Bug fixes

• Fix issue where MacOS binaries failed to run due to absolute openssl paths and incorrect minimun OS version requirement. (#4679)

What's new?

• You can now configure public network access for database accounts. To get started, set the Azure > Cosmos DB > Database Account > Public Network Access policy.

Control Types

• Azure > Cosmos DB > Database Account > Public Network Access

Policy Types

• Azure > Cosmos DB > Database Account > Public Network Access

Action Types

• Azure > Cosmos DB > Database Account > Set Public Network Access

Bug fixes

• Fixed policy mappings in various control types.

Whats new

• Update database version to PostgreSQL 14.19. (#4644)

Bug fixes

• Fix issue where the truncation message was not showing in batch queries for table output format. (#4674)
• Improve truncation message for datasets exceeding 10k rows in table output format. (#4674)

What's new?

• You can now configure advanced data security for workspaces. To get started, set the Azure > Synapse Analytics > Workspace > Advanced Data Security > * policies.

Control Types

• Azure > Synapse Analytics > Workspace > Advanced Data Security

Policy Types

• Azure > Synapse Analytics > Workspace > Advanced Data Security
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Threat Protection
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Threat Protection > Notify Admins
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Threat Protection > Types
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Threat Protection > Types > Email Addresses
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Vulnerability Assessment
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Vulnerability Assessment > Periodic Scans
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Email Addresses
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Notify Admins
• Azure > Synapse Analytics > Workspace > Advanced Data Security > Vulnerability Assessment > Storage Account

Action Types

• Azure > Synapse Analytics > Workspace > Update Advanced Data Security

What's new?

• You can now configure public network access for automation accounts. To get started, set the Azure > Automation > Automation Account > Public Network Access policy.

Control Types

• Azure > Automation > Automation Account > Public Network Access

Policy Types

• Azure > Automation > Automation Account > Public Network Access

Action Types

• Azure > Automation > Automation Account > Set Public Network Access

Enhancements

• Added the column leaked_credential_check_enabled to cloudflare_zone table. (#187) (Thanks @Theo-Bouguet for the contribution!!)
• Added the parent hydrate cloudflare_zone to the cloudflare_dns_record table, so queries no longer require zone_id in the WHERE or JOIN clause. (#185) (Thanks @Theo-Bouguet for the contribution!!)

Bug fixes

• Added support to process enable and disable real-time events for Vertex AI API via Service Usage APIs.

Bug fixes

• Unsupported regions were inadvertently included in the AWS > Bedrock > Custom Model > Regions policy, which led to the AWS > Bedrock > Custom Model > Discovery control being in an error state for those regions. We've now removed the unsupported regions from the Regions policy.

What's new?

• Policy Type, Control Type, and Action Type definitions now also include their mapping details to establish clear relationships between them.

What's new?

Resource Types

• AWS > Cognito > Identity Pool

Control Types

• AWS > Cognito > Identity Pool > Active
• AWS > Cognito > Identity Pool > Allowed
• AWS > Cognito > Identity Pool > Allowed > Custom
• AWS > Cognito > Identity Pool > Allowed > Region
• AWS > Cognito > Identity Pool > CMDB
• AWS > Cognito > Identity Pool > Classic Authentication Flow
• AWS > Cognito > Identity Pool > Discovery
• AWS > Cognito > Identity Pool > Guest Access
• AWS > Cognito > Identity Pool > Tags

Policy Types

• AWS > Cognito > Allowed Regions [Default]
• AWS > Cognito > Identity Pool > Active
• AWS > Cognito > Identity Pool > Active > Age
• AWS > Cognito > Identity Pool > Active > Last Modified
• AWS > Cognito > Identity Pool > Allowed
• AWS > Cognito > Identity Pool > Allowed > Custom
• AWS > Cognito > Identity Pool > Allowed > Custom > Rules
• AWS > Cognito > Identity Pool > Allowed > Region
• AWS > Cognito > Identity Pool > Allowed > Region > Regions
• AWS > Cognito > Identity Pool > CMDB
• AWS > Cognito > Identity Pool > Classic Authentication Flow
• AWS > Cognito > Identity Pool > Guest Access
• AWS > Cognito > Identity Pool > Regions
• AWS > Cognito > Identity Pool > Tags
• AWS > Cognito > Identity Pool > Tags > Template
• AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-cognito

Action Types

• AWS > Cognito > Identity Pool > Delete
• AWS > Cognito > Identity Pool > Router
• AWS > Cognito > Identity Pool > Update Classic Authentication Flow
• AWS > Cognito > Identity Pool > Update Guest Access
• AWS > Cognito > Identity Pool > Update Tags

Note: We recommend updating the @turbot/aws mod to v5.40.0 for proper functionality.

What's new?

• New tables added
  • grafana_alert_rule (#51) (Thanks @codenio for the contribution!!)

Bug fixes

• Fixed the folder_uid column of grafana_folder_permission table to correctly return data instead of null. (#49) (Thanks @codenio for the contribution!!)

Bug fixes

• Fixed OAuth2 scope handling by shifting to table-specific scope requests instead of global scopes, and documented required scopes per table. (#94)

What's new?

• New tables added
  • xml_file (#66) (Thanks @vil02 for the contribution!!)

Bug fixes

• Fixed file handling logic to close files correctly and improve error handling across all the tables. (#68) (Thanks @vil02 for the contribution!!)

What's new?

• AWS > EC2 > AMI > * Lambda functions have been migrated to use AWS SDK v3, reducing the mod package size and improving deployment efficiency. You will not notice any differences, and things will continue to work smoothly as before.

Dependencies

• AzureAD plugin v1.8.0 or higher is now required. (#344)

What's new?

• Added Azure CIS v5.0.0 benchmark (powerpipe benchmark run azure_compliance.benchmark.cis_v500). (#344)

What's new?

Policy Types

• Azure > Subscription > Allowed Regions [Default]

Bug fixes

• The real-time Event Handlers would fail to process tagging events for AWS > Secrets Manager > Secret resources. This is now fixed.

Enhancements

• Added the following columns to the azuread_user table: (#295)
  • automatic_replies_setting
  • date_format
  • delegate_meeting_message_delivery_options
  • language
  • time_format
  • time_zone
  • user_purpose
  • working_hours

Enhancements

• Added the column dhcp_options to azure_virtual_network table. (#959) (Thanks @manzomanze for the contribution!)

Bug fixes

• Fixed the legacy_usage_detail column in azure_consumption_usage table which now correctly returns the MeterDetails metadata instead of null. (#953)

What's new?

• New tables added
  • aws_eks_access_entry (#2651)
  • aws_eks_access_policy_association (#2651)

Enhancements

• Added the column routing_config to aws_lambda_alias table. (#2657)

Bug fixes

• Fixed the code column in aws_lambda_version table to correctly return data instead of null. (#2656)

Dependencies

• Recompiled plugin with aws-sdk-go-v2 v1.39.3. (#2658)
• Updated the OpenSearch tables to use github.com/aws/aws-sdk-go-v2/service/opensearch v1.52.6 module. (#2658)

What's new?

• Added CIS v5.0.0 benchmark (powerpipe benchmark run microsoft365_compliance.benchmark.cis_v500). (#81)

Enhancements

• Updated all top-level benchmark titles to include Microsoft 365 for clearer identification and consistency across benchmarks. (#80)

What's new?

• Virtual network rules details will now be available in CMDB for servers.

Bug fixes

• The AWS > Lambda > Function > URL Auth Type control previously entered an invalid state when a Function URL was not configured. This issue has now been resolved and the control will correctly transition to a skipped state in such cases.

Bug fixes

• The AWS > DynamoDB > Table > Encryption at Rest control previously remained incorrectly in an alarm state when encryption was enforced on Global Table replicas. This issue has been resolved; the control now transitions to an invalid state for replicas, as AWS Global Tables require a single, coordinated cross-region encryption update rather than per-replica changes.

v0.17.0 of the Terraform Provider for Pipes is now available.

What's new?

• Resource: pipes_tenant_service_account
• Resource: pipes_organization_service_account

Enhancements

• Add skip_initial_refresh attribute to the pipes_workspace_datatank_table resource to prevent immediately obtaining all data on creation or update.

What's new?

