From 15f98d79e0fc2c5c7e9ac9bddb69ff4bf24a332c Mon Sep 17 00:00:00 2001 From: Chandrapal Badshah <12944530+Chan9390@users.noreply.github.com> Date: Tue, 3 Jun 2025 15:33:57 +0530 Subject: [PATCH] Integrate Prowler Hub --- ui/actions/lighthouse/index.ts | 2 + ui/lib/lighthouse/helpers/checks.ts | 962 ------------------ .../helpers/complianceframeworks.ts | 77 -- ui/lib/lighthouse/tools/checks.ts | 31 +- ui/lib/lighthouse/tools/compliances.ts | 2 +- ui/lib/lighthouse/workflow.ts | 12 +- ui/types/lighthouse/checks.ts | 9 + 7 files changed, 48 insertions(+), 1047 deletions(-) delete mode 100644 ui/lib/lighthouse/helpers/checks.ts delete mode 100644 ui/lib/lighthouse/helpers/complianceframeworks.ts diff --git a/ui/actions/lighthouse/index.ts b/ui/actions/lighthouse/index.ts index 48cb8e8651..290e617ae7 100644 --- a/ui/actions/lighthouse/index.ts +++ b/ui/actions/lighthouse/index.ts @@ -1,2 +1,4 @@ +export * from "./checks"; +export * from "./complianceframeworks"; export * from "./compliances"; export * from "./lighthouse"; diff --git a/ui/lib/lighthouse/helpers/checks.ts b/ui/lib/lighthouse/helpers/checks.ts deleted file mode 100644 index 27c3322dbe..0000000000 --- a/ui/lib/lighthouse/helpers/checks.ts +++ /dev/null @@ -1,962 +0,0 @@ -import { ProviderType } from "@/types/providers"; - -const checksByProvider = async (provider_type: string) => { - const checksByProvider: Record = { - aws: [ - "accessanalyzer_enabled", - "accessanalyzer_enabled_without_findings", - "account_maintain_current_contact_details", - "account_maintain_different_contact_details_to_security_billing_and_operations", - "account_security_contact_information_is_registered", - "account_security_questions_are_registered_in_the_aws_account", - "acm_certificates_expiration_check", - "acm_certificates_transparency_logs_enabled", - "acm_certificates_with_secure_key_algorithms", - "apigateway_restapi_authorizers_enabled", - "apigateway_restapi_cache_encrypted", - "apigateway_restapi_client_certificate_enabled", - "apigateway_restapi_logging_enabled", - "apigateway_restapi_public", - "apigateway_restapi_public_with_authorizer", - "apigateway_restapi_tracing_enabled", - "apigateway_restapi_waf_acl_attached", - "apigatewayv2_api_access_logging_enabled", - "apigatewayv2_api_authorizers_enabled", - "appstream_fleet_default_internet_access_disabled", - "appstream_fleet_maximum_session_duration", - "appstream_fleet_session_disconnect_timeout", - "appstream_fleet_session_idle_disconnect_timeout", - "appsync_field_level_logging_enabled", - "appsync_graphql_api_no_api_key_authentication", - "athena_workgroup_encryption", - "athena_workgroup_enforce_configuration", - "athena_workgroup_logging_enabled", - "autoscaling_find_secrets_ec2_launch_configuration", - "autoscaling_group_capacity_rebalance_enabled", - "autoscaling_group_elb_health_check_enabled", - "autoscaling_group_launch_configuration_no_public_ip", - "autoscaling_group_launch_configuration_requires_imdsv2", - "autoscaling_group_multiple_az", - "autoscaling_group_multiple_instance_types", - "autoscaling_group_using_ec2_launch_template", - "awslambda_function_inside_vpc", - "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", - "awslambda_function_no_secrets_in_code", - "awslambda_function_no_secrets_in_variables", - "awslambda_function_not_publicly_accessible", - "awslambda_function_url_cors_policy", - "awslambda_function_url_public", - "awslambda_function_using_supported_runtimes", - "awslambda_function_vpc_multi_az", - "backup_plans_exist", - "backup_recovery_point_encrypted", - "backup_reportplans_exist", - "backup_vaults_encrypted", - "backup_vaults_exist", - "bedrock_agent_guardrail_enabled", - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "cloudformation_stack_cdktoolkit_bootstrap_version", - "cloudformation_stack_outputs_find_secrets", - "cloudformation_stacks_termination_protection_enabled", - "cloudfront_distributions_custom_ssl_certificate", - "cloudfront_distributions_default_root_object", - "cloudfront_distributions_field_level_encryption_enabled", - "cloudfront_distributions_geo_restrictions_enabled", - "cloudfront_distributions_https_enabled", - "cloudfront_distributions_https_sni_enabled", - "cloudfront_distributions_logging_enabled", - "cloudfront_distributions_multiple_origin_failover_configured", - "cloudfront_distributions_origin_traffic_encrypted", - "cloudfront_distributions_s3_origin_access_control", - "cloudfront_distributions_s3_origin_non_existent_bucket", - "cloudfront_distributions_using_deprecated_ssl_protocols", - "cloudfront_distributions_using_waf", - "cloudtrail_bucket_requires_mfa_delete", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_insights_exist", - "cloudtrail_kms_encryption_enabled", - "cloudtrail_log_file_validation_enabled", - "cloudtrail_logs_s3_bucket_access_logging_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "cloudtrail_multi_region_enabled", - "cloudtrail_multi_region_enabled_logging_management_events", - "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_threat_detection_enumeration", - "cloudtrail_threat_detection_llm_jacking", - "cloudtrail_threat_detection_privilege_escalation", - "cloudwatch_alarm_actions_alarm_state_configured", - "cloudwatch_alarm_actions_enabled", - "cloudwatch_changes_to_network_acls_alarm_configured", - "cloudwatch_changes_to_network_gateways_alarm_configured", - "cloudwatch_changes_to_network_route_tables_alarm_configured", - "cloudwatch_changes_to_vpcs_alarm_configured", - "cloudwatch_cross_account_sharing_disabled", - "cloudwatch_log_group_kms_encryption_enabled", - "cloudwatch_log_group_no_secrets_in_logs", - "cloudwatch_log_group_not_publicly_accessible", - "cloudwatch_log_group_retention_policy_specific_days_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", - "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", - "cloudwatch_log_metric_filter_authentication_failures", - "cloudwatch_log_metric_filter_aws_organizations_changes", - "