old mode 100755 new mode 100644 index 8b03bde7c..965d07f1d --- a/queries/aws_vpc_security_group_rule_2.yaml +++ b/queries/aws_vpc_security_group_rule_2.yaml @@ -1,26 +1,46 @@ -Description: Allows users to query AWS VPC Security Group Rule, providing detailed - information about security group rules within Amazon Virtual Private Cloud (VPC). +Description: Allows users to query AWS VPC Security Group Rule, providing detailed information about security group rules within Amazon Virtual Private Cloud (VPC). ID: aws_vpc_security_group_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n security_group_rule_id,\n group_id,\n ip_protocol,\n\ - \ from_port,\n to_port,\n cidr_ipv4\nfrom\n aws_vpc_security_group_rule\n\ - where\n not is_egress\n and cidr_ipv4 = '0.0.0.0/0'\n and (\n (\n ip_protocol\ - \ = '-1' -- all traffic\n and from_port is null\n )\n or (\n from_port\ - \ <= 22\n and to_port >= 22\n )\n or (\n from_port <= 3389\n \ - \ and to_port >= 3389\n )\n );" + QueryToExecute: | + SELECT + security_group_rule_id, + group_id, + ip_protocol, + from_port, + to_port, + cidr_ipv4 + FROM + aws_vpc_security_group_rule + WHERE + NOT is_egress + AND cidr_ipv4 = '0.0.0.0/0' + AND ( + ( + ip_protocol = '-1' + AND from_port IS NULL + ) + OR ( + from_port <= 22 + AND to_port >= 22 + ) + OR ( + from_port <= 3389 + AND to_port >= 3389 + ) + ); Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud (VPC) -Title: Find AWS VPC Security Group Rule - Query with Details + - Amazon Virtual Private Cloud (VPC) +Title: Find AWS VPC Security Group Rule - Query with Details \ No newline at end of file diff --git a/queries/aws_vpc_security_group_rule_3.yaml b/queries/aws_vpc_security_group_rule_3.yaml old mode 100755 new mode 100644 index 1c6445701..7c52d839b --- a/queries/aws_vpc_security_group_rule_3.yaml +++ b/queries/aws_vpc_security_group_rule_3.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS VPC Security Group Rule, providing detailed - information about security group rules within Amazon Virtual Private Cloud (VPC). +Description: Allows users to query AWS VPC Security Group Rule, providing detailed information about security group rules within Amazon Virtual Private Cloud (VPC). ID: aws_vpc_security_group_rule_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.security_group_rule_id,\n r.ip_protocol,\n r.from_port,\n\ - \ r.to_port,\n r.cidr_ipv4,\n r.group_id,\n sg.group_name,\n sg.vpc_id \n\ - from\n aws_vpc_security_group_rule as r,\n aws_vpc_security_group as sg \nwhere\n\ - \ r.group_id = sg.group_id;" + QueryToExecute: | + SELECT + r.security_group_rule_id, + r.ip_protocol, + r.from_port, + r.to_port, + r.cidr_ipv4, + r.group_id, + sg.group_name, + sg.vpc_id + FROM + aws_vpc_security_group_rule AS r, + aws_vpc_security_group AS sg + WHERE + r.group_id = sg.group_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon Virtual Private Cloud -Title: List all AWS VPC Security Group Rules + - Amazon Virtual Private Cloud +Title: List all AWS VPC Security Group Rules \ No newline at end of file diff --git a/queries/aws_vpc_subnet_1.yaml b/queries/aws_vpc_subnet_1.yaml old mode 100755 new mode 100644 index 8426fdab6..8ad189b98 --- a/queries/aws_vpc_subnet_1.yaml +++ b/queries/aws_vpc_subnet_1.yaml @@ -1,24 +1,30 @@ -Description: Allows users to query AWS VPC Subnets and obtain detailed information - about each subnet, including its configuration, associated VPC, availability zone, - and CIDR block. +Description: Allows users to query AWS VPC Subnets and obtain detailed information about each subnet, including its configuration, associated VPC, availability zone, and CIDR block. ID: aws_vpc_subnet_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n subnet_id,\n cidr_block,\n assign_ipv6_address_on_creation,\n\ - \ map_customer_owned_ip_on_launch,\n map_public_ip_on_launch,\n ipv6_cidr_block_association_set\n\ - from\n aws_vpc_subnet;" + QueryToExecute: | + SELECT + vpc_id, + subnet_id, + cidr_block, + assign_ipv6_address_on_creation, + map_customer_owned_ip_on_launch, + map_public_ip_on_launch, + ipv6_cidr_block_association_set + FROM + aws_vpc_subnet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Subnets with Detailed Information + - VPC +Title: List all AWS VPC Subnets with Detailed Information \ No newline at end of file diff --git a/queries/aws_vpc_subnet_2.yaml b/queries/aws_vpc_subnet_2.yaml old mode 100755 new mode 100644 index 17a82dd16..0a2ea188d --- a/queries/aws_vpc_subnet_2.yaml +++ b/queries/aws_vpc_subnet_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS VPC Subnets and obtain detailed information - about each subnet, including its configuration, associated VPC, availability zone, - and CIDR block. +Description: Allows users to query AWS VPC Subnets and obtain detailed information about each subnet, including its configuration, associated VPC, availability zone, and CIDR block. ID: aws_vpc_subnet_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n subnet_id,\n availability_zone,\n availability_zone_id\n\ - from\n aws_vpc_subnet\norder by\n vpc_id,\n availability_zone;" + QueryToExecute: | + SELECT + vpc_id, + subnet_id, + availability_zone, + availability_zone_id + FROM + aws_vpc_subnet + ORDER BY + vpc_id, + availability_zone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Subnets with Details + - VPC +Title: List all AWS VPC Subnets with Details \ No newline at end of file diff --git a/queries/aws_vpc_subnet_3.yaml b/queries/aws_vpc_subnet_3.yaml old mode 100755 new mode 100644 index 1d63643ca..8ad2ad26a --- a/queries/aws_vpc_subnet_3.yaml +++ b/queries/aws_vpc_subnet_3.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS VPC Subnets and obtain detailed information - about each subnet, including its configuration, associated VPC, availability zone, - and CIDR block. +Description: Allows users to query AWS VPC Subnets and obtain detailed information about each subnet, including its configuration, associated VPC, availability zone, and CIDR block. ID: aws_vpc_subnet_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n subnet_id,\n cidr_block,\n available_ip_address_count,\n\ - \ power(2, 32 - masklen(cidr_block :: cidr)) -1 as raw_size\nfrom\n aws_vpc_subnet;" + QueryToExecute: | + SELECT + subnet_id, + cidr_block, + available_ip_address_count, + POWER(2, 32 - MASKLEN(cidr_block :: cidr)) - 1 AS raw_size + FROM + aws_vpc_subnet; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Subnets Information including CIDR Blocks + - VPC +Title: Find AWS VPC Subnets Information including CIDR Blocks \ No newline at end of file diff --git a/queries/aws_vpc_subnet_4.yaml b/queries/aws_vpc_subnet_4.yaml old mode 100755 new mode 100644 index f8ce9ead0..35e5785c8 --- a/queries/aws_vpc_subnet_4.yaml +++ b/queries/aws_vpc_subnet_4.yaml @@ -1,25 +1,28 @@ -Description: Allows users to query AWS VPC Subnets and obtain detailed information - about each subnet, including its configuration, associated VPC, availability zone, - and CIDR block. +Description: Allows users to query AWS VPC Subnets and obtain detailed information about each subnet, including its configuration, associated VPC, availability zone, and CIDR block. ID: aws_vpc_subnet_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n associations_detail ->> 'SubnetId' as subnet_id,\n route_table_id\n\ - from\n aws_vpc_route_table as rt\n cross join jsonb_array_elements(associations)\ - \ as associations_detail\n join aws_vpc_subnet as sub on sub.subnet_id = associations_detail\ - \ ->> 'SubnetId';" + QueryToExecute: | + SELECT + associations_detail ->> 'SubnetId' AS subnet_id, + route_table_id + FROM + aws_vpc_route_table AS rt + CROSS JOIN jsonb_array_elements(associations) AS associations_detail + JOIN aws_vpc_subnet AS sub + ON sub.subnet_id = associations_detail ->> 'SubnetId'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC Subnets with Configuration Details + - VPC +Title: Find AWS VPC Subnets with Configuration Details \ No newline at end of file diff --git a/queries/aws_vpc_subnet_5.yaml b/queries/aws_vpc_subnet_5.yaml old mode 100755 new mode 100644 index ef4e7204f..36c0078c1 --- a/queries/aws_vpc_subnet_5.yaml +++ b/queries/aws_vpc_subnet_5.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS VPC Subnets and obtain detailed information - about each subnet, including its configuration, associated VPC, availability zone, - and CIDR block. +Description: Allows users to query AWS VPC Subnets and obtain detailed information about each subnet, including its configuration, associated VPC, availability zone, and CIDR block. ID: aws_vpc_subnet_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpc_id,\n count(subnet_id) as subnet_count\nfrom\n \ - \ aws_vpc_subnet\ngroup by\n vpc_id;" + QueryToExecute: | + SELECT + vpc_id, + COUNT(subnet_id) AS subnet_count + FROM + aws_vpc_subnet + GROUP BY + vpc_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Subnets and Obtain Detailed Information + - VPC +Title: List all AWS VPC Subnets and Obtain Detailed Information \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_1.yaml b/queries/aws_vpc_verified_access_endpoint_1.yaml old mode 100755 new mode 100644 index ab1753ce9..b3357c5fc --- a/queries/aws_vpc_verified_access_endpoint_1.yaml +++ b/queries/aws_vpc_verified_access_endpoint_1.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_endpoint_id,\n verified_access_instance_id,\n\ - \ verified_access_group_id,\n creation_time,\n verified_access_instance_id,\n\ - \ domain_certificate_arn,\n device_validation_domain,\n status_code\nfrom\n\ - \ aws_vpc_verified_access_endpoint;" + QueryToExecute: | + SELECT + verified_access_endpoint_id, + verified_access_instance_id, + verified_access_group_id, + creation_time, + verified_access_instance_id, + domain_certificate_arn, + device_validation_domain, + status_code + FROM + aws_vpc_verified_access_endpoint; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access Endpoint -Title: List all AWS VPC Verified Access Endpoint Details + - VPC Verified Access Endpoint +Title: List all AWS VPC Verified Access Endpoint Details \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_2.yaml b/queries/aws_vpc_verified_access_endpoint_2.yaml old mode 100755 new mode 100644 index 5006351c4..d72097b3a --- a/queries/aws_vpc_verified_access_endpoint_2.yaml +++ b/queries/aws_vpc_verified_access_endpoint_2.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_endpoint_id,\n creation_time,\n description,\n\ - \ status_code\nfrom\n aws_vpc_verified_access_endpoint\nwhere\n creation_time\ - \ <= now() - interval '30' day;" + QueryToExecute: | + SELECT + verified_access_endpoint_id, + creation_time, + description, + status_code + FROM + aws_vpc_verified_access_endpoint + WHERE + creation_time <= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access Endpoint -Title: List All AWS VPC Verified Access Endpoint Data + - VPC Verified Access Endpoint +Title: List All AWS VPC Verified Access Endpoint Data \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_3.yaml b/queries/aws_vpc_verified_access_endpoint_3.yaml old mode 100755 new mode 100644 index da86d1c94..6e68d12b3 --- a/queries/aws_vpc_verified_access_endpoint_3.yaml +++ b/queries/aws_vpc_verified_access_endpoint_3.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_endpoint_id,\n status_code,\n creation_time,\n\ - \ deletion_time,\n description,\n device_validation_domain\nfrom\n aws_vpc_verified_access_endpoint\n\ - where\n status_code <> 'active';" + QueryToExecute: | + SELECT + verified_access_endpoint_id, + status_code, + creation_time, + deletion_time, + description, + device_validation_domain + FROM + aws_vpc_verified_access_endpoint + WHERE + status_code <> 'active'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Verified Access Endpoint data with SQL + - VPC +Title: List all AWS VPC Verified Access Endpoint data with SQL \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_4.yaml b/queries/aws_vpc_verified_access_endpoint_4.yaml old mode 100755 new mode 100644 index 89f16bfeb..fde81d1a4 --- a/queries/aws_vpc_verified_access_endpoint_4.yaml +++ b/queries/aws_vpc_verified_access_endpoint_4.yaml @@ -1,28 +1,32 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.verified_access_endpoint_id,\n e.creation_time,\n\ - \ g.verified_access_group_id,\n g.creation_time as group_create_time\nfrom\n\ - \ aws_vpc_verified_access_endpoint as e,\n aws_vpc_verified_access_group as\ - \ g\nwhere\n e.verified_access_group_id = g.verified_access_group_id;" + QueryToExecute: | + SELECT + e.verified_access_endpoint_id, + e.creation_time, + g.verified_access_group_id, + g.creation_time AS group_create_time + FROM + aws_vpc_verified_access_endpoint AS e, + aws_vpc_verified_access_group AS g + WHERE + e.verified_access_group_id = g.verified_access_group_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS VPC -Title: List all AWS VPC Verified Access Endpoint Configs + - AWS VPC +Title: List all AWS VPC Verified Access Endpoint Configs \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_5.yaml b/queries/aws_vpc_verified_access_endpoint_5.yaml old mode 100755 new mode 100644 index 947294ce4..a78771dd8 --- a/queries/aws_vpc_verified_access_endpoint_5.yaml +++ b/queries/aws_vpc_verified_access_endpoint_5.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.verified_access_group_id,\n e.creation_time,\n i.creation_time\ - \ as instance_create_time,\n i.verified_access_instance_id,\n jsonb_pretty(i.verified_access_trust_providers)\ - \ as verified_access_trust_providers\nfrom\n aws_vpc_verified_access_endpoint\ - \ as e,\n aws_vpc_verified_access_instance as i\nwhere\n e.verified_access_instance_id\ - \ = i.verified_access_instance_id;" + QueryToExecute: | + SELECT + e.verified_access_group_id, + e.creation_time, + i.creation_time AS instance_create_time, + i.verified_access_instance_id, + jsonb_pretty(i.verified_access_trust_providers) AS verified_access_trust_providers + FROM + aws_vpc_verified_access_endpoint AS e, + aws_vpc_verified_access_instance AS i + WHERE + e.verified_access_instance_id = i.verified_access_instance_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access Endpoint -Title: List Verified Access Endpoints in AWS VPC + - VPC Verified Access Endpoint +Title: List Verified Access Endpoints in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_6.yaml b/queries/aws_vpc_verified_access_endpoint_6.yaml old mode 100755 new mode 100644 index 4042e2b1b..5a32513a4 --- a/queries/aws_vpc_verified_access_endpoint_6.yaml +++ b/queries/aws_vpc_verified_access_endpoint_6.yaml @@ -1,24 +1,27 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_instance_id,\n count(verified_access_endpoint_id)\ - \ as instance_count\nfrom\n aws_vpc_verified_access_endpoint\ngroup by\n verified_access_instance_id;" + QueryToExecute: | + SELECT + verified_access_instance_id, + COUNT(verified_access_endpoint_id) AS instance_count + FROM + aws_vpc_verified_access_endpoint + GROUP BY + verified_access_instance_id; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access Endpoint -Title: List all AWS VPC Verified Access Endpoints configuration + - VPC Verified Access Endpoint +Title: List all AWS VPC Verified Access Endpoints configuration \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_endpoint_7.yaml b/queries/aws_vpc_verified_access_endpoint_7.yaml old mode 100755 new mode 100644 index 8953b3b02..fd27fe833 --- a/queries/aws_vpc_verified_access_endpoint_7.yaml +++ b/queries/aws_vpc_verified_access_endpoint_7.yaml @@ -1,26 +1,32 @@ -Description: Allows users to query AWS VPC Verified Access Endpoint data, including - details about the endpoint configuration, service name, and VPC ID. This information - can be used to manage and secure network access to services within an AWS Virtual - Private Cloud. +Description: Allows users to query AWS VPC Verified Access Endpoint data, including details about the endpoint configuration, service name, and VPC ID. This information can be used to manage and secure network access to services within an AWS Virtual Private Cloud. ID: aws_vpc_verified_access_endpoint_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n e.verified_access_endpoint_id,\n i.network_interface_id,\n\ - \ i.interface_type,\n i.private_ip_address,\n i.association_public_ip,\n jsonb_pretty(i.groups)\ - \ as security_groups\nfrom\n aws_vpc_verified_access_endpoint as e,\n aws_ec2_network_interface\ - \ as i\nwhere\n e.network_interface_options ->> 'NetworkInterfaceId' = i.network_interface_id;" + QueryToExecute: | + SELECT + e.verified_access_endpoint_id, + i.network_interface_id, + i.interface_type, + i.private_ip_address, + i.association_public_ip, + jsonb_pretty(i.groups) AS security_groups + FROM + aws_vpc_verified_access_endpoint AS e, + aws_ec2_network_interface AS i + WHERE + e.network_interface_options ->> 'NetworkInterfaceId' = i.network_interface_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS VPC -Title: List AWS VPC Verified Access Endpoints and Network Interface + - AWS VPC +Title: List AWS VPC Verified Access Endpoints and Network Interface \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_group_1.yaml b/queries/aws_vpc_verified_access_group_1.yaml old mode 100755 new mode 100644 index bf1ad4090..5fd52eaf0 --- a/queries/aws_vpc_verified_access_group_1.yaml +++ b/queries/aws_vpc_verified_access_group_1.yaml @@ -1,24 +1,29 @@ -Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private - Cloud (VPC). This table provides information about each verified access group within - a VPC, including details such as group ID, group name, and the VPC ID it is associated - with. +Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private Cloud (VPC). This table provides information about each verified access group within a VPC, including details such as group ID, group name, and the VPC ID it is associated with. ID: aws_vpc_verified_access_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_group_id,\n arn,\n verified_access_instance_id,\n\ - \ creation_time,\n description,\n last_updated_time\nfrom\n aws_vpc_verified_access_group;" + QueryToExecute: | + SELECT + verified_access_group_id, + arn, + verified_access_instance_id, + creation_time, + description, + last_updated_time + FROM + aws_vpc_verified_access_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud -Title: List all AWS VPC Verified Access Groups with Details + - Virtual Private Cloud +Title: List all AWS VPC Verified Access Groups with Details \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_group_2.yaml b/queries/aws_vpc_verified_access_group_2.yaml old mode 100755 new mode 100644 index e32b201fa..26630dad8 --- a/queries/aws_vpc_verified_access_group_2.yaml +++ b/queries/aws_vpc_verified_access_group_2.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private - Cloud (VPC). This table provides information about each verified access group within - a VPC, including details such as group ID, group name, and the VPC ID it is associated - with. +Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private Cloud (VPC). This table provides information about each verified access group within a VPC, including details such as group ID, group name, and the VPC ID it is associated with. ID: aws_vpc_verified_access_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_group_id,\n creation_time,\n description,\n\ - \ last_updated_time\nfrom\n aws_vpc_verified_access_group\nwhere\n creation_time\ - \ <= now() - interval '30' day;" + QueryToExecute: | + SELECT + verified_access_group_id, + creation_time, + description, + last_updated_time + FROM + aws_vpc_verified_access_group + WHERE + creation_time <= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all VPC Verified Access Groups in AWS + - VPC +Title: List all VPC Verified Access Groups in AWS \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_group_3.yaml b/queries/aws_vpc_verified_access_group_3.yaml old mode 100755 new mode 100644 index d59aa44f8..4e3f23a81 --- a/queries/aws_vpc_verified_access_group_3.yaml +++ b/queries/aws_vpc_verified_access_group_3.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private - Cloud (VPC). This table provides information about each verified access group within - a VPC, including details such as group ID, group name, and the VPC ID it is associated - with. +Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private Cloud (VPC). This table provides information about each verified access group within a VPC, including details such as group ID, group name, and the VPC ID it is associated with. ID: aws_vpc_verified_access_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_group_id,\n creation_time,\n deletion_time,\n\ - \ description,\n last_updated_time\nfrom\n aws_vpc_verified_access_group\n\ - where\n deletion_time is null;" + QueryToExecute: | + SELECT + verified_access_group_id, + creation_time, + deletion_time, + description, + last_updated_time + FROM + aws_vpc_verified_access_group + WHERE + deletion_time IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud -Title: List all AWS VPC Verified Access Groups Information + - Virtual Private Cloud +Title: List all AWS VPC Verified Access Groups Information \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_group_4.yaml b/queries/aws_vpc_verified_access_group_4.yaml old mode 100755 new mode 100644 index 16db52647..637496d54 --- a/queries/aws_vpc_verified_access_group_4.yaml +++ b/queries/aws_vpc_verified_access_group_4.yaml @@ -1,27 +1,31 @@ -Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private - Cloud (VPC). This table provides information about each verified access group within - a VPC, including details such as group ID, group name, and the VPC ID it is associated - with. +Description: Allows users to query VPC Verified Access Groups within AWS Virtual Private Cloud (VPC). This table provides information about each verified access group within a VPC, including details such as group ID, group name, and the VPC ID it is associated with. ID: aws_vpc_verified_access_group_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n g.verified_access_group_id,\n g.creation_time,\n i.creation_time\ - \ as instance_create_time,\n i.verified_access_instance_id,\n jsonb_pretty(i.verified_access_trust_providers)\ - \ as verified_access_trust_providers\nfrom\n aws_vpc_verified_access_group as\ - \ g,\n aws_vpc_verified_access_instance as i\nwhere\n g.verified_access_instance_id\ - \ = i.verified_access_instance_id;" + QueryToExecute: | + SELECT + g.verified_access_group_id, + g.creation_time, + i.creation_time AS instance_create_time, + i.verified_access_instance_id, + JSONB_PRETTY(i.verified_access_trust_providers) AS verified_access_trust_providers + FROM + aws_vpc_verified_access_group AS g, + aws_vpc_verified_access_instance AS i + WHERE + g.verified_access_instance_id = i.verified_access_instance_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud -Title: List AWS VPC Verified Access Groups within AWS VPC + - Virtual Private Cloud +Title: List AWS VPC Verified Access Groups within AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_instance_1.yaml b/queries/aws_vpc_verified_access_instance_1.yaml old mode 100755 new mode 100644 index 70904623f..d2859e371 --- a/queries/aws_vpc_verified_access_instance_1.yaml +++ b/queries/aws_vpc_verified_access_instance_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS VPC Verified Access Instances and provides - information about the Amazon VPC verified access instances. This table can be used - to gather details such as the instance ID, instance state, instance type, and associated - tags. +Description: Allows users to query AWS VPC Verified Access Instances and provides information about the Amazon VPC verified access instances. This table can be used to gather details such as the instance ID, instance state, instance type, and associated tags. ID: aws_vpc_verified_access_instance_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_instance_id,\n creation_time,\n description,\n\ - \ last_updated_time,\n verified_access_trust_providers\nfrom\n aws_vpc_verified_access_instance;" + QueryToExecute: | + SELECT + verified_access_instance_id, + creation_time, + description, + last_updated_time, + verified_access_trust_providers + FROM + aws_vpc_verified_access_instance; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon VPC -Title: List AWS VPC Verified Access Instance Information + - Amazon VPC +Title: List AWS VPC Verified Access Instance Information \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_instance_2.yaml b/queries/aws_vpc_verified_access_instance_2.yaml old mode 100755 new mode 100644 index a18bbcad9..bf70dd845 --- a/queries/aws_vpc_verified_access_instance_2.yaml +++ b/queries/aws_vpc_verified_access_instance_2.