Resource Types

• AWS > Neptune > DB Cluster Snapshot

Control Types

• AWS > Neptune > DB Cluster Snapshot > Active
• AWS > Neptune > DB Cluster Snapshot > Allowed
• AWS > Neptune > DB Cluster Snapshot > Allowed > Custom
• AWS > Neptune > DB Cluster Snapshot > Allowed > Region
• AWS > Neptune > DB Cluster Snapshot > CMDB
• AWS > Neptune > DB Cluster Snapshot > Discovery
• AWS > Neptune > DB Cluster Snapshot > Tags
• AWS > Neptune > DB Cluster Snapshot > Usage

Policy Types

• AWS > Neptune > Allowed Regions [Default]
• AWS > Neptune > DB Cluster Snapshot > Active
• AWS > Neptune > DB Cluster Snapshot > Active > Age
• AWS > Neptune > DB Cluster Snapshot > Active > Last Modified
• AWS > Neptune > DB Cluster Snapshot > Allowed
• AWS > Neptune > DB Cluster Snapshot > Allowed > Custom
• AWS > Neptune > DB Cluster Snapshot > Allowed > Custom > Rules
• AWS > Neptune > DB Cluster Snapshot > Allowed > Region
• AWS > Neptune > DB Cluster Snapshot > Allowed > Region > Regions
• AWS > Neptune > DB Cluster Snapshot > CMDB
• AWS > Neptune > DB Cluster Snapshot > Regions
• AWS > Neptune > DB Cluster Snapshot > Tags
• AWS > Neptune > DB Cluster Snapshot > Tags > Template
• AWS > Neptune > DB Cluster Snapshot > Usage
• AWS > Neptune > DB Cluster Snapshot > Usage > Limit

Action Types

• AWS > Neptune > DB Cluster Snapshot > Delete
• AWS > Neptune > DB Cluster Snapshot > Delete from AWS
• AWS > Neptune > DB Cluster Snapshot > Router
• AWS > Neptune > DB Cluster Snapshot > Set Tags
• AWS > Neptune > DB Cluster Snapshot > Skip alarm for Active control
• AWS > Neptune > DB Cluster Snapshot > Skip alarm for Active control [90 days]
• AWS > Neptune > DB Cluster Snapshot > Skip alarm for Tags control
• AWS > Neptune > DB Cluster Snapshot > Skip alarm for Tags control [90 days]
• AWS > Neptune > DB Cluster Snapshot > Update Tags

Note: We recommend updating the @turbot/aws-rds mod to v5.32.2 and the @turbot/aws mod to v5.40.0 for proper functionality.

What's new?

• New tables added (#516)
  • github_actions_environment_variable
  • github_actions_organization_variable
  • github_actions_repository_variable

What's new?

• New tables added (#294)
  • azuread_device_registration_policy

Bug fixes

• Server:
  • Materialization now handles invalid policy type mappings gracefully by skipping them instead of failing.

Requirements

• Upgrade to 5.54.2 requires your workspace to be on 5.53.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.56.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• UI
  • Added Terraform import block generation to policy pack developer tab alongside existing import commands.

Bug fixes

• UI
  • Control page policy lists now show complete trunk names without cutting them off.
  • Resource page alert counts now accurately reflect the actual number of alerts

Requirements

• Upgrade to 5.53.6 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Updated permissions to support real-time event processing for DB cluster snapshot resources used by Neptune and DocDB services.

What's new?

Resource Types

• AWS > Doc DB > DB Cluster Snapshot

Control Types

• AWS > Doc DB > DB Cluster Snapshot > Active
• AWS > Doc DB > DB Cluster Snapshot > Allowed
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Custom
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Region
• AWS > Doc DB > DB Cluster Snapshot > CMDB
• AWS > Doc DB > DB Cluster Snapshot > Discovery
• AWS > Doc DB > DB Cluster Snapshot > Tags
• AWS > Doc DB > DB Cluster Snapshot > Usage

Policy Types

• AWS > Doc DB > Allowed Regions [Default]
• AWS > Doc DB > DB Cluster Snapshot > Active
• AWS > Doc DB > DB Cluster Snapshot > Active > Age
• AWS > Doc DB > DB Cluster Snapshot > Active > Budget
• AWS > Doc DB > DB Cluster Snapshot > Active > Last Modified
• AWS > Doc DB > DB Cluster Snapshot > Allowed
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Custom
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Custom > Rules
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Region
• AWS > Doc DB > DB Cluster Snapshot > Allowed > Region > Regions
• AWS > Doc DB > DB Cluster Snapshot > CMDB
• AWS > Doc DB > DB Cluster Snapshot > Regions
• AWS > Doc DB > DB Cluster Snapshot > Tags
• AWS > Doc DB > DB Cluster Snapshot > Tags > Template
• AWS > Doc DB > DB Cluster Snapshot > Usage
• AWS > Doc DB > DB Cluster Snapshot > Usage > Limit

Action Types

• AWS > Doc DB > DB Cluster Snapshot > Delete
• AWS > Doc DB > DB Cluster Snapshot > Delete from AWS
• AWS > Doc DB > DB Cluster Snapshot > Router
• AWS > Doc DB > DB Cluster Snapshot > Set Tags
• AWS > Doc DB > DB Cluster Snapshot > Skip alarm for Active control
• AWS > Doc DB > DB Cluster Snapshot > Skip alarm for Active control [90 days]
• AWS > Doc DB > DB Cluster Snapshot > Skip alarm for Tags control
• AWS > Doc DB > DB Cluster Snapshot > Skip alarm for Tags control [90 days]
• AWS > Doc DB > DB Cluster Snapshot > Update Tags

Note: We recommend updating the @turbot/aws-rds mod to v5.32.2 and the @turbot/aws mod to v5.40.0 for proper functionality.

What's new?

• New tables added: (#950)
  • azure_cost_forecast_daily
  • azure_cost_forecast_monthly

What's new?

• New tables added (#283)
  • azuread_access_review_schedule_definition
  • azuread_authentication_method_policy
  • azuread_external_identity_policy

Enhancements

• Added additional_data column to the azuread_conditional_access_policy table. (#283)

Dependencies

• Recompiled plugin with github.com/microsoftgraph/msgraph-beta-sdk-go v0.151.0. (#283)
• Recompiled plugin with steampipe-plugin-sdk v5.13.1 that addresses critical and high vulnerabilities in dependent packages. (#288)

What's new?

• Firewall rules details will now be available in CMDB for workspaces.
• Security alert policy and vulnerability assessments details will now be available in CMDB for workspaces.

What's new?

• Firewall rules details will now be available in CMDB for redis cache.

What's new?

• Firewall rules details will now be available in CMDB for flexible servers.

Currently executing queries can now be efficiently stopped using the Cancel button in the query console.

For more information, check out the docs

All Steampipe plugins have been updated to use steampipe-plugin-sdk v5.13.1, which includes:

• Updated dependent packages to address critical and high vulnerabilities
• Upgraded Go version to 1.24

What's new?

• New tables added (#67)
  • microsoft365_group
  • microsoft365_list
  • microsoft365_organization
  • microsoft365_site
  • microsoft365_user

Enhancements

• Added the following columns to the microsoft365_drive table: (#67)
  • list
  • owner
  • quota
  • sharepoint_ids
  • system

Bug fixes

• Fixed the microsoft365_user table to populate all the column values correctly. (#68)

Dependencies

• Recompiled plugin with msgraph-sdk-go v1.84.0. (#67)
• Recompiled plugin with Go version 1.24. (#66)
• Recompiled plugin with steampipe-plugin-sdk v5.13.1 that addresses critical and high vulnerabilities in dependent packages. (#70)

Enhancements

• Added column full_snapshot_size_in_bytes to aws_ebs_snapshot table. (#2652) (Thanks @bahybintang for the contribution!)
• Added column code to aws_lambda_alias table. (#2649)

Bug fixes

• Fixed the default rate limiter configuration for AWS Kinesis service tables. (#2644) (Thanks @pdecat for the contribution!)

Dependencies

• Recompiled plugin with steampipe-plugin-sdk v5.13.1 that addresses critical and high vulnerabilities in dependent packages. (#2649)

What's new?

