CloudSploit v3.2 releases: Cloud Security Posture Management

CloudSploit

CloudSploit by Aqua is an open-source project designed to allow detection of security risks in cloud infrastructure accounts, including Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and GitHub. These scripts are designed to return a series of potential misconfigurations and security risks.

It provides GitHub account security auditing capabilities. It uses the GitHub APIs to obtain metadata about the GitHub account (number of repositories, configuration, security settings, etc.) which is then used to evaluate alignment with security best practices.

CloudSploit is available in two deployment options:

Self-Hosted

Follow the instructions below to deploy the open-source version of CloudSploit on your machine in just a few simple steps.

Hosted at Aqua Wave

A commercial version of CloudSploit hosted at Aqua Wave. Try Aqua Wave today!

Architecture

It works in two phases. First, it queries the cloud infrastructure APIs for various metadata about your account, namely the “collection” phase. Once all the necessary data is collected, the result is passed to the “scanning” phase. The scan uses the collected data to search for potential misconfigurations, risks, and other security issues, which are the resulting output.

Changelog v3.2

CloudSploit version 3.2.0 introduces the most latest version on 2023-12-08. The update includes new category plugins for Azure Media Services and Service Bus for Azure. And new category plugins for Bedrock for AWS. Along with this there are new plugins for existing services of Azure, AWS with the hotfixes and enhancements in the existing plugins. The details are as follows.

New Plugins

AWS

Bedrock

• Custom Model Encryption Enabled
• Private Custom Model
• Custom Model In VPC
• Bedrock Model Invocation Logging Enabled

Azure

Application Gateway

• Application Gateway SSL Policy
• Application Gateway Security Logging
• Application Gateway Request Body Inspection

Front Door

• Front Door HTTPS only
• Front Door Security Logging
• Front Door Waf Enabled
• Front Door WAF Bot Protection
• Front Door Request Body Inspection
• Front Door WAF Detection Mode
• Front Door WAF Rate limit
• Front Door Domain Managed DNS

Media Services

• Media Services Public Access Disabled
• Media Services Diagnostic Logs Enabled
• Media Services Managed Identity Enabled
• Media Services Storage Account Managed Identity
• Media Services Classic API Disabled

PostgreSQL Server

• PostgreSQL Flexible Server SCRAM Enabled
• PostgreSQL Diagnostic Logging Enabled
• PostgreSQL Minimum TLS Version
• PostgreSQL Server Private Endpoints Configured
• PostgreSQL Encryption At Rest with BYOK
• PostgreSQL Flexible Server Services Access Disabled
• PostgreSQL Flexible Server Diagnostic Logging

Redis Cache

• Redis Cache Private Endpoint

Service Bus

• Namespace Encryption At Rest with CMK
• Namespace Minimum TLS Version
• Namespace Local Authentication Disabled
• Namespace Logging Enabled

SQL Databases

• Transparent Data Encryption Enabled
• Database Private Link Enabled
• Ledger Automatic Digest Storage
• Database Secure Enclaves Encryption Enabled
• Database Ledger Enabled
• SQL Databases Data Masking Enabled

SQL Server

• Microsoft Support Operations Auditing Enabled
• Server Outbound Networking Restricted

Virtual Machines

• VM vTPM Enabled
• VM Security Type
• VM Secure Boot Enabled
• VM Disks Deletion Config

Hot fixes and enhancements

Aws

• All Open Ports Plugins
  Added settings to check for associated ENIs with open ports security groups. Enabling this setting produces fail result. if ENI is exposed to public.
• S3 Bucket Has Tags
  Updated the plugin to produce the result on regional basis instead of global.
• SSM Managed Instances
  Updated the plugin to produce pass results if the instance is not in running state.

Azure

• Client Certificates Enabled
  When HTTP version 2.0 is enabled, client certificates are ignored by default from azure. Updated the plugin to only check for Client Certificates when HTTP2.0 is not enabled. In case of HTTP2.0 plugin produces pass result.

Installation

Ensure that NodeJS is installed. If not, install it from here.

git clone git@github.com:cloudsploit/scans.git
cd scans
npm install

Tutorial

Copyright (C) 2015 aquasecurity