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query AWS VPC Verified Access Instances and provides - information about the Amazon VPC verified access instances. This table can be used - to gather details such as the instance ID, instance state, instance type, and associated - tags. +Description: Allows users to query AWS VPC Verified Access Instances and provides information about the Amazon VPC verified access instances. This table can be used to gather details such as the instance ID, instance state, instance type, and associated tags. ID: aws_vpc_verified_access_instance_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_instance_id,\n creation_time,\n description,\n\ - \ last_updated_time\nfrom\n aws_vpc_verified_access_instance\nwhere\n creation_time\ - \ <= now() - interval '30' day;" + QueryToExecute: | + SELECT + verified_access_instance_id, + creation_time, + description, + last_updated_time + FROM + aws_vpc_verified_access_instance + WHERE + creation_time <= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access -Title: Find AWS VPC Verified Access Instances with Details + - VPC Verified Access +Title: Find AWS VPC Verified Access Instances with Details \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_instance_3.yaml b/queries/aws_vpc_verified_access_instance_3.yaml old mode 100755 new mode 100644 index 39da592cf..e6d02461f --- a/queries/aws_vpc_verified_access_instance_3.yaml +++ b/queries/aws_vpc_verified_access_instance_3.yaml @@ -1,30 +1,35 @@ -Description: Allows users to query AWS VPC Verified Access Instances and provides - information about the Amazon VPC verified access instances. This table can be used - to gather details such as the instance ID, instance state, instance type, and associated - tags. +Description: Allows users to query AWS VPC Verified Access Instances and provides information about the Amazon VPC verified access instances. This table can be used to gather details such as the instance ID, instance state, instance type, and associated tags. ID: aws_vpc_verified_access_instance_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n i.verified_access_instance_id,\n i.creation_time,\n\ - \ p ->> 'Description' as trust_provider_description,\n p ->> 'TrustProviderType'\ - \ as trust_provider_type,\n p ->> 'UserTrustProviderType' as user_trust_provider_type,\n\ - \ p ->> 'DeviceTrustProviderType' as device_trust_provider_type,\n p ->> 'VerifiedAccessTrustProviderId'\ - \ as verified_access_trust_provider_id,\n t.policy_reference_name as trust_access_policy_reference_name\n\ - from\n aws_vpc_verified_access_instance as i,\n aws_vpc_verified_access_trust_provider\ - \ as t,\n jsonb_array_elements(verified_access_trust_providers) as p\nwhere\n\ - \ p ->> 'VerifiedAccessTrustProviderId' = t.verified_access_trust_provider_id;" + QueryToExecute: | + SELECT + i.verified_access_instance_id, + i.creation_time, + p ->> 'Description' AS trust_provider_description, + p ->> 'TrustProviderType' AS trust_provider_type, + p ->> 'UserTrustProviderType' AS user_trust_provider_type, + p ->> 'DeviceTrustProviderType' AS device_trust_provider_type, + p ->> 'VerifiedAccessTrustProviderId' AS verified_access_trust_provider_id, + t.policy_reference_name AS trust_access_policy_reference_name + FROM + aws_vpc_verified_access_instance AS i, + aws_vpc_verified_access_trust_provider AS t, + jsonb_array_elements(verified_access_trust_providers) AS p + WHERE + p ->> 'VerifiedAccessTrustProviderId' = t.verified_access_trust_provider_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List all AWS VPC Verified Access Instances and Details + - VPC +Title: List all AWS VPC Verified Access Instances and Details \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_trust_provider_1.yaml b/queries/aws_vpc_verified_access_trust_provider_1.yaml old mode 100755 new mode 100644 index 2f51bb3a3..f10aa1007 --- a/queries/aws_vpc_verified_access_trust_provider_1.yaml +++ b/queries/aws_vpc_verified_access_trust_provider_1.yaml @@ -1,23 +1,27 @@ -Description: Allows users to query AWS VPC Verified Access Trust Providers, providing - information about the trust providers for VPC endpoints in AWS. This table can be - used to gain insights into the trust relationships between VPC endpoints and the - services they access. +Description: Allows users to query AWS VPC Verified Access Trust Providers, providing information about the trust providers for VPC endpoints in AWS. This table can be used to gain insights into the trust relationships between VPC endpoints and the services they access. ID: aws_vpc_verified_access_trust_provider_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_trust_provider_id,\n creation_time,\n\ - \ device_trust_provider_type,\n last_updated_time,\n policy_reference_name,\n\ - \ trust_provider_type\nfrom\n aws_vpc_verified_access_trust_provider;" + QueryToExecute: | + SELECT + verified_access_trust_provider_id, + creation_time, + device_trust_provider_type, + last_updated_time, + policy_reference_name, + trust_provider_type + FROM + aws_vpc_verified_access_trust_provider; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access -Title: List AWS VPC Verified Access Trust Providers + - VPC Verified Access +Title: List AWS VPC Verified Access Trust Providers \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_trust_provider_2.yaml b/queries/aws_vpc_verified_access_trust_provider_2.yaml old mode 100755 new mode 100644 index d1b4a112d..6c5d6e749 --- a/queries/aws_vpc_verified_access_trust_provider_2.yaml +++ b/queries/aws_vpc_verified_access_trust_provider_2.yaml @@ -1,26 +1,31 @@ -Description: Allows users to query AWS VPC Verified Access Trust Providers, providing - information about the trust providers for VPC endpoints in AWS. This table can be - used to gain insights into the trust relationships between VPC endpoints and the - services they access. +Description: Allows users to query AWS VPC Verified Access Trust Providers, providing information about the trust providers for VPC endpoints in AWS. This table can be used to gain insights into the trust relationships between VPC endpoints and the services they access. ID: aws_vpc_verified_access_trust_provider_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_trust_provider_id,\n creation_time,\n\ - \ device_trust_provider_type,\n last_updated_time,\n policy_reference_name,\n\ - \ trust_provider_type\nfrom\n aws_vpc_verified_access_trust_provider\nwhere\n\ - \ trust_provider_type = 'user';" + QueryToExecute: | + SELECT + verified_access_trust_provider_id, + creation_time, + device_trust_provider_type, + last_updated_time, + policy_reference_name, + trust_provider_type + FROM + aws_vpc_verified_access_trust_provider + WHERE + trust_provider_type = 'user'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC Verified Access -Title: List AWS VPC Verified Access Trust Providers' Details + - VPC Verified Access +Title: List AWS VPC Verified Access Trust Providers' Details \ No newline at end of file diff --git a/queries/aws_vpc_verified_access_trust_provider_3.yaml b/queries/aws_vpc_verified_access_trust_provider_3.yaml old mode 100755 new mode 100644 index 859b439cf..f5e045eeb --- a/queries/aws_vpc_verified_access_trust_provider_3.yaml +++ b/queries/aws_vpc_verified_access_trust_provider_3.yaml @@ -1,26 +1,30 @@ -Description: Allows users to query AWS VPC Verified Access Trust Providers, providing - information about the trust providers for VPC endpoints in AWS. This table can be - used to gain insights into the trust relationships between VPC endpoints and the - services they access. +Description: Allows users to query AWS VPC Verified Access Trust Providers, providing information about the trust providers for VPC endpoints in AWS. This table can be used to gain insights into the trust relationships between VPC endpoints and the services they access. ID: aws_vpc_verified_access_trust_provider_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n verified_access_trust_provider_id,\n creation_time,\n\ - \ last_updated_time,\n policy_reference_name,\n trust_provider_type\nfrom\n\ - \ aws_vpc_verified_access_trust_provider\nwhere\n creation_time >= now() - interval\ - \ '90' day;" + QueryToExecute: | + SELECT + verified_access_trust_provider_id, + creation_time, + last_updated_time, + policy_reference_name, + trust_provider_type + FROM + aws_vpc_verified_access_trust_provider + WHERE + creation_time >= NOW() - INTERVAL '90' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: List VPC Verified Access Trust Providers in AWS + - VPC +Title: List VPC Verified Access Trust Providers in AWS \ No newline at end of file diff --git a/queries/aws_vpc_vpn_connection_1.yaml b/queries/aws_vpc_vpn_connection_1.yaml old mode 100755 new mode 100644 index a54b6cfa4..04b6e70f8 --- a/queries/aws_vpc_vpn_connection_1.yaml +++ b/queries/aws_vpc_vpn_connection_1.yaml @@ -1,21 +1,29 @@ Description: Allows users to query VPN connections in an AWS VPC. ID: aws_vpc_vpn_connection_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_connection_id,\n state,\n type,\n vpn_gateway_id,\n\ - \ customer_gateway_id,\n region\nfrom\n aws_vpc_vpn_connection;" + QueryToExecute: | + SELECT + vpn_connection_id, + state, + type, + vpn_gateway_id, + customer_gateway_id, + region + FROM + aws_vpc_vpn_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC VPN -Title: List all VPN Connections in an AWS VPC + - VPC VPN +Title: List all VPN Connections in an AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_vpn_connection_2.yaml b/queries/aws_vpc_vpn_connection_2.yaml old mode 100755 new mode 100644 index 23acd80f4..b75343133 --- a/queries/aws_vpc_vpn_connection_2.yaml +++ b/queries/aws_vpc_vpn_connection_2.yaml @@ -1,26 +1,32 @@ Description: Allows users to query VPN connections in an AWS VPC. ID: aws_vpc_vpn_connection_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_connection_id,\n options -> 'EnableAcceleration'\ - \ as enable_acceleration,\n options ->> 'LocalIpv4NetworkCidr' as local_ipv4_network_cidr,\n\ - \ options ->> 'LocalIpv6NetworkCidr' as local_ipv6_network_cidr,\n options ->>\ - \ 'RemoteIpv4NetworkCidr' as remote_ipv4_network_cidr,\n options ->> 'RemoteIpv6NetworkCidr'\ - \ as remote_ipv6_network_cidr,\n options -> 'StaticRoutesOnly' as static_routes_only,\n\ - \ options ->> 'TunnelInsideIpVersion' as tunnel_inside_ip_version,\n options\ - \ ->> 'TunnelOptions' as tunnel_options\nfrom\n aws_vpc_vpn_connection;" + QueryToExecute: | + SELECT + vpn_connection_id, + options -> 'EnableAcceleration' AS enable_acceleration, + options ->> 'LocalIpv4NetworkCidr' AS local_ipv4_network_cidr, + options ->> 'LocalIpv6NetworkCidr' AS local_ipv6_network_cidr, + options ->> 'RemoteIpv4NetworkCidr' AS remote_ipv4_network_cidr, + options ->> 'RemoteIpv6NetworkCidr' AS remote_ipv6_network_cidr, + options -> 'StaticRoutesOnly' AS static_routes_only, + options ->> 'TunnelInsideIpVersion' AS tunnel_inside_ip_version, + options ->> 'TunnelOptions' AS tunnel_options + FROM + aws_vpc_vpn_connection; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC VPN -Title: Find VPN Connections in AWS VPC + - VPC VPN +Title: Find VPN Connections in AWS VPC \ No newline at end of file diff --git a/queries/aws_vpc_vpn_connection_3.yaml b/queries/aws_vpc_vpn_connection_3.yaml old mode 100755 new mode 100644 index 238023e1c..6a7df1d14 --- a/queries/aws_vpc_vpn_connection_3.yaml +++ b/queries/aws_vpc_vpn_connection_3.yaml @@ -1,22 +1,29 @@ Description: Allows users to query VPN connections in an AWS VPC. ID: aws_vpc_vpn_connection_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_connection_id,\n arn,\n t ->> 'Status' as status\n\ - from\n aws_vpc_vpn_connection,\n jsonb_array_elements(vgw_telemetry) as t\n\ - where t ->> 'Status' = 'UP';" + QueryToExecute: | + SELECT + vpn_connection_id, + arn, + t ->> 'Status' AS status + FROM + aws_vpc_vpn_connection, + JSONB_ARRAY_ELEMENTS(vgw_telemetry) AS t + WHERE + t ->> 'Status' = 'UP'; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC -Title: Find AWS VPC VPN Connection Using SQL + - VPC +Title: Find AWS VPC VPN Connection Using SQL \ No newline at end of file diff --git a/queries/aws_vpc_vpn_gateway_1.yaml b/queries/aws_vpc_vpn_gateway_1.yaml old mode 100755 new mode 100644 index 51455de08..3952175a5 --- a/queries/aws_vpc_vpn_gateway_1.yaml +++ b/queries/aws_vpc_vpn_gateway_1.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS VPC VPN Gateway data, providing details about - Virtual Private Cloud (VPC) VPN gateways in an AWS account. +Description: Allows users to query AWS VPC VPN Gateway data, providing details about Virtual Private Cloud (VPC) VPN gateways in an AWS account. ID: aws_vpc_vpn_gateway_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_gateway_id,\n state,\n type,\n amazon_side_asn,\n\ - \ availability_zone,\n vpc_attachments\nfrom\n aws_vpc_vpn_gateway;" + QueryToExecute: | + SELECT + vpn_gateway_id, + state, + type, + amazon_side_asn, + availability_zone, + vpc_attachments + FROM + aws_vpc_vpn_gateway; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC VPN Gateway -Title: Find AWS VPC VPN Gateway Details with SQL + - VPC VPN Gateway +Title: Find AWS VPC VPN Gateway Details with SQL \ No newline at end of file diff --git a/queries/aws_vpc_vpn_gateway_2.yaml b/queries/aws_vpc_vpn_gateway_2.yaml old mode 100755 new mode 100644 index 4efcd6549..584697032 --- a/queries/aws_vpc_vpn_gateway_2.yaml +++ b/queries/aws_vpc_vpn_gateway_2.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS VPC VPN Gateway data, providing details about - Virtual Private Cloud (VPC) VPN gateways in an AWS account. +Description: Allows users to query AWS VPC VPN Gateway data, providing details about Virtual Private Cloud (VPC) VPN gateways in an AWS account. ID: aws_vpc_vpn_gateway_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_gateway_id\nfrom\n aws_vpc_vpn_gateway\nwhere\n\ - \ vpc_attachments is null;" + QueryToExecute: | + SELECT + vpn_gateway_id + FROM + aws_vpc_vpn_gateway + WHERE + vpc_attachments IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Virtual Private Cloud (VPC) VPN Gateway -Title: List all AWS VPC VPN Gateways without VPC Attachments + - Virtual Private Cloud (VPC) VPN Gateway +Title: List all AWS VPC VPN Gateways without VPC Attachments \ No newline at end of file diff --git a/queries/aws_vpc_vpn_gateway_3.yaml b/queries/aws_vpc_vpn_gateway_3.yaml old mode 100755 new mode 100644 index 95beed150..b0189d968 --- a/queries/aws_vpc_vpn_gateway_3.yaml +++ b/queries/aws_vpc_vpn_gateway_3.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS VPC VPN Gateway data, providing details about - Virtual Private Cloud (VPC) VPN gateways in an AWS account. +Description: Allows users to query AWS VPC VPN Gateway data, providing details about Virtual Private Cloud (VPC) VPN gateways in an AWS account. ID: aws_vpc_vpn_gateway_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n vpn_gateway_id,\n vpc.is_default\nfrom\n aws_vpc_vpn_gateway\n\ - \ cross join jsonb_array_elements(vpc_attachments) as i\n join aws_vpc vpc on\ - \ i ->> 'VpcId' = vpc.vpc_id\nwhere\n vpc.is_default = true;" + QueryToExecute: | + SELECT + vpn_gateway_id, + vpc.is_default + FROM + aws_vpc_vpn_gateway + CROSS JOIN + jsonb_array_elements(vpc_attachments) AS i + JOIN + aws_vpc vpc ON i ->> 'VpcId' = vpc.vpc_id + WHERE + vpc.is_default = TRUE; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - VPC VPN Gateway -Title: List all AWS VPC VPN Gateway Details for Default VPCs + - VPC VPN Gateway +Title: List all AWS VPC VPN Gateway Details for Default VPCs \ No newline at end of file diff --git a/queries/aws_waf_rate_based_rule_1.yaml b/queries/aws_waf_rate_based_rule_1.yaml old mode 100755 new mode 100644 index 81e5bc35c..f4b85bfe1 --- a/queries/aws_waf_rate_based_rule_1.yaml +++ b/queries/aws_waf_rate_based_rule_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS WAF RateBasedRule to retrieve information about - rate-based security rules that AWS Web Application Firewall (WAF) uses. +Description: Allows users to query AWS WAF RateBasedRule to retrieve information about rate-based security rules that AWS Web Application Firewall (WAF) uses. ID: aws_waf_rate_based_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n metric_name\nfrom\n aws_waf_rate_based_rule;" + QueryToExecute: | + SELECT + name, + rule_id, + metric_name + FROM + aws_waf_rate_based_rule; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Web Application Firewall -Title: Find AWS WAF RateBasedRule info using SQL query + - Web Application Firewall +Title: Find AWS WAF RateBasedRule info using SQL query \ No newline at end of file diff --git a/queries/aws_waf_rate_based_rule_2.yaml b/queries/aws_waf_rate_based_rule_2.yaml old mode 100755 new mode 100644 index 31175e7c4..aebfe8b1f --- a/queries/aws_waf_rate_based_rule_2.yaml +++ b/queries/aws_waf_rate_based_rule_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS WAF RateBasedRule to retrieve information about - rate-based security rules that AWS Web Application Firewall (WAF) uses. +Description: Allows users to query AWS WAF RateBasedRule to retrieve information about rate-based security rules that AWS Web Application Firewall (WAF) uses. ID: aws_waf_rate_based_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n p ->> 'DataId' as data_id,\n p\ - \ ->> 'Negated' as negated,\n p ->> 'Type' as type\nfrom\n aws_waf_rate_based_rule,\n\ - \ jsonb_array_elements(predicates) as p\nwhere\n p ->> 'Negated' = 'True';" + QueryToExecute: | + SELECT + name, + rule_id, + p ->> 'DataId' AS data_id, + p ->> 'Negated' AS negated, + p ->> 'Type' AS type + FROM + aws_waf_rate_based_rule, + jsonb_array_elements(predicates) AS p + WHERE + p ->> 'Negated' = 'True'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Web Application Firewall (WAF) -Title: Find rate-based security rules in AWS WAF + - Web Application Firewall (WAF) +Title: Find rate-based security rules in AWS WAF \ No newline at end of file diff --git a/queries/aws_waf_rule_1.yaml b/queries/aws_waf_rule_1.yaml old mode 100755 new mode 100644 index a67cdf552..d9bd9740a --- a/queries/aws_waf_rule_1.yaml +++ b/queries/aws_waf_rule_1.yaml @@ -1,18 +1,24 @@ Description: Allows users to query AWS Web Application Firewall (WAF) rules. ID: aws_waf_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n metric_name\nfrom\n aws_waf_rule;" + QueryToExecute: | + SELECT + name, + rule_id, + metric_name + FROM + aws_waf_rule; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Web Application Firewall -Title: List AWS WAF Rules + - AWS Web Application Firewall +Title: List AWS WAF Rules \ No newline at end of file diff --git a/queries/aws_waf_rule_2.yaml b/queries/aws_waf_rule_2.yaml old mode 100755 new mode 100644 index 565519514..263af3291 --- a/queries/aws_waf_rule_2.yaml +++ b/queries/aws_waf_rule_2.yaml @@ -1,20 +1,27 @@ Description: Allows users to query AWS Web Application Firewall (WAF) rules. ID: aws_waf_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n p ->> 'DataId' as data_id,\n p\ - \ ->> 'Negated' as negated,\n p ->> 'Type' as type\nfrom\n aws_waf_rule,\n \ - \ jsonb_array_elements(predicates) as p;" + QueryToExecute: | + SELECT + name, + rule_id, + p ->> 'DataId' AS data_id, + p ->> 'Negated' AS negated, + p ->> 'Type' AS type + FROM + aws_waf_rule, + jsonb_array_elements(predicates) AS p; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Web Application Firewall -Title: Find all AWS WAF rules with specific details + - Web Application Firewall +Title: Find all AWS WAF rules with specific details \ No newline at end of file diff --git a/queries/aws_waf_rule_group_1.yaml b/queries/aws_waf_rule_group_1.yaml old mode 100755 new mode 100644 index 6d90831a0..68e0afe08 --- a/queries/aws_waf_rule_group_1.yaml +++ b/queries/aws_waf_rule_group_1.yaml @@ -1,24 +1,28 @@ -Description: Allows users to query AWS WAF Rule Groups to provide information about - Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security - and DevOps engineers to query rule group-specific details, including rules, actions, - and associated metadata. +Description: Allows users to query AWS WAF Rule Groups to provide information about Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security and DevOps engineers to query rule group-specific details, including rules, actions, and associated metadata. ID: aws_waf_rule_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n rule_group_id,\n metric_name,\n activated_rules\n\ - from\n aws_waf_rule_group;" + QueryToExecute: | + SELECT + name, + arn, + rule_group_id, + metric_name, + activated_rules + FROM + aws_waf_rule_group; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAF -Title: Find AWS WAF Rule Group Details with Rules and Metadata + - AWS WAF +Title: Find AWS WAF Rule Group Details with Rules and Metadata \ No newline at end of file diff --git a/queries/aws_waf_rule_group_2.yaml b/queries/aws_waf_rule_group_2.yaml old mode 100755 new mode 100644 index 793b3ed47..30bf5be7a --- a/queries/aws_waf_rule_group_2.yaml +++ b/queries/aws_waf_rule_group_2.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS WAF Rule Groups to provide information about - Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security - and DevOps engineers to query rule group-specific details, including rules, actions, - and associated metadata. +Description: Allows users to query AWS WAF Rule Groups to provide information about Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security and DevOps engineers to query rule group-specific details, including rules, actions, and associated metadata. ID: aws_waf_rule_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n rule_group_id,\n metric_name,\n activated_rules\n\ - from\n aws_waf_rule_group\nwhere\n activated_rules is null or jsonb_array_length(activated_rules)\ - \ = 0;" + QueryToExecute: | + SELECT + name, + arn, + rule_group_id, + metric_name, + activated_rules + FROM + aws_waf_rule_group + WHERE + activated_rules IS NULL OR jsonb_array_length(activated_rules) = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: Find AWS WAF Rule Groups with No Activated Rules + - WAF +Title: Find AWS WAF Rule Groups with No Activated Rules \ No newline at end of file diff --git a/queries/aws_waf_rule_group_3.yaml b/queries/aws_waf_rule_group_3.yaml old mode 100755 new mode 100644 index 36ecc0a4e..98a4b194c --- a/queries/aws_waf_rule_group_3.yaml +++ b/queries/aws_waf_rule_group_3.yaml @@ -1,26 +1,29 @@ -Description: Allows users to query AWS WAF Rule Groups to provide information about - Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security - and DevOps engineers to query rule group-specific details, including rules, actions, - and associated metadata. +Description: Allows users to query AWS WAF Rule Groups to provide information about Web Application Firewall (WAF) rule groups within AWS WAF. This table enables security and DevOps engineers to query rule group-specific details, including rules, actions, and associated metadata. ID: aws_waf_rule_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as rule_group_name,\n rule_group_id,\n a ->> 'RuleId'\ - \ as rule_id,\n a -> 'Action' ->> 'Type' as rule_action_type,\n a ->> 'Type'\ - \ as rule_type\nfrom\n aws_waf_rule_group,\n jsonb_array_elements(activated_rules)\ - \ as a;" + QueryToExecute: | + SELECT + name AS rule_group_name, + rule_group_id, + a ->> 'RuleId' AS rule_id, + a -> 'Action' ->> 'Type' AS rule_action_type, + a ->> 'Type' AS rule_type + FROM + aws_waf_rule_group, + jsonb_array_elements(activated_rules) AS a; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: Query AWS WAF Rule Groups for Security Details + - WAF +Title: Query AWS WAF Rule Groups for Security Details \ No newline at end of file diff --git a/queries/aws_waf_web_acl_1.yaml b/queries/aws_waf_web_acl_1.yaml old mode 100755 new mode 100644 index 167984f85..1ac2a94e9 --- a/queries/aws_waf_web_acl_1.yaml +++ b/queries/aws_waf_web_acl_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS WAF WebACLs to retrieve information about their - configuration, rules, and associated metadata. +Description: Allows users to query AWS WAF WebACLs to retrieve information about their configuration, rules, and associated metadata. ID: aws_waf_web_acl_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action,\n\ - \ tags\nfrom\n aws_waf_web_acl;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action, + tags + FROM + aws_waf_web_acl; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: List all AWS WAF WebACLs and their configurations + - WAF +Title: List all AWS WAF WebACLs and their configurations \ No newline at end of file diff --git a/queries/aws_waf_web_acl_2.yaml b/queries/aws_waf_web_acl_2.yaml old mode 100755 new mode 100644 index df6627cdc..fb0a67871 --- a/queries/aws_waf_web_acl_2.yaml +++ b/queries/aws_waf_web_acl_2.