• Server
  • Turbot > Notifications > Rule-Based Routing now supports using Turbot > File resources as notification templates — update the @turbot/turbot mod to v5.56.1 or later to enable this feature.

Requirements

• Upgrade to 5.53.5 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Server
  • Redis/Valkey connection management now tracks connection creation times for improved visibility and connection lifecycle tracking.
  • Maintenance container logic refined to avoid errors when attempting to drop unique index constraints.

Requirements

• Upgrade to 5.53.4 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Users can now manage trusted access for layers. To get started, set the AWS > Lambda > Function > Layer Trusted Access > * policies.

Control Types

• AWS > Lambda > Function > Layer Trusted Access

Policy Types

• AWS > Lambda > Function > Layer Trusted Access
• AWS > Lambda > Function > Layer Trusted Access > Accounts

Action Types

• AWS > Lambda > Function > Set Layer Trusted Access

What's new?

• Added CIS v6.0.0 benchmark (powerpipe benchmark run aws_compliance.benchmark.cis_v600). (#941)

Bug fixes

• Fixed the foundational_security_redshift_4 control to correctly reference redshift_cluster_audit_logging_enabled query instead of redshift_cluster_automatic_snapshots_min_7_days. (#945)

What's new?

Policy Types

• AWS > Account > Allowed Regions [Default]

Bug Fixes

• Build: Restored CentOS/RHEL 9 compatibility by pinning the build image to an older libstdc++/GCC baseline. Previous build linked against newer GLIBCXX symbols, causing Tailpipe to fail on CentOS/RHEL 9.

Bug Fixes

• Build: Restored CentOS/RHEL 9 compatibility by pinning the build image to an older libstdc++/GCC baseline. Previous build linked against newer GLIBCXX symbols, causing Powerpipe to fail on CentOS/RHEL 9.
• Improve benchmark/detection summary chart width calculations. (#945)
• Fix filtering by false boolean values in tables. (#946)

What's new?

Resource Types

• Azure > Redis
• Azure > Redis > Redis Cache

Control Types

• Azure > Redis > Redis Cache > Active
• Azure > Redis > Redis Cache > CMDB
• Azure > Redis > Redis Cache > Discovery
• Azure > Redis > Redis Cache > Tags

Policy Types

• Azure > Redis > Approved Regions [Default]
• Azure > Redis > Enabled
• Azure > Redis > Permissions
• Azure > Redis > Permissions > Levels
• Azure > Redis > Permissions > Levels > Modifiers
• Azure > Redis > Redis Cache > Active
• Azure > Redis > Redis Cache > Active > Age
• Azure > Redis > Redis Cache > Active > Last Modified
• Azure > Redis > Redis Cache > CMDB
• Azure > Redis > Redis Cache > Regions
• Azure > Redis > Redis Cache > Tags
• Azure > Redis > Redis Cache > Tags > Template
• Azure > Redis > Regions
• Azure > Redis > Tags Template [Default]
• Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-redis
• Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-redis

Action Types

• Azure > Redis > Redis Cache > Delete
• Azure > Redis > Redis Cache > Router
• Azure > Redis > Redis Cache > Set Tags

What's new?

Resource Types

• Azure > Provider > Redis

Control Types

• Azure > Provider > Redis > CMDB
• Azure > Provider > Redis > Discovery
• Azure > Provider > Redis > Registered

Policy Types

• Azure > Provider > Redis > CMDB
• Azure > Provider > Redis > Registered

Action Types

• Azure > Provider > Redis > Set Registered

What's new?

• You can now configure anonymous pull access for registries. To get started, set the Azure > Container Registry > Registry > Anonymous Pull Access policy.

Control Types

• Azure > Container Registry > Registry > Anonymous Pull Access

Policy Types

• Azure > Container Registry > Registry > Anonymous Pull Access

Action Types

• Azure > Container Registry > Registry > Set Anonymous Pull Access

Bug fixes

• Fixed the jira_issue_comment table to correctly return data instead of an empty row when issue_id is passed in as an optional qual when querying the table. (#190)

Dependencies

• Recompiled plugin with steampipe-plugin-sdk v5.13.1 that addresses critical and high vulnerabilities in dependent packages. (#191)

Bug fixes

• Re-added control elb_application_lb_drop_http_headers to avoid breaking dependencies in other mods. (#943)

v0.16.0 of the Pipes SDK Go is now available.

What's new?

• AI Key Management APIs for Tenants, Users and Organizations.
• Workspace Conversations, Conversation Messages and Conversation Artifacts APIs for UserWorkspaces and OrgWorkspaces.
• Workspace AI Models APIs for UserWorkspaces and OrgWorkspaces.
• Service Account APIs.
• Added ServiceState enum to represent the state of a service.
• Added ModelState enum to represent the state of an AI model.
• Added UserType enum to classify users.

Enhancements

• Added AiEnabled attribute to TenantSettings to allow enabling / disabling AI features at a tenant level.
• Added Type attribute to User (backed by UserType) to distinguish user types.
• Added TokenWithValue and CreateTokenRequest models to improve token creation workflows.

Bug fixes

• Controls for Lambda functions now use updated CMDB references in internal GraphQL queries. You will not notice any differences, and things will continue to work smoothly as before.

What's new?

• You can now configure anonymous auth for domains. To get started, set the AWS > OpenSearch > Domain > Anonymous Auth policy.

Control Types

• AWS > OpenSearch > Domain > Anonymous Auth

Policy Types

• AWS > OpenSearch > Domain > Anonymous Auth

Action Types

• AWS > OpenSearch > Domain > Disable Anonymous Auth

What's new?

• You can now configure URL auth type for functions. To get started, set the AWS > Lambda > Function > URL Auth Type policy.

Bug fixes

• Fixed action and control mappings in various control types and policy types.

• We've removed the redundant Configuration details for functions from the CMDB. We recommend updating your existing policy settings to reference the top-level attributes from the CMDB data instead.

  Removed: In AWS > Lambda > Function:

  • Configuration

Control Types

• AWS > Lambda > Function > URL Auth Type

Policy Types

• AWS > Lambda > Function > URL Auth Type

Action Types

• AWS > Lambda > Function > Update URL Auth Type

Bug fixes

• Controls for Lambda functions now use updated CMDB references in internal GraphQL queries. You will not notice any differences, and things will continue to work smoothly as before.

Bug fixes

• Guardrails would sometimes fail to process the real-time ec2:DisableSnapshotBlockPublicAccess event for EC2 Account Attributes correctly. This is now fixed.

Dependencies

• Recompiled plugin with tailpipe-plugin-sdk v0.9.4 that fixes an issue where azure_blob_storage was not working correctly as an artifact source. (#94)

What's new?

• New benchmarks added:

  • GitHub Security Log Detections benchmark (powerpipe benchmark run github_security_log_detections.benchmark.security_log_detections).
  • MITRE ATT&CK v16.1 benchmark (powerpipe benchmark run github_security_log_detections.benchmark.mitre_attack_v161).

• New dashboards added:

  • GitHub Security Log Activity Dashboard

Bug fixes

• Fixed the cis_v400_8_1 control to correctly reference the dataproc_cluster_encryption_with_cmek query instead of bigquery_dataset_not_publicly_accessible. (#218)

Dependencies

• Azure plugin v1.8.0 or higher is now required.

Enhancements

• Updated the kubernetes_cluster_sku_standard query to report clusters using the Free SKU tier as alarm, ensuring consistency with the API response. (#340)

Bug fixes

• Fixed control and query name by renaming elb_application_lb_drop_http_headers to elb_application_lb_http_drop_invalid_header_enabled to correctly indicate that it checks whether Application Load Balancers are configured to drop invalid HTTP headers (not all headers). (#936)
• Fixed the iam_policy_no_full_access_to_kms control to correctly reference iam_policy_no_full_access_to_kms query instead of iam_policy_no_full_access_to_cloudtrail. (#938)

Bug fixes

• Server

  • Resolved an issue where creating policy values could hang when related policies had no targets.

• UI

  • Policy value cards are now better aligned, improving readability and visual consistency.
  • Smoothed out the header experience on the resources page by removing flicker.

Requirements

• Upgrade to 5.54.1 requires your workspace to be on 5.53.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.56.0

Base images

• Alpine: 3.17.5
• Ubuntu: 22.04.3

What's new?