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", - "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", - "cloudwatch_log_metric_filter_policy_changes", - "cloudwatch_log_metric_filter_root_usage", - "cloudwatch_log_metric_filter_security_group_changes", - "cloudwatch_log_metric_filter_sign_in_without_mfa", - "cloudwatch_log_metric_filter_unauthorized_api_calls", - "codeartifact_packages_external_public_publishing_disabled", - "codebuild_project_logging_enabled", - "codebuild_project_no_secrets_in_variables", - "codebuild_project_older_90_days", - "codebuild_project_s3_logs_encrypted", - "codebuild_project_source_repo_url_no_sensitive_credentials", - "codebuild_project_user_controlled_buildspec", - "codebuild_report_group_export_encrypted", - "cognito_identity_pool_guest_access_disabled", - "cognito_user_pool_advanced_security_enabled", - "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", - "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", - "cognito_user_pool_client_prevent_user_existence_errors", - "cognito_user_pool_client_token_revocation_enabled", - "cognito_user_pool_deletion_protection_enabled", - "cognito_user_pool_mfa_enabled", - "cognito_user_pool_password_policy_lowercase", - "cognito_user_pool_password_policy_minimum_length_14", - "cognito_user_pool_password_policy_number", - "cognito_user_pool_password_policy_symbol", - "cognito_user_pool_password_policy_uppercase", - "cognito_user_pool_self_registration_disabled", - "cognito_user_pool_temporary_password_expiration", - "cognito_user_pool_waf_acl_attached", - "config_recorder_all_regions_enabled", - "config_recorder_using_aws_service_role", - "datasync_task_logging_enabled", - "directconnect_connection_redundancy", - "directconnect_virtual_interface_redundancy", - "directoryservice_directory_log_forwarding_enabled", - "directoryservice_directory_monitor_notifications", - "directoryservice_directory_snapshots_limit", - "directoryservice_ldap_certificate_expiration", - "directoryservice_radius_server_security_protocol", - "directoryservice_supported_mfa_radius_enabled", - "dlm_ebs_snapshot_lifecycle_policy_exists", - "dms_endpoint_mongodb_authentication_enabled", - "dms_endpoint_neptune_iam_authorization_enabled", - "dms_endpoint_redis_in_transit_encryption_enabled", - "dms_endpoint_ssl_enabled", - "dms_instance_minor_version_upgrade_enabled", - "dms_instance_multi_az_enabled", - "dms_instance_no_public_access", - "dms_replication_task_source_logging_enabled", - "dms_replication_task_target_logging_enabled", - "documentdb_cluster_backup_enabled", - "documentdb_cluster_cloudwatch_log_export", - "documentdb_cluster_deletion_protection", - "documentdb_cluster_multi_az_enabled", - "documentdb_cluster_public_snapshot", - "documentdb_cluster_storage_encrypted", - "drs_job_exist", - "dynamodb_accelerator_cluster_encryption_enabled", - "dynamodb_accelerator_cluster_in_transit_encryption_enabled", - "dynamodb_accelerator_cluster_multi_az", - "dynamodb_table_autoscaling_enabled", - "dynamodb_table_cross_account_access", - "dynamodb_table_deletion_protection_enabled", - "dynamodb_table_protected_by_backup_plan", - "dynamodb_tables_kms_cmk_encryption_enabled", - "dynamodb_tables_pitr_enabled", - "ec2_ami_public", - "ec2_client_vpn_endpoint_connection_logging_enabled", - "ec2_ebs_default_encryption", - "ec2_ebs_public_snapshot", - "ec2_ebs_snapshot_account_block_public_access", - "ec2_ebs_snapshots_encrypted", - "ec2_ebs_volume_encryption", - "ec2_ebs_volume_protected_by_backup_plan", - "ec2_ebs_volume_snapshots_exists", - "ec2_elastic_ip_shodan", - "ec2_elastic_ip_unassigned", - "ec2_instance_account_imdsv2_enabled", - "ec2_instance_detailed_monitoring_enabled", - "ec2_instance_imdsv2_enabled", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_instance_managed_by_ssm", - "ec2_instance_older_than_specific_days", - "ec2_instance_paravirtual_type", - "ec2_instance_port_cassandra_exposed_to_internet", - "ec2_instance_port_cifs_exposed_to_internet", - "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "ec2_instance_port_ftp_exposed_to_internet", - "ec2_instance_port_kafka_exposed_to_internet", - "ec2_instance_port_kerberos_exposed_to_internet", - "ec2_instance_port_ldap_exposed_to_internet", - "ec2_instance_port_memcached_exposed_to_internet", - "ec2_instance_port_mongodb_exposed_to_internet", - "ec2_instance_port_mysql_exposed_to_internet", - "ec2_instance_port_oracle_exposed_to_internet", - "ec2_instance_port_postgresql_exposed_to_internet", - "ec2_instance_port_rdp_exposed_to_internet", - "ec2_instance_port_redis_exposed_to_internet", - "ec2_instance_port_sqlserver_exposed_to_internet", - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_instance_port_telnet_exposed_to_internet", - "ec2_instance_profile_attached", - "ec2_instance_public_ip", - "ec2_instance_secrets_user_data", - "ec2_instance_uses_single_eni", - "ec2_launch_template_imdsv2_required", - "ec2_launch_template_no_public_ip", - "ec2_launch_template_no_secrets", - "ec2_networkacl_allow_ingress_any_port", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_networkacl_unused", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "ec2_securitygroup_allow_wide_open_public_ipv4", - "ec2_securitygroup_default_restrict_traffic", - "ec2_securitygroup_from_launch_wizard", - "ec2_securitygroup_not_used", - "ec2_securitygroup_with_many_ingress_egress_rules", - "ec2_transitgateway_auto_accept_vpc_attachments", - "ecr_registry_scan_images_on_push_enabled", - "ecr_repositories_lifecycle_policy_enabled", - "ecr_repositories_not_publicly_accessible", - "ecr_repositories_scan_images_on_push_enabled", - "ecr_repositories_scan_vulnerabilities_in_latest_image", - "ecr_repositories_tag_immutability", - "ecs_cluster_container_insights_enabled", - "ecs_service_fargate_latest_platform_version", - "ecs_service_no_assign_public_ip", - "ecs_task_definitions_containers_readonly_access", - "ecs_task_definitions_host_namespace_not_shared", - "ecs_task_definitions_host_networking_mode_users", - "ecs_task_definitions_logging_block_mode", - "ecs_task_definitions_logging_enabled", - "ecs_task_definitions_no_environment_secrets", - "ecs_task_definitions_no_privileged_containers", - "ecs_task_set_no_assign_public_ip", - "efs_access_point_enforce_root_directory", - "efs_access_point_enforce_user_identity", - "efs_encryption_at_rest_enabled", - "efs_have_backup_enabled", - "efs_mount_target_not_publicly_accessible", - "efs_multi_az_enabled", - "efs_not_publicly_accessible", - "eks_cluster_kms_cmk_encryption_in_secrets_enabled", - "eks_cluster_network_policy_enabled", - "eks_cluster_not_publicly_accessible", - "eks_cluster_private_nodes_enabled", - "eks_cluster_uses_a_supported_version", - "eks_control_plane_logging_all_types_enabled", - "elasticache_cluster_uses_public_subnet", - "elasticache_redis_cluster_auto_minor_version_upgrades", - "elasticache_redis_cluster_automatic_failover_enabled", - "elasticache_redis_cluster_backup_enabled", - "elasticache_redis_cluster_in_transit_encryption_enabled", - "elasticache_redis_cluster_multi_az_enabled", - "elasticache_redis_cluster_rest_encryption_enabled", - "elasticache_redis_replication_group_auth_enabled", - "elasticbeanstalk_environment_cloudwatch_logging_enabled", - "elasticbeanstalk_environment_enhanced_health_reporting", - "elasticbeanstalk_environment_managed_updates_enabled", - "elb_connection_draining_enabled", - "elb_cross_zone_load_balancing_enabled", - "elb_desync_mitigation_mode", - "elb_insecure_ssl_ciphers", - "elb_internet_facing", - "elb_is_in_multiple_az", - "elb_logging_enabled", - "elb_ssl_listeners", - "elb_ssl_listeners_use_acm_certificate", - "elbv2_cross_zone_load_balancing_enabled", - "elbv2_deletion_protection", - "elbv2_desync_mitigation_mode", - "elbv2_insecure_ssl_ciphers", - "elbv2_internet_facing", - "elbv2_is_in_multiple_az", - "elbv2_listeners_underneath", - "elbv2_logging_enabled", - "elbv2_nlb_tls_termination_enabled", - "elbv2_ssl_listeners", - "elbv2_waf_acl_attached", - "emr_cluster_account_public_block_enabled", - "emr_cluster_master_nodes_no_public_ip", - "emr_cluster_publicly_accesible", - "eventbridge_bus_cross_account_access", - "eventbridge_bus_exposed", - "eventbridge_global_endpoint_event_replication_enabled", - "eventbridge_schema_registry_cross_account_access", - "firehose_stream_encrypted_at_rest", - "fms_policy_compliant", - "fsx_file_system_copy_tags_to_backups_enabled", - "fsx_file_system_copy_tags_to_volumes_enabled", - "fsx_windows_file_system_multi_az_enabled", - "glacier_vaults_policy_public_access", - "glue_data_catalogs_connection_passwords_encryption_enabled", - "glue_data_catalogs_metadata_encryption_enabled", - "glue_data_catalogs_not_publicly_accessible", - "glue_database_connections_ssl_enabled", - "glue_development_endpoints_cloudwatch_logs_encryption_enabled", - "glue_development_endpoints_job_bookmark_encryption_enabled", - "glue_development_endpoints_s3_encryption_enabled", - "glue_etl_jobs_amazon_s3_encryption_enabled", - "glue_etl_jobs_cloudwatch_logs_encryption_enabled", - "glue_etl_jobs_job_bookmark_encryption_enabled", - "glue_etl_jobs_logging_enabled", - "glue_ml_transform_encrypted_at_rest", - "guardduty_centrally_managed", - "guardduty_ec2_malware_protection_enabled", - "guardduty_eks_audit_log_enabled", - "guardduty_eks_runtime_monitoring_enabled", - "guardduty_is_enabled", - "guardduty_lambda_protection_enabled", - "guardduty_no_high_severity_findings", - "guardduty_rds_protection_enabled", - "guardduty_s3_protection_enabled", - "iam_administrator_access_with_mfa", - "iam_avoid_root_usage", - "iam_aws_attached_policy_no_administrative_privileges", - "iam_check_saml_providers_sts", - "iam_customer_attached_policy_no_administrative_privileges", - "iam_customer_unattached_policy_no_administrative_privileges", - "iam_group_administrator_access_policy", - "iam_inline_policy_allows_privilege_escalation", - "iam_inline_policy_no_administrative_privileges", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_inline_policy_no_full_access_to_kms", - "iam_no_custom_policy_permissive_role_assumption", - "iam_no_expired_server_certificates_stored", - "iam_no_root_access_key", - "iam_password_policy_expires_passwords_within_90_days_or_less", - "iam_password_policy_lowercase", - "iam_password_policy_minimum_length_14", - "iam_password_policy_number", - "iam_password_policy_reuse_24", - "iam_password_policy_symbol", - "iam_password_policy_uppercase", - "iam_policy_allows_privilege_escalation", - "iam_policy_attached_only_to_group_or_roles", - "iam_policy_cloudshell_admin_not_attached", - "iam_policy_no_full_access_to_cloudtrail", - "iam_policy_no_full_access_to_kms", - "iam_role_administratoraccess_policy", - "iam_role_cross_account_readonlyaccess_policy", - "iam_role_cross_service_confused_deputy_prevention", - "iam_root_credentials_management_enabled", - "iam_root_hardware_mfa_enabled", - "iam_root_mfa_enabled", - "iam_rotate_access_key_90_days", - "iam_securityaudit_role_created", - "iam_support_role_created", - "iam_user_accesskey_unused", - "iam_user_administrator_access_policy", - "iam_user_console_access_unused", - "iam_user_hardware_mfa_enabled", - "iam_user_mfa_enabled_console_access", - "iam_user_no_setup_initial_access_key", - "iam_user_two_active_access_key", - "iam_user_with_temporary_credentials", - "inspector2_active_findings_exist", - "inspector2_is_enabled", - "kafka_cluster_encryption_at_rest_uses_cmk", - "kafka_cluster_enhanced_monitoring_enabled", - "kafka_cluster_in_transit_encryption_enabled", - "kafka_cluster_is_public", - "kafka_cluster_mutual_tls_authentication_enabled", - "kafka_cluster_unrestricted_access_disabled", - "kafka_cluster_uses_latest_version", - "kafka_connector_in_transit_encryption_enabled", - "kinesis_stream_data_retention_period", - "kinesis_stream_encrypted_at_rest", - "kms_cmk_are_used", - "kms_cmk_not_deleted_unintentionally", - "kms_cmk_not_multi_region", - "kms_cmk_rotation_enabled", - "kms_key_not_publicly_accessible", - "lightsail_database_public", - "lightsail_instance_automated_snapshots", - "lightsail_instance_public", - "lightsail_static_ip_unused", - "macie_automated_sensitive_data_discovery_enabled", - "macie_is_enabled", - "memorydb_cluster_auto_minor_version_upgrades", - "mq_broker_active_deployment_mode", - "mq_broker_auto_minor_version_upgrades", - "mq_broker_cluster_deployment_mode", - "mq_broker_logging_enabled", - "mq_broker_not_publicly_accessible", - "neptune_cluster_backup_enabled", - "neptune_cluster_copy_tags_to_snapshots", - "neptune_cluster_deletion_protection", - "neptune_cluster_iam_authentication_enabled", - "neptune_cluster_integration_cloudwatch_logs", - "neptune_cluster_multi_az", - "neptune_cluster_public_snapshot", - "neptune_cluster_snapshot_encrypted", - "neptune_cluster_storage_encrypted", - "neptune_cluster_uses_public_subnet", - "networkfirewall_deletion_protection", - "networkfirewall_in_all_vpc", - "networkfirewall_logging_enabled", - "networkfirewall_multi_az", - "networkfirewall_policy_default_action_fragmented_packets", - "networkfirewall_policy_default_action_full_packets", - "networkfirewall_policy_rule_group_associated", - "opensearch_service_domains_access_control_enabled", - "opensearch_service_domains_audit_logging_enabled", - "opensearch_service_domains_cloudwatch_logging_enabled", - "opensearch_service_domains_encryption_at_rest_enabled", - "opensearch_service_domains_fault_tolerant_data_nodes", - "opensearch_service_domains_fault_tolerant_master_nodes", - "opensearch_service_domains_https_communications_enforced", - "opensearch_service_domains_internal_user_database_enabled", - "opensearch_service_domains_node_to_node_encryption_enabled", - "opensearch_service_domains_not_publicly_accessible", - "opensearch_service_domains_updated_to_the_latest_service_software_version", - "opensearch_service_domains_use_cognito_authentication_for_kibana", - "organizations_account_part_of_organizations", - "organizations_delegated_administrators", - "organizations_opt_out_ai_services_policy", - "organizations_scp_check_deny_regions", - "organizations_tags_policies_enabled_and_attached", - "rds_cluster_backtrack_enabled", - "rds_cluster_copy_tags_to_snapshots", - "rds_cluster_critical_event_subscription", - "rds_cluster_default_admin", - "rds_cluster_deletion_protection", - "rds_cluster_iam_authentication_enabled", - "rds_cluster_integration_cloudwatch_logs", - "rds_cluster_minor_version_upgrade_enabled", - "rds_cluster_multi_az", - "rds_cluster_non_default_port", - "rds_cluster_protected_by_backup_plan", - "rds_cluster_storage_encrypted", - "rds_instance_backup_enabled", - "rds_instance_certificate_expiration", - "rds_instance_copy_tags_to_snapshots", - "rds_instance_critical_event_subscription", - "rds_instance_default_admin", - "rds_instance_deletion_protection", - "rds_instance_deprecated_engine_version", - "rds_instance_enhanced_monitoring_enabled", - "rds_instance_event_subscription_parameter_groups", - "rds_instance_event_subscription_security_groups", - "rds_instance_iam_authentication_enabled", - "rds_instance_inside_vpc", - "rds_instance_integration_cloudwatch_logs", - "rds_instance_minor_version_upgrade_enabled", - "rds_instance_multi_az", - "rds_instance_no_public_access", - "rds_instance_non_default_port", - "rds_instance_protected_by_backup_plan", - "rds_instance_storage_encrypted", - "rds_instance_transport_encrypted", - "rds_snapshots_encrypted", - "rds_snapshots_public_access", - "redshift_cluster_audit_logging", - "redshift_cluster_automated_snapshot", - "redshift_cluster_automatic_upgrades", - "redshift_cluster_encrypted_at_rest", - "redshift_cluster_enhanced_vpc_routing", - "redshift_cluster_in_transit_encryption_enabled", - "redshift_cluster_multi_az_enabled", - "redshift_cluster_non_default_database_name", - "redshift_cluster_non_default_username", - "redshift_cluster_public_access", - "resourceexplorer2_indexes_found", - "route53_dangling_ip_subdomain_takeover", - "route53_domains_privacy_protection_enabled", - "route53_domains_transferlock_enabled", - "route53_public_hosted_zones_cloudwatch_logging_enabled", - "s3_access_point_public_access_block", - "s3_account_level_public_access_blocks", - "s3_bucket_acl_prohibited", - "s3_bucket_cross_account_access", - "s3_bucket_cross_region_replication", - "s3_bucket_default_encryption", - "s3_bucket_event_notifications_enabled", - "s3_bucket_kms_encryption", - "s3_bucket_level_public_access_block", - "s3_bucket_lifecycle_enabled", - "s3_bucket_no_mfa_delete", - "s3_bucket_object_lock", - "s3_bucket_object_versioning", - "s3_bucket_policy_public_write_access", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_public_write_acl", - "s3_bucket_secure_transport_policy", - "s3_bucket_server_access_logging_enabled", - "s3_multi_region_access_point_public_access_block", - "sagemaker_endpoint_config_prod_variant_instances", - "sagemaker_models_network_isolation_enabled", - "sagemaker_models_vpc_settings_configured", - "sagemaker_notebook_instance_encryption_enabled", - "sagemaker_notebook_instance_root_access_disabled", - "sagemaker_notebook_instance_vpc_settings_configured", - "sagemaker_notebook_instance_without_direct_internet_access_configured", - "sagemaker_training_jobs_intercontainer_encryption_enabled", - "sagemaker_training_jobs_network_isolation_enabled", - "sagemaker_training_jobs_volume_and_output_encryption_enabled", - "sagemaker_training_jobs_vpc_settings_configured", - "secretsmanager_automatic_rotation_enabled", - "secretsmanager_not_publicly_accessible", - "secretsmanager_secret_rotated_periodically", - "secretsmanager_secret_unused", - "securityhub_enabled", - "servicecatalog_portfolio_shared_within_organization_only", - "ses_identity_not_publicly_accessible", - "shield_advanced_protection_in_associated_elastic_ips", - "shield_advanced_protection_in_classic_load_balancers", - "shield_advanced_protection_in_cloudfront