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query AWS WAF WebACLs to retrieve information about their - configuration, rules, and associated metadata. +Description: Allows users to query AWS WAF WebACLs to retrieve information about their configuration, rules, and associated metadata. ID: aws_waf_web_acl_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n r ->> 'RuleId' as rule_id,\n\ - \ r ->> 'Type' as rule_type,\n r ->> 'ExcludedRules' as excluded_rules,\n r\ - \ ->> 'OverrideAction' as override_action,\n r -> 'Action' ->> 'Type' as action_type\n\ - from\n aws_waf_web_acl,\n jsonb_array_elements(rules) as r;" + QueryToExecute: | + SELECT + name, + web_acl_id, + r ->> 'RuleId' AS rule_id, + r ->> 'Type' AS rule_type, + r ->> 'ExcludedRules' AS excluded_rules, + r ->> 'OverrideAction' AS override_action, + r -> 'Action' ->> 'Type' AS action_type + FROM + aws_waf_web_acl, + jsonb_array_elements(rules) AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: List all AWS WAF WebACLs configuration and rules + - WAF +Title: List all AWS WAF WebACLs configuration and rules \ No newline at end of file diff --git a/queries/aws_waf_web_acl_3.yaml b/queries/aws_waf_web_acl_3.yaml old mode 100755 new mode 100644 index 153bd9ab3..142b649cd --- a/queries/aws_waf_web_acl_3.yaml +++ b/queries/aws_waf_web_acl_3.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS WAF WebACLs to retrieve information about their - configuration, rules, and associated metadata. +Description: Allows users to query AWS WAF WebACLs to retrieve information about their configuration, rules, and associated metadata. ID: aws_waf_web_acl_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action,\n\ - \ tags\nfrom\n aws_waf_web_acl\nwhere\n rules is null;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action, + tags + FROM + aws_waf_web_acl + WHERE + rules IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAF -Title: List all AWS WAF WebACLs and their configurations + - AWS WAF +Title: List all AWS WAF WebACLs and their configurations \ No newline at end of file diff --git a/queries/aws_waf_web_acl_4.yaml b/queries/aws_waf_web_acl_4.yaml old mode 100755 new mode 100644 index 0fc6b6793..87ade91ce --- a/queries/aws_waf_web_acl_4.yaml +++ b/queries/aws_waf_web_acl_4.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS WAF WebACLs to retrieve information about their - configuration, rules, and associated metadata. +Description: Allows users to query AWS WAF WebACLs to retrieve information about their configuration, rules, and associated metadata. ID: aws_waf_web_acl_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action\n\ - from\n aws_waf_web_acl\nwhere\n default_action = 'ALLOW';" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action + FROM + aws_waf_web_acl + WHERE + default_action = 'ALLOW'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAF -Title: Find AWS WAF WebACLs and Retrieve Configurations + - AWS WAF +Title: Find AWS WAF WebACLs and Retrieve Configurations \ No newline at end of file diff --git a/queries/aws_waf_web_acl_5.yaml b/queries/aws_waf_web_acl_5.yaml old mode 100755 new mode 100644 index 75f9e2e41..dd1a0a7d8 --- a/queries/aws_waf_web_acl_5.yaml +++ b/queries/aws_waf_web_acl_5.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS WAF WebACLs to retrieve information about their - configuration, rules, and associated metadata. +Description: Allows users to query AWS WAF WebACLs to retrieve information about their configuration, rules, and associated metadata. ID: aws_waf_web_acl_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region\nfrom\n aws_waf_web_acl\n\ - where\n logging_configuration is null;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region + FROM + aws_waf_web_acl + WHERE + logging_configuration IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAF -Title: Find AWS WAF WebACL Configuration and Metadata + - AWS WAF +Title: Find AWS WAF WebACL Configuration and Metadata \ No newline at end of file diff --git a/queries/aws_wafregional_rule_1.yaml b/queries/aws_wafregional_rule_1.yaml old mode 100755 new mode 100644 index 5ffc84c2f..8011b78a2 --- a/queries/aws_wafregional_rule_1.yaml +++ b/queries/aws_wafregional_rule_1.yaml @@ -1,22 +1,26 @@ -Description: Allows users to query AWS WAF Regional Rules for detailed information - about each rule, including its ID, metric name, name, and the predicates associated - with it. +Description: Allows users to query AWS WAF Regional Rules for detailed information about each rule, including its ID, metric name, name, and the predicates associated with it. ID: aws_wafregional_rule_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n metric_name\nfrom\n aws_wafregional_rule;" + QueryToExecute: | + SELECT + name, + rule_id, + metric_name + FROM + aws_wafregional_rule; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: List AWS WAF Regional Rules and Details + - WAF +Title: List AWS WAF Regional Rules and Details \ No newline at end of file diff --git a/queries/aws_wafregional_rule_2.yaml b/queries/aws_wafregional_rule_2.yaml old mode 100755 new mode 100644 index f110d4b45..542f3c5f1 --- a/queries/aws_wafregional_rule_2.yaml +++ b/queries/aws_wafregional_rule_2.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS WAF Regional Rules for detailed information - about each rule, including its ID, metric name, name, and the predicates associated - with it. +Description: Allows users to query AWS WAF Regional Rules for detailed information about each rule, including its ID, metric name, name, and the predicates associated with it. ID: aws_wafregional_rule_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n rule_id,\n p ->> 'DataId' as data_id,\n p\ - \ ->> 'Negated' as negated,\n p ->> 'Type' as type\nfrom\n aws_wafregional_rule,\n\ - \ jsonb_array_elements(predicates) as p;" + QueryToExecute: | + SELECT + name, + rule_id, + p ->> 'DataId' AS data_id, + p ->> 'Negated' AS negated, + p ->> 'Type' AS type + FROM + aws_wafregional_rule, + jsonb_array_elements(predicates) AS p; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF -Title: List all AWS WAF Regional Rules with Details + - WAF +Title: List all AWS WAF Regional Rules with Details \ No newline at end of file diff --git a/queries/aws_wafregional_rule_group_1.yaml b/queries/aws_wafregional_rule_group_1.yaml old mode 100755 new mode 100644 index aef8d4240..80e1c63af --- a/queries/aws_wafregional_rule_group_1.yaml +++ b/queries/aws_wafregional_rule_group_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS WAF Regional Rule Groups to gather information - about each rule group''s metadata, associated rules, and other relevant details. +Description: Allows users to query AWS WAF Regional Rule Groups to gather information about each rule group's metadata, associated rules, and other relevant details. ID: aws_wafregional_rule_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n rule_group_id,\n metric_name,\n activated_rules,\n\ - \ region\nfrom\n aws_wafregional_rule_group;" + QueryToExecute: | + SELECT + name, + arn, + rule_group_id, + metric_name, + activated_rules, + region + FROM + aws_wafregional_rule_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: Find AWS WAF Regional Rule Groups Metadata and Details + - WAF Regional +Title: Find AWS WAF Regional Rule Groups Metadata and Details \ No newline at end of file diff --git a/queries/aws_wafregional_rule_group_2.yaml b/queries/aws_wafregional_rule_group_2.yaml old mode 100755 new mode 100644 index b176568a7..588ed9714 --- a/queries/aws_wafregional_rule_group_2.yaml +++ b/queries/aws_wafregional_rule_group_2.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS WAF Regional Rule Groups to gather information - about each rule group''s metadata, associated rules, and other relevant details. +Description: Allows users to query AWS WAF Regional Rule Groups to gather information about each rule group's metadata, associated rules, and other relevant details. ID: aws_wafregional_rule_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n arn,\n rule_group_id,\n metric_name,\n activated_rules\n\ - from\n aws_wafregional_rule_group\nwhere\n activated_rules is null or jsonb_array_length(activated_rules)\ - \ = 0;" + QueryToExecute: | + SELECT + name, + arn, + rule_group_id, + metric_name, + activated_rules + FROM + aws_wafregional_rule_group + WHERE + activated_rules IS NULL OR jsonb_array_length(activated_rules) = 0; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: List all AWS WAF Regional Rule Groups + - WAF Regional +Title: List all AWS WAF Regional Rule Groups \ No newline at end of file diff --git a/queries/aws_wafregional_rule_group_3.yaml b/queries/aws_wafregional_rule_group_3.yaml old mode 100755 new mode 100644 index 13827132d..ad63cee53 --- a/queries/aws_wafregional_rule_group_3.yaml +++ b/queries/aws_wafregional_rule_group_3.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query AWS WAF Regional Rule Groups to gather information - about each rule group''s metadata, associated rules, and other relevant details. +Description: Allows users to query AWS WAF Regional Rule Groups to gather information about each rule group's metadata, associated rules, and other relevant details. ID: aws_wafregional_rule_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name as rule_group_name,\n rule_group_id,\n a ->> 'RuleId'\ - \ as rule_id,\n a -> 'Action' ->> 'Type' as rule_action_type,\n a ->> 'Type'\ - \ as rule_type\nfrom\n aws_wafregional_rule_group,\n jsonb_array_elements(activated_rules)\ - \ as a;" + QueryToExecute: | + SELECT + name AS rule_group_name, + rule_group_id, + a ->> 'RuleId' AS rule_id, + a -> 'Action' ->> 'Type' AS rule_action_type, + a ->> 'Type' AS rule_type + FROM + aws_wafregional_rule_group, + jsonb_array_elements(activated_rules) AS a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: List all AWS WAF Regional Rule Groups and Details + - WAF Regional +Title: List all AWS WAF Regional Rule Groups and Details \ No newline at end of file diff --git a/queries/aws_wafregional_web_acl_1.yaml b/queries/aws_wafregional_web_acl_1.yaml old mode 100755 new mode 100644 index 2ab1c312e..050e72544 --- a/queries/aws_wafregional_web_acl_1.yaml +++ b/queries/aws_wafregional_web_acl_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS WAF Regional WebACL to get information about - AWS WAF Regional WebACLs. +Description: Allows users to query AWS WAF Regional WebACL to get information about AWS WAF Regional WebACLs. ID: aws_wafregional_web_acl_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action,\n\ - \ tags\nfrom\n aws_wafregional_web_acl;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action, + tags + FROM + aws_wafregional_web_acl; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: List all AWS WAF Regional WebACL Information + - WAF Regional +Title: List all AWS WAF Regional WebACL Information \ No newline at end of file diff --git a/queries/aws_wafregional_web_acl_2.yaml b/queries/aws_wafregional_web_acl_2.yaml old mode 100755 new mode 100644 index d42f05790..ed2a2d611 --- a/queries/aws_wafregional_web_acl_2.yaml +++ b/queries/aws_wafregional_web_acl_2.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS WAF Regional WebACL to get information about - AWS WAF Regional WebACLs. +Description: Allows users to query AWS WAF Regional WebACL to get information about AWS WAF Regional WebACLs. ID: aws_wafregional_web_acl_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n r ->> 'RuleId' as rule_id,\n\ - \ r ->> 'Type' as rule_type,\n r ->> 'ExcludedRules' as excluded_rules,\n r\ - \ ->> 'OverrideAction' as override_action,\n r -> 'Action' ->> 'Type' as action_type\n\ - from\n aws_wafregional_web_acl,\n jsonb_array_elements(rules) as r;" + QueryToExecute: | + SELECT + name, + web_acl_id, + r ->> 'RuleId' AS rule_id, + r ->> 'Type' AS rule_type, + r ->> 'ExcludedRules' AS excluded_rules, + r ->> 'OverrideAction' AS override_action, + r -> 'Action' ->> 'Type' AS action_type + FROM + aws_wafregional_web_acl, + JSONB_ARRAY_ELEMENTS(rules) AS r; Tags: cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: List all AWS WAF Regional WebACLs information + - WAF Regional +Title: List all AWS WAF Regional WebACLs information \ No newline at end of file diff --git a/queries/aws_wafregional_web_acl_3.yaml b/queries/aws_wafregional_web_acl_3.yaml old mode 100755 new mode 100644 index 570bcf7f0..a9c49d5d4 --- a/queries/aws_wafregional_web_acl_3.yaml +++ b/queries/aws_wafregional_web_acl_3.yaml @@ -1,20 +1,29 @@ -Description: Allows users to query AWS WAF Regional WebACL to get information about - AWS WAF Regional WebACLs. +Description: Allows users to query AWS WAF Regional WebACL to get information about AWS WAF Regional WebACLs. ID: aws_wafregional_web_acl_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action,\n\ - \ tags\nfrom\n aws_wafregional_web_acl\nwhere\n rules is null;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action, + tags + FROM + aws_wafregional_web_acl + WHERE + rules IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional WebACL -Title: Find AWS WAF Regional WebACL Information + - WAF Regional WebACL +Title: Find AWS WAF Regional WebACL Information \ No newline at end of file diff --git a/queries/aws_wafregional_web_acl_4.yaml b/queries/aws_wafregional_web_acl_4.yaml old mode 100755 new mode 100644 index ad558a420..8661bfb0e --- a/queries/aws_wafregional_web_acl_4.yaml +++ b/queries/aws_wafregional_web_acl_4.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS WAF Regional WebACL to get information about - AWS WAF Regional WebACLs. +Description: Allows users to query AWS WAF Regional WebACL to get information about AWS WAF Regional WebACLs. ID: aws_wafregional_web_acl_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region,\n default_action\n\ - from\n aws_wafregional_web_acl\nwhere\n default_action = 'ALLOW';" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region, + default_action + FROM + aws_wafregional_web_acl + WHERE + default_action = 'ALLOW'; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAF Regional -Title: Find AWS WAF Regional WebACL Details + - AWS WAF Regional +Title: Find AWS WAF Regional WebACL Details \ No newline at end of file diff --git a/queries/aws_wafregional_web_acl_5.yaml b/queries/aws_wafregional_web_acl_5.yaml old mode 100755 new mode 100644 index 52cf04a7d..57837ebf6 --- a/queries/aws_wafregional_web_acl_5.yaml +++ b/queries/aws_wafregional_web_acl_5.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS WAF Regional WebACL to get information about - AWS WAF Regional WebACLs. +Description: Allows users to query AWS WAF Regional WebACL to get information about AWS WAF Regional WebACLs. ID: aws_wafregional_web_acl_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n web_acl_id,\n arn,\n region\nfrom\n aws_wafregional_web_acl\n\ - where\n logging_configuration is null;" + QueryToExecute: | + SELECT + name, + web_acl_id, + arn, + region + FROM + aws_wafregional_web_acl + WHERE + logging_configuration IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAF Regional -Title: Find all AWS WAF Regional WebACL Details + - WAF Regional +Title: Find all AWS WAF Regional WebACL Details \ No newline at end of file diff --git a/queries/aws_wafv2_ip_set_1.yaml b/queries/aws_wafv2_ip_set_1.yaml old mode 100755 new mode 100644 index c76f283a3..f2a8574e3 --- a/queries/aws_wafv2_ip_set_1.yaml +++ b/queries/aws_wafv2_ip_set_1.yaml @@ -1,22 +1,31 @@ -Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, - IP address version, and associated metadata. +Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, IP address version, and associated metadata. ID: aws_wafv2_ip_set_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n addresses,\n\ - \ ip_address_version,\n region\nfrom\n aws_wafv2_ip_set;" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + addresses, + ip_address_version, + region + FROM + aws_wafv2_ip_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: List all AWS WAFv2 IPSets with Detailed Information + - AWS WAFv2 +Title: List all AWS WAFv2 IPSets with Detailed Information \ No newline at end of file diff --git a/queries/aws_wafv2_ip_set_2.yaml b/queries/aws_wafv2_ip_set_2.yaml old mode 100755 new mode 100644 index 16b56eb8d..95fd43237 --- a/queries/aws_wafv2_ip_set_2.yaml +++ b/queries/aws_wafv2_ip_set_2.yaml @@ -1,20 +1,31 @@ -Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, - IP address version, and associated metadata. +Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, IP address version, and associated metadata. ID: aws_wafv2_ip_set_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n addresses,\n\ - \ ip_address_version,\n region\nfrom\n aws_wafv2_ip_set\nwhere\n scope = 'CLOUDFRONT';" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + addresses, + ip_address_version, + region + FROM + aws_wafv2_ip_set + WHERE + scope = 'CLOUDFRONT'; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: List all AWS WAFv2 IPSet Information with Metadata + - WAFv2 +Title: List all AWS WAFv2 IPSet Information with Metadata \ No newline at end of file diff --git a/queries/aws_wafv2_ip_set_3.yaml b/queries/aws_wafv2_ip_set_3.yaml old mode 100755 new mode 100644 index dadf2da53..8bae1e45a --- a/queries/aws_wafv2_ip_set_3.yaml +++ b/queries/aws_wafv2_ip_set_3.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, - IP address version, and associated metadata. +Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, IP address version, and associated metadata. ID: aws_wafv2_ip_set_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n addresses,\n\ - \ ip_address_version,\n region\nfrom\n aws_wafv2_ip_set\nwhere\n ip_address_version\ - \ = 'IPV4';" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + addresses, + ip_address_version, + region + FROM + aws_wafv2_ip_set + WHERE + ip_address_version = 'IPV4'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find AWS WAFv2 IPSet Information including IP Addresses + - WAFv2 +Title: Find AWS WAFv2 IPSet Information including IP Addresses \ No newline at end of file diff --git a/queries/aws_wafv2_ip_set_4.yaml b/queries/aws_wafv2_ip_set_4.yaml old mode 100755 new mode 100644 index 3f424d224..0135c2156 --- a/queries/aws_wafv2_ip_set_4.yaml +++ b/queries/aws_wafv2_ip_set_4.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, - IP address version, and associated metadata. +Description: Allows users to query AWS WAFv2 IPSet information, including IP addresses, IP address version, and associated metadata. ID: aws_wafv2_ip_set_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n ip_address_version,\n\ - \ region,\n address\nfrom\n aws_wafv2_ip_set,\n jsonb_array_elements_text(addresses)\ - \ as address\nwhere\n address = '1.2.3.4/32';" + QueryToExecute: | + SELECT + name, + description, + arn, + ip_address_version, + region, + address + FROM + aws_wafv2_ip_set, + jsonb_array_elements_text(addresses) AS address + WHERE + address = '1.2.3.4/32'; Tags: cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find AWS WAFv2 IPSet Information including IP Addresses + - WAFv2 +Title: Find AWS WAFv2 IPSet Information including IP Addresses \ No newline at end of file diff --git a/queries/aws_wafv2_regex_pattern_set_1.yaml b/queries/aws_wafv2_regex_pattern_set_1.yaml old mode 100755 new mode 100644 index 1b05e2915..8ff7f6eec --- a/queries/aws_wafv2_regex_pattern_set_1.yaml +++ b/queries/aws_wafv2_regex_pattern_set_1.yaml @@ -1,20 +1,28 @@ -Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details - about the regex pattern sets used in AWS WAFv2 to filter web requests. +Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details about the regex pattern sets used in AWS WAFv2 to filter web requests. ID: aws_wafv2_regex_pattern_set_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n regular_expressions,\n\ - \ region\nfrom\n aws_wafv2_regex_pattern_set;" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + regular_expressions, + region + FROM + aws_wafv2_regex_pattern_set; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: List all AWS WAFv2 Regex Pattern Sets in Steampipe + - WAFv2 +Title: List all AWS WAFv2 Regex Pattern Sets in Steampipe \ No newline at end of file diff --git a/queries/aws_wafv2_regex_pattern_set_2.yaml b/queries/aws_wafv2_regex_pattern_set_2.yaml old mode 100755 new mode 100644 index 7c7063cc2..207dd44b5 --- a/queries/aws_wafv2_regex_pattern_set_2.yaml +++ b/queries/aws_wafv2_regex_pattern_set_2.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details - about the regex pattern sets used in AWS WAFv2 to filter web requests. +Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details about the regex pattern sets used in AWS WAFv2 to filter web requests. ID: aws_wafv2_regex_pattern_set_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n regular_expressions,\n\ - \ region\nfrom\n aws_wafv2_regex_pattern_set\nwhere\n scope = 'CLOUDFRONT';" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + regular_expressions, + region + FROM + aws_wafv2_regex_pattern_set + WHERE + scope = 'CLOUDFRONT'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: Find AWS WAFv2 Regex Pattern Sets in CloudFront + - AWS WAFv2 +Title: Find AWS WAFv2 Regex Pattern Sets in CloudFront \ No newline at end of file diff --git a/queries/aws_wafv2_regex_pattern_set_3.yaml b/queries/aws_wafv2_regex_pattern_set_3.yaml old mode 100755 new mode 100644 index b4f37ceaf..75acf7b89 --- a/queries/aws_wafv2_regex_pattern_set_3.yaml +++ b/queries/aws_wafv2_regex_pattern_set_3.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details - about the regex pattern sets used in AWS WAFv2 to filter web requests. +Description: Allows users to query AWS WAFv2 Regex Pattern Set data, providing details about the regex pattern sets used in AWS WAFv2 to filter web requests. ID: aws_wafv2_regex_pattern_set_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n wrps.id,\n scope,\n\ - \ regular_expressions,\n region\nfrom\n aws_wafv2_regex_pattern_set as wrps,\n\ - \ jsonb_array_elements_text(regular_expressions) as regex\nwhere\n regex = '^steampipe';" + QueryToExecute: | + SELECT + name, + description, + arn, + wrps.id, + scope, + regular_expressions, + region + FROM + aws_wafv2_regex_pattern_set AS wrps, + jsonb_array_elements_text(regular_expressions) AS regex + WHERE + regex = '^steampipe'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: Find all AWS WAFv2 Regex Pattern Set data details + - AWS WAFv2 +Title: Find all AWS WAFv2 Regex Pattern Set data details \ No newline at end of file diff --git a/queries/aws_wafv2_rule_group_1.yaml b/queries/aws_wafv2_rule_group_1.yaml old mode 100755 new mode 100644 index ab40b7610..ae976f9ed --- a/queries/aws_wafv2_rule_group_1.yaml +++ b/queries/aws_wafv2_rule_group_1.