• Server
  • Increased type installation limit from 600 to 1500.

Bug fixes

• UI
  • Policy value cards are now better aligned, improving readability and visual consistency.
  • Smoothed out the header experience on the resources page by removing flicker.

Requirements

• Upgrade to 5.53.3 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.1 that addresses critical and high vulnerabilities in dependent packages.

Whats new

• Add support for using context functions in steampipe connection config. (#4433)
• Show message during startup indicating whether Steampipe launched its own Postgres or connected to an existing service. (#4427)

Bug fixes

• Fix issue where running plugin update was creating the default config file, if it did not exist. (#4628)
• Fix help message after uninstalling plugins. (#4483)
• Fix issue where steampipe login was not respecting PIPES_INSTALL_DIR env var. (#4402)

We've added an AI-powered chat interface that unifies your entire cloud environment - AWS, Azure, GCP, GitHub, M365 and 80+ other services. Start conversations to get instant, accurate answers through natural language.

For more information, see the launch post or check out the docs.

Bug fixes

• Fixed the folder names for GitHub security log table queries. (#36) (#37)

What's new?

You now have more control over when Guardrails creates controls and policy values based on policy settings. Previously, Guardrails would evaluate all possible controls for every resource by default. With this release, Guardrails can be configured to only create controls impacted by policy settings, improving both user experience and backend performance.

The Turbot > Materialization policy supports two modes:

• Always (Default) — Create controls and policy values for all applicable resources, even if no setting exists. This matches legacy behavior.
• Automatic — Create controls and policy values only if a setting is explicitly defined for the primary policy. This can significantly reduce noise and improve performance.

Note that some types, such as those used to discover resources and configure accounts, are always created regardless of the materialization mode.

To get started, we recommend setting the Turbot > Materialization policy to Automatic and updating any cloud mods currently installed, like aws, aws-s3, azure, to their latest versions.

In the upcoming TE version, the default for the Turbot > Materialization policy will change from Always to Automatic. To retain the existing behavior, set the Turbot > Materialization policy to Always before upgrading to the next TE version.

Requirements

• Upgrade to 5.54.0 requires your workspace to be on 5.53.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.56.0

Base images

• Alpine: 3.17.5
• Ubuntu: 22.04.3

What's new?

• Added the Turbot > Materialization policy to control when Guardrails creates controls and policy values, with modes for Always (legacy behavior) and Automatic (create only when explicitly set), reducing noise and improving performance.

Control Types

• Turbot > Policy Pack > Materialize
• Turbot > Guardrail > Materialize
• Turbot > Materialize

Policy Types

• Turbot > Materialization

• Renamed

  • Turbot > Notifications > Email > CC > Tag > Name to Turbot > Notifications > Email > CC > Tag Name.

• Deprecated

  • Turbot > Notifications > Email > CC > Tag

Requirements

• TE: 5.35.4

What's new?

• You can now configure key based metadata write access for database accounts. To get started, set the Azure > Cosmos DB > Database Account > Key Based Metadata Write Access policy.

Control Types

• Azure > Cosmos DB > Database Account > Key Based Metadata Write Access

Policy Types

• Azure > Cosmos DB > Database Account > Key Based Metadata Write Access

Action Types

• Azure > Cosmos DB > Database Account > Set Key Based Metadata Write Access

Bug fixes

• All Lambda functions have been migrated to use AWS SDK v3, reducing the mod package size and improving deployment efficiency. You will not notice any differences, and things will continue to work smoothly as before.

Major Changes

• Replace native Parquet conversion with a DuckLake database backend. (#546)

  • DuckLake is DuckDB’s new lakehouse format: data remains in Parquet files, but metadata is efficiently tracked in a separate DuckDB database.
  • DuckLake supports function-based partitioning, which allows data to be partitioned by year and month. This enables efficient file pruning on tp_timestamp without needing a separate tp_date filter. A tp_date column will still be present for compatibility, but it is no longer required for efficient query filtering.
  • Existing data will be automatically migrated the next time Tailpipe runs. Migration does not occur if progress output is disabled (--progress=false) or when using machine-readable output (json, line, csv).

  Note: For CentOS/RHEL users, the minimum supported version is now CentOS Stream 10 / RHEL 10 due to libstdc++ library compatibility.

• The connect command now returns the path to an initialisation SQL script instead of the database path. (#550)

  • The script sets up DuckDB with required extensions, attaches the Tailpipe database, and defines views with optional filters.
  • You can pass the generated script to DuckDB using the --init argument to immediately configure the session. For example:

    duckdb --init $(tailpipe connect)

    Note: The minimum supported DuckDB version is 1.4.0.

Bug Fixes

• Include partitions for local plugins in the tailpipe plugin list command. (#538)

What's new

• Updated the tailpipe connection to support the new Tailpipe v0.7.0 DuckLake backend. (#889)
  Note: When using Powerpipe with Tailpipe v0.7.0, existing Tailpipe data must be migrated to DuckLake before running a dashboard that uses a Tailpipe backend. Data can be migrated by running tailpipe query.

• Updated pipe-fittings to v2.7.0. (#760)

Note: For CentOS/RHEL users, the minimum supported version is now CentOS Stream 10 / RHEL 10 due to libstdc++ library compatibility.

What's new?

• Server

  • GitHub integration now supports importing GitHub Enterprise organizations, expanding coverage for enterprise users.

• UI

  • The main dashboard’s resource list is now split into favorites and accounts for easier navigation and prioritization.
  • The GitHub import page now includes support for GitHub Enterprise.

Bug fixes

• Server

  • Resolved an issue that could prevent confirmation of SNS subscriptions during event handler setup for accounts.
  • Resolved issues with incorrect index mapping definitions in the maintenance container.

• UI

  • Improved UI consistency and usability across policy value cards, control actions, and resource control lists.

Requirements

• Upgrade to 5.53.2 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Track and manage domain resources in Guardrails.

Resource Types

• AWS > OpenSearch > Domain

Control Types

• AWS > OpenSearch > Domain > Active
• AWS > OpenSearch > Domain > Approved
• AWS > OpenSearch > Domain > CMDB
• AWS > OpenSearch > Domain > Discovery
• AWS > OpenSearch > Domain > Tags

Policy Types

• AWS > OpenSearch > Domain > Active
• AWS > OpenSearch > Domain > Active > Age
• AWS > OpenSearch > Domain > Active > Last Modified
• AWS > OpenSearch > Domain > Approved
• AWS > OpenSearch > Domain > Approved > Custom
• AWS > OpenSearch > Domain > Approved > Regions
• AWS > OpenSearch > Domain > Approved > Usage
• AWS > OpenSearch > Domain > CMDB
• AWS > OpenSearch > Domain > Regions
• AWS > OpenSearch > Domain > Tags
• AWS > OpenSearch > Domain > Tags > Template
• AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-opensearch

Action Types

• AWS > OpenSearch > Domain > Delete
• AWS > OpenSearch > Domain > Delete from AWS
• AWS > OpenSearch > Domain > Router
• AWS > OpenSearch > Domain > Set Tags
• AWS > OpenSearch > Domain > Skip alarm for Active control
• AWS > OpenSearch > Domain > Skip alarm for Active control [90 days]
• AWS > OpenSearch > Domain > Skip alarm for Approved control
• AWS > OpenSearch > Domain > Skip alarm for Approved control [90 days]
• AWS > OpenSearch > Domain > Skip alarm for Tags control
• AWS > OpenSearch > Domain > Skip alarm for Tags control [90 days]
• AWS > OpenSearch > Domain > Update Tags

What's new?

• New dashboards added: (#2)
  • GCP Cloud Billing: Cost by Label
  • GCP Cloud Billing: Cost by Location
  • GCP Cloud Billing: Cost by Project
  • GCP Cloud Billing: Cost by Service
  • GCP Cloud Billing: Overview Dashboard

• Fixed queries to use LEFT JOIN instead of INNER JOIN to ensure results are returned correctly. (#338)

What's new?

• Intelligent Assessment controls now also support OpenAI GPT-5 and Anthropic Claude Opus 4.1 models.
• All policy types across AWS, Azure, GCP, GitHub, Kubernetes, and ServiceNow mods now have an associated class. You will not notice any differences, and everything will continue to function smoothly as before.

