aquasecurity · balasathya16 · Dec 14, 2022 · Dec 14, 2022 · Dec 14, 2022 · Dec 14, 2022
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1 @@
+.DS_Store
diff --git a/README.md b/README.md
@@ -13,6 +13,17 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
 * AWS
     * ACM
         * [ACM Certificate Validation](en/aws/acm/acm-certificate-validation.md)
+    * APIGateway
+        * [API Gateway Certificate Rotation](en/aws/apigateway/api-gateway-certificate-rotation.md)
+        * [API Gateway Client Certificate](en/aws/apigateway/api-gateway-client-certificate.md)
+        * [API Gateway CloudWatch Logs](en/aws/apigateway/api-gateway-cloudwatch-logs.md)
+        * [API Gateway Content Encoding](en/aws/apigateway/api-gateway-content-encoding.md)
+        * [API Gateway Detailed CloudWatch Metrics](en/aws/apigateway/api-gateway-detailed-cloudwatch-metrics.md)
+        * [API Gateway Private Endpoints](en/aws/apigateway/api-gateway-private-endpoints.md)
+        * [API Gateway Response Caching](en/aws/apigateway/api-gateway-response-caching.md)
+        * [API Gateway Tracing Enabled](en/aws/apigateway/api-gateway-tracing-enabled.md)
+        * [API Gateway WAF Enabled](en/aws/apigateway/api-gateway-waf-enabled.md)
+        * [API Stage-Level Cache Encryption](en/aws/apigateway/api-stage-level-cache-encryption.md)
     * AutoScaling
         * [ASG Multiple AZ](en/aws/autoscaling/asg-multiple-az.md)
     * CloudFront
@@ -31,22 +42,32 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
         * [CloudTrail To CloudWatch](en/aws/cloudtrail/cloudtrail-to-cloudwatch.md)
     * CloudWatchLogs
         * [CloudWatch Monitoring Metrics](en/aws/cloudwatchlogs/cloudwatch-monitoring-metrics.md)
+    * CodeBuild
+        * [Project Artifacts Encrypted](en/aws/codebuild/project-artifacts-encrypted.md)
     * ConfigService
         * [Config Service Enabled](en/aws/configservice/config-service-enabled.md)
     * EC2
+        * [Amazon EBS Public Snapshots](en/aws/ec2/amazon-ebs-public-snapshots.md)
+        * [App-Tier EC2 Instance IAM Role](en/aws/ec2/app-tier-ec2-instance-iam-role.md)
+        * [Automate EBS Snapshot Lifecycle](en/aws/ec2/automate-ebs-snapshot-lifecycle.md)
+        * [Cross Organization VPC Peering Connections](en/aws/ec2/cross-organization-vpc-peering-connections.md)
         * [Cross VPC Public Private Communication](en/aws/ec2/cross-vpc-public-private-communication.md)
         * [Default Security Group](en/aws/ec2/default-security-group.md)
         * [Default VPC In Use](en/aws/ec2/default-vpc-in-use.md)
         * [Detect EC2 Classic Instances](en/aws/ec2/detect-ec2-classic-instances.md)
+        * [EBS Backup Enabled](en/aws/ec2/ebs-backup-enabled.md)
         * [EBS Encrypted Snapshots](en/aws/ec2/ebs-encrypted-snapshots.md)
         * [EBS Encryption Enabled](en/aws/ec2/ebs-encryption-enabled.md)
+        * [EBS Encryption Enabled By Default](en/aws/ec2/ebs-encryption-enabled-by-default.md)
+        * [EBS Volumes Too Old Snapshots](en/aws/ec2/ebs-volumes-too-old-snapshots.md)
         * [EC2 Instance Key Based Login](en/aws/ec2/ec2-instance-key-based-login.md)
         * [EC2 Max Instances](en/aws/ec2/ec2-max-instances.md)
         * [Elastic IP Limit](en/aws/ec2/elastic-ip-limit.md)