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS WAFv2 Rule Groups and gather information such - as the group''s ARN, capacity, description, rules, visibility configuration, and - more. +Description: Allows users to query AWS WAFv2 Rule Groups and gather information such as the group's ARN, capacity, description, rules, visibility configuration, and more. ID: aws_wafv2_rule_group_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n capacity,\n\ - \ rules,\n region\nfrom\n aws_wafv2_rule_group;" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + capacity, + rules, + region + FROM + aws_wafv2_rule_group; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: List all AWS WAFv2 Rule Groups and their details + - AWS WAFv2 +Title: List all AWS WAFv2 Rule Groups and their details \ No newline at end of file diff --git a/queries/aws_wafv2_rule_group_2.yaml b/queries/aws_wafv2_rule_group_2.yaml old mode 100755 new mode 100644 index 0c613248c..d0095af96 --- a/queries/aws_wafv2_rule_group_2.yaml +++ b/queries/aws_wafv2_rule_group_2.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS WAFv2 Rule Groups and gather information such - as the group''s ARN, capacity, description, rules, visibility configuration, and - more. +Description: Allows users to query AWS WAFv2 Rule Groups and gather information such as the group's ARN, capacity, description, rules, visibility configuration, and more. ID: aws_wafv2_rule_group_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n capacity,\n\ - \ region\nfrom\n aws_wafv2_rule_group\nwhere\n scope = 'CLOUDFRONT';" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + capacity, + region + FROM + aws_wafv2_rule_group + WHERE + scope = 'CLOUDFRONT'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: List all AWS WAFv2 Rule Groups with Capacity and Details + - WAFv2 +Title: List all AWS WAFv2 Rule Groups with Capacity and Details \ No newline at end of file diff --git a/queries/aws_wafv2_rule_group_3.yaml b/queries/aws_wafv2_rule_group_3.yaml old mode 100755 new mode 100644 index e0e749c71..2f45942eb --- a/queries/aws_wafv2_rule_group_3.yaml +++ b/queries/aws_wafv2_rule_group_3.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS WAFv2 Rule Groups and gather information such - as the group''s ARN, capacity, description, rules, visibility configuration, and - more. +Description: Allows users to query AWS WAFv2 Rule Groups and gather information such as the group's ARN, capacity, description, rules, visibility configuration, and more. ID: aws_wafv2_rule_group_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n description,\n arn,\n id,\n scope,\n capacity,\n\ - \ region\nfrom\n aws_wafv2_rule_group\nwhere\n capacity < 5;" + QueryToExecute: | + SELECT + name, + description, + arn, + id, + scope, + capacity, + region + FROM + aws_wafv2_rule_group + WHERE + capacity < 5; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: List AWS WAFv2 Rule Groups with Capacity Info + - WAFv2 +Title: List AWS WAFv2 Rule Groups with Capacity Info \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_1.yaml b/queries/aws_wafv2_web_acl_1.yaml old mode 100755 new mode 100644 index 142a43aa8..112b19e3a --- a/queries/aws_wafv2_web_acl_1.yaml +++ b/queries/aws_wafv2_web_acl_1.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n scope,\n description,\n capacity,\n\ - \ managed_by_firewall_manager\nfrom\n aws_wafv2_web_acl;" + QueryToExecute: | + SELECT + name, + id, + scope, + description, + capacity, + managed_by_firewall_manager + FROM + aws_wafv2_web_acl; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find AWS WAFv2 WebACL Resources Information + - WAFv2 +Title: Find AWS WAFv2 WebACL Resources Information \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_2.yaml b/queries/aws_wafv2_web_acl_2.yaml old mode 100755 new mode 100644 index c2c1d2cd9..660152769 --- a/queries/aws_wafv2_web_acl_2.yaml +++ b/queries/aws_wafv2_web_acl_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n visibility_config ->> 'CloudWatchMetricsEnabled'\ - \ as cloud_watch_metrics_enabled,\n visibility_config ->> 'MetricName' as metric_name\n\ - from\n aws_wafv2_web_acl;" + QueryToExecute: | + SELECT + name, + id, + visibility_config ->> 'CloudWatchMetricsEnabled' AS cloud_watch_metrics_enabled, + visibility_config ->> 'MetricName' AS metric_name + FROM + aws_wafv2_web_acl; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: List all AWS WAFv2 WebACLs and their Metric Names + - AWS WAFv2 +Title: List all AWS WAFv2 WebACLs and their Metric Names \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_3.yaml b/queries/aws_wafv2_web_acl_3.yaml old mode 100755 new mode 100644 index 272a841a3..b0a10f350 --- a/queries/aws_wafv2_web_acl_3.yaml +++ b/queries/aws_wafv2_web_acl_3.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n visibility_config ->> 'SampledRequestsEnabled'\ - \ as sampled_requests_enabled\nfrom\n aws_wafv2_web_acl\nwhere\n visibility_config\ - \ ->> 'SampledRequestsEnabled' = 'false';" + QueryToExecute: | + SELECT + name, + id, + visibility_config ->> 'SampledRequestsEnabled' AS sampled_requests_enabled + FROM + aws_wafv2_web_acl + WHERE + visibility_config ->> 'SampledRequestsEnabled' = 'false'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find all AWS WAFv2 WebACLs with Disabled Sampled Requests + - WAFv2 +Title: Find all AWS WAFv2 WebACLs with Disabled Sampled Requests \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_4.yaml b/queries/aws_wafv2_web_acl_4.yaml old mode 100755 new mode 100644 index 4815e02f8..e2fa8aff6 --- a/queries/aws_wafv2_web_acl_4.yaml +++ b/queries/aws_wafv2_web_acl_4.yaml @@ -1,34 +1,41 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n r ->> 'Name' as name,\n r -> 'Statement'\ - \ ->> 'AndStatement' as and_statement,\n r -> 'Statement' ->> 'ByteMatchStatement'\ - \ as byte_match_statement,\n r -> 'Statement' ->> 'GeoMatchStatement' as geo_match_statement,\n\ - \ r -> 'Statement' ->> 'IPSetReferenceStatement' as ip_set_reference_statement,\n\ - \ r -> 'Statement' ->> 'NotStatement' as not_statement,\n r -> 'Statement' ->>\ - \ 'OrStatement' as or_statement,\n r -> 'Statement' ->> 'RateBasedStatement'\ - \ as rate_based_statement,\n r -> 'Statement' ->> 'RegexPatternSetReferenceStatement'\ - \ as regex_pattern_set_reference_statement,\n r -> 'Statement' ->> 'RuleGroupReferenceStatement'\ - \ as rule_group_reference_statement,\n r -> 'Statement' ->> 'SizeConstraintStatement'\ - \ as size_constraint_statement,\n r -> 'Statement' ->> 'SqliMatchStatement' as\ - \ sql_match_statement,\n r -> 'Statement' ->> 'XssMatchStatement' as xss_match_statement\n\ - from\n aws_wafv2_web_acl,\n jsonb_array_elements(rules) as r;" + QueryToExecute: | + SELECT + name, + id, + r ->> 'Name' AS name, + r -> 'Statement' ->> 'AndStatement' AS and_statement, + r -> 'Statement' ->> 'ByteMatchStatement' AS byte_match_statement, + r -> 'Statement' ->> 'GeoMatchStatement' AS geo_match_statement, + r -> 'Statement' ->> 'IPSetReferenceStatement' AS ip_set_reference_statement, + r -> 'Statement' ->> 'NotStatement' AS not_statement, + r -> 'Statement' ->> 'OrStatement' AS or_statement, + r -> 'Statement' ->> 'RateBasedStatement' AS rate_based_statement, + r -> 'Statement' ->> 'RegexPatternSetReferenceStatement' AS regex_pattern_set_reference_statement, + r -> 'Statement' ->> 'RuleGroupReferenceStatement' AS rule_group_reference_statement, + r -> 'Statement' ->> 'SizeConstraintStatement' AS size_constraint_statement, + r -> 'Statement' ->> 'SqliMatchStatement' AS sql_match_statement, + r -> 'Statement' ->> 'XssMatchStatement' AS xss_match_statement + FROM + aws_wafv2_web_acl, + jsonb_array_elements(rules) AS r; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: List AWS WAFv2 WebACLs and Manage Information + - AWS WAFv2 +Title: List AWS WAFv2 WebACLs and Manage Information \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_5.yaml b/queries/aws_wafv2_web_acl_5.yaml old mode 100755 new mode 100644 index e6ed08c6b..73fe1502f --- a/queries/aws_wafv2_web_acl_5.yaml +++ b/queries/aws_wafv2_web_acl_5.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n scope,\n region\nfrom\n aws_wafv2_web_acl\n\ - where\n scope = 'REGIONAL';" + QueryToExecute: | + SELECT + name, + id, + scope, + region + FROM + aws_wafv2_web_acl + WHERE + scope = 'REGIONAL'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find AWS WAFv2 WebACLs and Manage WebACL Resources + - WAFv2 +Title: Find AWS WAFv2 WebACLs and Manage WebACL Resources \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_6.yaml b/queries/aws_wafv2_web_acl_6.yaml old mode 100755 new mode 100644 index 6a8db9059..5318652d6 --- a/queries/aws_wafv2_web_acl_6.yaml +++ b/queries/aws_wafv2_web_acl_6.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n id,\n scope,\n region\nfrom\n aws_wafv2_web_acl\n\ - where\n logging_configuration is null;" + QueryToExecute: | + SELECT + name, + id, + scope, + region + FROM + aws_wafv2_web_acl + WHERE + logging_configuration IS NULL; Tags: cloud_asset_management: - - 'true' + - "true" cloud_network_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WAFv2 -Title: Find WebACL Resources in AWS WAFv2 Without Logging + - AWS WAFv2 +Title: Find WebACL Resources in AWS WAFv2 Without Logging \ No newline at end of file diff --git a/queries/aws_wafv2_web_acl_7.yaml b/queries/aws_wafv2_web_acl_7.yaml old mode 100755 new mode 100644 index 791c5879d..0f5ea7df5 --- a/queries/aws_wafv2_web_acl_7.yaml +++ b/queries/aws_wafv2_web_acl_7.yaml @@ -1,25 +1,32 @@ -Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information - about WebACL resources within AWS WAFv2. +Description: Allows users to query AWS WAFv2 WebACLs to retrieve and manage information about WebACL resources within AWS WAFv2. ID: aws_wafv2_web_acl_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lb.name as application_load_balancer_name,\n w.name\ - \ as web_acl_name,\n w.id as web_acl_id,\n w.scope as web_acl_scope,\n lb.type\ - \ as application_load_balancer_type\nfrom\n aws_ec2_application_load_balancer\ - \ as lb,\n aws_wafv2_web_acl as w,\n jsonb_array_elements_text(associated_resources)\ - \ as arns\nwhere\n lb.arn = arns;" + QueryToExecute: | + SELECT + lb.name AS application_load_balancer_name, + w.name AS web_acl_name, + w.id AS web_acl_id, + w.scope AS web_acl_scope, + lb.type AS application_load_balancer_type + FROM + aws_ec2_application_load_balancer AS lb, + aws_wafv2_web_acl AS w, + jsonb_array_elements_text(associated_resources) AS arns + WHERE + lb.arn = arns; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WAFv2 -Title: Find AWS WAFv2 WebACLs and Associated Load Balancers + - WAFv2 +Title: Find AWS WAFv2 WebACLs and Associated Load Balancers \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_1.yaml b/queries/aws_wellarchitected_answer_1.yaml old mode 100755 new mode 100644 index 22ea46ae8..ce75ca4b3 --- a/queries/aws_wellarchitected_answer_1.yaml +++ b/queries/aws_wellarchitected_answer_1.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.question_id,\n a.lens_alias,\n a.workload_id,\n \ - \ a.is_applicable,\n a.pillar_id,\n a.question_title,\n a.risk,\n a.reason,\n\ - \ a.region\nfrom\n aws_wellarchitected_answer a;" + QueryToExecute: | + SELECT + a.question_id, + a.lens_alias, + a.workload_id, + a.is_applicable, + a.pillar_id, + a.question_title, + a.risk, + a.reason, + a.region + FROM + aws_wellarchitected_answer a; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List All AWS Well-Architected Tool Answer Data + - Well-Architected Tool +Title: List All AWS Well-Architected Tool Answer Data \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_2.yaml b/queries/aws_wellarchitected_answer_2.yaml old mode 100755 new mode 100644 index fd393e53d..446182ba7 --- a/queries/aws_wellarchitected_answer_2.yaml +++ b/queries/aws_wellarchitected_answer_2.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.workload_id,\n a.pillar_id,\n count(a.question_id)\ - \ as total_questions\nfrom\n aws_wellarchitected_answer a\ngroup by\n a.workload_id,\n\ - \ a.pillar_id;" + QueryToExecute: | + SELECT + a.workload_id, + a.pillar_id, + COUNT(a.question_id) AS total_questions + FROM + aws_wellarchitected_answer a + GROUP BY + a.workload_id, + a.pillar_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Answers by Workload and Pillar + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Answers by Workload and Pillar \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_3.yaml b/queries/aws_wellarchitected_answer_3.yaml old mode 100755 new mode 100644 index 6fb7ef7fa..777dcc5b5 --- a/queries/aws_wellarchitected_answer_3.yaml +++ b/queries/aws_wellarchitected_answer_3.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.question_id,\n a.lens_alias,\n a.workload_id,\n \ - \ a.question_title,\n a.question_description,\n c ->> 'Title' as choice_title,\n\ - \ c ->> 'ChoiceId' as choice_id,\n c ->> 'Description' as choice_description,\n\ - \ c ->> 'HelpfulResource' as choice_helpful_resource,\n c ->> 'ImprovementPlan'\ - \ as choice_improvement_plan\nfrom\n aws_wellarchitected_answer a,\n jsonb_array_elements(choices)\ - \ c;" + QueryToExecute: | + SELECT + a.question_id, + a.lens_alias, + a.workload_id, + a.question_title, + a.question_description, + c ->> 'Title' AS choice_title, + c ->> 'ChoiceId' AS choice_id, + c ->> 'Description' AS choice_description, + c ->> 'HelpfulResource' AS choice_helpful_resource, + c ->> 'ImprovementPlan' AS choice_improvement_plan + FROM + aws_wellarchitected_answer a, + jsonb_array_elements(choices) c; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Answer Data + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Answer Data \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_4.yaml b/queries/aws_wellarchitected_answer_4.yaml old mode 100755 new mode 100644 index 40eb770c5..66725dfc7 --- a/queries/aws_wellarchitected_answer_4.yaml +++ b/queries/aws_wellarchitected_answer_4.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.question_id,\n a.lens_alias,\n a.workload_id,\n \ - \ a.question_title,\n a.question_description,\n c ->> 'Notes' as choice_notes,\n\ - \ c ->> 'Reason' as choice_reason,\n c ->> 'Status' as choice_status,\n c ->>\ - \ 'ChoiceId' as choice_id\nfrom\n aws_wellarchitected_answer a,\n jsonb_array_elements(choice_answers)\ - \ c;" + QueryToExecute: | + SELECT + a.question_id, + a.lens_alias, + a.workload_id, + a.question_title, + a.question_description, + c ->> 'Notes' AS choice_notes, + c ->> 'Reason' AS choice_reason, + c ->> 'Status' AS choice_status, + c ->> 'ChoiceId' AS choice_id + FROM + aws_wellarchitected_answer a, + jsonb_array_elements(choice_answers) c; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Answer Data + - Well-Architected Tool +Title: List AWS Well-Architected Tool Answer Data \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_5.yaml b/queries/aws_wellarchitected_answer_5.yaml old mode 100755 new mode 100644 index 80157b921..1b40f1422 --- a/queries/aws_wellarchitected_answer_5.yaml +++ b/queries/aws_wellarchitected_answer_5.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.question_id,\n a.lens_alias,\n a.workload_id,\n \ - \ a.question_title,\n a.question_description,\n reason\nfrom\n aws_wellarchitected_answer\ - \ a\nwhere\n not is_applicable;" + QueryToExecute: | + SELECT + a.question_id, + a.lens_alias, + a.workload_id, + a.question_title, + a.question_description, + a.reason + FROM + aws_wellarchitected_answer a + WHERE + NOT a.is_applicable; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tools Answers and Details + - Well-Architected Tool +Title: List all AWS Well-Architected Tools Answers and Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_6.yaml b/queries/aws_wellarchitected_answer_6.yaml old mode 100755 new mode 100644 index cc3343b20..f7701c2d9 --- a/queries/aws_wellarchitected_answer_6.yaml +++ b/queries/aws_wellarchitected_answer_6.yaml @@ -1,25 +1,36 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n a.question_id,\n a.lens_alias,\n a.workload_id,\n \ - \ a.question_title,\n a.risk,\n c ->> 'ChoiceId' as choice_id,\n c ->> 'Status'\ - \ as choice_status,\n c ->> 'Reason' as choice_reason,\n c ->> 'Notes' as choice_notes\n\ - from\n aws_wellarchitected_answer a,\n jsonb_array_elements(choice_answers)\ - \ c\nwhere\n risk = 'HIGH'\n or risk = 'MEDIUM';" + QueryToExecute: | + SELECT + a.question_id, + a.lens_alias, + a.workload_id, + a.question_title, + a.risk, + c ->> 'ChoiceId' AS choice_id, + c ->> 'Status' AS choice_status, + c ->> 'Reason' AS choice_reason, + c ->> 'Notes' AS choice_notes + FROM + aws_wellarchitected_answer a, + jsonb_array_elements(choice_answers) c + WHERE + risk = 'HIGH' + OR risk = 'MEDIUM'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List All AWS Well-Architected Tool Answer Data + - Well-Architected Tool +Title: List All AWS Well-Architected Tool Answer Data \ No newline at end of file diff --git a/queries/aws_wellarchitected_answer_7.yaml b/queries/aws_wellarchitected_answer_7.yaml old mode 100755 new mode 100644 index a026a95d9..f91c45988 --- a/queries/aws_wellarchitected_answer_7.yaml +++ b/queries/aws_wellarchitected_answer_7.yaml @@ -1,23 +1,32 @@ -Description: Allows users to query AWS Well-Architected Tool Answer data, including - information about the workloads, lens, and questions associated with each answer. +Description: Allows users to query AWS Well-Architected Tool Answer data, including information about the workloads, lens, and questions associated with each answer. ID: aws_wellarchitected_answer_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n risk,\n count(question_id) as total_questions\n\ - from\n aws_wellarchitected_answer\nwhere\n risk = 'HIGH'\n or risk = 'MEDIUM'\n\ - group by\n workload_id,\n risk;" + QueryToExecute: | + SELECT + workload_id, + risk, + COUNT(question_id) AS total_questions + FROM + aws_wellarchitected_answer + WHERE + risk = 'HIGH' + OR risk = 'MEDIUM' + GROUP BY + workload_id, + risk; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Answers by Risk + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Answers by Risk \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_1.yaml b/queries/aws_wellarchitected_check_detail_1.yaml old mode 100755 new mode 100644 index 47be7cf4a..d6fc52262 --- a/queries/aws_wellarchitected_check_detail_1.yaml +++ b/queries/aws_wellarchitected_check_detail_1.yaml @@ -1,21 +1,30 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n lens_arn,\n pillar_id,\n question_id,\n\ - \ choice_id,\n id,\n name,\n description,\n status\nfrom\n aws_wellarchitected_check_detail;" + QueryToExecute: | + SELECT + workload_id, + lens_arn, + pillar_id, + question_id, + choice_id, + id, + name, + description, + status + FROM + aws_wellarchitected_check_detail; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find Details on AWS Well-Architected Tool Checks + - Well-Architected Tool +Title: Find Details on AWS Well-Architected Tool Checks \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_2.yaml b/queries/aws_wellarchitected_check_detail_2.yaml old mode 100755 new mode 100644 index 938112711..50b6b7ffc --- a/queries/aws_wellarchitected_check_detail_2.yaml +++ b/queries/aws_wellarchitected_check_detail_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n status,\n count(id) as checks\nfrom\n\ - \ aws_wellarchitected_check_detail\ngroup by\n workload_id,\n status;" + QueryToExecute: | + SELECT + workload_id, + status, + COUNT(id) AS checks + FROM + aws_wellarchitected_check_detail + GROUP BY + workload_id, + status; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Check Details + - Well-Architected Tool +Title: List AWS Well-Architected Tool Check Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_3.yaml b/queries/aws_wellarchitected_check_detail_3.yaml old mode 100755 new mode 100644 index 73466132f..455384187 --- a/queries/aws_wellarchitected_check_detail_3.yaml +++ b/queries/aws_wellarchitected_check_detail_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n lens_arn,\n pillar_id,\n question_id,\n\ - \ choice_id,\n id,\n name,\n description,\n status\nfrom\n aws_wellarchitected_check_detail\n\ - where \n pillar_id = 'security';" + QueryToExecute: | + SELECT + workload_id, + lens_arn, + pillar_id, + question_id, + choice_id, + id, + name, + description, + status + FROM + aws_wellarchitected_check_detail + WHERE + pillar_id = 'security'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Details for Security + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Details for Security \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_4.yaml b/queries/aws_wellarchitected_check_detail_4.yaml old mode 100755 new mode 100644 index 0a35668ee..87b7e58cd --- a/queries/aws_wellarchitected_check_detail_4.yaml +++ b/queries/aws_wellarchitected_check_detail_4.yaml @@ -1,24 +1,32 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n choice_id,\n name,\n pillar_id,\n question_id,\n\ - \ flagged_resources,\n updated_at\nfrom\n aws_wellarchitected_check_detail\n\ - where \n status = 'ERROR';" + QueryToExecute: | + SELECT + id, + choice_id, + name, + pillar_id, + question_id, + flagged_resources, + updated_at + FROM + aws_wellarchitected_check_detail + WHERE + status = 'ERROR'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Details Status + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Details Status \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_5.yaml b/queries/aws_wellarchitected_check_detail_5.yaml old mode 100755 new mode 100644 index 2431e413e..d21e51bd3 --- a/queries/aws_wellarchitected_check_detail_5.yaml +++ b/queries/aws_wellarchitected_check_detail_5.yaml @@ -1,25 +1,35 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n w.workload_name,\n w.workload_id,\n w.environment,\n\ - \ w.industry,\n w.owner,\n d.name as check_name,\n d.flagged_resources,\n\ - \ d.pillar_id\nfrom\n aws_wellarchitected_check_detail d,\n aws_wellarchitected_workload\ - \ w\nwhere\n d.workload_id = w.workload_id\n and d.status = 'ERROR';" + QueryToExecute: | + SELECT + w.workload_name, + w.workload_id, + w.environment, + w.industry, + w.owner, + d.name AS check_name, + d.flagged_resources, + d.pillar_id + FROM + aws_wellarchitected_check_detail d, + aws_wellarchitected_workload w + WHERE + d.workload_id = w.workload_id + AND d.status = 'ERROR'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Check Details + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Check Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_detail_6.yaml b/queries/aws_wellarchitected_check_detail_6.yaml old mode 100755 new mode 100644 index f76308a0e..5b07e2333 --- a/queries/aws_wellarchitected_check_detail_6.yaml +++ b/queries/aws_wellarchitected_check_detail_6.yaml @@ -1,25 +1,34 @@ -Description: Allows users to query AWS Well-Architected Tool Check Details for information - on individual checks within a workload. The table provides data on the check status, - risk, reason for risk, improvement plan, and other related details. +Description: Allows users to query AWS Well-Architected Tool Check Details for information on individual checks within a workload. The table provides data on the check status, risk, reason for risk, improvement plan, and other related details. ID: aws_wellarchitected_check_detail_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n choice_id,\n name,\n pillar_id,\n question_id,\n\ - \ flagged_resources,\n status,\n updated_at\nfrom\n aws_wellarchitected_check_detail\n\ - where\n lens_arn = 'arn:aws:wellarchitected::aws:lens/wellarchitected'\n and\ - \ workload_id = 'abcdc851ac1d8d9d5b9938615da016ce';" + QueryToExecute: | + SELECT + id, + choice_id, + name, + pillar_id, + question_id, + flagged_resources, + status, + updated_at + FROM + aws_wellarchitected_check_detail + WHERE + lens_arn = 'arn:aws:wellarchitected::aws:lens/wellarchitected' + AND workload_id = 'abcdc851ac1d8d9d5b9938615da016ce'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Detail Information + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Detail Information \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_summary_1.yaml b/queries/aws_wellarchitected_check_summary_1.yaml old mode 100755 new mode 100644 index c49bc38a3..f97b15171 --- a/queries/aws_wellarchitected_check_summary_1.yaml +++ b/queries/aws_wellarchitected_check_summary_1.yaml @@ -1,24 +1,34 @@ -Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed - information about the checks for all workloads. This table provides insights into - the state of your workloads, highlighting potential risks and areas for improvement. +Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed information about the checks for all workloads. This table provides insights into the state of your workloads, highlighting potential risks and areas for improvement. ID: aws_wellarchitected_check_summary_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n id,\n name,\n description,\n jsonb_pretty(account_summary)\ - \ as account_summary,\n choice_id,\n lens_arn,\n pillar_id,\n question_id,\n\ - \ status,\n region,\n workload_id\nfrom\n aws_wellarchitected_check_summary;" + QueryToExecute: | + SELECT + id, + name, + description, + jsonb_pretty(account_summary) AS account_summary, + choice_id, + lens_arn, + pillar_id, + question_id, + status, + region, + workload_id + FROM + aws_wellarchitected_check_summary; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Check Summary Details + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Check Summary Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_summary_2.yaml b/queries/aws_wellarchitected_check_summary_2.yaml old mode 100755 new mode 100644 index d5220b0af..3ff2b8cc9 --- a/queries/aws_wellarchitected_check_summary_2.yaml +++ b/queries/aws_wellarchitected_check_summary_2.yaml @@ -1,24 +1,33 @@ -Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed - information about the checks for all workloads. This table provides insights into - the state of your workloads, highlighting potential risks and areas for improvement. +Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed information about the checks for all workloads. This table provides insights into the state of your workloads, highlighting potential risks and areas for improvement. ID: aws_wellarchitected_check_summary_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n id,\n name,\n jsonb_pretty(account_summary)\ - \ as account_summary,\n status,\n choice_id,\n pillar_id,\n question_id\n\ - from\n aws_wellarchitected_check_summary\nwhere\n workload_id = 'abcdc851ac1d8d9d5b9938615da016ce';" + QueryToExecute: | + SELECT + workload_id, + id, + name, + jsonb_pretty(account_summary) AS account_summary, + status, + choice_id, + pillar_id, + question_id + FROM + aws_wellarchitected_check_summary + WHERE + workload_id = 'abcdc851ac1d8d9d5b9938615da016ce'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Summary Details + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Summary Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_summary_3.yaml b/queries/aws_wellarchitected_check_summary_3.yaml old mode 100755 new mode 100644 index 79a0fddbf..fc7f52494 --- a/queries/aws_wellarchitected_check_summary_3.yaml +++ b/queries/aws_wellarchitected_check_summary_3.