_distributions", - "shield_advanced_protection_in_global_accelerators", - "shield_advanced_protection_in_internet_facing_load_balancers", - "shield_advanced_protection_in_route53_hosted_zones", - "sns_subscription_not_using_http_endpoints", - "sns_topics_kms_encryption_at_rest_enabled", - "sns_topics_not_publicly_accessible", - "sqs_queues_not_publicly_accessible", - "sqs_queues_server_side_encryption_enabled", - "ssm_document_secrets", - "ssm_documents_set_as_public", - "ssm_managed_compliant_patching", - "ssmincidents_enabled_with_plans", - "stepfunctions_statemachine_logging_enabled", - "storagegateway_fileshare_encryption_enabled", - "storagegateway_gateway_fault_tolerant", - "transfer_server_in_transit_encryption_enabled", - "trustedadvisor_errors_and_warnings", - "trustedadvisor_premium_support_plan_subscribed", - "vpc_different_regions", - "vpc_endpoint_connections_trust_boundaries", - "vpc_endpoint_for_ec2_enabled", - "vpc_endpoint_multi_az_enabled", - "vpc_endpoint_services_allowed_principals_trust_boundaries", - "vpc_flow_logs_enabled", - "vpc_peering_routing_tables_with_least_privilege", - "vpc_subnet_different_az", - "vpc_subnet_no_public_ip_by_default", - "vpc_subnet_separate_private_public", - "vpc_vpn_connection_tunnels_up", - "waf_global_rule_with_conditions", - "waf_global_rulegroup_not_empty", - "waf_global_webacl_logging_enabled", - "waf_global_webacl_with_rules", - "waf_regional_rule_with_conditions", - "waf_regional_rulegroup_not_empty", - "waf_regional_webacl_with_rules", - "wafv2_webacl_logging_enabled", - "wafv2_webacl_rule_logging_enabled", - "wafv2_webacl_with_rules", - "wellarchitected_workload_no_high_or_medium_risks", - "workspaces_volume_encryption_enabled", - "workspaces_vpc_2private_1public_subnets_nat", - ], - gcp: [ - "apikeys_api_restrictions_configured", - "apikeys_key_exists", - "apikeys_key_rotated_in_90_days", - "artifacts_container_analysis_enabled", - "bigquery_dataset_cmk_encryption", - "bigquery_dataset_public_access", - "bigquery_table_cmk_encryption", - "cloudsql_instance_automated_backups", - "cloudsql_instance_mysql_local_infile_flag", - "cloudsql_instance_mysql_skip_show_database_flag", - "cloudsql_instance_postgres_enable_pgaudit_flag", - "cloudsql_instance_postgres_log_connections_flag", - "cloudsql_instance_postgres_log_disconnections_flag", - "cloudsql_instance_postgres_log_error_verbosity_flag", - "cloudsql_instance_postgres_log_min_duration_statement_flag", - "cloudsql_instance_postgres_log_min_error_statement_flag", - "cloudsql_instance_postgres_log_min_messages_flag", - "cloudsql_instance_postgres_log_statement_flag", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_access", - "cloudsql_instance_public_ip", - "cloudsql_instance_sqlserver_contained_database_authentication_flag", - "cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag", - "cloudsql_instance_sqlserver_external_scripts_enabled_flag", - "cloudsql_instance_sqlserver_remote_access_flag", - "cloudsql_instance_sqlserver_trace_flag", - "cloudsql_instance_sqlserver_user_connections_flag", - "cloudsql_instance_sqlserver_user_options_flag", - "cloudsql_instance_ssl_connections", - "cloudstorage_bucket_log_retention_policy_lock", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_instance_confidential_computing_enabled", - "compute_instance_default_service_account_in_use", - "compute_instance_default_service_account_in_use_with_full_api_access", - "compute_instance_encryption_with_csek_enabled", - "compute_instance_ip_forwarding_is_enabled", - "compute_instance_public_ip", - "compute_instance_serial_ports_in_use", - "compute_instance_shielded_vm_enabled", - "compute_loadbalancer_logging_enabled", - "compute_network_default_in_use", - "compute_network_dns_logging_enabled", - "compute_network_not_legacy", - "compute_project_os_login_enabled", - "compute_public_address_shodan", - "compute_subnet_flow_logs_enabled", - "dataproc_encrypted_with_cmks_disabled", - "dns_dnssec_disabled", - "dns_rsasha1_in_use_to_key_sign_in_dnssec", - "dns_rsasha1_in_use_to_zone_sign_in_dnssec", - "gcr_container_scanning_enabled", - "gke_cluster_no_default_service_account", - "iam_account_access_approval_enabled", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "iam_no_service_roles_at_project_level", - "iam_organization_essential_contacts_configured", - "iam_role_kms_enforce_separation_of_duties", - "iam_role_sa_enforce_separation_of_duties", - "iam_sa_no_administrative_privileges", - "iam_sa_no_user_managed_keys", - "iam_sa_user_managed_key_rotate_90_days", - "iam_sa_user_managed_key_unused", - "iam_service_account_unused", - "kms_key_not_publicly_accessible", - "kms_key_rotation_enabled", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", - "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", - "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", - "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", - "logging_sink_created", - ], - azure: [ - "aisearch_service_not_publicly_accessible", - "aks_cluster_rbac_enabled", - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_client_certificates_on", - "app_ensure_auth_is_set_up", - "app_ensure_http_is_redirected_to_https", - "app_ensure_java_version_is_latest", - "app_ensure_php_version_is_latest", - "app_ensure_python_version_is_latest", - "app_ensure_using_http20", - "app_ftp_deployment_disabled", - "app_function_access_keys_configured", - "app_function_application_insights_enabled", - "app_function_ftps_deployment_disabled", - "app_function_identity_is_configured", - "app_function_identity_without_admin_privileges", - "app_function_latest_runtime_version", - "app_function_not_publicly_accessible", - "app_function_vnet_integration_enabled", - "app_http_logs_enabled", - "app_minimum_tls_version_12", - "app_register_with_identity", - "appinsights_ensure_is_configured", - "containerregistry_admin_user_disabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "cosmosdb_account_firewall_use_selected_networks", - "cosmosdb_account_use_aad_and_rbac", - "cosmosdb_account_use_private_endpoints", - "defender_additional_email_configured_with_a_security_contact", - "defender_assessments_vm_endpoint_protection_installed", - "defender_auto_provisioning_log_analytics_agent_vms_on", - "defender_auto_provisioning_vulnerabilty_assessments_machines_on", - "defender_container_images_resolved_vulnerabilities", - "defender_container_images_scan_enabled", - "defender_ensure_defender_for_app_services_is_on", - "defender_ensure_defender_for_arm_is_on", - "defender_ensure_defender_for_azure_sql_databases_is_on", - "defender_ensure_defender_for_containers_is_on", - "defender_ensure_defender_for_cosmosdb_is_on", - "defender_ensure_defender_for_databases_is_on", - "defender_ensure_defender_for_dns_is_on", - "defender_ensure_defender_for_keyvault_is_on", - "defender_ensure_defender_for_os_relational_databases_is_on", - "defender_ensure_defender_for_server_is_on", - "defender_ensure_defender_for_sql_servers_is_on", - "defender_ensure_defender_for_storage_is_on", - "defender_ensure_iot_hub_defender_is_on", - "defender_ensure_mcas_is_enabled", - "defender_ensure_notify_alerts_severity_is_high", - "defender_ensure_notify_emails_to_owners", - "defender_ensure_system_updates_are_applied", - "defender_ensure_wdatp_is_enabled", - "entra_conditional_access_policy_require_mfa_for_management_api", - "entra_global_admin_in_less_than_five_users", - "entra_non_privileged_user_has_mfa", - "entra_policy_default_users_cannot_create_security_groups", - "entra_policy_ensure_default_user_cannot_create_apps", - "entra_policy_ensure_default_user_cannot_create_tenants", - "entra_policy_guest_invite_only_for_admin_roles", - "entra_policy_guest_users_access_restrictions", - "entra_policy_restricts_user_consent_for_apps", - "entra_policy_user_consent_for_verified_apps", - "entra_privileged_user_has_mfa", - "entra_security_defaults_enabled", - "entra_trusted_named_locations_exists", - "entra_user_with_vm_access_has_mfa", - "entra_users_cannot_create_microsoft_365_groups", - "iam_custom_role_has_permissions_to_administer_resource_locks", - "iam_subscription_roles_owner_custom_not_created", - "keyvault_key_expiration_set_in_non_rbac", - "keyvault_key_rotation_enabled", - "keyvault_logging_enabled", - "keyvault_non_rbac_secret_expiration_set", - "keyvault_private_endpoints", - "keyvault_rbac_enabled", - "keyvault_rbac_key_expiration_set", - "keyvault_rbac_secret_expiration_set", - "keyvault_recoverable", - "monitor_alert_create_policy_assignment", - "monitor_alert_create_update_nsg", - "monitor_alert_create_update_public_ip_address_rule", - "monitor_alert_create_update_security_solution", - "monitor_alert_create_update_sqlserver_fr", - "monitor_alert_delete_nsg", - "monitor_alert_delete_policy_assignment", - "monitor_alert_delete_public_ip_address_rule", - "monitor_alert_delete_security_solution", - "monitor_alert_delete_sqlserver_fr", - "monitor_diagnostic_setting_with_appropriate_categories", - "monitor_diagnostic_settings_exists", - "monitor_storage_account_with_activity_logs_cmk_encrypted", - "monitor_storage_account_with_activity_logs_is_private", - "mysql_flexible_server_audit_log_connection_activated", - "mysql_flexible_server_audit_log_enabled", - "mysql_flexible_server_minimum_tls_version_12", - "mysql_flexible_server_ssl_connection_enabled", - "network_bastion_host_exists", - "network_flow_log_captured_sent", - "network_flow_log_more_than_90_days", - "network_http_internet_access_restricted", - "network_public_ip_shodan", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "network_watcher_enabled", - "policy_ensure_asc_enforcement_enabled", - "postgresql_flexible_server_allow_access_services_disabled", - "postgresql_flexible_server_connection_throttling_on", - "postgresql_flexible_server_enforce_ssl_enabled", - "postgresql_flexible_server_log_checkpoints_on", - "postgresql_flexible_server_log_connections_on", - "postgresql_flexible_server_log_disconnections_on", - "postgresql_flexible_server_log_retention_days_greater_3", - "sqlserver_auditing_enabled", - "sqlserver_auditing_retention_90_days", - "sqlserver_azuread_administrator_enabled", - "sqlserver_microsoft_defender_enabled", - "sqlserver_recommended_minimal_tls_version", - "sqlserver_tde_encrypted_with_cmk", - "sqlserver_tde_encryption_enabled", - "sqlserver_unrestricted_inbound_access", - "sqlserver_va_emails_notifications_admins_enabled", - "sqlserver_va_periodic_recurring_scans_enabled", - "sqlserver_va_scan_reports_configured", - "sqlserver_vulnerability_assessment_enabled", - "storage_blob_public_access_level_is_disabled", - "storage_default_network_access_rule_is_denied", - "storage_ensure_azure_services_are_trusted_to_access_is_enabled", - "storage_ensure_encryption_with_customer_managed_keys", - "storage_ensure_minimum_tls_version_12", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_ensure_soft_delete_is_enabled", - "storage_infrastructure_encryption_is_enabled", - "storage_key_rotation_90_days", - "storage_secure_transfer_required_is_enabled", - "vm_ensure_attached_disks_encrypted_with_cmk", - "vm_ensure_unattached_disks_encrypted_with_cmk", - "vm_ensure_using_managed_disks", - "vm_trusted_launch_enabled", - ], - kubernetes: [ - "apiserver_always_pull_images_plugin", - "apiserver_anonymous_requests", - "apiserver_audit_log_maxage_set", - "apiserver_audit_log_maxbackup_set", - "apiserver_audit_log_maxsize_set", - "apiserver_audit_log_path_set", - "apiserver_auth_mode_include_node", - "apiserver_auth_mode_include_rbac", - "apiserver_auth_mode_not_always_allow", - "apiserver_client_ca_file_set", - "apiserver_deny_service_external_ips", - "apiserver_disable_profiling", - "apiserver_encryption_provider_config_set", - "apiserver_etcd_cafile_set", - "apiserver_etcd_tls_config", - "apiserver_event_rate_limit", - "apiserver_kubelet_cert_auth", - "apiserver_kubelet_tls_auth", - "apiserver_namespace_lifecycle_plugin", - "apiserver_no_always_admit_plugin", - "apiserver_no_token_auth_file", - "apiserver_node_restriction_plugin", - "apiserver_request_timeout_set", - "apiserver_security_context_deny_plugin", - "apiserver_service_account_key_file_set", - "apiserver_service_account_lookup_true", - "apiserver_service_account_plugin", - "apiserver_strong_ciphers_only", - "apiserver_tls_config", - "controllermanager_bind_address", - "controllermanager_disable_profiling", - "controllermanager_garbage_collection", - "controllermanager_root_ca_file_set", - "controllermanager_rotate_kubelet_server_cert", - "controllermanager_service_account_credentials", - "controllermanager_service_account_private_key_file", - "core_minimize_admission_hostport_containers", - "core_minimize_admission_windows_hostprocess_containers", - "core_minimize_allowPrivilegeEscalation_containers", - "core_minimize_containers_added_capabilities", - "core_minimize_containers_capabilities_assigned", - "core_minimize_hostIPC_containers", - "core_minimize_hostNetwork_containers", - "core_minimize_hostPID_containers", - "core_minimize_net_raw_capability_admission", - "core_minimize_privileged_containers", - "core_minimize_root_containers_admission", - "core_no_secrets_envs", - "core_seccomp_profile_docker_default", - "etcd_client_cert_auth", - "etcd_no_auto_tls", - "etcd_no_peer_auto_tls", - "etcd_peer_client_cert_auth", - "etcd_peer_tls_config", - "etcd_tls_encryption", - "etcd_unique_ca", - "kubelet_authorization_mode", - "kubelet_client_ca_file_set", - "kubelet_conf_file_ownership", - "kubelet_conf_file_permissions", - "kubelet_config_yaml_ownership", - "kubelet_config_yaml_permissions", - "kubelet_disable_anonymous_auth", - "kubelet_disable_read_only_port", - "kubelet_event_record_qps", - "kubelet_manage_iptables", - "kubelet_rotate_certificates", - "kubelet_service_file_ownership_root", - "kubelet_service_file_permissions", - "kubelet_streaming_connection_timeout", - "kubelet_strong_ciphers_only", - "kubelet_tls_cert_and_key", - "rbac_cluster_admin_usage", - "rbac_minimize_csr_approval_access", - "rbac_minimize_node_proxy_subresource_access", - "rbac_minimize_pod_creation_access", - "rbac_minimize_pv_creation_access", - "rbac_minimize_secret_access", - "rbac_minimize_service_account_token_creation", - "rbac_minimize_webhook_config_access", - "rbac_minimize_wildcard_use_roles", - "scheduler_bind_address", - "scheduler_profiling", - ], - m365: [ - "admincenter_groups_not_public_visibility", - "admincenter_settings_password_never_expire", - "admincenter_users_admins_reduced_license_footprint", - "admincenter_users_between_two_and_four_global_admins", - "defender_antiphishing_policy_configured", - "defender_antispam_connection_filter_policy_empty_ip_allowlist", - "defender_antispam_connection_filter_policy_safe_list_off", - "defender_antispam_outbound_policy_configured", - "defender_antispam_outbound_policy_forwarding_disabled", - "defender_antispam_policy_inbound_no_allowed_domains", - "defender_chat_report_policy_configured", - "defender_domain_dkim_enabled", - "defender_malware_policy_common_attachments_filter_enabled", - "defender_malware_policy_comprehensive_attachments_filter_applied", - "defender_malware_policy_notifications_internal_users_malware_enabled", - "entra_admin_consent_workflow_enabled", - "entra_admin_portals_access_restriction", - "entra_admin_users_cloud_only", - "entra_admin_users_mfa_enabled", - "entra_admin_users_phishing_resistant_mfa_enabled", - "entra_admin_users_sign_in_frequency_enabled", - "entra_dynamic_group_for_guests_created", - "entra_identity_protection_sign_in_risk_enabled", - "entra_identity_protection_user_risk_enabled", - "entra_legacy_authentication_blocked", - "entra_managed_device_required_for_authentication", - "entra_managed_device_required_for_mfa_registration", - "entra_password_hash_sync_enabled", - "entra_policy_ensure_default_user_cannot_create_tenants", - "entra_policy_guest_invite_only_for_admin_roles", - "entra_policy_guest_users_access_restrictions", - "entra_policy_restricts_user_consent_for_apps", - "entra_thirdparty_integrated_apps_not_allowed", - "entra_users_mfa_enabled", - "exchange_external_email_tagging_enabled", - "exchange_mailbox_audit_bypass_disabled", - "exchange_mailbox_policy_additional_storage_restricted", - "exchange_organization_mailbox_auditing_enabled", - "exchange_organization_mailtips_enabled", - "exchange_organization_modern_authentication_enabled", - "exchange_roles_assignment_policy_addins_disabled", - "exchange_transport_config_smtp_auth_disabled", - "exchange_transport_rules_mail_forwarding_disabled", - "exchange_transport_rules_whitelist_disabled", - "exchange_user_mailbox_auditing_enabled", - "purview_audit_log_search_enabled", - "sharepoint_external_sharing_managed", - "sharepoint_external_sharing_restricted", - "sharepoint_guest_sharing_restricted", - "sharepoint_modern_authentication_required", - "sharepoint_onedrive_sync_restricted_unmanaged_devices", - "teams_email_sending_to_channel_disabled", - "teams_external_domains_restricted", - "teams_external_file_sharing_restricted", - "teams_external_users_cannot_start_conversations", - "teams_meeting_anonymous_user_join_disabled", - "teams_meeting_anonymous_user_start_disabled", - "teams_meeting_chat_anonymous_users_disabled", - "teams_meeting_dial_in_lobby_bypass_disabled", - "teams_meeting_external_chat_disabled", - "teams_meeting_external_control_disabled", - "teams_meeting_external_lobby_bypass_disabled", - "teams_meeting_presenters_restricted", - "teams_meeting_recording_disabled", - "teams_security_reporting_enabled", - "teams_unmanaged_communication_disabled", - ], - }; - - return checksByProvider[provider_type as ProviderType] || []; -}; - -export const getLighthouseProviderChecks = async (provider_type: string) => { - return await checksByProvider(provider_type); -}; diff --git a/ui/lib/lighthouse/helpers/complianceframeworks.ts b/ui/lib/lighthouse/helpers/complianceframeworks.ts deleted file mode 100644 