InsightCloudSec Software Release Notice - 22.12.21 Release

Release Highlights (22.12.21)

InsightCloudSec is pleased to announce Release 22.12.21. This release includes added support for AWS Glue Databases and Azure’s Application Credentials. For GCP we have added support for GCP Cloud Composer, GCP Data Fusion, and GCP Service Certificate Authority. This release also includes a new Compliance Pack supporting the Cloud Security Alliance Cloud Controls Matrix (CSA CCM). In addition, 22.12.21 includes three new Insights, one updated Query Filter, one new Query Filter, and five bug fixes.

• Contact us through the unified Customer Support Portal  with any questions.

New Permissions Required (22.12.21)

Features & Enhancements (22.12.21)

• Added a new download option that can be used to get organization metrics about cloud utilization. Note that this report can only be called by Org Admins, Domain Admins, and Domain Viewers. [ENG-22039]

• Improved performance for the EDH History cloud section dropdown. [ENG-21686]

• Alibaba has indicated to their vendors that they prefer to be referred to as Alibaba Cloud rather than the more informal AliCloud which they had used in the past. Names have been updated to reflect that preference. [ENG-21505]

Resources (22.12.21)

AWS

• Added visibility and lifecycle support for AWS Glue Databases (new Resource type ETL Database, Storage category). This support includes the ability to manipulate tags despite the cloud provider not supporting tags within the console. We have added a new read only permission to AWS commercial and GovCloud readonly policies, “glue:GetTables”. [ENG-22148]

AZURE

• We have added support for Azure’s Application Credentials (Resource type API Access Key, Identity & Management resource category). The permission “Application.Read.All” is needed for Microsoft Graph to run this new capability successfully. A new Query Filter, Service Access Key Expiration Date Exceeds is also available. [ENG-21855]

GCP

• Added visibility into three additional GCP services:

  • GCP Cloud Composer (Resource type “Airflow Environment”, Compute category)
  • GCP Data Fusion (Resource type “Data Factory”, Storage category)
  • GCP Service Certificate Authority (Resource type “SSL Certificate Authority”, Identity & Management category)

  In conjunction with this added visibility, the following Insights have added GCP support:

  • Airflow Environment Allows Public Web Server Access
  • Data Factory Encrypted with Cloud Managed Key
  • Data Factory Supports Public Access

  No new permissions are required for this as we use the Cloud Asset Inventory for retrieval and these permissions are already documented. However, there are three new APIs that customers will need to enable: Cloud Composer API, Cloud Data Fusion API, and Certificate Authority Service API. [ENG-22116]

Insights (22.12.21)

New CSA CMM Compliance Pack

• We have added a new Compliance Pack to support the Cloud Security Alliance Cloud Controls Matrix (CSA CCM). This pack includes 491 Insights that map to CSA CCM standards . See also our listing of Compliance Packs  on our Insights page. [ENG-20019]

GCP

• Three Insights have added GCP support In conjunction with the added visibility into GCP Cloud Composer, GCP Data Fusion, and GCP Data Factory [ENG-22116]
  • Airflow Environment Allows Public Web Server Access
  • Data Factory Encrypted with Cloud Managed Key
  • Data Factory Supports Public Access

Query Filters (22.12.21)

AZURE

• Web App Configured To Use SCM - Expanded Query Filter to identify Azure App Services which are SCM Compliant/Non-compliant.compliant/non-compliant resources. Compliant resources contain a DenyALL rule in the list of firewall rules or scmIpSecurityRestrictionsUseMain is TRUE. A resource is non-compliant if any the following properties are NULL or FALSE: “scmipSecurityRestrictions”, “scmIpSecurityRestrictionsDefaultAction”, or “scmIpSecurityRestrictionsUseMain”. [ENG-21951]

MULTI-CLOUD/GENERAL

• Service Access Key Expiration Date Exceeds - New Query Filter identifies Service Access Keys depending on whether their expiration date is within a specified number of days. [ENG-21855]

Infrastructure as Code (IaC) (22.12.21)

• Added IaC support for the google_kms_key_ring, google_kms_key_ring_iam_binding, and google_kms_key_ring_iam_member resources in Terraform plans targeting GCP. (Note: This is support for the “Key Vault” resource type.) [ENG-22044]

• Added IaC support for the google_apikey_key resource in Terraform plans targeting GCP. (Note: This is support for the “Cloud Credentials” resource type.) [ENG-21848]

IAM (22.12.21)

• AWS IAM Effective Access results will now include cross-account access. This will affect results for Access Explorer as well as identity-related Query Filters:

  • Identity Resource with Effective Access to Resources
  • Identity Resource with Effective Access to Resources Using Tags
  • Resource Granting Effective Access to Identity

  Results will also increase to reflect new services announced at re:Invent. Anywhere that lists permissions allowed by a principal (the Principal Explorer page, the Principal Activity page, etc.) should now include these new actions. [ENG-21803]

• Updated the displayed table columns on the Permissions Blade in the Resources panel to show permissions-relevant information: Used status, Permission Name, Count, and Last Executed [date]. [ENG-21461]

Bug Fixes (22.12.21)

• Fixed bug where GetBucketLocation was failing due to region in LPAAggregationJob. [ENG-22131]

• Fixed edge case where the ECSTaskHarvester raised an unnecessary exception when there was no hookpoint notification to send. [ENG-22082]

• Updated harvesting of the AWS Launch Template property for AWS Autoscaling Groups to accommodate different AWS API responses. [ENG-22077]

• Fixed an edge case that prevented collection of Azure Functions due to Storage Account permissions errors. [ENG-22064]

• Fixed an issue where AWS EDH Incognito User Pool events were not processing. [ENG-21506]