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed - information about the checks for all workloads. This table provides insights into - the state of your workloads, highlighting potential risks and areas for improvement. +Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed information about the checks for all workloads. This table provides insights into the state of your workloads, highlighting potential risks and areas for improvement. ID: aws_wellarchitected_check_summary_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n id,\n name,\n jsonb_pretty(account_summary)\ - \ as account_summary,\n pillar_id,\n question_id\nfrom\n aws_wellarchitected_check_summary\n\ - where\n status = 'ERROR';" + QueryToExecute: | + SELECT + workload_id, + id, + name, + jsonb_pretty(account_summary) AS account_summary, + pillar_id, + question_id + FROM + aws_wellarchitected_check_summary + WHERE + status = 'ERROR'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Summaries + - AWS Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Summaries \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_summary_4.yaml b/queries/aws_wellarchitected_check_summary_4.yaml old mode 100755 new mode 100644 index f78e86111..b04628782 --- a/queries/aws_wellarchitected_check_summary_4.yaml +++ b/queries/aws_wellarchitected_check_summary_4.yaml @@ -1,24 +1,31 @@ -Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed - information about the checks for all workloads. This table provides insights into - the state of your workloads, highlighting potential risks and areas for improvement. +Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed information about the checks for all workloads. This table provides insights into the state of your workloads, highlighting potential risks and areas for improvement. ID: aws_wellarchitected_check_summary_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n id,\n name,\n account_summary ->> 'ERROR'\ - \ as errors,\n account_summary ->> 'FETCH_FAILED' as fetch_failed,\n account_summary\ - \ ->> 'NOT_AVAILABLE' as not_available,\n account_summary ->> 'OKAY' as okay,\n\ - \ account_summary ->> 'WARNING' as warnings,\n pillar_id,\n question_id\nfrom\n\ - \ aws_wellarchitected_check_summary;" + QueryToExecute: | + SELECT + workload_id, + id, + name, + account_summary ->> 'ERROR' AS errors, + account_summary ->> 'FETCH_FAILED' AS fetch_failed, + account_summary ->> 'NOT_AVAILABLE' AS not_available, + account_summary ->> 'OKAY' AS okay, + account_summary ->> 'WARNING' AS warnings, + pillar_id, + question_id + FROM + aws_wellarchitected_check_summary; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Query AWS Well-Architected Tool Check Summaries + - Well-Architected Tool +Title: Query AWS Well-Architected Tool Check Summaries \ No newline at end of file diff --git a/queries/aws_wellarchitected_check_summary_5.yaml b/queries/aws_wellarchitected_check_summary_5.yaml old mode 100755 new mode 100644 index eba8c613c..8827df833 --- a/queries/aws_wellarchitected_check_summary_5.yaml +++ b/queries/aws_wellarchitected_check_summary_5.yaml @@ -1,27 +1,36 @@ -Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed - information about the checks for all workloads. This table provides insights into - the state of your workloads, highlighting potential risks and areas for improvement. +Description: Allows users to query AWS Well-Architected Tool Check Summary for detailed information about the checks for all workloads. This table provides insights into the state of your workloads, highlighting potential risks and areas for improvement. ID: aws_wellarchitected_check_summary_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n id,\n name,\n account_summary ->> 'ERROR'\ - \ as errors,\n account_summary ->> 'FETCH_FAILED' as fetch_failed,\n account_summary\ - \ ->> 'NOT_AVAILABLE' as not_available,\n account_summary ->> 'OKAY' as okay,\n\ - \ account_summary ->> 'WARNING' as warnings,\n pillar_id,\n question_id\nfrom\n\ - \ aws_wellarchitected_check_summary\nwhere\n lens_arn = 'arn:aws:wellarchitected::aws:lens/wellarchitected'\n\ - \ and workload_id = 'abcdc851ac1d8d9d5b9938615da016ce';" + QueryToExecute: | + SELECT + workload_id, + id, + name, + account_summary ->> 'ERROR' AS errors, + account_summary ->> 'FETCH_FAILED' AS fetch_failed, + account_summary ->> 'NOT_AVAILABLE' AS not_available, + account_summary ->> 'OKAY' AS okay, + account_summary ->> 'WARNING' AS warnings, + pillar_id, + question_id + FROM + aws_wellarchitected_check_summary + WHERE + lens_arn = 'arn:aws:wellarchitected::aws:lens/wellarchitected' + AND workload_id = 'abcdc851ac1d8d9d5b9938615da016ce'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Check Summary Insights + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Check Summary Insights \ No newline at end of file diff --git a/queries/aws_wellarchitected_consolidated_report_1.yaml b/queries/aws_wellarchitected_consolidated_report_1.yaml old mode 100755 new mode 100644 index 6a8e7a20c..1a358eb01 --- a/queries/aws_wellarchitected_consolidated_report_1.yaml +++ b/queries/aws_wellarchitected_consolidated_report_1.yaml @@ -1,23 +1,29 @@ -Description: Allows users to query consolidated reports from the AWS Well-Architected - Tool, providing a comprehensive view of a workload''s alignment with AWS architectural - best practices. +Description: Allows users to query consolidated reports from the AWS Well-Architected Tool, providing a comprehensive view of a workload's alignment with AWS architectural best practices. ID: aws_wellarchitected_consolidated_report_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_arn,\n workload_id,\n lenses_applied_count,\n\ - \ metric_type,\n updated_at\nfrom\n aws_wellarchitected_consolidated_report;" + QueryToExecute: | + SELECT + workload_name, + workload_arn, + workload_id, + lenses_applied_count, + metric_type, + updated_at + FROM + aws_wellarchitected_consolidated_report; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Consolidated Reports + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Consolidated Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_consolidated_report_2.yaml b/queries/aws_wellarchitected_consolidated_report_2.yaml old mode 100755 new mode 100644 index aa4619fff..e5e6f2d39 --- a/queries/aws_wellarchitected_consolidated_report_2.yaml +++ b/queries/aws_wellarchitected_consolidated_report_2.yaml @@ -1,26 +1,33 @@ -Description: Allows users to query consolidated reports from the AWS Well-Architected - Tool, providing a comprehensive view of a workload''s alignment with AWS architectural - best practices. +Description: Allows users to query consolidated reports from the AWS Well-Architected Tool, providing a comprehensive view of a workload's alignment with AWS architectural best practices. ID: aws_wellarchitected_consolidated_report_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.workload_name,\n r.workload_arn,\n r.workload_id,\n\ - \ r.lenses_applied_count,\n w.environment as workload_environment,\n w.improvement_status\ - \ as workload_improvement_status,\n w.review_restriction_date as workload_review_restriction_date\n\ - from\n aws_wellarchitected_consolidated_report as r,\n aws_wellarchitected_workload\ - \ as w\nwhere\n w.workload_id = r.workload_id;" + QueryToExecute: | + SELECT + r.workload_name, + r.workload_arn, + r.workload_id, + r.lenses_applied_count, + w.environment AS workload_environment, + w.improvement_status AS workload_improvement_status, + w.review_restriction_date AS workload_review_restriction_date + FROM + aws_wellarchitected_consolidated_report AS r, + aws_wellarchitected_workload AS w + WHERE + w.workload_id = r.workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find All AWS Well-Architected Consolidated Reports + - Well-Architected Tool +Title: Find All AWS Well-Architected Consolidated Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_consolidated_report_3.yaml b/queries/aws_wellarchitected_consolidated_report_3.yaml old mode 100755 new mode 100644 index 390a44b26..1c60a9ba7 --- a/queries/aws_wellarchitected_consolidated_report_3.yaml +++ b/queries/aws_wellarchitected_consolidated_report_3.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query consolidated reports from the AWS Well-Architected - Tool, providing a comprehensive view of a workload''s alignment with AWS architectural - best practices. +Description: Allows users to query consolidated reports from the AWS Well-Architected Tool, providing a comprehensive view of a workload's alignment with AWS architectural best practices. ID: aws_wellarchitected_consolidated_report_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n risk_counts -> 'HIGH'\ - \ as high_risk_counts\nfrom\n aws_wellarchitected_consolidated_report;" + QueryToExecute: | + SELECT + workload_name, + workload_id, + risk_counts -> 'HIGH' AS high_risk_counts + FROM + aws_wellarchitected_consolidated_report; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Consolidated Reports + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Consolidated Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_consolidated_report_4.yaml b/queries/aws_wellarchitected_consolidated_report_4.yaml old mode 100755 new mode 100644 index 43d1dde1b..3be2fb5e7 --- a/queries/aws_wellarchitected_consolidated_report_4.yaml +++ b/queries/aws_wellarchitected_consolidated_report_4.yaml @@ -1,25 +1,29 @@ -Description: Allows users to query consolidated reports from the AWS Well-Architected - Tool, providing a comprehensive view of a workload''s alignment with AWS architectural - best practices. +Description: Allows users to query consolidated reports from the AWS Well-Architected Tool, providing a comprehensive view of a workload's alignment with AWS architectural best practices. ID: aws_wellarchitected_consolidated_report_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n l ->> 'LensArn' as\ - \ lens_arn,\n l -> 'Pillars' as pillars,\n l -> 'RiskCounts' as risk_counts\n\ - from\n aws_wellarchitected_consolidated_report,\n jsonb_array_elements(lenses)\ - \ as l;" + QueryToExecute: | + SELECT + workload_name, + workload_id, + l ->> 'LensArn' AS lens_arn, + l -> 'Pillars' AS pillars, + l -> 'RiskCounts' AS risk_counts + FROM + aws_wellarchitected_consolidated_report, + jsonb_array_elements(lenses) AS l; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Consolidated Reports + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Consolidated Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_1.yaml b/queries/aws_wellarchitected_lens_1.yaml old mode 100755 new mode 100644 index 3e8f0dfee..da249a55b --- a/queries/aws_wellarchitected_lens_1.yaml +++ b/queries/aws_wellarchitected_lens_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_alias,\n arn,\n lens_status,\n \ - \ lens_type,\n owner\nfrom\n aws_wellarchitected_lens;" + QueryToExecute: | + SELECT + lens_name, + lens_alias, + arn, + lens_status, + lens_type, + owner + FROM + aws_wellarchitected_lens; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected -Title: List all AWS Well-Architected Lenses with details + - Well-Architected +Title: List all AWS Well-Architected Lenses with details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_2.yaml b/queries/aws_wellarchitected_lens_2.yaml old mode 100755 new mode 100644 index 841d09a35..76b010b7e --- a/queries/aws_wellarchitected_lens_2.yaml +++ b/queries/aws_wellarchitected_lens_2.yaml @@ -1,21 +1,25 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select distinct\n on(arn) arn,\n lens_name,\n lens_status,\n\ - \ lens_type\nfrom\n aws_wellarchitected_lens;" + QueryToExecute: | + SELECT DISTINCT ON (arn) + arn, + lens_name, + lens_status, + lens_type + FROM + aws_wellarchitected_lens; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Lens -Title: List AWS Well-Architected Lens Details + - Well-Architected Lens +Title: List AWS Well-Architected Lens Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_3.yaml b/queries/aws_wellarchitected_lens_3.yaml old mode 100755 new mode 100644 index bf39b4d65..793dea279 --- a/queries/aws_wellarchitected_lens_3.yaml +++ b/queries/aws_wellarchitected_lens_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n arn,\n lens_status,\n lens_type,\n owner,\n\ - \ share_invitation_id\nfrom\n aws_wellarchitected_lens\nwhere\n lens_type =\ - \ 'CUSTOM_SHARED';" + QueryToExecute: | + SELECT + lens_name, + arn, + lens_status, + lens_type, + owner, + share_invitation_id + FROM + aws_wellarchitected_lens + WHERE + lens_type = 'CUSTOM_SHARED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Lens -Title: Find AWS Well-Architected Lens details + - Well-Architected Lens +Title: Find AWS Well-Architected Lens details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_4.yaml b/queries/aws_wellarchitected_lens_4.yaml old mode 100755 new mode 100644 index 83e1bf71c..7e96b00aa --- a/queries/aws_wellarchitected_lens_4.yaml +++ b/queries/aws_wellarchitected_lens_4.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_status,\n lens_type,\n lens_version,\n\ - \ owner\nfrom\n aws_wellarchitected_lens\nwhere\n lens_status = 'DEPRECATED';" + QueryToExecute: | + SELECT + lens_name, + lens_status, + lens_type, + lens_version, + owner + FROM + aws_wellarchitected_lens + WHERE + lens_status = 'DEPRECATED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Well-Architected Lens -Title: List all AWS Well-Architected Lens with Details + - AWS Well-Architected Lens +Title: List all AWS Well-Architected Lens with Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_5.yaml b/queries/aws_wellarchitected_lens_5.yaml old mode 100755 new mode 100644 index 10655dc16..9a49f6e34 --- a/queries/aws_wellarchitected_lens_5.yaml +++ b/queries/aws_wellarchitected_lens_5.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_status,\n lens_type,\n created_at,\n\ - \ lens_version\nfrom\n aws_wellarchitected_lens\nwhere\n created_at <= now()\ - \ - interval '30' day;" + QueryToExecute: | + SELECT + lens_name, + lens_status, + lens_type, + created_at, + lens_version + FROM + aws_wellarchitected_lens + WHERE + created_at <= NOW() - INTERVAL '30' DAY; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Lens -Title: List all AWS Well-Architected Lens with Details + - Well-Architected Lens +Title: List all AWS Well-Architected Lens with Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_6.yaml b/queries/aws_wellarchitected_lens_6.yaml old mode 100755 new mode 100644 index 1d16a8f1e..6b7554576 --- a/queries/aws_wellarchitected_lens_6.yaml +++ b/queries/aws_wellarchitected_lens_6.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Well-Architected Lens, providing details about - each lens such as its name, description, and associated AWS Well-Architected Framework - pillars. +Description: Allows users to query AWS Well-Architected Lens, providing details about each lens such as its name, description, and associated AWS Well-Architected Framework pillars. ID: aws_wellarchitected_lens_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_status,\n lens_type,\n lens_version,\n\ - \ owner,\n account_id\nfrom\n aws_wellarchitected_lens\nwhere\n owner = account_id;" + QueryToExecute: | + SELECT + lens_name, + lens_status, + lens_type, + lens_version, + owner, + account_id + FROM + aws_wellarchitected_lens + WHERE + owner = account_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Lens -Title: List All AWS Well-Architected Lens Details + - Well-Architected Lens +Title: List All AWS Well-Architected Lens Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_1.yaml b/queries/aws_wellarchitected_lens_review_1.yaml old mode 100755 new mode 100644 index 0c848e929..40d4bc797 --- a/queries/aws_wellarchitected_lens_review_1.yaml +++ b/queries/aws_wellarchitected_lens_review_1.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n workload_id,\n lens_arn,\n lens_alias,\n\ - \ lens_version,\n updated_at\nfrom\n aws_wellarchitected_lens_review;" + QueryToExecute: | + SELECT + lens_name, + workload_id, + lens_arn, + lens_alias, + lens_version, + updated_at + FROM + aws_wellarchitected_lens_review; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Lens Reviews + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Lens Reviews \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_2.yaml b/queries/aws_wellarchitected_lens_review_2.yaml old mode 100755 new mode 100644 index bdfe17672..ec0e919f9 --- a/queries/aws_wellarchitected_lens_review_2.yaml +++ b/queries/aws_wellarchitected_lens_review_2.yaml @@ -1,21 +1,27 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n workload_id,\n lens_alias,\n lens_status\n\ - from\n aws_wellarchitected_lens_review\nwhere\n lens_status = 'DEPRECATED';" + QueryToExecute: | + SELECT + lens_name, + workload_id, + lens_alias, + lens_status + FROM + aws_wellarchitected_lens_review + WHERE + lens_status = 'DEPRECATED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Lens Reviews with Status + - Well-Architected Tool +Title: List all AWS Well-Architected Lens Reviews with Status \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_3.yaml b/queries/aws_wellarchitected_lens_review_3.yaml old mode 100755 new mode 100644 index 2f404a893..f3dcfc284 --- a/queries/aws_wellarchitected_lens_review_3.yaml +++ b/queries/aws_wellarchitected_lens_review_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n workload_id,\n risk_counts -> 'HIGH' as\ - \ high_risk_counts\nfrom\n aws_wellarchitected_lens_review;" + QueryToExecute: | + SELECT + lens_name, + workload_id, + risk_counts -> 'HIGH' AS high_risk_counts + FROM + aws_wellarchitected_lens_review; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Lens Review Information + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Lens Review Information \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_4.yaml b/queries/aws_wellarchitected_lens_review_4.yaml old mode 100755 new mode 100644 index 5d5738f1d..8cb097234 --- a/queries/aws_wellarchitected_lens_review_4.yaml +++ b/queries/aws_wellarchitected_lens_review_4.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.lens_name,\n r.workload_id,\n r.lens_status,\n r.lens_version,\n\ - \ w.architectural_design,\n w.environment,\n w.review_restriction_date\nfrom\n\ - \ aws_wellarchitected_lens_review as r,\n aws_wellarchitected_workload as w\n\ - where\n r.workload_id = w.workload_id;" + QueryToExecute: | + SELECT + r.lens_name, + r.workload_id, + r.lens_status, + r.lens_version, + w.architectural_design, + w.environment, + w.review_restriction_date + FROM + aws_wellarchitected_lens_review AS r, + aws_wellarchitected_workload AS w + WHERE + r.workload_id = w.workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Query AWS Well-Architected Lens Reviews using SQL + - Well-Architected Tool +Title: Query AWS Well-Architected Lens Reviews using SQL \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_5.yaml b/queries/aws_wellarchitected_lens_review_5.yaml old mode 100755 new mode 100644 index 32210832b..36505f620 --- a/queries/aws_wellarchitected_lens_review_5.yaml +++ b/queries/aws_wellarchitected_lens_review_5.yaml @@ -1,25 +1,30 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_arn,\n s ->> 'Notes' as pillar_review_summary_note,\n\ - \ s ->> 'PillarId' as pillar_id,\n s ->> 'PillarName' as pillar_name,\n s ->>\ - \ 'RiskCounts' as RiskCounts\nfrom\n aws_wellarchitected_lens_review,\n jsonb_array_elements(pillar_review_summaries)\ - \ as s;" + QueryToExecute: | + SELECT + lens_name, + lens_arn, + s ->> 'Notes' AS pillar_review_summary_note, + s ->> 'PillarId' AS pillar_id, + s ->> 'PillarName' AS pillar_name, + s ->> 'RiskCounts' AS risk_counts + FROM + aws_wellarchitected_lens_review, + JSONB_ARRAY_ELEMENTS(pillar_review_summaries) AS s; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Lens Reviews with SQL + - Well-Architected Tool +Title: List AWS Well-Architected Tool Lens Reviews with SQL \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_6.yaml b/queries/aws_wellarchitected_lens_review_6.yaml old mode 100755 new mode 100644 index 0ed314db3..baa06b58a --- a/queries/aws_wellarchitected_lens_review_6.yaml +++ b/queries/aws_wellarchitected_lens_review_6.yaml @@ -1,21 +1,24 @@ -Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain - detailed information about each review, including its associated workload, lens, - and milestone information. +Description: Allows users to query AWS Well-Architected Tool Lens Reviews to obtain detailed information about each review, including its associated workload, lens, and milestone information. ID: aws_wellarchitected_lens_review_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_arn,\n jsonb_pretty(risk_counts)\ - \ as risk_counts\nfrom\n aws_wellarchitected_lens_review;" + QueryToExecute: | + SELECT + lens_name, + lens_arn, + JSONB_PRETTY(risk_counts) AS risk_counts + FROM + aws_wellarchitected_lens_review; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find Lens Reviews with Workload and Milestone Info + - Well-Architected Tool +Title: Find Lens Reviews with Workload and Milestone Info \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_improvement_1.yaml b/queries/aws_wellarchitected_lens_review_improvement_1.yaml old mode 100755 new mode 100644 index 558780025..2f37cae11 --- a/queries/aws_wellarchitected_lens_review_improvement_1.yaml +++ b/queries/aws_wellarchitected_lens_review_improvement_1.