Skip to content

Commit

Permalink
docs(queries): update queries catalog
Browse files Browse the repository at this point in the history
  • Loading branch information
gabriel-cx committed Nov 16, 2023
1 parent a58a315 commit dc5db32
Show file tree
Hide file tree
Showing 1,691 changed files with 7,935 additions and 6,345 deletions.
3,052 changes: 1,532 additions & 1,520 deletions docs/queries/all-queries.md

Large diffs are not rendered by default.

312 changes: 156 additions & 156 deletions docs/queries/ansible-queries.md

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the co

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="31 15"
```yaml title="Positive test num. 1 - yaml file" hl_lines="31 15"
---
- name: Create task definition
community.aws.ecs_taskdefinition:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ AWS Auto Scaling Groups must have associated ELBs to ensure high availability an

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="4"
```yaml title="Positive test num. 1 - yaml file" hl_lines="4"
- name: elb1
community.aws.ec2_asg:
name: special
Expand All @@ -44,7 +44,7 @@ AWS Auto Scaling Groups must have associated ELBs to ensure high availability an
propagate_at_launch: no

```
```yaml title="Postitive test num. 2 - yaml file" hl_lines="2"
```yaml title="Positive test num. 2 - yaml file" hl_lines="2"
- name: elb2
ec2_asg:
name: special
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The IP address in a DB Security Group should not be '0.0.0.0/0' (IPv4) or '::/0'

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="53 22"
```yaml title="Positive test num. 1 - yaml file" hl_lines="53 22"
- name: create minimal aurora instance in default VPC and default subnet group
community.aws.rds_instance:
engine: aurora
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ IAM Database Auth Enabled should be configured to true when using compatible eng

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="9 22"
```yaml title="Positive test num. 1 - yaml file" hl_lines="9 22"
- name: create minimal aurora instance in default VPC and default subnet group
community.aws.rds_instance:
engine: mysql
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ IAM Policy should not grant 'AssumeRole' permission across all services.<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="4"
```yaml title="Positive test num. 1 - yaml file" hl_lines="4"
- name: Create IAM Managed Policy
community.aws.iam_managed_policy:
policy_name: "ManagedPolicy"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ AWS Key Management Service (KMS) must only possess usable Customer Master Keys (

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="6"
```yaml title="Positive test num. 1 - yaml file" hl_lines="6"
- name: Update IAM policy on an existing KMS key1
community.aws.aws_kms:
alias: my-kms-key
Expand All @@ -37,7 +37,7 @@ AWS Key Management Service (KMS) must only possess usable Customer Master Keys (
enabled: false

```
```yaml title="Postitive test num. 2 - yaml file" hl_lines="6"
```yaml title="Positive test num. 2 - yaml file" hl_lines="6"
- name: Update IAM policy on an existing KMS key2
community.aws.aws_kms:
alias: my-kms-key
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ RDS should not run in public subnet<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="9"
```yaml title="Positive test num. 1 - yaml file" hl_lines="9"
- name: create minimal aurora instance in default VPC and default subnet group
community.aws.rds_instance:
engine: aurora
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Make sure that retain_stack is enabled to keep the Stack and it's associated res

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2 23"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2 23"
- name: Create a stack set with instances in two accounts
community.aws.cloudformation_stack_set:
name: my-stack2
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Lambda Permission Principal should not contain a wildcard.<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="8"
```yaml title="Positive test num. 1 - yaml file" hl_lines="8"
- name: Lambda S3 event notification
community.aws.lambda_policy:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ User Data Shell Script must be encoded<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="9"
```yaml title="Positive test num. 1 - yaml file" hl_lines="9"
---
- name: note that encrypted volumes are only supported in >= Ansible 2.4
community.aws.ec2_lc:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="3 70 40 52 21 89"
```yaml title="Positive test num. 1 - yaml file" hl_lines="3 70 40 52 21 89"
#this is a problematic code where the query should report a result(s)
- name: elb1
community.aws.elb_application_lb:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ API Gateway should have X-Ray Tracing enabled<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="8 12"
```yaml title="Positive test num. 1 - yaml file" hl_lines="8 12"
---
- name: Setup AWS API Gateway setup on AWS and deploy API definition
community.aws.aws_api_gateway:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Check if secure ciphers aren't used in CloudFront<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="14"
```yaml title="Positive test num. 1 - yaml file" hl_lines="14"
- name: example
community.aws.cloudfront_distribution:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ All AWS CloudFront distributions should be integrated with the Web Application F