         * [Encrypted AMI](en/aws/ec2/encrypted-ami.md)
         * [Excessive Security Groups](en/aws/ec2/excessive-security-groups.md)
         * [Instance IAM Role](en/aws/ec2/instance-iam-role.md)
         * [Instance Limit](en/aws/ec2/instance-limit.md)
+        * [Managed NAT Gateway In Use](en/aws/ec2/managed-nat-gateway-in-use.md)
         * [NAT Multiple AZ](en/aws/ec2/nat-multiple-az.md)
         * [Open All Ports Protocols](en/aws/ec2/open-all-ports-protocols.md)
         * [Open CIFS](en/aws/ec2/open-cifs.md)
@@ -66,19 +87,44 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
         * [Open Telnet](en/aws/ec2/open-telnet.md)
         * [Open VNC Client](en/aws/ec2/open-vnc-client.md)
         * [Open VNC Server](en/aws/ec2/open-vnc-server.md)
+        * [Outdated Amazon Machine Images](en/aws/ec2/outdated-amazon-machine-images.md)
         * [Overlapping Security Groups](en/aws/ec2/overlapping-security-groups.md)
         * [Public AMI](en/aws/ec2/public-ami.md)
         * [Subnet IP Availability](en/aws/ec2/subnet-ip-availability.md)
+        * [Unrestricted Network ACL Outbound Traffic](en/aws/ec2/unrestricted-network-acl-outbound-traffic.md)
+        * [Unused Amazon Machine Images](en/aws/ec2/unused-amazon-machine-images.md)
+        * [Unused Elastic Network Interfaces](en/aws/ec2/unused-elastic-network-interfaces.md)
+        * [Unused Virtual Private Gateway](en/aws/ec2/unused-virtual-private-gateway.md)
+        * [Unused VPC Internet Gateways](en/aws/ec2/unused-vpc-internet-gateways.md)
         * [VPC Elastic IP Limit](en/aws/ec2/vpc-elastic-ip-limit.md)
+        * [VPC Endpoint Cross Account Access](en/aws/ec2/vpc-endpoint-cross-account-acess.md)
+        * [VPC Endpoint Exposed](en/aws/ec2/vpc-endpoint-exposed.md)
         * [VPC Flow Logs Enabled](en/aws/ec2/vpc-flow-logs-enabled.md)
         * [VPC Multiple Subnets](en/aws/ec2/vpc-multiple-subnets.md)
+        * [VPC Subnet Instances Present](en/aws/ec2/vpc-subnet-instances-present.md)
+        * [VPN Tunnel State](en/aws/ec2/vpn-tunnel-state.md)
+        * [Web-Tier EC2 Instance IAM Role](en/aws/ec2/web-tier-ec2-instance-iam-role.md)
+    * EFS
+        * [EFS CMK Encrypted](en/aws/efs/efs-cmk-encrypted.md)
+        * [EFS Encryption Enabled](en/aws/efs/efs-encryption-enabled.md)
+    * EKS
+        * [EKS Kubernetes Version](en/aws/eks/eks-kubernetes-version.md)
+        * [EKS Latest Platform Version](en/aws/eks/eks-latest-platform-version.md)
+        * [EKS Logging Enabled](en/aws/eks/eks-logging-enabled.md)
+        * [EKS Private Endpoint](en/aws/eks/eks-private-endpoint.md)
+        * [EKS Secrets Encrypted](en/aws/eks/eks-secrets-encrypted.md)
+        * [EKS Security Groups](en/aws/eks/eks-security-groups.md)
     * ELB
         * [ELB HTTPS Only](en/aws/elb/elb-https-only.md)
         * [ELB Logging Enabled](en/aws/elb/elb-logging-enabled.md)
         * [ELB No Instances](en/aws/elb/elb-no-instances.md)
         * [Insecure Ciphers](en/aws/elb/insecure-ciphers.md)
-    * Firehose
+   * EventBridge
+        * [EventBridge Event Rules In Use](en/aws/eventbridge/eventbridge-event-rules-in-use.md)
+   * Firehose
         * [Firehose Delivery Streams Encrypted](en/aws/firehose/firehose-delivery-streams-encrypted.md)