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query Lens Review Improvements in the AWS Well-Architected - Framework. +Description: Allows users to query Lens Review Improvements in the AWS Well-Architected Framework. ID: aws_wellarchitected_lens_review_improvement_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_alias,\n lens_arn,\n workload_id,\n improvement_plan_url,\n\ - \ pillar_id,\n question_id,\n question_title\nfrom\n aws_wellarchitected_lens_review_improvement;" + QueryToExecute: | + SELECT + lens_alias, + lens_arn, + workload_id, + improvement_plan_url, + pillar_id, + question_id, + question_title + FROM + aws_wellarchitected_lens_review_improvement; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Framework -Title: List AWS Well-Architected Framework Lens Review Improvements + - Well-Architected Framework +Title: List AWS Well-Architected Framework Lens Review Improvements \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_improvement_2.yaml b/queries/aws_wellarchitected_lens_review_improvement_2.yaml old mode 100755 new mode 100644 index 23bf487ff..c39feaed5 --- a/queries/aws_wellarchitected_lens_review_improvement_2.yaml +++ b/queries/aws_wellarchitected_lens_review_improvement_2.yaml @@ -1,21 +1,31 @@ -Description: Allows users to query Lens Review Improvements in the AWS Well-Architected - Framework. +Description: Allows users to query Lens Review Improvements in the AWS Well-Architected Framework. ID: aws_wellarchitected_lens_review_improvement_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_alias,\n lens_arn,\n workload_id,\n improvement_plan_url,\n\ - \ question_id,\n question_title,\n risk\nfrom\n aws_wellarchitected_lens_review_improvement\n\ - where\n workload_id = '4fca39b680a31bb118be6bc0d177849d'\n and risk = 'HIGH';" + QueryToExecute: | + SELECT + lens_alias, + lens_arn, + workload_id, + improvement_plan_url, + question_id, + question_title, + risk + FROM + aws_wellarchitected_lens_review_improvement + WHERE + workload_id = '4fca39b680a31bb118be6bc0d177849d' + AND risk = 'HIGH'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Framework -Title: List All AWS Lens Review Improvements with High Risk + - Well-Architected Framework +Title: List All AWS Lens Review Improvements with High Risk \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_improvement_3.yaml b/queries/aws_wellarchitected_lens_review_improvement_3.yaml old mode 100755 new mode 100644 index 15c8f795b..92fd928df --- a/queries/aws_wellarchitected_lens_review_improvement_3.yaml +++ b/queries/aws_wellarchitected_lens_review_improvement_3.yaml @@ -1,22 +1,32 @@ -Description: Allows users to query Lens Review Improvements in the AWS Well-Architected - Framework. +Description: Allows users to query Lens Review Improvements in the AWS Well-Architected Framework. ID: aws_wellarchitected_lens_review_improvement_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_arn,\n workload_id,\n risk,\n count(risk)\nfrom\n\ - \ aws_wellarchitected_lens_review_improvement\nwhere\n lens_alias = 'wellarchitected'\n\ - \ and workload_id = '4fca39b680a31bb118be6bc0d177849d'\ngroup by\n risk,\n \ - \ lens_arn,\n workload_id;" + QueryToExecute: | + SELECT + lens_arn, + workload_id, + risk, + COUNT(risk) + FROM + aws_wellarchitected_lens_review_improvement + WHERE + lens_alias = 'wellarchitected' + AND workload_id = '4fca39b680a31bb118be6bc0d177849d' + GROUP BY + risk, + lens_arn, + workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Framework -Title: List All Lens Review Improvements in AWS Well-Architected + - Well-Architected Framework +Title: List All Lens Review Improvements in AWS Well-Architected \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_improvement_4.yaml b/queries/aws_wellarchitected_lens_review_improvement_4.yaml old mode 100755 new mode 100644 index 01245df02..91987aff5 --- a/queries/aws_wellarchitected_lens_review_improvement_4.yaml +++ b/queries/aws_wellarchitected_lens_review_improvement_4.yaml @@ -1,22 +1,27 @@ -Description: Allows users to query Lens Review Improvements in the AWS Well-Architected - Framework. +Description: Allows users to query Lens Review Improvements in the AWS Well-Architected Framework. ID: aws_wellarchitected_lens_review_improvement_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_alias,\n workload_id,\n p ->> 'ChoiceId' as choice_id,\n\ - \ p ->> 'DisplayText' as display_text,\n p ->> 'ImprovementPlanUrl' as improvement_plan_url\n\ - from\n aws_wellarchitected_lens_review_improvement,\n jsonb_array_elements(improvement_plans)\ - \ as p;" + QueryToExecute: | + SELECT + lens_alias, + workload_id, + p ->> 'ChoiceId' AS choice_id, + p ->> 'DisplayText' AS display_text, + p ->> 'ImprovementPlanUrl' AS improvement_plan_url + FROM + aws_wellarchitected_lens_review_improvement, + JSONB_ARRAY_ELEMENTS(improvement_plans) AS p; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Framework -Title: List AWS Well-Architected Framework Lens Review Improvements + - Well-Architected Framework +Title: List AWS Well-Architected Framework Lens Review Improvements \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_report_1.yaml b/queries/aws_wellarchitected_lens_review_report_1.yaml old mode 100755 new mode 100644 index 3437bfde1..6ef795d0f --- a/queries/aws_wellarchitected_lens_review_report_1.yaml +++ b/queries/aws_wellarchitected_lens_review_report_1.yaml @@ -1,22 +1,28 @@ -Description: Allows users to query Lens Review Reports in the AWS Well-Architected - Tool. +Description: Allows users to query Lens Review Reports in the AWS Well-Architected Tool. ID: aws_wellarchitected_lens_review_report_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_alias,\n lens_arn,\n workload_id,\n milestone_number,\n\ - \ base64_string\nfrom\n aws_wellarchitected_lens_review_report;" + QueryToExecute: | + SELECT + lens_alias, + lens_arn, + workload_id, + milestone_number, + base64_string + FROM + aws_wellarchitected_lens_review_report; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Lens Review Reports + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Lens Review Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_report_2.yaml b/queries/aws_wellarchitected_lens_review_report_2.yaml old mode 100755 new mode 100644 index 5537c1c91..9799938fc --- a/queries/aws_wellarchitected_lens_review_report_2.yaml +++ b/queries/aws_wellarchitected_lens_review_report_2.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query Lens Review Reports in the AWS Well-Architected - Tool. +Description: Allows users to query Lens Review Reports in the AWS Well-Architected Tool. ID: aws_wellarchitected_lens_review_report_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n w.workload_name,\n r.workload_id,\n r.base64_string,\n\ - \ w.environment,\n w.is_review_owner_update_acknowledged\nfrom\n aws_wellarchitected_lens_review_report\ - \ as r,\n aws_wellarchitected_workload as w\nwhere\n r.workload_id = w.workload_id;" + QueryToExecute: | + SELECT + w.workload_name, + r.workload_id, + r.base64_string, + w.environment, + w.is_review_owner_update_acknowledged + FROM + aws_wellarchitected_lens_review_report AS r, + aws_wellarchitected_workload AS w + WHERE + r.workload_id = w.workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Lens Review Reports + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Lens Review Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_review_report_3.yaml b/queries/aws_wellarchitected_lens_review_report_3.yaml old mode 100755 new mode 100644 index db916a9d9..62ccb3ad9 --- a/queries/aws_wellarchitected_lens_review_report_3.yaml +++ b/queries/aws_wellarchitected_lens_review_report_3.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query Lens Review Reports in the AWS Well-Architected - Tool. +Description: Allows users to query Lens Review Reports in the AWS Well-Architected Tool. ID: aws_wellarchitected_lens_review_report_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n r.lens_alias,\n r.lens_arn,\n r.base64_string,\n l.lens_type\n\ - from\n aws_wellarchitected_lens_review_report as r,\n aws_wellarchitected_lens\ - \ as l\nwhere\n l.lens_type <> `aws_OFFICIAL';" + QueryToExecute: | + SELECT + r.lens_alias, + r.lens_arn, + r.base64_string, + l.lens_type + FROM + aws_wellarchitected_lens_review_report AS r, + aws_wellarchitected_lens AS l + WHERE + l.lens_type <> 'aws_OFFICIAL'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Lens Review Reports + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Lens Review Reports \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_share_1.yaml b/queries/aws_wellarchitected_lens_share_1.yaml old mode 100755 new mode 100644 index fa6ba71ce..4b02a8a9f --- a/queries/aws_wellarchitected_lens_share_1.yaml +++ b/queries/aws_wellarchitected_lens_share_1.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing - details about shared lenses including the share ARN, share status, and the AWS account - ID of the lens owner. +Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing details about shared lenses including the share ARN, share status, and the AWS account ID of the lens owner. ID: aws_wellarchitected_lens_share_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_alias,\n lens_arn,\n share_id,\n\ - \ shared_with\nfrom\n aws_wellarchitected_lens_share;" + QueryToExecute: | + SELECT + lens_name, + lens_alias, + lens_arn, + share_id, + shared_with + FROM + aws_wellarchitected_lens_share; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Lens Shares Details + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Lens Shares Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_share_2.yaml b/queries/aws_wellarchitected_lens_share_2.yaml old mode 100755 new mode 100644 index 85ca0c975..4223de269 --- a/queries/aws_wellarchitected_lens_share_2.yaml +++ b/queries/aws_wellarchitected_lens_share_2.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing - details about shared lenses including the share ARN, share status, and the AWS account - ID of the lens owner. +Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing details about shared lenses including the share ARN, share status, and the AWS account ID of the lens owner. ID: aws_wellarchitected_lens_share_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n s.lens_name,\n l.arn,\n l.lens_status,\n l.lens_type,\n\ - \ l.owner,\n l.share_invitation_id\nfrom\n aws_wellarchitected_lens_share as\ - \ s,\n aws_wellarchitected_lens as l\nwhere\n s.lens_arn = l.arn;" + QueryToExecute: | + SELECT + s.lens_name, + l.arn, + l.lens_status, + l.lens_type, + l.owner, + l.share_invitation_id + FROM + aws_wellarchitected_lens_share AS s, + aws_wellarchitected_lens AS l + WHERE + s.lens_arn = l.arn; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Lens Shares Details + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Lens Shares Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_lens_share_3.yaml b/queries/aws_wellarchitected_lens_share_3.yaml old mode 100755 new mode 100644 index 10ec96966..8e150b905 --- a/queries/aws_wellarchitected_lens_share_3.yaml +++ b/queries/aws_wellarchitected_lens_share_3.yaml @@ -1,22 +1,29 @@ -Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing - details about shared lenses including the share ARN, share status, and the AWS account - ID of the lens owner. +Description: Allows users to query Lens Shares in AWS Well-Architected Tool, providing details about shared lenses including the share ARN, share status, and the AWS account ID of the lens owner. ID: aws_wellarchitected_lens_share_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_name,\n lens_alias,\n lens_arn,\n share_id,\n\ - \ shared_with,\n status\nfrom\n aws_wellarchitected_lens_share\nwhere\n status\ - \ = 'PENDING';" + QueryToExecute: | + SELECT + lens_name, + lens_alias, + lens_arn, + share_id, + shared_with, + status + FROM + aws_wellarchitected_lens_share + WHERE + status = 'PENDING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Lens Shares + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Lens Shares \ No newline at end of file diff --git a/queries/aws_wellarchitected_milestone_1.yaml b/queries/aws_wellarchitected_milestone_1.yaml old mode 100755 new mode 100644 index d1b1c3b16..7d28e704a --- a/queries/aws_wellarchitected_milestone_1.yaml +++ b/queries/aws_wellarchitected_milestone_1.yaml @@ -1,20 +1,26 @@ -Description: Allows users to query AWS Well-Architected Tool Milestones for detailed - information about the milestones of a workload. +Description: Allows users to query AWS Well-Architected Tool Milestones for detailed information about the milestones of a workload. ID: aws_wellarchitected_milestone_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n milestone_name,\n milestone_number,\n\ - \ recorded_at,\n region\nfrom\n aws_wellarchitected_milestone;" + QueryToExecute: | + SELECT + workload_id, + milestone_name, + milestone_number, + recorded_at, + region + FROM + aws_wellarchitected_milestone; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Milestones + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Milestones \ No newline at end of file diff --git a/queries/aws_wellarchitected_milestone_2.yaml b/queries/aws_wellarchitected_milestone_2.yaml old mode 100755 new mode 100644 index 36cfde6e4..99520f86f --- a/queries/aws_wellarchitected_milestone_2.yaml +++ b/queries/aws_wellarchitected_milestone_2.yaml @@ -1,26 +1,41 @@ -Description: Allows users to query AWS Well-Architected Tool Milestones for detailed - information about the milestones of a workload. +Description: Allows users to query AWS Well-Architected Tool Milestones for detailed information about the milestones of a workload. ID: aws_wellarchitected_milestone_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "with latest_milestones as \n(\n select\n max(milestone_number)\ - \ as milestone_number,\n workload_id\n from\n aws_wellarchitected_milestone\n\ - \ group by\n workload_id\n) \nselect\n m.workload_id,\n m.milestone_name,\n\ - \ m.milestone_number as latest_milestone_number,\n m.recorded_at,\n m.region\n\ - from\n aws_wellarchitected_milestone m,\n latest_milestones l\nwhere\n m.milestone_number\ - \ = l.milestone_number\n and m.workload_id = l.workload_id;" + QueryToExecute: | + WITH latest_milestones AS ( + SELECT + MAX(milestone_number) AS milestone_number, + workload_id + FROM + aws_wellarchitected_milestone + GROUP BY + workload_id + ) + SELECT + m.workload_id, + m.milestone_name, + m.milestone_number AS latest_milestone_number, + m.recorded_at, + m.region + FROM + aws_wellarchitected_milestone m, + latest_milestones l + WHERE + m.milestone_number = l.milestone_number + AND m.workload_id = l.workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool milestone details + - Well-Architected Tool +Title: List AWS Well-Architected Tool milestone details \ No newline at end of file diff --git a/queries/aws_wellarchitected_milestone_3.yaml b/queries/aws_wellarchitected_milestone_3.yaml old mode 100755 new mode 100644 index 76e65c99e..2bc3d1a06 --- a/queries/aws_wellarchitected_milestone_3.yaml +++ b/queries/aws_wellarchitected_milestone_3.yaml @@ -1,23 +1,33 @@ -Description: Allows users to query AWS Well-Architected Tool Milestones for detailed - information about the milestones of a workload. +Description: Allows users to query AWS Well-Architected Tool Milestones for detailed information about the milestones of a workload. ID: aws_wellarchitected_milestone_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n m.milestone_name,\n m.milestone_number,\n w.workload_name,\n\ - \ w.workload_id,\n w.environment,\n w.industry,\n w.owner\nfrom\n aws_wellarchitected_workload\ - \ w,\n aws_wellarchitected_milestone m\nwhere\n w.workload_id = m.workload_id;" + QueryToExecute: | + SELECT + m.milestone_name, + m.milestone_number, + w.workload_name, + w.workload_id, + w.environment, + w.industry, + w.owner + FROM + aws_wellarchitected_workload w, + aws_wellarchitected_milestone m + WHERE + w.workload_id = m.workload_id; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Query AWS Well-Architected Tool Milestones in Detail + - Well-Architected Tool +Title: Query AWS Well-Architected Tool Milestones in Detail \ No newline at end of file diff --git a/queries/aws_wellarchitected_milestone_4.yaml b/queries/aws_wellarchitected_milestone_4.yaml old mode 100755 new mode 100644 index 1eca4720f..f24f7b509 --- a/queries/aws_wellarchitected_milestone_4.yaml +++ b/queries/aws_wellarchitected_milestone_4.yaml @@ -1,24 +1,35 @@ -Description: Allows users to query AWS Well-Architected Tool Milestones for detailed - information about the milestones of a workload. +Description: Allows users to query AWS Well-Architected Tool Milestones for detailed information about the milestones of a workload. ID: aws_wellarchitected_milestone_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n m.milestone_name,\n m.milestone_number,\n w.workload_name,\n\ - \ w.workload_id,\n w.environment,\n w.industry,\n w.owner\nfrom\n aws_wellarchitected_workload\ - \ w,\n aws_wellarchitected_milestone m\nwhere\n w.workload_id = m.workload_id\n\ - \ and milestone_number = 1\n and w.workload_id = 'abcdec851ac1d8d9d5b9938615da016ce';" + QueryToExecute: | + SELECT + m.milestone_name, + m.milestone_number, + w.workload_name, + w.workload_id, + w.environment, + w.industry, + w.owner + FROM + aws_wellarchitected_workload w, + aws_wellarchitected_milestone m + WHERE + w.workload_id = m.workload_id + AND m.milestone_number = 1 + AND w.workload_id = 'abcdec851ac1d8d9d5b9938615da016ce'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find All AWS Well-Architected Tool Milestones + - Well-Architected Tool +Title: Find All AWS Well-Architected Tool Milestones \ No newline at end of file diff --git a/queries/aws_wellarchitected_notification_1.yaml b/queries/aws_wellarchitected_notification_1.yaml old mode 100755 new mode 100644 index 5910c22e8..1d767b7cc --- a/queries/aws_wellarchitected_notification_1.yaml +++ b/queries/aws_wellarchitected_notification_1.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Well-Architected Tool Notifications for detailed - information about each notification. +Description: Allows users to query AWS Well-Architected Tool Notifications for detailed information about each notification. ID: aws_wellarchitected_notification_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n lens_alias,\n lens_arn,\n current_lens_version,\n\ - \ latest_lens_version\nfrom\n aws_wellarchitected_notification\nwhere\n type\ - \ = 'LENS_VERSION_UPGRADED';" + QueryToExecute: | + SELECT + workload_name, + lens_alias, + lens_arn, + current_lens_version, + latest_lens_version + FROM + aws_wellarchitected_notification + WHERE + type = 'LENS_VERSION_UPGRADED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Notifications + - Well-Architected Tool +Title: List AWS Well-Architected Tool Notifications \ No newline at end of file diff --git a/queries/aws_wellarchitected_notification_2.yaml b/queries/aws_wellarchitected_notification_2.yaml old mode 100755 new mode 100644 index f9f104b51..bf8c88341 --- a/queries/aws_wellarchitected_notification_2.yaml +++ b/queries/aws_wellarchitected_notification_2.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Well-Architected Tool Notifications for detailed - information about each notification. +Description: Allows users to query AWS Well-Architected Tool Notifications for detailed information about each notification. ID: aws_wellarchitected_notification_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n lens_alias,\n lens_arn,\n current_lens_version,\n\ - \ latest_lens_version\nfrom\n aws_wellarchitected_notification\nwhere\n type\ - \ = 'LENS_VERSION_DEPRECATED';" + QueryToExecute: | + SELECT + workload_name, + lens_alias, + lens_arn, + current_lens_version, + latest_lens_version + FROM + aws_wellarchitected_notification + WHERE + type = 'LENS_VERSION_DEPRECATED'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Notification Details + - Well-Architected Tool +Title: List AWS Well-Architected Tool Notification Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_notification_3.yaml b/queries/aws_wellarchitected_notification_3.yaml old mode 100755 new mode 100644 index 751660ff2..87a6f737b --- a/queries/aws_wellarchitected_notification_3.yaml +++ b/queries/aws_wellarchitected_notification_3.yaml @@ -1,21 +1,28 @@ -Description: Allows users to query AWS Well-Architected Tool Notifications for detailed - information about each notification. +Description: Allows users to query AWS Well-Architected Tool Notifications for detailed information about each notification. ID: aws_wellarchitected_notification_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n lens_alias,\n lens_arn,\n current_lens_version,\n\ - \ latest_lens_version\nfrom\n aws_wellarchitected_notification\nwhere\n workload_id\ - \ = '123451c59cebcd4612f1f858bf75566';" + QueryToExecute: | + SELECT + workload_name, + lens_alias, + lens_arn, + current_lens_version, + latest_lens_version + FROM + aws_wellarchitected_notification + WHERE + workload_id = '123451c59cebcd4612f1f858bf75566'; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Tool Notification Details + - Well-Architected Tool +Title: Find AWS Well-Architected Tool Notification Details \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_1.yaml b/queries/aws_wellarchitected_share_invitation_1.yaml old mode 100755 new mode 100644 index 04fdc752e..e9243fd60 --- a/queries/aws_wellarchitected_share_invitation_1.yaml +++ b/queries/aws_wellarchitected_share_invitation_1.yaml @@ -1,19 +1,26 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n share_invitation_id,\n permission_type,\n shared_by,\n\ - \ shared_with,\n share_resource_type\nfrom\n aws_wellarchitected_share_invitation;" + QueryToExecute: | + SELECT + share_invitation_id, + permission_type, + shared_by, + shared_with, + share_resource_type + FROM + aws_wellarchitected_share_invitation; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List AWS Well-Architected Tool Share Invitations + - Well-Architected Tool +Title: List AWS Well-Architected Tool Share Invitations \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_2.yaml b/queries/aws_wellarchitected_share_invitation_2.yaml old mode 100755 new mode 100644 index d06daff93..de8ab401b --- a/queries/aws_wellarchitected_share_invitation_2.yaml +++ b/queries/aws_wellarchitected_share_invitation_2.yaml @@ -1,20 +1,30 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n lens_arn,\n lens_name,\n share_invitation_id,\n permission_type,\n\ - \ shared_by,\n shared_with\nfrom\n aws_wellarchitected_share_invitation\nwhere\n\ - \ share_resource_type = 'LENS'\n or lens_arn is not null;" + QueryToExecute: | + SELECT + lens_arn, + lens_name, + share_invitation_id, + permission_type, + shared_by, + shared_with + FROM + aws_wellarchitected_share_invitation + WHERE + share_resource_type = 'LENS' + OR lens_arn IS NOT NULL; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Well-Architected Tool -Title: Find AWS Well-Architected Tool Share