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2"
- name: create a basic distribution with defaults and tags
community.aws.cloudfront_distribution:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ AWS Lambda Functions must have associated tags.<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2"
- name: add tags
community.aws.lambda:
name: 'Lambda function'
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ RDS should not use the default port (an attacker can easily guess the port). For

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="10"
```yaml title="Positive test num. 1 - yaml file" hl_lines="10"
- name: create minimal aurora instance in default VPC and default subnet group
community.aws.rds_instance:
engine: aurora
Expand All @@ -41,7 +41,7 @@ RDS should not use the default port (an attacker can easily guess the port). For
port: 3306

```
```yaml title="Postitive test num. 2 - yaml file" hl_lines="10"
```yaml title="Positive test num. 2 - yaml file" hl_lines="10"
- name: create minimal aurora instance in default VPC and default subnet group2
community.aws.rds_instance:
engine: postgres
Expand All @@ -54,7 +54,7 @@ RDS should not use the default port (an attacker can easily guess the port). For
port: 5432

```
```yaml title="Postitive test num. 3 - yaml file" hl_lines="10"
```yaml title="Positive test num. 3 - yaml file" hl_lines="10"
- name: create minimal aurora instance in default VPC and default subnet group2
community.aws.rds_instance:
engine: oracle-ee
Expand All @@ -67,7 +67,7 @@ RDS should not use the default port (an attacker can easily guess the port). For
port: 1521

```
<details><summary>Postitive test num. 4 - yaml file</summary>
<details><summary>Positive test num. 4 - yaml file</summary>

```yaml hl_lines="10"
- name: create minimal aurora instance in default VPC and default subnet group2
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Check if the Memcached is disabled on the ElastiCache<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="5"
```yaml title="Positive test num. 1 - yaml file" hl_lines="5"
- name: Basic example
community.aws.elasticache:
name: "test-please-delete"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ If algorithm is AES256 then the master key is null, empty or undefined, otherwis

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="6"
```yaml title="Positive test num. 1 - yaml file" hl_lines="6"
---
- name: mys3Bucket
amazon.aws.s3_bucket:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ AWS CloudFormation should have a template defined through the attribute template

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="40 2 30 15"
```yaml title="Positive test num. 1 - yaml file" hl_lines="40 2 30 15"
- name: create a stack, pass in the template via an URL
amazon.aws.cloudformation:
stack_name: "ansible-cloudformation"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ It's considered a best practice for an EC2 instance to use an EBS optimized inst

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2"
- name: example
amazon.aws.ec2:
key_name: mykey
Expand All @@ -40,7 +40,7 @@ It's considered a best practice for an EC2 instance to use an EBS optimized inst
vpc_subnet_id: subnet-29e63245

```
```yaml title="Postitive test num. 2 - yaml file" hl_lines="10"
```yaml title="Positive test num. 2 - yaml file" hl_lines="10"
- name: example2
amazon.aws.ec2:
key_name: mykey
Expand All @@ -53,7 +53,7 @@ It's considered a best practice for an EC2 instance to use an EBS optimized inst
ebs_optimized: false

```
```yaml title="Postitive test num. 3 - yaml file" hl_lines="2"
```yaml title="Positive test num. 3 - yaml file" hl_lines="2"
- name: example3
amazon.aws.ec2:
key_name: mykey
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="5"
```yaml title="Positive test num. 1 - yaml file" hl_lines="5"
- name: Create s3 bucket2
community.aws.aws_s3_cors:
name: mys3bucket
Expand All @@ -50,7 +50,7 @@ If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it
max_age_seconds: 30000

```
```yaml title="Postitive test num. 2 - yaml file" hl_lines="5"
```yaml title="Positive test num. 2 - yaml file" hl_lines="5"
- name: Create s3 bucket4
aws_s3_cors:
name: mys3bucket2
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Checks if the S3 bucket is accessible for all users<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="4"
```yaml title="Positive test num. 1 - yaml file" hl_lines="4"
- name: Create a simple s3 bucket with a policy
amazon.aws.s3_bucket:
name: mys3bucket
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Lambda permission may be misconfigured if the action field is not filled in by '

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="7"
```yaml title="Positive test num. 1 - yaml file" hl_lines="7"
- name: Lambda S3 notification positive
community.aws.lambda_policy:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ No password expiration policy<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="33 2 21"
```yaml title="Positive test num. 1 - yaml file" hl_lines="33 2 21"
- name: Missing Password policy for AWS account
community.aws.iam_password_policy:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Route53 Record should have a list of records<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="3 14"
```yaml title="Positive test num. 1 - yaml file" hl_lines="3 14"
---
- name: Use a routing policy to distribute traffic02
community.aws.route53:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ EBS volumes should be encrypted<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="24 19 12 5"
```yaml title="Positive test num. 1 - yaml file" hl_lines="24 19 12 5"
---
- name: Creating EBS volume01
amazon.aws.ec2_vol:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ CloudTrail log file validation should be enabled to determine whether a log file

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2 21"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2 21"
- name: create multi-region trail with validation and tags
community.aws.cloudtrail:
state: present
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The CIDR IP should not be a public interface<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="22"
```yaml title="Positive test num. 1 - yaml file" hl_lines="22"
- name: create minimal aurora instance in default VPC and default subnet group
community.aws.rds_instance:
engine: aurora
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ S3 Buckets must not allow Get Action From All Principals, as to prevent leaking

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="6"
```yaml title="Positive test num. 1 - yaml file" hl_lines="6"
#this is a problematic code where the query should report a result(s)
- name: Bucket
amazon.aws.s3_bucket:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ ElastiCache should be launched in a Virtual Private Cloud (VPC)<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2"
- name: Basic example
community.aws.elasticache:
name: "test-please-delete"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The API Endpoint type in API Gateway should be set to PRIVATE so it's not expose

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="8"
```yaml title="Positive test num. 1 - yaml file" hl_lines="8"
- name: Setup AWS API Gateway setup on AWS and deploy API definition
community.aws.aws_api_gateway:
swagger_file: my_api.yml
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ hide:

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="7"
```yaml title="Positive test num. 1 - yaml file" hl_lines="7"
- name: example ec2 group
amazon.aws.ec2_group:
name: example
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ AWS S3 Storage should be protected with SSE (Server-Side Encryption)<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="5"
```yaml title="Positive test num. 1 - yaml file" hl_lines="5"
- name: Create a simple s3 bucket
amazon.aws.s3_bucket:
name: mys3bucket
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Expired SSL/TLS certificates should be removed<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="3"
```yaml title="Positive test num. 1 - yaml file" hl_lines="3"
- name: upload a self-signed certificate
community.aws.aws_acm:
certificate: "{{ lookup('file', 'expiredCertificate.pem' ) }}"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The KMS key has a policy that is too permissive, as it provides the AWS account

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="3 5"
```yaml title="Positive test num. 1 - yaml file" hl_lines="3 5"
---
- name: Update IAM policy on an existing KMS key
community.aws.aws_kms:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Check if SNS topic name is set for CloudTrail<br>

### Code samples
#### Code samples with security vulnerabilities
```yaml title="Postitive test num. 1 - yaml file" hl_lines="2 15"
```yaml title="Positive test num. 1 - yaml file" hl_lines="2 15"
- name: no sns topic name
community.aws.cloudtrail:
state: present
Expand Down
Loading

0 comments on commit dc5db32

Please sign in to comment.