+    * Glacier
+        * [S3 Glacier Vault Public Access](en/aws/glacier/S3-glacier-vault-public-access.md)
     * IAM
         * [Access Keys Extra](en/aws/iam/access-keys-extra.md)
         * [Access Keys Last Used](en/aws/iam/access-keys-last-used.md)
@@ -102,14 +148,21 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
         * [Users MFA Enabled](en/aws/iam/users-mfa-enabled.md)
         * [Users Password Last Used](en/aws/iam/users-password-last-used.md)
     * KMS
+        * [App-Tier KMS Customer Master Key (CMK)](en/aws/kms/app-tier-kms-customer-master-key-(cmk).md)
         * [KMS Default Key Usage](en/aws/kms/kms-default-key-usage.md)
+        * [KMS Duplicate Grants](en/aws/kms/kms-duplicate-grants.md)
+        * [KMS Grant Least Privilege](en/aws/kms/kms-grant-least-privilege.md)
         * [KMS Key Policy](en/aws/kms/kms-key-policy.md)
         * [KMS Key Rotation](en/aws/kms/kms-key-rotation.md)
         * [KMS Scheduled Deletion](en/aws/kms/kms-scheduled-deletion.md)
     * Kinesis
+        * [Kinesis Data Streams Encrypted](en/aws/kinesis/kinesis-data-streams-encrypted.md)
         * [Kinesis Streams Encrypted](en/aws/kinesis/kinesis-streams-encrypted.md)
     * Lambda
         * [Lambda Old Runtimes](en/aws/lambda/lambda-old-runtimes.md)
+        * [Lambda Tracing Enabled](en/aws/lambda/lambda-tracing-enabled.md)
+    * Neptune
+       * [Neptune Database Instance Encrypted](en/aws/neptune/neptune-database-instance-encrypted.md)
     * RDS
         * [RDS Automated Backups](en/aws/rds/rds-automated-backups.md)
         * [RDS Encryption Enabled](en/aws/rds/rds-encryption-enabled.md)
@@ -128,6 +181,11 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
         * [S3 Bucket All Users Policy](en/aws/s3/s3-bucket-all-users-policy.md)
         * [S3 Bucket Logging](en/aws/s3/s3-bucket-logging.md)
         * [S3 Bucket Versioning](en/aws/s3/s3-bucket-versioning.md)
+        * [S3 Bucket Lifecycle Configuration](en/aws/s3/s3-bucket-lifecycle-configuration.md)
+        * [S3 Bucket Policy CloudFront OAI](en/aws/s3/s3-bucket-policy-cloudfront-oai.md)
+        * [S3 DNS Compliant Bucket Names](en/aws/s3/s3-dns-compliant-bucket-names.md)
+        * [S3 Transfer Acceleration Enabled](en/aws/s3/s3-transfer-acceleration-enabled.md)
+        * [S3 Versioned Buckets Lifecycle Configuration](en/aws/s3/s3-versioned-buckets-lifecycle-configuration.md)
     * SES
         * [Email DKIM Enabled](en/aws/ses/email-dkim-enabled.md)
     * SNS
@@ -140,6 +198,10 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
     * SageMaker
         * [Notebook Data Encrypted](en/aws/sagemaker/notebook-data-encrypted.md)
         * [Notebook Direct Internet Access](en/aws/sagemaker/notebook-direct-internet-access.md)
+    * WAF
+        * [AWS WAF In Use](en/aws/waf/aws-waf-in-use.md) 
+    * WAFV2
+        * [AWS WAFV2 In Use](en/aws/wafv2/aws-wafv2-in-use.md) 
 * Azure
     * Active Directory
         * [Ensure No Guest User](en/azure/activedirectory/ensure-no-guest-user.md)
@@ -481,4 +543,4 @@ This repository is an extension of CloudSploit's [open-source scanning engine](h
 
 ## Contributing
 
-Please see the [contributor's guide](.github/CONTRIBUTING.md).