Invitations + - AWS Well-Architected Tool +Title: Find AWS Well-Architected Tool Share Invitations \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_3.yaml b/queries/aws_wellarchitected_share_invitation_3.yaml old mode 100755 new mode 100644 index c6e4996ee..27abb6b24 --- a/queries/aws_wellarchitected_share_invitation_3.yaml +++ b/queries/aws_wellarchitected_share_invitation_3.yaml @@ -1,20 +1,30 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n workload_name,\n share_invitation_id,\n\ - \ permission_type,\n shared_by,\n shared_with\nfrom\n aws_wellarchitected_share_invitation\n\ - where\n share_resource_type = 'WORKLOAD'\n or workload_id is not null;" + QueryToExecute: | + SELECT + workload_id, + workload_name, + share_invitation_id, + permission_type, + shared_by, + shared_with + FROM + aws_wellarchitected_share_invitation + WHERE + share_resource_type = 'WORKLOAD' + OR workload_id IS NOT NULL; Tags: cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find Share Invitations in AWS Well-Architected Tool + - Well-Architected Tool +Title: Find Share Invitations in AWS Well-Architected Tool \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_4.yaml b/queries/aws_wellarchitected_share_invitation_4.yaml old mode 100755 new mode 100644 index eaaa6f200..135b96ef4 --- a/queries/aws_wellarchitected_share_invitation_4.yaml +++ b/queries/aws_wellarchitected_share_invitation_4.yaml @@ -1,20 +1,28 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n share_invitation_id,\n permission_type,\n shared_by,\n\ - \ shared_with,\n share_resource_type\nfrom\n aws_wellarchitected_share_invitation\n\ - where\n permission_type = 'CONTRIBUTOR';" + QueryToExecute: | + SELECT + share_invitation_id, + permission_type, + shared_by, + shared_with, + share_resource_type + FROM + aws_wellarchitected_share_invitation + WHERE + permission_type = 'CONTRIBUTOR'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find All AWS Well-Architected Tool Share Invitations + - Well-Architected Tool +Title: Find All AWS Well-Architected Tool Share Invitations \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_5.yaml b/queries/aws_wellarchitected_share_invitation_5.yaml old mode 100755 new mode 100644 index e00cac882..f51758856 --- a/queries/aws_wellarchitected_share_invitation_5.yaml +++ b/queries/aws_wellarchitected_share_invitation_5.yaml @@ -1,20 +1,28 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n share_invitation_id,\n permission_type,\n shared_by,\n\ - \ shared_with,\n share_resource_type\nfrom\n aws_wellarchitected_share_invitation\n\ - where\n permission_type = 'READONLY';" + QueryToExecute: | + SELECT + share_invitation_id, + permission_type, + shared_by, + shared_with, + share_resource_type + FROM + aws_wellarchitected_share_invitation + WHERE + permission_type = 'READONLY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Share Invitations + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Share Invitations \ No newline at end of file diff --git a/queries/aws_wellarchitected_share_invitation_6.yaml b/queries/aws_wellarchitected_share_invitation_6.yaml old mode 100755 new mode 100644 index 5d0d77b7e..8cfc6b20e --- a/queries/aws_wellarchitected_share_invitation_6.yaml +++ b/queries/aws_wellarchitected_share_invitation_6.yaml @@ -1,19 +1,25 @@ Description: Allows users to query Share Invitations in the AWS Well-Architected Tool. ID: aws_wellarchitected_share_invitation_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n count(*) as total,\n share_resource_type\nfrom\n aws_wellarchitected_share_invitation\n\ - group by\n share_resource_type;" + QueryToExecute: | + SELECT + COUNT(*) AS total, + share_resource_type + FROM + aws_wellarchitected_share_invitation + GROUP BY + share_resource_type; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List All Share Invitations in AWS Well-Architected Tool + - Well-Architected Tool +Title: List All Share Invitations in AWS Well-Architected Tool \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_1.yaml b/queries/aws_wellarchitected_workload_1.yaml old mode 100755 new mode 100644 index 45052227b..f05dc1eab --- a/queries/aws_wellarchitected_workload_1.yaml +++ b/queries/aws_wellarchitected_workload_1.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve - and manage workload data, including workload names, ARNs, risk counts, and improvement - statuses. +Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve and manage workload data, including workload names, ARNs, risk counts, and improvement statuses. ID: aws_wellarchitected_workload_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n environment,\n industry,\n\ - \ owner\nfrom\n aws_wellarchitected_workload;" + QueryToExecute: | + SELECT + workload_name, + workload_id, + environment, + industry, + owner + FROM + aws_wellarchitected_workload; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Workloads including names, ARNs, and statuses + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Workloads including names, ARNs, and statuses \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_2.yaml b/queries/aws_wellarchitected_workload_2.yaml old mode 100755 new mode 100644 index 6ec96529b..de8d68594 --- a/queries/aws_wellarchitected_workload_2.yaml +++ b/queries/aws_wellarchitected_workload_2.yaml @@ -1,23 +1,28 @@ -Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve - and manage workload data, including workload names, ARNs, risk counts, and improvement - statuses. +Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve and manage workload data, including workload names, ARNs, risk counts, and improvement statuses. ID: aws_wellarchitected_workload_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n environment\nfrom\n\ - \ aws_wellarchitected_workload\nwhere\n environment = 'PRODUCTION';" + QueryToExecute: | + SELECT + workload_name, + workload_id, + environment + FROM + aws_wellarchitected_workload + WHERE + environment = 'PRODUCTION'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS Well-Architected Tool Workloads -Title: List all AWS Well-Architected Tool Workloads Data + - AWS Well-Architected Tool Workloads +Title: List all AWS Well-Architected Tool Workloads Data \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_3.yaml b/queries/aws_wellarchitected_workload_3.yaml old mode 100755 new mode 100644 index 668736afb..22a98b209 --- a/queries/aws_wellarchitected_workload_3.yaml +++ b/queries/aws_wellarchitected_workload_3.yaml @@ -1,23 +1,26 @@ -Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve - and manage workload data, including workload names, ARNs, risk counts, and improvement - statuses. +Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve and manage workload data, including workload names, ARNs, risk counts, and improvement statuses. ID: aws_wellarchitected_workload_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n risk_counts -> 'HIGH'\ - \ as high_risk_counts\nfrom\n aws_wellarchitected_workload;" + QueryToExecute: | + SELECT + workload_name, + workload_id, + risk_counts -> 'HIGH' AS high_risk_counts + FROM + aws_wellarchitected_workload; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Workloads Risk and IDs + - Well-Architected Tool +Title: Find AWS Well-Architected Workloads Risk and IDs \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_4.yaml b/queries/aws_wellarchitected_workload_4.yaml old mode 100755 new mode 100644 index 3d27a2b86..35a7b7a38 --- a/queries/aws_wellarchitected_workload_4.yaml +++ b/queries/aws_wellarchitected_workload_4.yaml @@ -1,21 +1,26 @@ -Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve - and manage workload data, including workload names, ARNs, risk counts, and improvement - statuses. +Description: Allows users to query AWS Well-Architected Tool Workloads to retrieve and manage workload data, including workload names, ARNs, risk counts, and improvement statuses. ID: aws_wellarchitected_workload_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_name,\n workload_id,\n is_review_owner_update_acknowledged\n\ - from\n aws_wellarchitected_workload\nwhere\n not is_review_owner_update_acknowledged;" + QueryToExecute: | + SELECT + workload_name, + workload_id, + is_review_owner_update_acknowledged + FROM + aws_wellarchitected_workload + WHERE + NOT is_review_owner_update_acknowledged; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find all AWS Well-Architected Tool Workloads + - Well-Architected Tool +Title: Find all AWS Well-Architected Tool Workloads \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_share_1.yaml b/queries/aws_wellarchitected_workload_share_1.yaml old mode 100755 new mode 100644 index 88a706854..31294f81a --- a/queries/aws_wellarchitected_workload_share_1.yaml +++ b/queries/aws_wellarchitected_workload_share_1.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query AWS Well-Architected Workload Share, providing - information about shared workloads within AWS Well-Architected Tool. +Description: Allows users to query AWS Well-Architected Workload Share, providing information about shared workloads within AWS Well-Architected Tool. ID: aws_wellarchitected_workload_share_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n share_id,\n shared_with\n permission_type,\n\ - \ status,\n region\nfrom\n aws_wellarchitected_workload_share;" + QueryToExecute: | + SELECT + workload_id, + share_id, + shared_with, + permission_type, + status, + region + FROM + aws_wellarchitected_workload_share; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find Shared Workloads in AWS Well-Architected Tool + - Well-Architected Tool +Title: Find Shared Workloads in AWS Well-Architected Tool \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_share_2.yaml b/queries/aws_wellarchitected_workload_share_2.yaml old mode 100755 new mode 100644 index dedd85de3..710e2c357 --- a/queries/aws_wellarchitected_workload_share_2.yaml +++ b/queries/aws_wellarchitected_workload_share_2.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Well-Architected Workload Share, providing - information about shared workloads within AWS Well-Architected Tool. +Description: Allows users to query AWS Well-Architected Workload Share, providing information about shared workloads within AWS Well-Architected Tool. ID: aws_wellarchitected_workload_share_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n share_id,\n shared_with\n permission_type,\n\ - \ status,\n region\nfrom\n aws_wellarchitected_workload_share\nwhere\n status\ - \ = 'PENDING';" + QueryToExecute: | + SELECT + workload_id, + share_id, + shared_with, + permission_type, + status, + region + FROM + aws_wellarchitected_workload_share + WHERE + status = 'PENDING'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Workload Shares + - Well-Architected Tool +Title: List all AWS Well-Architected Workload Shares \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_share_3.yaml b/queries/aws_wellarchitected_workload_share_3.yaml old mode 100755 new mode 100644 index 31a686354..4df257eb9 --- a/queries/aws_wellarchitected_workload_share_3.yaml +++ b/queries/aws_wellarchitected_workload_share_3.yaml @@ -1,21 +1,29 @@ -Description: Allows users to query AWS Well-Architected Workload Share, providing - information about shared workloads within AWS Well-Architected Tool. +Description: Allows users to query AWS Well-Architected Workload Share, providing information about shared workloads within AWS Well-Architected Tool. ID: aws_wellarchitected_workload_share_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n share_id,\n shared_with\n permission_type,\n\ - \ status,\n region\nfrom\n aws_wellarchitected_workload_share\nwhere\n permission_type\ - \ = 'CONTRIBUTOR';" + QueryToExecute: | + SELECT + workload_id, + share_id, + shared_with, + permission_type, + status, + region + FROM + aws_wellarchitected_workload_share + WHERE + permission_type = 'CONTRIBUTOR'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: List all AWS Well-Architected Tool Workload Shares + - Well-Architected Tool +Title: List all AWS Well-Architected Tool Workload Shares \ No newline at end of file diff --git a/queries/aws_wellarchitected_workload_share_4.yaml b/queries/aws_wellarchitected_workload_share_4.yaml old mode 100755 new mode 100644 index af03d1c86..e8dab30c3 --- a/queries/aws_wellarchitected_workload_share_4.yaml +++ b/queries/aws_wellarchitected_workload_share_4.yaml @@ -1,23 +1,31 @@ -Description: Allows users to query AWS Well-Architected Workload Share, providing - information about shared workloads within AWS Well-Architected Tool. +Description: Allows users to query AWS Well-Architected Workload Share, providing information about shared workloads within AWS Well-Architected Tool. ID: aws_wellarchitected_workload_share_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n workload_id,\n share_id,\n shared_with\n permission_type,\n\ - \ status,\n region\nfrom\n aws_wellarchitected_workload_share\nwhere\n permission_type\ - \ = 'READONLY';" + QueryToExecute: | + SELECT + workload_id, + share_id, + shared_with, + permission_type, + status, + region + FROM + aws_wellarchitected_workload_share + WHERE + permission_type = 'READONLY'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Well-Architected Tool -Title: Find AWS Well-Architected Workload Share With Read-Only Permission + - Well-Architected Tool +Title: Find AWS Well-Architected Workload Share With Read-Only Permission \ No newline at end of file diff --git a/queries/aws_workspaces_directory_1.yaml b/queries/aws_workspaces_directory_1.yaml old mode 100755 new mode 100644 index 56c8e3548..c43cbf580 --- a/queries/aws_workspaces_directory_1.yaml +++ b/queries/aws_workspaces_directory_1.yaml @@ -1,23 +1,30 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n alias,\n customer_user_name,\n\ - \ directory_type,\n state\nfrom\n aws_workspaces_directory;" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + alias, + customer_user_name, + directory_type, + state + FROM + aws_workspaces_directory; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WorkSpaces -Title: Find AWS WorkSpaces Directory Information Details + - AWS WorkSpaces +Title: Find AWS WorkSpaces Directory Information Details \ No newline at end of file diff --git a/queries/aws_workspaces_directory_2.yaml b/queries/aws_workspaces_directory_2.yaml old mode 100755 new mode 100644 index 60740411f..6edb1949e --- a/queries/aws_workspaces_directory_2.yaml +++ b/queries/aws_workspaces_directory_2.yaml @@ -1,26 +1,34 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n alias,\n customer_user_name,\n\ - \ directory_type,\n state\nfrom\n aws_workspaces_directory\nwhere\n certificate_based_auth_properties\ - \ ->> 'Status' = 'ENABLED';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + alias, + customer_user_name, + directory_type, + state + FROM + aws_workspaces_directory + WHERE + certificate_based_auth_properties ->> 'Status' = 'ENABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WorkSpaces -Title: Find all AWS WorkSpaces Directory Details via SQL + - WorkSpaces +Title: Find all AWS WorkSpaces Directory Details via SQL \ No newline at end of file diff --git a/queries/aws_workspaces_directory_3.yaml b/queries/aws_workspaces_directory_3.yaml old mode 100755 new mode 100644 index 4ab7c4758..f236a914c --- a/queries/aws_workspaces_directory_3.yaml +++ b/queries/aws_workspaces_directory_3.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_3 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n alias,\n customer_user_name,\n\ - \ directory_type,\n state\nfrom\n aws_workspaces_directory\nwhere\n directory_type\ - \ = 'SIMPLE_AD';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + alias, + customer_user_name, + directory_type, + state + FROM + aws_workspaces_directory + WHERE + directory_type = 'SIMPLE_AD'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WorkSpaces -Title: Find AWS WorkSpaces Directory Information + - WorkSpaces +Title: Find AWS WorkSpaces Directory Information \ No newline at end of file diff --git a/queries/aws_workspaces_directory_4.yaml b/queries/aws_workspaces_directory_4.yaml old mode 100755 new mode 100644 index 939e56b71..9769ff4c1 --- a/queries/aws_workspaces_directory_4.yaml +++ b/queries/aws_workspaces_directory_4.yaml @@ -1,25 +1,31 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_4 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n saml_properties ->>\ - \ 'RelayStateParameterName' as saml_relay_state_parameter_name,\n saml_properties\ - \ ->> 'Status' as saml_status,\n saml_properties ->> 'UserAccessUrl' as saml_user_access_url\n\ - from\n aws_workspaces_directory\nwhere\n directory_id = 'd-96676995ea';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + saml_properties ->> 'RelayStateParameterName' AS saml_relay_state_parameter_name, + saml_properties ->> 'Status' AS saml_status, + saml_properties ->> 'UserAccessUrl' AS saml_user_access_url + FROM + aws_workspaces_directory + WHERE + directory_id = 'd-96676995ea'; Tags: cloud_identity_security: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WorkSpaces -Title: Find all AWS WorkSpaces Directory Information + - WorkSpaces +Title: Find all AWS WorkSpaces Directory Information \ No newline at end of file diff --git a/queries/aws_workspaces_directory_5.yaml b/queries/aws_workspaces_directory_5.yaml old mode 100755 new mode 100644 index f5381f436..72fdeac29 --- a/queries/aws_workspaces_directory_5.yaml +++ b/queries/aws_workspaces_directory_5.yaml @@ -1,25 +1,33 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_5 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n alias,\n customer_user_name,\n\ - \ directory_type,\n state,\n selfservice_permissions ->> 'SwitchRunningMode'\ - \ as switch_running_mode\nfrom\n aws_workspaces_directory\nwhere\n selfservice_permissions\ - \ ->> 'SwitchRunningMode' = 'ENABLED';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + alias, + customer_user_name, + directory_type, + state, + selfservice_permissions ->> 'SwitchRunningMode' AS switch_running_mode + FROM + aws_workspaces_directory + WHERE + selfservice_permissions ->> 'SwitchRunningMode' = 'ENABLED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_ops: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WorkSpaces -Title: List AWS WorkSpaces Directory Information + - WorkSpaces +Title: List AWS WorkSpaces Directory Information \ No newline at end of file diff --git a/queries/aws_workspaces_directory_6.yaml b/queries/aws_workspaces_directory_6.yaml old mode 100755 new mode 100644 index 59cb3dc6d..f5f73f1e8 --- a/queries/aws_workspaces_directory_6.yaml +++ b/queries/aws_workspaces_directory_6.yaml @@ -1,27 +1,32 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_6 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n workspace_creation_properties\ - \ ->> 'CustomSecurityGroupId' as custom_security_group_id,\n workspace_creation_properties\ - \ ->> 'DefaultOu' as default_ou,\n workspace_creation_properties ->> 'EnableInternetAccess'\ - \ as enable_internet_access,\n workspace_creation_properties ->> 'EnableMaintenanceMode'\ - \ as enable_maintenance_mode,\n workspace_creation_properties ->> 'EnableWorkDocs'\ - \ as enable_work_docs,\n workspace_creation_properties ->> 'UserEnabledAsLocalAdministrator'\ - \ as user_enabled_as_local_administrator\nfrom\n aws_workspaces_directory\nwhere\n\ - \ directory_id = 'd-96676995ea';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + workspace_creation_properties ->> 'CustomSecurityGroupId' AS custom_security_group_id, + workspace_creation_properties ->> 'DefaultOu' AS default_ou, + workspace_creation_properties ->> 'EnableInternetAccess' AS enable_internet_access, + workspace_creation_properties ->> 'EnableMaintenanceMode' AS enable_maintenance_mode, + workspace_creation_properties ->> 'EnableWorkDocs' AS enable_work_docs, + workspace_creation_properties ->> 'UserEnabledAsLocalAdministrator' AS user_enabled_as_local_administrator + FROM + aws_workspaces_directory + WHERE + directory_id = 'd-96676995ea'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WorkSpaces -Title: Find AWS WorkSpaces Directory Details Including IDs and Properties + - AWS WorkSpaces +Title: Find AWS WorkSpaces Directory Details Including IDs and Properties \ No newline at end of file diff --git a/queries/aws_workspaces_directory_7.yaml b/queries/aws_workspaces_directory_7.yaml old mode 100755 new mode 100644 index 0ad346851..bec89ecb3 --- a/queries/aws_workspaces_directory_7.yaml +++ b/queries/aws_workspaces_directory_7.yaml @@ -1,22 +1,30 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_7 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n alias,\n customer_user_name,\n\ - \ directory_type,\n state\nfrom\n aws_workspaces_directory\nwhere\n state\ - \ = 'REGISTERED';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + alias, + customer_user_name, + directory_type, + state + FROM + aws_workspaces_directory + WHERE + state = 'REGISTERED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - WorkSpaces -Title: List all AWS WorkSpaces Directory Information + - WorkSpaces +Title: List all AWS WorkSpaces Directory Information \ No newline at end of file diff --git a/queries/aws_workspaces_directory_8.yaml b/queries/aws_workspaces_directory_8.yaml old mode 100755 new mode 100644 index 8b0f387d8..70742fbb7 --- a/queries/aws_workspaces_directory_8.yaml +++ b/queries/aws_workspaces_directory_8.yaml @@ -1,30 +1,36 @@ -Description: Allows users to query AWS WorkSpaces Directory information to retrieve - details such as directory ID, directory type, workspace creation properties, and - more. +Description: Allows users to query AWS WorkSpaces Directory information to retrieve details such as directory ID, directory type, workspace creation properties, and more. ID: aws_workspaces_directory_8 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n directory_id,\n arn,\n workspace_access_properties\ - \ ->> 'DeviceTypeAndroid' as device_type_android,\n workspace_access_properties\ - \ ->> 'DeviceTypeChromeOs' as device_type_chrome_os,\n workspace_access_properties\ - \ ->> 'DeviceTypeIos' as device_type_ios,\n workspace_access_properties ->> 'DeviceTypeLinux'\ - \ as device_type_linux,\n workspace_access_properties ->> 'DeviceTypeOsx' as\ - \ device_type_osx,\n workspace_access_properties ->> 'DeviceTypeWeb' as device_type_web,\n\ - \ workspace_access_properties ->> 'DeviceTypeWindows' as device_type_windows,\n\ - \ workspace_access_properties ->> 'DeviceTypeZeroClient' as device_type_zero_client\n\ - from\n aws_workspaces_directory\nwhere\n directory_id = 'd-96676995ea';" + QueryToExecute: | + SELECT + name, + directory_id, + arn, + workspace_access_properties ->> 'DeviceTypeAndroid' AS device_type_android, + workspace_access_properties ->> 'DeviceTypeChromeOs' AS device_type_chrome_os, + workspace_access_properties ->> 'DeviceTypeIos' AS device_type_ios, + workspace_access_properties ->> 'DeviceTypeLinux' AS device_type_linux, + workspace_access_properties ->> 'DeviceTypeOsx' AS device_type_osx, + workspace_access_properties ->> 'DeviceTypeWeb' AS device_type_web, + workspace_access_properties ->> 'DeviceTypeWindows' AS device_type_windows, + workspace_access_properties ->> 'DeviceTypeZeroClient' AS device_type_zero_client + FROM + aws_workspaces_directory + WHERE + directory_id = 'd-96676995ea'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_identity_security: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - AWS WorkSpaces -Title: List AWS WorkSpaces Directory Details Using SQL + - AWS WorkSpaces +Title: List AWS WorkSpaces Directory Details Using SQL \ No newline at end of file diff --git a/queries/aws_workspaces_workspace_1.yaml b/queries/aws_workspaces_workspace_1.yaml old mode 100755 new mode 100644 index 4b6ac862b..d5c52be3b --- a/queries/aws_workspaces_workspace_1.yaml +++ b/queries/aws_workspaces_workspace_1.yaml @@ -1,19 +1,25 @@ -Description: Allows users to query Amazon WorkSpaces Workspace to retrieve details - about each workspace in the AWS account. +Description: Allows users to query Amazon WorkSpaces Workspace to retrieve details about each workspace in the AWS account. ID: aws_workspaces_workspace_1 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n workspace_id,\n arn,\n state\nfrom\n aws_workspaces_workspace;" + QueryToExecute: | + SELECT + name, + workspace_id, + arn, + state + FROM + aws_workspaces_workspace; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon WorkSpaces -Title: List all Amazon WorkSpaces Workspace details + - Amazon WorkSpaces +Title: List all Amazon WorkSpaces Workspace details \ No newline at end of file diff --git a/queries/aws_workspaces_workspace_2.yaml b/queries/aws_workspaces_workspace_2.yaml old mode 100755 new mode 100644 index 7017eb895..abfef75c9 --- a/queries/aws_workspaces_workspace_2.yaml +++ b/queries/aws_workspaces_workspace_2.yaml @@ -1,20 +1,27 @@ -Description: Allows users to query Amazon WorkSpaces Workspace to retrieve details - about each workspace in the AWS account. +Description: Allows users to query Amazon WorkSpaces Workspace to retrieve details about each workspace in the AWS account. ID: aws_workspaces_workspace_2 IntegrationType: -- aws_cloud_account + - aws_cloud_account Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select\n name,\n workspace_id,\n arn,\n state\nfrom\n aws_workspaces_workspace\n\ - where\n state = 'TERMINATED';" + QueryToExecute: | + SELECT + name, + workspace_id, + arn, + state + FROM + aws_workspaces_workspace + WHERE + state = 'TERMINATED'; Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Amazon WorkSpaces -Title: Find Amazon WorkSpaces Workspace details in AWS + - Amazon WorkSpaces +Title: Find Amazon WorkSpaces Workspace details in AWS \ No newline at end of file diff --git a/queries/bulk_update_yaml.sh b/queries/bulk_update_yaml.sh deleted file mode 100755 index c4c434160..000000000 --- a/queries/bulk_update_yaml.sh +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/bash - -# Script Name: replace_integration_types.sh -# Description: -# Replaces '- aws' with '- aws_cloud_account' and '- azure' with '- azure_subscription' -# within the IntegrationType sections of YAML files. -# -# Usage: -# ./replace_integration_types.sh [-r] [directory] -# -r : Recursively search through subdirectories -# directory : Directory to start from (default: current directory) - -# Exit immediately if a command exits with a non-zero status -set -e - -# Function to display usage instructions -usage() { - echo "Usage: $0 [-r] [directory]" - echo " -r Recursively search through subdirectories" - echo " directory Directory to start from (default: current directory)" - exit 1 -} - -# Initialize variables -RECURSIVE=false -START_DIR="." - -# Parse options -while getopts "r" opt; do - case "$opt" in - r) - RECURSIVE=true - ;; - \?) - echo "Invalid option: -$OPTARG" >&2 - usage - ;; - esac -done -shift $((OPTIND -1)) - -# If a directory is provided, use it -if [ "$#" -ge 1 ]; then - START_DIR="$1" -fi - -# Check if the starting directory exists and is a directory -if [ ! -d "$START_DIR" ]; then - echo "Error: Directory '$START_DIR' does not exist." >&2 - exit 1 -fi - -# Determine the find command based on the recursive flag -if [ "$RECURSIVE" = true ]; then - FIND_CMD=(find "$START_DIR" -type f) -else - FIND_CMD=(find "$START_DIR" -maxdepth 1 -type f) -fi - -# Find and process each file -for FILE in "${FIND_CMD[@]}"; do - # Check if the file has a .yaml or .yml extension - if [[ "$FILE" =~ \.