index f1b2eae7e6..0000000000 --- a/ui/lib/lighthouse/helpers/complianceframeworks.ts +++ /dev/null @@ -1,77 +0,0 @@ -import { ProviderType } from "@/types/providers"; - -export const complianceFrameworksByProvider = async (provider_type: string) => { - const complianceFrameworks: Record = { - aws: [ - "aws_account_security_onboarding_aws", - "aws_audit_manager_control_tower_guardrails_aws", - "aws_foundational_security_best_practices_aws", - "aws_foundational_technical_review_aws", - "aws_well_architected_framework_reliability_pillar_aws", - "aws_well_architected_framework_security_pillar_aws", - "cis_1.4_aws", - "cis_1.5_aws", - "cis_2.0_aws", - "cis_3.0_aws", - "cis_4.0_aws", - "cisa_aws", - "ens_rd2022_aws", - "fedramp_low_revision_4_aws", - "fedramp_moderate_revision_4_aws", - "ffiec_aws", - "gdpr_aws", - "gxp_21_cfr_part_11_aws", - "gxp_eu_annex_11_aws", - "hipaa_aws", - "iso27001_2013_aws", - "iso27001_2022_aws", - "kisa_isms_p_2023_aws", - "kisa_isms_p_2023_korean_aws", - "mitre_attack_aws", - "nist_800_171_revision_2_aws", - "nist_800_53_revision_4_aws", - "nist_800_53_revision_5_aws", - "nist_csf_1.1_aws", - "pci_3.2.1_aws", - "pci_4.0_aws", - "prowler_threatscore_aws", - "rbi_cyber_security_framework_aws", - "soc2_aws", - ], - azure: [ - "cis_2.0_azure", - "cis_2.1_azure", - "cis_3.0_azure", - "ens_rd2022_azure", - "iso27001_2022_azure", - "mitre_attack_azure", - "pci_4.0_azure", - "prowler_threatscore_azure", - "soc2_azure", - ], - gcp: [ - "cis_2.0_gcp", - "cis_3.0_gcp", - "ens_rd2022_gcp", - "iso27001_2022_gcp", - "mitre_attack_gcp", - "pci_4.0_gcp", - "prowler_threatscore_gcp", - "soc2_gcp", - ], - kubernetes: [ - "cis_1.10_kubernetes", - "cis_1.8_kubernetes", - "iso27001_2022_kubernetes", - "pci_4.0_kubernetes", - ], - m365: ["cis_4.0_m365", "prowler_threatscore_m365"], - }; - return complianceFrameworks[provider_type as ProviderType] || []; -}; - -export const getLighthouseComplianceFrameworks = async ( - provider_type: string, -) => { - return await complianceFrameworksByProvider(provider_type); -}; diff --git a/ui/lib/lighthouse/tools/checks.ts b/ui/lib/lighthouse/tools/checks.ts index 9d96325333..dbb1cccf6f 100644 --- a/ui/lib/lighthouse/tools/checks.ts +++ b/ui/lib/lighthouse/tools/checks.ts @@ -1,17 +1,38 @@ import { tool } from "@langchain/core/tools"; -import { getLighthouseProviderChecks } from "@/lib/lighthouse/helpers/checks"; -import { checkSchema } from "@/types/lighthouse"; +import { + getLighthouseCheckDetails, + getLighthouseProviderChecks, +} from "@/actions/lighthouse/checks"; +import { checkDetailsSchema, checkSchema } from "@/types/lighthouse"; export const getProviderChecksTool = tool( - async ({ providerType }) => { - const checks = await getLighthouseProviderChecks(providerType); + async ({ providerType, service, severity, compliances }) => { + const checks = await getLighthouseProviderChecks({ + providerType, + service: service || [], + severity: severity || [], + compliances: compliances || [], + }); return checks; }, { name: "getProviderChecks", description: - "Returns a list of available checks for a specific provider (aws, gcp, azure, kubernetes)", + "Returns a list of available checks for a specific provider (aws, gcp, azure, kubernetes). Allows filtering by service, severity, and compliance framework ID. If no filters are provided, all checks will be returned.", schema: checkSchema, }, ); + +export const getProviderCheckDetailsTool = tool( + async ({ checkId }: { checkId: string }) => { + const check = await getLighthouseCheckDetails({ checkId }); + return check; + }, + { + name: "getCheckDetails", + description: + "Returns the details of a specific check including details about severity, risk, remediation, compliances that are associated with the check, etc", + schema: checkDetailsSchema, + }, +); diff --git a/ui/lib/lighthouse/tools/compliances.ts b/ui/lib/lighthouse/tools/compliances.ts index 397afa27c3..7baeff6dea 100644 --- a/ui/lib/lighthouse/tools/compliances.ts +++ b/ui/lib/lighthouse/tools/compliances.ts @@ -1,10 +1,10 @@ import { tool } from "@langchain/core/tools"; +import { getLighthouseComplianceFrameworks } from "@/actions/lighthouse/complianceframeworks"; import { getLighthouseComplianceOverview, getLighthouseCompliancesOverview, } from "@/actions/lighthouse/compliances"; -import { getLighthouseComplianceFrameworks } from "@/lib/lighthouse/helpers/complianceframeworks"; import { getComplianceFrameworksSchema, getComplianceOverviewSchema, diff --git a/ui/lib/lighthouse/workflow.ts b/ui/lib/lighthouse/workflow.ts index 8cdd920a67..faa7f02f4c 100644 --- a/ui/lib/lighthouse/workflow.ts +++ b/ui/lib/lighthouse/workflow.ts @@ -13,7 +13,10 @@ import { supervisorPrompt, userInfoAgentPrompt, } from "@/lib/lighthouse/prompts"; -import { getProviderChecksTool } from "@/lib/lighthouse/tools/checks"; +import { + getProviderCheckDetailsTool, + getProviderChecksTool, +} from "@/lib/lighthouse/tools/checks"; import { getComplianceFrameworksTool, getComplianceOverviewTool, @@ -96,7 +99,12 @@ export async function initLighthouseWorkflow() { const findingsAgent = createReactAgent({ llm: llm, - tools: [getFindingsTool, getMetadataInfoTool, getProviderChecksTool], + tools: [ + getFindingsTool, + getMetadataInfoTool, + getProviderChecksTool, + getProviderCheckDetailsTool, + ], name: "findings_agent", prompt: findingsAgentPrompt, }); diff --git a/ui/types/lighthouse/checks.ts b/ui/types/lighthouse/checks.ts index fa359766b1..186eb6cae6 100644 --- a/ui/types/lighthouse/checks.ts +++ b/ui/types/lighthouse/checks.ts @@ -2,4 +2,13 @@ import { z } from "zod"; export const checkSchema = z.object({ providerType: z.enum(["aws", "gcp", "azure", "kubernetes", "m365"]), + service: z.array(z.string()).optional(), + severity: z + .array(z.enum(["informational", "low", "medium", "high", "critical"])) + .optional(), + compliances: z.array(z.string()).optional(), +}); + +export const checkDetailsSchema = z.object({ + id: z.string(), });