+Please see the [contributor's guide](.github/CONTRIBUTING.md).
diff --git a/en/aws/apigateway/api-gateway-certificate-rotation.md b/en/aws/apigateway/api-gateway-certificate-rotation.md
@@ -0,0 +1,27 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway Certificate Rotation
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway Certificate Rotation |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that Amazon API Gateway APIs have certificates with expiration date more than the rotation limit. |
+| **More Info** | API Gateway APIs should have certificates with long term expiry date to avoid API insecurity after certificate expiration. |
+| **AWS Link** | https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html |
+| **Recommended Action** | Rotate the certificate attached to API Gateway API |
+
+## Detailed Remediation Steps
+You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. </br>
+To rotate a client certificate in the console for a previously deployed API, do the following: </br>
+1. Open the API Gateway console at https://console.aws.amazon.com/apigateway/. </br>
+2.  In the main navigation pane, choose Client Certificates. </br>
+3. From the Client Certificates pane, choose Generate Client Certificate. </br>
+4. From navigation pane again click on APIs. </br>
+5. Open the API for which you want to use the client certificate. </br>
+6. Choose Stages under the selected API and then choose a stage. </br>
+7. In the Stage Editor panel, select the new certificate under the Client Certificate section. </br>
+8. To save the settings, choose Save Changes. </br>
diff --git a/en/aws/apigateway/api-gateway-client-certificate.md b/en/aws/apigateway/api-gateway-client-certificate.md
@@ -0,0 +1,30 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway Client Certificate
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway Client Certificate |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that Amazon API Gateway API stages use client certificates |
+| **More Info** | API Gateway API stages should use client certificates to ensure API security authorization. |
+| **AWS Link** | https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html |
+| **Recommended Action** | Attach client certificate to API Gateway API stages |
+
+## Detailed Remediation Steps
+Generate a client certificate using the API Gateway console: </br>
+1. Open the API Gateway console at https://console.aws.amazon.com/apigateway/. </br>
+2. Choose a REST API.
+3. In the main navigation pane, choose Client Certificates. </br>
+4. From the Client Certificates pane, choose Generate Client Certificate. </br>
+5. Optionally, for Edit, choose to add a descriptive title for the generated certificate and choose Save to save the description. API Gateway generates a new certificate and returns the new certificate GUID. </br>
+
+Now you need to configure an API to use SSL certificate:
+1. In the API Gateway console, create or open an API for which you want to use the client certificate. Make sure that the API has been deployed to a stage. For more information on how to deploy see https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api-with-console.html#how-to-deploy-api-console </br>
+2. Choose Stages under the selected API and then choose a stage. </br>
+3. In the Stage Editor panel, select a certificate under the Client Certificate section. </br>
+4. To save the settings, choose Save Changes. </br>
+5. If the API has been deployed previously in the API Gateway console, you'll need to redeploy it for the changes to take effect. For more information, see https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api-with-console.html#apigateway-how-to-redeploy-api-console </br>
diff --git a/en/aws/apigateway/api-gateway-cloudwatch-logs.md b/en/aws/apigateway/api-gateway-cloudwatch-logs.md
@@ -0,0 +1,33 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway CloudWatch Logs
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway CloudWatch Logs |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that Amazon API Gateway API stages have Amazon CloudWatch Logs enabled |
+| **More Info** | API Gateway API stages should have Amazon CloudWatch Logs enabled to help debug issues related to request execution or client access to your API. |
+| **AWS Link** | https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html |
+| **Recommended Action** | Modify API Gateway API stages to enable CloudWatch Logs |
+
+## Detailed Remediation Steps
+1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. </br>
+2. Choose a REST API. </br>
+3. Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. </br>
+4. Choose an existing API and then choose a stage. </br>