Bug fixes

• Support for the contactable interface has been removed from all resource types except AWS Account, Azure Subscription, and GCP Project. As a result, the Turbot > Notifications > Email > CC > Tag Name policy can no longer be explicitly set for the affected resource types.

What's new?

• You can now configure public network access for registries. To get started, set the Azure > Container Registry > Registry > Public Network Access policy.

Control Types

• Azure > Container Registry > Registry > Public Network Access

Policy Types

• Azure > Container Registry > Registry > Public Network Access

Action Types

• Azure > Container Registry > Registry > Set Public Network Access

Bug fixes

• Various controls sometimes failed to evaluate their dependent policies correctly, which led to the controls failing without explicitly throwing errors. This issue has been fixed, and such controls will now work as expected.

What's new?

• You can now configure public network access for API management services. To get started, set the Azure > API Management > API Management Service > Public Network Access policy.

Control Types

• Azure > API Management > API Management Service > Public Network Access

Policy Types

• Azure > API Management > API Management Service > Public Network Access

Action Types

• Azure > API Management > API Management Service > Set Public Network Access

Enhancements

• Added column support_plan to the azure_kubernetes_cluster table. (#944) (Thanks @pdecat for the contribution!)

Bug fixes

• Fixed the common subscription_id column across all Azure tables to always fetch the value from the API, ensuring consistency and avoiding mismatches with subscription IDs set via connection config arguments or environment variables. (#948)

Enhancements

• Added physical_resource_id column as an optional qualifier to the aws_cloudformation_stack_resource table. (#2635)
• Added metadata column to aws_cloudformation_stack_resource table. (#2635)
• Added default rate limit configuration for AWS Lambda service tables. (#2561)

Bug fixes

• Fixed the aws_availability_zone table to respect ignore_error_codes and ignore_error_messages connection config arguments. (#2640)

What's new?

• You can now import GitHub Enterprise organizations in Guardrails. To get started, select GitHub Enterprise Organization from the Connect screen and configure details. We recommend upgrading TE to v5.53.2 for this change to take effect.
• Added support for class attribute for various policy types.

Policy Types

• GitHub > Config > Base URL

Resource Types

• AWS > IAM > Service Specific Credential

Control Types

• AWS > IAM > Service Specific Credential > Active
• AWS > IAM > Service Specific Credential > Approved
• AWS > IAM > Service Specific Credential > CMDB
• AWS > IAM > Service Specific Credential > Discovery

Policy Types

• AWS > IAM > Service Specific Credential > Active
• AWS > IAM > Service Specific Credential > Active > Age
• AWS > IAM > Service Specific Credential > Active > Last Modified
• AWS > IAM > Service Specific Credential > Approved
• AWS > IAM > Service Specific Credential > Approved > Custom
• AWS > IAM > Service Specific Credential > Approved > Usage
• AWS > IAM > Service Specific Credential > CMDB

Action Types

• AWS > IAM > Service Specific Credential > Delete
• AWS > IAM > Service Specific Credential > Delete from AWS
• AWS > IAM > Service Specific Credential > Router
• AWS > IAM > Service Specific Credential > Skip alarm for Active control
• AWS > IAM > Service Specific Credential > Skip alarm for Active control [90 days]
• AWS > IAM > Service Specific Credential > Skip alarm for Approved control
• AWS > IAM > Service Specific Credential > Skip alarm for Approved control [90 days]

Enhancements

• Added default rate limiter configurations for GCP Resource Manager, Compute Engine, Storage, Secret Manager, Logging, Pub/Sub, IAM, Cloud Functions, and Cloud DNS tables. (#779)

What's new?

• New tables added
  • azuread_cross_tenant_access_policy (#279)
  • azuread_directory_role_assignment (#265)
  • azuread_directory_role_definition (#265)
  • azuread_directory_role_eligibility_schedule_instance (#265)
  • azuread_directory_role_template (#265)

Dependencies

• Recompiled plugin with Go version 1.24. (#267)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#267)

Bug fixes

• Fixed pagination in datadog_security_monitoring_signal table. (#94) (Thanks @l-teles for the contribution!)

What's new?

• You can now configure Encryption at Rest for agents. To get started, set the AWS > Bedrock > Agent > Encryption at Rest > * policies.

Bug fixes

• The promptOverrideConfiguration.promptConfigurations attribute for agents has now been made dynamic to avoid unnecessary notifications in the activity tab.

Control Types

• AWS > Bedrock > Agent > Encryption at Rest

Policy Types

• AWS > Bedrock > Agent > Encryption at Rest
• AWS > Bedrock > Agent > Encryption at Rest > Customer Managed Key

Action Types

• AWS > Bedrock > Agent > Update Encryption at Rest

Bug fixes

• Fixed the fields column in the jira_issue table to consistently return all custom fields instead of null. (#185) (Thanks @l-teles for the contribution!)

Breaking changes

• jira_issue_comment table now requires an issue_id filter in the WHERE or JOIN clause. (#180)

Enhancements

• Updated the jira_issue table to use the latest Jira Cloud platform REST API. (#180)

Bug fixes

• Fixed the jira_issue_worklog table to correctly populate the issue_id column when provided as a query parameter. (#164)

Dependencies

• Recompiled plugin with Go version 1.24. (#175)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#175)

What's new?

• Added support for the DD_CLIENT_API_URL environment variable to configure the api_url connection argument. Please refer to the Configuration section for more details. (#92) (Thanks @l-teles for the contribution!)

Dependencies

• Recompiled plugin with Go version 1.24. (#89)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#89)

Deprecations

• crowdstrike_detection table has been deprecated due to missing API support. It will be removed in a future major release. Please use crowdstrike_alert table instead. (#57)

What's new?

• New tables added
  • crowdstrike_alert (#57)

Dependencies

• Recompiled plugin with github.com/crowdstrike/gofalcon with v0.16.0. (#57)
• Recompiled plugin with Go version 1.24. (#55)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#55)

What's new?

• Server
  • Added support for the class property in policy types.

Requirements

• Upgrade to 5.53.1 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• Fixed service title to CodeArtifact.

Resource Types

Renamed

• AWS > Code Artifact to AWS > CodeArtifact

Policy Types

Renamed

• AWS > Code Artifact > API Enabled to AWS > CodeArtifact > API Enabled
• AWS > Code Artifact > Enabled to AWS > CodeArtifact > Enabled
• AWS > Code Artifact > Permissions to AWS > CodeArtifact > Permissions
• AWS > Code Artifact > Permissions > Levels to AWS > CodeArtifact > Permissions > Levels
• AWS > Code Artifact > Permissions > Levels > Modifiers to AWS > CodeArtifact > Permissions > Levels > Modifiers
• AWS > Code Artifact > Permissions > Lockdown to AWS > CodeArtifact > Permissions > Lockdown
• AWS > Code Artifact > Permissions > Lockdown > API Boundary to AWS > CodeArtifact > Permissions > Lockdown > API Boundary

Bug fixes

• Removed the unnecessary AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-codeartifact policy.

Policy Types

Removed

• AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-codeartifact

What's new?

Resource Types

• AWS > Code Artifact

Policy Types

• AWS > Code Artifact > API Enabled
• AWS > Code Artifact > Enabled
• AWS > Code Artifact > Permissions
• AWS > Code Artifact > Permissions > Levels
• AWS > Code Artifact > Permissions > Levels > Modifiers
• AWS > Code Artifact > Permissions > Lockdown
• AWS > Code Artifact > Permissions > Lockdown > API Boundary
• AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-codeartifact
• AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-codeartifact
• AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-codeartifact
• AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-codeartifact

Custom tenant and organization member pages now allow for creation and management of service accounts. Service accounts are a specialized type of user designed for programmatic access to Turbot Pipes.

For more information, check out the tenant or organization member docs.

What's new?

• Server
  • Added support for the Storage token audience in the Azure credential resolver.

Bug fixes

• Server
  • Creating a new workspace now correctly adds the missing policy pack (aka) for Smart Folder resource types.
  • Numeric values in wildcard tag filters are now processed correctly.

Requirements

• Upgrade to 5.52.5 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• The Azure > Storage > Storage Account > CMDB no longer requires the listkeys permission on storage accounts to fetch details for Blob, Queue, and File Share services. We recommend upgrading TE to v5.52.5 for this change to take effect.

Bug fixes

• The AWS > S3 > Bucket > Encryption In Transit control previously required an Encryption in Transit policy statement with the Sid MustBeEncryptedInTransit and the condition "aws:SecureTransport": "false". This sometimes caused the control to incorrectly enter an alarm state when the bucket had the correct condition but a different Sid. The control has been updated to check only for the relevant Encryption in Transit condition, without explicitly requiring the Sid MustBeEncryptedInTransit.

What's new?

• New tables added
  • github_repository_discussion (#513)

Dependencies

• Recompiled plugin with Go version 1.24. (#509)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#509)

Enhancements

• Added DefaultRetryConfig to the plugin, enabling automatic retries on rate limit errors and improving overall query stability and performance. (#55)

Dependencies

• Recompiled plugin with Go version 1.24. (#52)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#52)

Enhancements

• Updated all top-level benchmark titles to include Kubernetes for clearer cloud provider identification. (#98)

Bug fixes

• Fixed the title of pod_volume_host_path control to correctly use Pod containers should not mount hostPath volumes. (#100)

v0.16.0 of the Terraform Provider for Pipes is now available.

What's new?

• Updated hashicorp/terraform-plugin-sdk to v2.37.0
• Updated go-kit to v1.3.0

Enhancements

• The following resources now support write-only configuration with new config_wo and config_wo_version arguments
  • resources/pipes_connection
  • resources/pipes_organization_connection
  • resources/pipes_tenant_connection
  • resources/pipes_workspace_connection
  • resources/pipes_organization_integration
  • resources/pipes_tenant_integration
  • resources/pipes_user_integration

Dependencies

• Recompiled plugin with github.com/grafana/grafana-openapi-client-go. (#47)
• Recompiled plugin with Go version 1.24. (#45)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#45)

What's new?

• New tables added
  • gcp_organization_audit_policy (#781)

What's new?

• New tables added: (#923)
  • azure_cost_by_resource_group_daily
  • azure_cost_by_resource_group_monthly
  • azure_cost_by_service_daily
  • azure_cost_by_service_monthly
  • azure_cost_usage

Enhancements

• Added default rate limiter configuration for the following tables: (#942)
  • azure_compute_virtual_machine
  • azure_key_vault_key
  • azure_key_vault_secret
  • azure_monitor_activity_log
  • azure_resource_group
  • azure_storage_account
  • azure_storage_blob
  • azure_subscription

Bug fixes

• The Azure > Storage > Storage Account > Data Protection > Soft Delete control will no longer attempt to apply soft delete settings if Guardrails does not have the required permissions to read or write soft delete data. Instead, it will transition to an invalid state.

Dependencies

• AWS plugin v1.23.0 or higher is now required. (#932)

Enhancements

• Added 42 new controls to the AWS Foundational Security Best Practices benchmark, expanding coverage across multiple AWS services, including DocumentDB, EC2, EFS, ELB, EMR, Glue, GuardDuty, Inspector, MQ, MSK, NetworkFirewall, Redshift, S3, SageMaker, Service Catalog, SSM, and Transfer. (#932)

Enhancements

• Updated all top-level benchmark titles to include GCP for clearer cloud provider identification. (#211)

Bug fixes

• Fixed compute_instance_oslogin_enabled and project_oslogin_enabled queries to correctly handle case-sensitive columns to ensure accurate compliance results. (#214)

What's new?

• Users can now manage trusted access for datasets. To get started, set the GCP > BigQuery > Dataset > Policy > Trusted Access > * policies.

Control Types

• GCP > BigQuery > Dataset > Policy
• GCP > BigQuery > Dataset > Policy > Trusted Access

Policy Types

• GCP > BigQuery > Dataset > Policy
• GCP > BigQuery > Dataset > Policy > Trusted Access
• GCP > BigQuery > Dataset > Policy > Trusted Access > Domains
• GCP > BigQuery > Dataset > Policy > Trusted Access > Groups
• GCP > BigQuery > Dataset > Policy > Trusted Access > Service Accounts
• GCP > BigQuery > Dataset > Policy > Trusted Access > Users

Action Types

• GCP > BigQuery > Dataset > Set Trusted Access

Bug fixes

• The Azure > PostgreSQL > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

What's new?

• New tables added (Thanks @Theo-Bouguet for the contribution!!)
  • cloudflare_custom_certificate (#180)
  • cloudflare_healthcheck (#181)
  • cloudflare_worker_script (#182)

What's new?

• Server
  • The Turbot > Notifications > CC > Tag policy is no longer checked; resource tags previously specified in Turbot > Notifications > CC > Tag > Name are now associated with the Account/CC policy instead of being evaluated independently.

Bug fixes

• Server
  • Policy settings now return results correctly for policies inside Policy Packs when you have valid access.

Requirements

• Upgrade to 5.52.4 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• You can now configure and manage project role bindings for service accounts. To get started, set the GCP > IAM > Service Account > Project Role Bindings > * policies.

Control Types

• GCP > IAM > Service Account > Project Role Bindings
• GCP > IAM > Service Account > Project Role Bindings > Approved

Policy Types

• GCP > IAM > Service Account > Project Role Bindings
• GCP > IAM > Service Account > Project Role Bindings > Approved
• GCP > IAM > Service Account > Project Role Bindings > Approved > Rules

Action Types

• GCP > IAM > Service Account > Update Project Role Bindings

Bug fixes

• The Azure > Azure > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > MySQL > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Monitor > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Data Factory > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Cosmos DB > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Automation > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug Fixes

• Fix issue where the database argument from a query resource was not respected. (#829)
• Fix issue where the default config path was not resolved correctly. The default is the mod-location, followed by the $POWERPIPE_INSTALL_DIR/config. Also the POWERPIPE_CONFIG_PATH environment variable was not respected. (#898)
• Fix issue where pie/donut charts were not rendering correctly on boolean values. (#433)

Dependencies

• Upgrade hashicorp/go-getter, sha.js and cipher-base to remediate critical and high vulnerabilities.

Bug fixes

• CIS controls previously entered an invalid or TBD state when the CMDB controls for associated resources were in a skipped or TBD state, even if the corresponding CIS policies were set to Skip. This issue has been resolved; such controls will now correctly transition to a skipped state.

Bug fixes

• CIS controls previously entered an invalid or TBD state when the CMDB controls for associated resources were in a skipped or TBD state, even if the corresponding CIS policies were set to Skip. This issue has been resolved; such controls will now correctly transition to a skipped state.

Bug fixes

• Removed the unsupported database variable from the mod to ensure compatibility with Pipes. (#8)

What's new?

• Server
  • Controls now wait for dependent policy values to finish processing, preventing redundant runs and duplicate execution attempts.

Bug fixes

• Server
  • Restrict smart folder and policy pack to create exception if there is a top level setting available.

Requirements

• Upgrade to 5.53.0 requires your workspace to be on 5.51.x
• TEF: 1.66.0
• TED: 1.9.1
• Mods:
  • @turbot/turbot: 5.55.0

Base images

• Alpine: 3.17.5
• Ubuntu: 22.04.3

What's new?

• You can now configure boot diagnostics for virtual machines. To get started, set the Azure > Compute > Virtual Machine > Update Boot Diagnostics policy.

Control Types

• Azure > Compute > Virtual Machine > Boot Diagnostics

Policy Types

• Azure > Compute > Virtual Machine > Boot Diagnostics
• Azure > Compute > Virtual Machine > Boot Diagnostics > Custom Storage Account

Action Types

• Azure > Compute > Virtual Machine > Update Boot Diagnostics

Bug fixes

• Web App and Function App metadata will now also include createdBy details in Guardrails CMDB.

Bug fixes

• Optimized the Azure > Active Directory > Directory > Discovery control to run more efficiently and prevent unnecessary resource updates, thereby reducing CMDB churn.

What's new?

• You can now configure organization restrictions for AWS Lambda function policies. To get started, configure the AWS > Lambda > Function > Policy > Trusted Access > Organization Restrictions policy accordingly.

Policy Types

• AWS > Lambda > Function > Policy > Trusted Access > Organization Restrictions
• AWS > Lambda > Trusted Organizations [Default]

• New tables added
  • hcloud_firewall (#47) (Thanks @kuang87 for the contribution!!)

