Update checks and compliance framework IDs

ui/lib/lighthouse/helperChecks.ts

@@ -6,6 +6,7 @@ const checksByProvider = async (provider_type: string) => {
       "accessanalyzer_enabled",
       "accessanalyzer_enabled_without_findings",
       "account_maintain_current_contact_details",
+      "account_maintain_different_contact_details_to_security_billing_and_operations",
       "account_security_contact_information_is_registered",
       "account_security_questions_are_registered_in_the_aws_account",
       "acm_certificates_expiration_check",
@@ -98,6 +99,8 @@ const checksByProvider = async (provider_type: string) => {
       "cloudwatch_log_group_no_secrets_in_logs",
       "cloudwatch_log_group_not_publicly_accessible",
       "cloudwatch_log_group_retention_policy_specific_days_enabled",
+      "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
+      "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
       "cloudwatch_log_metric_filter_authentication_failures",
       "cloudwatch_log_metric_filter_aws_organizations_changes",
       "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
@@ -221,12 +224,15 @@ const checksByProvider = async (provider_type: string) => {
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
+      "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888",
+      "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
+      "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
       "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
       "ec2_securitygroup_allow_wide_open_public_ipv4",
       "ec2_securitygroup_default_restrict_traffic",
@@ -635,11 +641,14 @@ const checksByProvider = async (provider_type: string) => {
       "iam_sa_no_administrative_privileges",
       "iam_sa_no_user_managed_keys",
       "iam_sa_user_managed_key_rotate_90_days",
+      "iam_sa_user_managed_key_unused",
       "kms_key_not_publicly_accessible",
       "kms_key_rotation_enabled",
+      "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
       "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
       "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
       "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+      "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
       "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
       "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
       "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
@@ -879,7 +888,29 @@ const checksByProvider = async (provider_type: string) => {
       "admincenter_settings_password_never_expire",
       "admincenter_users_admins_reduced_license_footprint",
       "admincenter_users_between_two_and_four_global_admins",
+      "entra_admin_consent_workflow_enabled",
+      "entra_admin_portals_access_restriction",
+      "entra_admin_users_cloud_only",
+      "entra_admin_users_mfa_enabled",
+      "entra_admin_users_phishing_resistant_mfa_enabled",
+      "entra_admin_users_sign_in_frequency_enabled",
+      "entra_dynamic_group_for_guests_created",
+      "entra_identity_protection_sign_in_risk_enabled",
+      "entra_identity_protection_user_risk_enabled",
+      "entra_legacy_authentication_blocked",
+      "entra_managed_device_required_for_authentication",
+      "entra_managed_device_required_for_mfa_registration",
+      "entra_password_hash_sync_enabled",
+      "entra_policy_ensure_default_user_cannot_create_tenants",
+      "entra_policy_guest_invite_only_for_admin_roles",
+      "entra_policy_guest_users_access_restrictions",
+      "entra_policy_restricts_user_consent_for_apps",
       "entra_thirdparty_integrated_apps_not_allowed",
+      "entra_users_mfa_enabled",
+      "sharepoint_external_sharing_managed",
+      "sharepoint_external_sharing_restricted",
+      "sharepoint_guest_sharing_restricted",
+      "sharepoint_modern_authentication_required",
     ],
   };
 

ui/lib/lighthouse/helperComplianceFrameworks.ts

@@ -10,19 +10,21 @@ export const complianceFrameworksByProvider = async (provider_type: string) => {
       "aws_well_architected_framework_reliability_pillar_aws",
       "aws_well_architected_framework_security_pillar_aws",
       "cis_1.4_aws",
-      "cis_3.0_aws",
       "cis_1.5_aws",
       "cis_2.0_aws",
+      "cis_3.0_aws",
+      "cis_4.0_aws",
       "cisa_aws",
       "ens_rd2022_aws",
-      "ffiec_aws",
       "fedramp_low_revision_4_aws",
       "fedramp_moderate_revision_4_aws",
+      "ffiec_aws",
       "gdpr_aws",
       "gxp_21_cfr_part_11_aws",
       "gxp_eu_annex_11_aws",
       "hipaa_aws",
       "iso27001_2013_aws",
+      "iso27001_2022_aws",
       "kisa_isms_p_2023_aws",
       "kisa_isms_p_2023_korean_aws",
       "mitre_attack_aws",
@@ -31,6 +33,7 @@ export const complianceFrameworksByProvider = async (provider_type: string) => {
       "nist_800_53_revision_5_aws",
       "nist_csf_1.1_aws",
       "pci_3.2.1_aws",
+      "pci_4.0_aws",
       "rbi_cyber_security_framework_aws",
       "soc2_aws",
     ],
@@ -39,11 +42,27 @@ export const complianceFrameworksByProvider = async (provider_type: string) => {
       "cis_2.1_azure",
       "cis_3.0_azure",
       "ens_rd2022_azure",
+      "iso27001_2022_azure",
       "mitre_attack_azure",
+      "pci_4.0_azure",
+      "soc2_azure",
     ],
-    gcp: ["cis_2.0_gcp", "cis_3.0_gcp", "ens_rd2022_gcp", "mitre_attack_gcp"],
-    kubernetes: ["cis_1.10_kubernetes", "cis_1.8_kubernetes"],
-    microsoft365: [],
+    gcp: [
+      "cis_2.0_gcp",
+      "cis_3.0_gcp",
+      "ens_rd2022_gcp",
+      "iso27001_2022_gcp",
+      "mitre_attack_gcp",
+      "pci_4.0_gcp",
+      "soc2_gcp",
+    ],
+    kubernetes: [
+      "cis_1.10_kubernetes",
+      "cis_1.8_kubernetes",
+      "iso27001_2022_kubernetes",
+      "pci_4.0_kubernetes",
+    ],
+    microsoft365: ["cis_4.0_microsoft365"],
   };
   return complianceFrameworks[provider_type as ProviderType] || [];
 };