+5. Choose Logs/Tracing in the Stage Editor. </br>
+6. To enable execution logging: </br>
+a. Choose Enable CloudWatch Logs under CloudWatch Settings. </br>
+b. Choose Error or Info from the dropdown menu. </br>
+c. If desired, choose Log full requests/responses data to log the full API requests and responses. </br>
+Warning: This can be useful to troubleshoot APIs, but can result in logging sensitive data. We recommend that you don't enable Log full requests/responses data for production APIs. </br>
+d. If desired, choose Enable Detailed CloudWatch Metrics. </br>
+7. To enable access logging: </br>
+a. Choose Enable Access Logging under Custom Access Logging. </br>
+b. Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. </br>
+c. Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. </br>
+8. Choose Save Changes. </br>
diff --git a/en/aws/apigateway/api-gateway-content-encoding.md b/en/aws/apigateway/api-gateway-content-encoding.md
@@ -0,0 +1,22 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway Content Encoding
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway Content Encoding |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that Amazon API Gateway APIs have content encoding enabled. |
+| **More Info** | API Gateway API should have content encoding enabled to enable compression of response payload. |
+| **AWS Link** | https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-gzip-compression-decompression.html |
+| **Recommended Action** | Enable content encoding and set minimum compression size of API Gateway API response |
+
+## Detailed Remediation Steps
+1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. </br>
+2. Choose an existing API. </br>
+3. In the primary navigation pane, choose Settings under the API you chose. </br>
+4. Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. </br>
+5. Choose Save Changes.</br>
diff --git a/en/aws/apigateway/api-gateway-detailed-cloudwatch-metrics.md b/en/aws/apigateway/api-gateway-detailed-cloudwatch-metrics.md
@@ -0,0 +1,23 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway Detailed CloudWatch Metrics
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway Detailed CloudWatch Metrics |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that API Gateway API stages have detailed CloudWatch metrics enabled. |
+| **More Info** | API Gateway API stages should have detailed CloudWatch metrics enabled to monitor logs and events. |
+| **AWS Link** | https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-metrics.html |
+| **Recommended Action** | Add CloudWatch role ARN to API settings and enabled detailed metrics for each stage |
+
+## Detailed Remediation Steps
+1. Open the API Gateway console at https://console.aws.amazon.com/apigateway/. </br>
+2. Choose an API. </br>
+3. Choose a stage. </br>
+4. On the Logs/Tracing tab, choose Enable Detailed CloudWatch Metrics. </br>
+5. Choose Resources in the left side navigation panel. </br>
+6. To redeploy the API with the new settings, choose the Actions dropdown, and then choose Deploy API. </br>
diff --git a/en/aws/apigateway/api-gateway-private-endpoints.md b/en/aws/apigateway/api-gateway-private-endpoints.md
@@ -0,0 +1,25 @@
+[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)
+
+# AWS / API Gateway / API Gateway Private Endpoints
+
+## Quick Info
+
+| | |
+|-|-|
+| **Plugin Title** | API Gateway Private Endpoints |
+| **Cloud** | AWS |
+| **Category** | API Gateway |
+| **Description** | Ensures that Amazon API Gateway APIs are only accessible through private endpoints. |
+| **More Info** | API Gateway APIs should be only accessible through private endpoints to ensure API security |
+| **AWS Link** | https://aws.amazon.com/blogs/compute/introducing-amazon-api-gateway-private-endpoints |
+| **Recommended Action** | Set API Gateway API endpoint configuration to private |
+
+## Detailed Remediation Steps
+To convert a public endpoint from regional or edge-optimized to Private: </br>
+1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. </br>
+2. Choose an existing API. </br>
+3. Choose Settings. </br>
+4. Change the Endpoint Type option under Endpoint Configuration from Edge Optimized or from Regional to Private. </br>
+5. You need to specify one or more VPC endpoints with your API and API Gateway will generate new Route 53 Alias records which you can use to invoke your API. </br>
+6. If you don't have a VPC, then create one and then Create the VPC endpoint for API Gateway. See this for more details: https://aws.amazon.com/blogs/compute/introducing-amazon-api-gateway-private-endpoints/ </br>
+7. Choose Save Changes to start the update. </br>