Bug fixes

• Fixed the bound_to column of hcloud_image table to correctly return data instead of an error. (#48) (Thanks @kuang87 for the contribution!!)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

Bug fixes

• Fixed the example query in the plugin documentation to use the correct column name exec_output instead of output. (#63) (Thanks @pdecat for the contribution!!)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

What's new?

• New tables added
  • aws_ec2_spot_fleet_request (#2599)
  • aws_glue_ml_transform (#2610)
  • aws_inspector2_organization_configuration (#2608)
  • aws_mskconnect_connector (#2603)
  • aws_s3_directory_bucket (#2618)
  • aws_servicecatalog_portfolio_share (#2612)
  • aws_ssm_service_setting (#2611)
  • aws_transfer_connector (#2606)
  • aws_vpc_block_public_access_options (#2595)

Enhancements

• Added columns tags and tags_src to aws_ec2_load_balancer_listener_rule table. (#2625)
• Added column multi_az to aws_redshift_cluster table. (#2617)

Bug fixes

• Fixed the aws_cloudformation_stack_resource table to correctly return data instead of an error. (#2622)

Dependencies

• AWS plugin v1.22.0 or higher is now required. (#930)

Enhancements

• Added 47 new controls to the AWS Foundational Security Best Practices benchmark, expanding coverage across multiple AWS services, including AppSync, Athena, CodeBuild, Cognito, Data Firehose, DataSync, DMS, EC2, EFS, FSx, RDS, Kinesis, KMS, Redshift Serverless, SQS, SNS, Transfer, WorkSpaces, SageMaker, and DynamoDB. (#930)

Preview

All of the following resource types, policy types, and control types are currently in preview and may change in future releases.

• Resource Types:

  • Turbot > Rollout
  • Turbot > Guardrail

• Policy Types:

  • Turbot > Notifications > Email > Rollout > Check Template
  • Turbot > Notifications > Email > Rollout > Check Template > Warning Body
  • Turbot > Notifications > Email > Rollout > Check Template > Warning Subject
  • Turbot > Notifications > Email > Rollout > Check Template > Welcome Body
  • Turbot > Notifications > Email > Rollout > Check Template > Welcome Subject
  • Turbot > Notifications > Email > Rollout > Detach Template
  • Turbot > Notifications > Email > Rollout > Detach Template > Warning Body
  • Turbot > Notifications > Email > Rollout > Detach Template > Warning Subject
  • Turbot > Notifications > Email > Rollout > Enforce Template
  • Turbot > Notifications > Email > Rollout > Enforce Template > Warning Body
  • Turbot > Notifications > Email > Rollout > Enforce Template > Warning Subject
  • Turbot > Notifications > Email > Rollout > Enforce Template > Welcome Body
  • Turbot > Notifications > Email > Rollout > Enforce Template > Welcome Subject
  • Turbot > Notifications > Email > Rollout > Preview Template
  • Turbot > Notifications > Email > Rollout > Preview Template > Warning Body
  • Turbot > Notifications > Email > Rollout > Preview Template > Warning Subject
  • Turbot > Notifications > Email > Rollout > Preview Template > Welcome Subject
  • Turbot > Notifications > Email > Rollout > Preview Template > Welcome Body

• Control types

  • Turbot > Rollout > Events

Bug fixes

• The AWS > EC2 > Target Group > Discovery control could previously enter an error state when upserting a target group whose parent load balancer was not available in CMDB. We have improved this process so that all target groups are now upserted under a region, ensuring better consistency and reliability. Existing target groups under load balancers will also be moved under their respective regions automatically.

What's new?

• New tables added: (Thanks @xybytes for the new plugin!)
  • sentinelone_activity
  • sentinelone_agent
  • sentinelone_alert
  • sentinelone_application
  • sentinelone_cve
  • sentinelone_note
  • sentinelone_threat
  • sentinelone_timeline

What's new?

• New tables added
  • okta_authenticator (#182) (Thanks @ameyer117 for the contribution!!)

Bug fixes

• Fixed the okta_network_zone table to correctly return data instead of an error. (#160)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

What's new?

• You can now configure soft delete for file shares in storage accounts. To get started, configure the Azure > Storage > Storage Account > Data Protection > Soft Delete > File Shares > * policies accordingly.
• Delete retention policy details for file share will now be available in CMDB for Storage Accounts.

Policy Types

• Azure > Storage > Storage Account > Data Protection > Soft Delete > File Shares
• Azure > Storage > Storage Account > Data Protection > Soft Delete > File Shares > Retention Days

Bug fixes

• The Azure > Relay > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Recovery Service > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Key Vault > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > DNS > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Databricks > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

What's new?

• New tables added
  • bigfix_action
  • bigfix_analysis
  • bigfix_computer
  • bigfix_fixlet
  • bigfix_property
  • bigfix_role
  • bigfix_site
  • bigfix_task

Bug fixes

• The Azure > Synapse Analytics > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > SQL Virtual Machine Service > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > SignalR Service > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Service Bus > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The Azure > Network > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.
• The Azure > Network > Bastion Host > Discovery control previously could inadvertently upsert bastion hosts under incorrect resource groups. This issue has been resolved, and the control now upserts bastion hosts more reliably and consistently.

Bug fixes

• The Azure > Log Analytics > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• The AWS > Backup > Recovery Point > CMDB control previously ran every minute if a recovery point’s CalculatedLifecycle.DeleteAt timestamp was already in the past. It now deletes expired recovery points and no longer re-runs automatically when the next tick is also in the past.

Breaking changes

• Configuration Changes

  • The plugin configuration format has changed to support the REST API.
  • You must now configure either OAuth client credentials or an access token for authentication. Please refer to the Configuration section for additional information.

• API Migration

  • Migrated from Vanta's deprecated GraphQL API to the new REST API.
  • Queries, dashboards, and benchmarks that reference removed columns (listed below) will fail until updated.

• Removed Columns

  vanta_computer

  • agent_version
  • hostname
  • host_identifier
  • last_ping
  • num_browser_extensions
  • endpoint_applications
  • installed_av_programs
  • installed_password_managers
  • unsupported_reasons
  • organization_name

  vanta_evidence

  • title
  • evidence_request_id
  • category
  • uid
  • app_upload_enabled
  • restricted
  • dismissed_status
  • renewal_metadata
  • organization_name

  vanta_group

  • checklist
  • embedded_idp_group
  • organization_name

  vanta_integration

  • description
  • application_url
  • installation_url
  • logo_slug_id
  • credentials
  • integration_categories
  • service_categories
  • organization_name

  vanta_monitor

  • controls
  • organization_name

  vanta_policy

  • policy_type
  • created_at
  • updated_at
  • employee_acceptance_test_id
  • num_users
  • num_users_accepted
  • source
  • acceptance_controls
  • approver
  • standards
  • uploaded_doc
  • uploader
  • organization_name

  vanta_user

  • is_from_scan
  • needs_employee_digest_reminder
  • is_not_human

  vanta_vendor

  • vendor_risk_locked
  • owner
  • risk_profile
  • organization_name

• Migration Notes

  • Reason for change: Vanta has ended GraphQL API support; the REST API is now the only supported interface.
  • Action required:
    • Update SQL queries to remove or replace references to removed columns.
    • Review table documentation for updated field availability.

Deprecations

• The cloudflare_firewall_rule table has been deprecated. Please use cloudflare_ruleset table instead. (#166)
• The following columns have been deprecated due to lack of API support and will be fully removed in the future major release: (#166)
  • cloudflare_account_member
    • code
  • cloudflare_dns_record
    • locked
  • cloudflare_logpush_job
    • frequency
    • logpull_options
  • cloudflare_user
    • api_key
  • cloudflare_zone
    • plan_pending
    • settings

What's new?