(yaml|yml)$ ]]; then - # Output processing message - echo "Processing: $FILE" - - # Check if the file contains 'IntegrationType:' - if grep -q "^IntegrationType:" "$FILE"; then - # Create a temporary file securely - TMP_FILE=$(mktemp) - - # Use awk to perform the replacements within the IntegrationType block - awk ' - BEGIN { in_block = 0 } - /^IntegrationType:/ { - print; - in_block = 1; - next - } - # Exit the block if a new top-level key starts (line starts with non-space and not a list item) - /^[^[:space:]]/ && !/^[[:space:]]*-/ { - in_block = 0 - } - # If within the IntegrationType block and line matches '- aws', replace it - in_block == 1 && /^[[:space:]]*-[[:space:]]*aws[[:space:]]*$/ { - sub(/- aws[[:space:]]*$/, "- aws_cloud_account") - } - # If within the IntegrationType block and line matches '- azure', replace it - in_block == 1 && /^[[:space:]]*-[[:space:]]*azure[[:space:]]*$/ { - sub(/- azure[[:space:]]*$/, "- azure_subscription") - } - { print } - ' "$FILE" > "$TMP_FILE" - - # Compare the original file with the modified file - if ! cmp -s "$FILE" "$TMP_FILE"; then - # Replace the original file with the modified file - mv "$TMP_FILE" "$FILE" - echo "Modified: $FILE" - else - # No changes made; remove the temporary file - rm "$TMP_FILE" - fi - else - echo "No IntegrationType section found in: $FILE" - fi - else - # Non-YAML files are ignored, but still output processing message - echo "Processing: $FILE (skipped, not a YAML file)" - fi -done - -echo "Replacement process complete." diff --git a/queries/cloud_managed_software.yaml b/queries/cloud_managed_software.yaml old mode 100755 new mode 100644 index 64b356980..0f06c2f20 --- a/queries/cloud_managed_software.yaml +++ b/queries/cloud_managed_software.yaml @@ -1,26 +1,40 @@ -Description: '' +Description: "" ID: cloud_managed_software IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::kafka::cluster', 'aws::mwaa::environment', 'aws::amp::workspace',\ - \ 'microsoft.dashboard/grafana')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c + ON + r.connection_id = c.og_id + WHERE + resource_type IN ('aws::kafka::cluster', 'aws::mwaa::environment', 'aws::amp::workspace', 'microsoft.dashboard/grafana') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws + - aws cloud_service: - - Managed Software -Title: Cloud Managed Software + - Managed Software +Title: Cloud Managed Software \ No newline at end of file diff --git a/queries/cloud_networks.yaml b/queries/cloud_networks.yaml old mode 100755 new mode 100644 index a4072d805..542921bcc --- a/queries/cloud_networks.yaml +++ b/queries/cloud_networks.yaml @@ -1,26 +1,39 @@ -Description: '' +Description: "" ID: cloud_networks IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::ec2::vpc', 'microsoft.network/virtualnetworks')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::ec2::vpc', 'microsoft.network/virtualnetworks') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Network -Title: Cloud Networks + - Network +Title: Cloud Networks \ No newline at end of file diff --git a/queries/container_workload.yaml b/queries/container_workload.yaml old mode 100755 new mode 100644 index 5c54170e5..db04740c0 --- a/queries/container_workload.yaml +++ b/queries/container_workload.yaml @@ -1,26 +1,44 @@ -Description: '' +Description: "" ID: container_workload IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::eks::cluster', 'aws::ecs::cluster', 'microsoft.containerregistry/registries',\ - \ 'microsoft.containerservice/managedclusters', 'microsoft.app/containerapps')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN og_connections c + ON r.connection_id = c.og_id + WHERE + resource_type IN ( + 'aws::eks::cluster', + 'aws::ecs::cluster', + 'microsoft.containerregistry/registries', + 'microsoft.containerservice/managedclusters', + 'microsoft.app/containerapps' + ) Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws and azure + - aws and azure cloud_service: - - Container Workload -Title: Container Workload + - Container Workload +Title: Container Workload \ No newline at end of file diff --git a/queries/database_workload.yaml b/queries/database_workload.yaml old mode 100755 new mode 100644 index f671e47f1..6e77d15bb --- a/queries/database_workload.yaml +++ b/queries/database_workload.yaml @@ -1,30 +1,56 @@ -Description: '' +Description: "" ID: database_workload IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::memorydb::cluster', 'aws::neptune::database',\ - \ 'aws::dynamodb::table', 'aws::rds::dbinstance', \n 'aws::elasticache::cluster',\ - \ 'aws::redshift::cluster', 'aws::dms::replicationinstance', 'aws::redshiftserverless::namespace',\ - \ \n 'aws::opensearchserverless::collection', 'microsoft.dbforpostgresql/servers',\ - \ 'microsoft.documentdb/sqldatabases', 'microsoft.sql/servers', \n 'microsoft.dbformysql/servers','microsoft.sql/managedinstances')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c + ON + r.connection_id = c.og_id + WHERE + resource_type IN ( + 'aws::memorydb::cluster', + 'aws::neptune::database', + 'aws::dynamodb::table', + 'aws::rds::dbinstance', + 'aws::elasticache::cluster', + 'aws::redshift::cluster', + 'aws::dms::replicationinstance', + 'aws::redshiftserverless::namespace', + 'aws::opensearchserverless::collection', + 'microsoft.dbforpostgresql/servers', + 'microsoft.documentdb/sqldatabases', + 'microsoft.sql/servers', + 'microsoft.dbformysql/servers', + 'microsoft.sql/managedinstances' + ) Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Database -Title: List Database Workloads and Cloud Provider Information + - Database +Title: List Database Workloads and Cloud Provider Information \ No newline at end of file diff --git a/queries/devops.yaml b/queries/devops.yaml old mode 100755 new mode 100644 index d01e7b298..703dac27d --- a/queries/devops.yaml +++ b/queries/devops.yaml @@ -1,27 +1,40 @@ -Description: '' +Description: "" ID: devops IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::codecommit::repository', 'aws::codedeploy::deploymentgroup')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN og_connections c + ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::codecommit::repository', 'aws::codedeploy::deploymentgroup') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Codecommit - - Codedeploy -Title: DevOps + - Codecommit + - Codedeploy +Title: DevOps \ No newline at end of file diff --git a/queries/keys_and_secrets.yaml b/queries/keys_and_secrets.yaml old mode 100755 new mode 100644 index 896cb1fbb..587fdc79e --- a/queries/keys_and_secrets.yaml +++ b/queries/keys_and_secrets.yaml @@ -1,29 +1,40 @@ -Description: '' +Description: "" ID: keys_and_secrets IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::secretsmanager::secret', 'microsoft.keyvault/vaults',\ - \ 'microsoft.compute/sshpublickeys', 'aws::ec2::keypair')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN og_connections c ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::secretsmanager::secret', 'microsoft.keyvault/vaults', 'microsoft.compute/sshpublickeys', 'aws::ec2::keypair') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Secrets Manager - - Key Vault - - EC2 -Title: Keys and Secrets + - Secrets Manager + - Key Vault + - EC2 +Title: Keys and Secrets \ No newline at end of file diff --git a/queries/kubernetes_clusters.yaml b/queries/kubernetes_clusters.yaml old mode 100755 new mode 100644 index db53583e3..9fbd960cb --- a/queries/kubernetes_clusters.yaml +++ b/queries/kubernetes_clusters.yaml @@ -1,32 +1,60 @@ -Description: '' +Description: "" ID: kubernetes_clusters IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select c.name as cloud_account_name, c.id as _discovered_provider_id,\ - \ t.* from (\n(select \n 'AWS' as provider, \n r.name as name, \n r.region\ - \ as location, \n jsonb_path_query(r.description, '$.Cluster.Tags') as _tags,\n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n jsonb_path_query(r.description, '$.Cluster.PlatformVersion')\ - \ as kubernetes_version,\n r.created_at as _last_discovered\nfrom \n platform_resources\ - \ r\nwhere \n resource_type = 'aws::eks::cluster') \n\nunion \n\n(select \n \ - \ 'Azure' as provider, \n r.name as vm_name, \n r.region as location, \n jsonb_path_query(r.description,\ - \ '$.ManagedCluster.Tags') as _tags,\n r.connection_id as _og_connection_id,\n\ - \ r.resource_id as _resource_id,\n r.resource_type as _resource_type,\n jsonb_path_query(r.description,\ - \ '$.ManagedCluster.Properties.KubernetesVersion') as kubernetes_version,\n r.created_at\ - \ as _last_discovered\nfrom \n platform_resources r \nwhere \n resource_type = 'microsoft.containerservice/managedclusters')\n\ - \n) as t inner join og_connections c on t._og_connection_id = c.og_id " + QueryToExecute: | + SELECT + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + t.* + FROM ( + (SELECT + 'AWS' AS provider, + r.name AS name, + r.region AS location, + jsonb_path_query(r.description, '$.Cluster.Tags') AS _tags, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + jsonb_path_query(r.description, '$.Cluster.PlatformVersion') AS kubernetes_version, + r.created_at AS _last_discovered + FROM + platform_resources r + WHERE + resource_type = 'aws::eks::cluster') + + UNION + + (SELECT + 'Azure' AS provider, + r.name AS vm_name, + r.region AS location, + jsonb_path_query(r.description, '$.ManagedCluster.Tags') AS _tags, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + jsonb_path_query(r.description, '$.ManagedCluster.Properties.KubernetesVersion') AS kubernetes_version, + r.created_at AS _last_discovered + FROM + platform_resources r + WHERE + resource_type = 'microsoft.containerservice/managedclusters') + + ) AS t + INNER JOIN og_connections c + ON t._og_connection_id = c.og_id Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Kubernetes -Title: List All Kubernetes Clusters with Details + - Kubernetes +Title: List All Kubernetes Clusters with Details \ No newline at end of file diff --git a/queries/load_balancers.yaml b/queries/load_balancers.yaml old mode 100755 new mode 100644 index 3fe0f020a..75557b0bf --- a/queries/load_balancers.yaml +++ b/queries/load_balancers.yaml @@ -1,29 +1,46 @@ Description: Load Balancers ID: load_balancers IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered,\n r.description\ - \ -> 'LoadBalancer' -> 'Scheme' as scheme\nfrom \n platform_resources r inner join\ - \ og_connections c on r.connection_id = c.og_id\nwhere \n resource_type IN ('aws::elasticloadbalancing::loadbalancer',\ - \ 'microsoft.network/loadbalancers', 'microsoft.network/applicationgateways')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered, + r.description -> 'LoadBalancer' -> 'Scheme' AS scheme + FROM + platform_resources r + INNER JOIN + og_connections c + ON + r.connection_id = c.og_id + WHERE + resource_type IN ('aws::elasticloadbalancing::loadbalancer', + 'microsoft.network/loadbalancers', + 'microsoft.network/applicationgateways') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - Elastic Load Balancing - - Azure Load Balancer - - Azure Application Gateway -Title: Load Balancers + - Elastic Load Balancing + - Azure Load Balancer + - Azure Application Gateway +Title: Load Balancers \ No newline at end of file diff --git a/queries/network_&_file_stores.yaml b/queries/network_&_file_stores.yaml old mode 100755 new mode 100644 index 32428c553..520ffd9f3 --- a/queries/network_&_file_stores.yaml +++ b/queries/network_&_file_stores.yaml @@ -1,23 +1,36 @@ -Description: '' +Description: "" ID: network_&_file_stores IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::fsx::filesystem', 'aws::efs::filesystem')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::fsx::filesystem', 'aws::efs::filesystem') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws -Title: Network & File Stores + - aws +Title: Network & File Stores \ No newline at end of file diff --git a/queries/object_stores.yaml b/queries/object_stores.yaml old mode 100755 new mode 100644 index 582113496..b9c111e3a --- a/queries/object_stores.yaml +++ b/queries/object_stores.yaml @@ -1,28 +1,42 @@ Description: Object Stores ID: object_stores IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::s3::bucket', 'aws::glacier::vault', 'microsoft.storage/storageaccounts')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c + ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::s3::bucket', 'aws::glacier::vault', 'microsoft.storage/storageaccounts') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - S3 - - Glacier - - Storage Accounts -Title: Object Stores + - S3 + - Glacier + - Storage Accounts +Title: Object Stores \ No newline at end of file diff --git a/queries/replace_integration_types.py b/queries/replace_integration_types.py deleted file mode 100644 index 4e34ffe9c..000000000 --- a/queries/replace_integration_types.py +++ /dev/null @@ -1,84 +0,0 @@ -#!/usr/bin/env python3 - -import os -import sys -import argparse -import yaml - -def process_file(filepath): - with open(filepath, 'r') as file: - try: - data = yaml.safe_load(file) - except yaml.YAMLError as exc: - print(f"Error parsing {filepath}: {exc}") - return False - - if data is None: - print(f"File is empty or contains invalid YAML: {filepath}") - return False - - original_data = yaml.dump(data) - modified = False - - def replace_integration_type(data): - nonlocal modified - if isinstance(data, dict): - for key, value in data.items(): - if key == 'IntegrationType' and isinstance(value, list): - new_list = [] - for item in value: - if item == 'aws': - new_list.append('aws_cloud_account') - modified = True - elif item == 'azure': - new_list.append('azure_subscription') - modified = True - else: - new_list.append(item) - data[key] = new_list - else: - replace_integration_type(value) - elif isinstance(data, list): - for item in data: - replace_integration_type(item) - - replace_integration_type(data) - - if modified: - with open(filepath, 'w') as file: - yaml.dump(data, file, default_flow_style=False) - print(f"Modified: {filepath}") - else: - print(f"No changes in: {filepath}") - - return True - -def main(): - parser = argparse.ArgumentParser(description='Replace IntegrationType values in YAML files.') - parser.add_argument('directory', nargs='?', default='.', help='Directory to start from (default: current directory)') - parser.add_argument('-r', '--recursive', action='store_true', help='Recursively search through subdirectories') - args = parser.parse_args() - - if not os.path.isdir(args.directory): - print(f"Error: Directory '{args.directory}' does not exist.") - sys.exit(1) - - yaml_files = [] - if args.recursive: - for root, dirs, files in os.walk(args.directory): - for file in files: - if file.endswith(('.yaml', '.yml')): - yaml_files.append(os.path.join(root, file)) - else: - for file in os.listdir(args.directory): - if file.endswith(('.yaml', '.yml')): - yaml_files.append(os.path.join(args.directory, file)) - - for filepath in yaml_files: - print(f"Processing: {filepath}") - process_file(filepath) - - print("Replacement process complete.") - -if __name__ == "__main__": - main() diff --git a/queries/server_workload.yaml b/queries/server_workload.yaml old mode 100755 new mode 100644 index b8d167d6d..f76a6149b --- a/queries/server_workload.yaml +++ b/queries/server_workload.yaml @@ -1,40 +1,69 @@ Description: List Cloud VM Workloads for AWS and Azure ID: server_workload IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select c.name as cloud_account_name, c.id as _discovered_provider_id,\ - \ t.* from (\n(select \n 'AWS' as provider, \n r.name as vm_name, \n r.region\ - \ as location, \n jsonb_path_query(r.description, '$.Instance.InstanceType')\ - \ as instance_size,\n jsonb_path_query(r.description, '$.Instance.NetworkInterfaces[*].PrivateIpAddress')\ - \ as private_ip,\n jsonb_path_query(r.description, '$.Instance.PlatformDetails')\ - \ as platform,\n jsonb_path_query(r.description, '$.InstanceStatus.InstanceState.Name')\ - \ as state,\n jsonb_path_query(r.description, '$.Instance.Tags') as _tags,\n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r\nwhere \n resource_type = 'aws::ec2::instance') \n\nunion\ - \ \n\n(select \n 'Azure' as provider, \n r.name as vm_name, \n r.region as\ - \ location, \n jsonb_path_query(r.description, '$.VirtualMachine.Properties.HardwareProfile.VMSize')\ - \ as instance_size,\n jsonb_path_query(r.description, '$.InterfaceIPConfigurations[*].Properties.PrivateIPAddress')\ - \ as private_ip,\n jsonb_path_query(r.description, '$.VirtualMachineInstanceView.OSName')\ - \ as platform,\n jsonb_path_query(r.description, '$.VirtualMachineInstanceView.Statuses')\ - \ as state,\n jsonb_path_query(r.description, '$.VirtualMachine.Tags') as _tags,\n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r \nwhere \n resource_type = 'microsoft.compute/virtualmachines')\n\ - \n) as t inner join og_connections c on t._og_connection_id = c.og_id " + QueryToExecute: | + SELECT + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + t.* + FROM ( + ( + SELECT + 'AWS' AS provider, + r.name AS vm_name, + r.region AS location, + jsonb_path_query(r.description, '$.Instance.InstanceType') AS instance_size, + jsonb_path_query(r.description, '$.Instance.NetworkInterfaces[*].PrivateIpAddress') AS private_ip, + jsonb_path_query(r.description, '$.Instance.PlatformDetails') AS platform, + jsonb_path_query(r.description, '$.InstanceStatus.InstanceState.Name') AS state, + jsonb_path_query(r.description, '$.Instance.Tags') AS _tags, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + WHERE + resource_type = 'aws::ec2::instance' + ) + + UNION + + ( + SELECT + 'Azure' AS provider, + r.name AS vm_name, + r.region AS location, + jsonb_path_query(r.description, '$.VirtualMachine.Properties.HardwareProfile.VMSize') AS instance_size, + jsonb_path_query(r.description, '$.InterfaceIPConfigurations[*].Properties.PrivateIPAddress') AS private_ip, + jsonb_path_query(r.description, '$.VirtualMachineInstanceView.OSName') AS platform, + jsonb_path_query(r.description, '$.VirtualMachineInstanceView.Statuses') AS state, + jsonb_path_query(r.description, '$.VirtualMachine.Tags') AS _tags, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + WHERE + resource_type = 'microsoft.compute/virtualmachines' + ) + ) AS t + INNER JOIN og_connections c ON t._og_connection_id = c.og_id Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - EC2 - - Virtual Machines -Title: List Cloud VM Workloads for AWS and Azure + - EC2 + - Virtual Machines +Title: List Cloud VM Workloads for AWS and Azure \ No newline at end of file diff --git a/queries/snapshots_&_backup_media.yaml b/queries/snapshots_&_backup_media.yaml old mode 100755 new mode 100644 index 972257585..a7dedae9d --- a/queries/snapshots_&_backup_media.yaml +++ b/queries/snapshots_&_backup_media.yaml @@ -1,28 +1,41 @@ Description: Snapshots and Backup Resources by Cloud Account ID: snapshots_&_backup_media IntegrationType: -- aws_cloud_account -- azure_subscription + - aws_cloud_account + - azure_subscription Query: Engine: CloudQL-v0.0.1 ListOfTables: [] Parameters: [] PrimaryTable: null - QueryToExecute: "select \n case\n when resource_type like 'aws::%' then 'AWS'\n\ - \ else 'Azure'\n end as provider, \n c.name as cloud_account_name, \n c.id\ - \ as _discovered_provider_id,\n r.name as name, \n r.region as location, \n\ - \ r.connection_id as _og_connection_id,\n r.resource_id as _resource_id,\n \ - \ r.resource_type as _resource_type,\n r.created_at as _last_discovered\nfrom\ - \ \n platform_resources r inner join og_connections c on r.connection_id = c.og_id\n\ - where \n resource_type IN ('aws::ec2::image', 'aws::elasticache::cluster', 'aws::rds::dbsnapshot')" + QueryToExecute: | + SELECT + CASE + WHEN resource_type LIKE 'aws::%' THEN 'AWS' + ELSE 'Azure' + END AS provider, + c.name AS cloud_account_name, + c.id AS _discovered_provider_id, + r.name AS name, + r.region AS location, + r.connection_id AS _og_connection_id, + r.resource_id AS _resource_id, + r.resource_type AS _resource_type, + r.created_at AS _last_discovered + FROM + platform_resources r + INNER JOIN + og_connections c ON r.connection_id = c.og_id + WHERE + resource_type IN ('aws::ec2::image', 'aws::elasticache::cluster', 'aws::rds::dbsnapshot') Tags: cloud_asset_management: - - 'true' + - "true" cloud_provider: - - aws - - azure + - aws + - azure cloud_service: - - EC2 - - Elasticache - - RDS -Title: Snapshots and Backup Resources by Cloud Account + - EC2 + - Elasticache + - RDS +Title: Snapshots and Backup Resources by Cloud Account \ No newline at end of file