• New tables added
  • cloudflare_custom_page (#176) (Thanks @Theo-Bouguet for the contribution!!)
  • cloudflare_logpush_job (#177) (Thanks @Theo-Bouguet for the contribution!!)
  • cloudflare_notification (#179) (Thanks @Theo-Bouguet for the contribution!!)
  • cloudflare_ruleset (#166)
  • cloudflare_zone_setting (#170)
  • cloudflare_zone (#170)

Enhancements

• Added the following new columns to the cloudflare_zone table: (#174) (Thanks @Theo-Bouguet for the contribution!!)
  • smart_tiered_cache
  • regional_tiered_cache
  • argo_tiered_caching
  • argo_smart_routing
  • bot_management
  • security_txt
• Added columns account_name and health to the cloudflare_load_balancer_pool table. (#175) (Thanks @Theo-Bouguet for the contribution!!)
• Added max_request_timeout and max_retries config arguments to effectively manage the plugin's rate limiting errors. (#166)

Bug fixes

• Fixed the ttl column in cloudflare_dns_record table to correctly return data instead of null. (#173) (Thanks @Theo-Bouguet for the contribution!!)

Dependencies

• Recompiled plugin with cloudflare-go v4.2.0. (#166)
• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

What's new?

• Added support for tags attribute in the turbot_policy_pack resource. This will allow users to manage tags on policy packs.

Minimum version requirements:

TE v5.52.3

What's new?

• Server
  • Added support for tags in policy packs, making it easier to organize and filter them.

Note

Upgrade to 5.52.3 requires your workspace to be on 5.51.x; direct upgrades from older versions (e.g., 5.49.x) will fail.

Requirements

• TEF: 1.66.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The GCP > Turbot > Event Handlers > Pub/Sub > Source policy could previously evaluate incorrectly immediately after a GCP Project import if the Project CMDB data was not up to date. The policy now checks the GCP > Project > CMDB control and evaluates only when that control has run successfully and is in an OK state, preventing incorrect results and improving clarity.
• Event Poller controls now display improved help messages when the API used to fetch events returns an error, instead of only logging the errors under Activities.

Action Types Removed

• GCP > Folder > Event Poller
• GCP > Organization > Event Poller
• GCP > Project > Event Poller

Bug fixes

• The Azure > Compute > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Bug fixes

• We have updated the internal GraphQL queries for the AWS > PCI v3.2.1 > EC2 > 3 Unused EC2 security groups should be removed control to improve performance when evaluating the control’s outcome. There are no visible changes, but things will run smoother and faster than before.

Note: We recommend updating the @turbot/aws-ec2 mod to v5.46.2 for proper functionality.

Policy Types

• AWS > PCI v3.2.1 > EC2
• AWS > PCI v3.2.1 > EC2 > 3 Unused EC2 security groups should be removed

Bug fixes

• Added additional metadata for associated security groups to the CMDB data for network interfaces for internal performance improvements.

What's new?

• New tables added
  • aws_appsync_api (#2591)
  • aws_codebuild_report_group (#2589)
  • aws_connect_instance_attribute (#2592)
  • aws_connect_instance (#2592)
  • aws_datasync_task (#2590)
  • aws_vpc_security_group_vpc_association (#2597)

Enhancements

• Added api_cache column to aws_appsync_graphql_api table. (#2591)

What's new?

• New tables added: (#80)
  • gcp_billing_report

Enhancements

• Updated all top-level benchmark titles to include AWS for clearer cloud provider identification. (#924)
• Added database variable to configure the Steampipe database connection string, defaulting to connection.steampipe.default. (#926)
• Added new automated query implementations for the following CIS controls: (#927)
  • cis_v120_1_19
  • cis_v130_1_18
  • cis_v140_1_18
  • cis_v150_1_18
  • cis_v200_1_18
  • cis_v300_1_18
  • cis_v400_1_18
  • cis_v500_1_17
• Added ec2_instance_using_iam_instance_role and iam_root_user_account_console_access_mfa_enabled queries to the All AWS Compliance Controls benchmark. (#927)

v0.15.3 of the Terraform Provider for Pipes is now available.

What's new?

• Updated pipes-sdk-go to v0.15.0.
• New Resource: pipes_tenant_settings

Enhancements

• resources/pipes_connection: Added attributes status, last_error_at, last_error_process_id, last_successful_update_at, last_successful_update_process_id, last_update_attempt_at, last_update_attempt_process_id.
• resources/pipes_organization_connection: Added attributes status, last_error_at, last_error_process_id, last_successful_update_at, last_successful_update_process_id, last_update_attempt_at, last_update_attempt_process_id.
• resources/pipes_tenant: Added attribute token_min_issued_at.
• resources/pipes_tenant_connection: Added attributes status, last_error_at, last_error_process_id, last_successful_update_at, last_successful_update_process_id, last_update_attempt_at, last_update_attempt_process_id.
• resources/pipes_workspace_connection: Added attributes status, last_error_at, last_error_process_id, last_successful_update_at, last_successful_update_process_id, last_update_attempt_at, last_update_attempt_process_id.

v0.15.0 of the Pipes SDK Go is now available.

Enhancements

• Added extra attributes to Connection to support Status, LastErrorAt, LastErrorProcessId, LastSuccessfulUpdateAt, LastSuccessfulUpdateProcessId, LastUpdateAttemptAt and LastUpdateAttemptProcessId to track the connection status and last update attempts.
• Added extra attributes to WorkspaceConnection to support Status, LastErrorAt, LastErrorProcessId, LastSuccessfulUpdateAt, LastSuccessfulUpdateProcessId, LastUpdateAttemptAt and LastUpdateAttemptProcessId to track the connection status and last update attempts.
• Added ConnectionId attribute to SpProcess to track the connection associated with a process.
• Added TokenMinIssuedAt attribute to Tenant to determine the time after which tokens will be accepted for this tenant.
• Added extra attributes to TenantSettings to support MaxTokenExpiration, CliSessionTimeout, ConsoleSessionTimeout and PostgresEnabled to manage tenant settings around timeouts, tokens and direct database access.
• Added extra attributes to Token to support CreatedBy, CreatedById, UpdatedBy, UpdatedById, ExpiresAt, Title, Description and TokenType to provide more context and control over tokens.
• Added BillingMode attribute to UsageMetric to denote the billing mode for the metric.

What's new?

• Added ConnectionStatus enum to represent the status of a connection.
• Added PostgresEndpointState enum to represent the state of the Postgres endpoint.
• Added UsageBillingModeType enum to represent the billing mode for usage metrics.

What's new?

• Track and manage delivery, delivery destination, delivery source, and destination resources in Guardrails.

Resource Types

• AWS > Logs > Delivery
• AWS > Logs > Delivery Destination
• AWS > Logs > Delivery Source
• AWS > Logs > Destination

Control Types

• AWS > Logs > Delivery > Active
• AWS > Logs > Delivery > CMDB
• AWS > Logs > Delivery > Discovery
• AWS > Logs > Delivery > Tags
• AWS > Logs > Delivery Destination > Active
• AWS > Logs > Delivery Destination > CMDB
• AWS > Logs > Delivery Destination > Discovery
• AWS > Logs > Delivery Destination > Tags
• AWS > Logs > Delivery Source > Active
• AWS > Logs > Delivery Source > CMDB
• AWS > Logs > Delivery Source > Discovery
• AWS > Logs > Delivery Source > Tags
• AWS > Logs > Destination > Active
• AWS > Logs > Destination > CMDB
• AWS > Logs > Destination > Discovery

Policy Types

• AWS > Logs > Delivery > Active
• AWS > Logs > Delivery > Active > Age
• AWS > Logs > Delivery > Active > Budget
• AWS > Logs > Delivery > Active > Last Modified
• AWS > Logs > Delivery > CMDB
• AWS > Logs > Delivery > Regions
• AWS > Logs > Delivery > Tags
• AWS > Logs > Delivery > Tags > Template
• AWS > Logs > Delivery Destination > Active
• AWS > Logs > Delivery Destination > Active > Age
• AWS > Logs > Delivery Destination > Active > Budget
• AWS > Logs > Delivery Destination > Active > Last Modified
• AWS > Logs > Delivery Destination > CMDB
• AWS > Logs > Delivery Destination > Regions
• AWS > Logs > Delivery Destination > Tags
• AWS > Logs > Delivery Destination > Tags > Template
• AWS > Logs > Delivery Source > Active
• AWS > Logs > Delivery Source > Active > Age
• AWS > Logs > Delivery Source > Active > Budget
• AWS > Logs > Delivery Source > Active > Last Modified
• AWS > Logs > Delivery Source > CMDB
• AWS > Logs > Delivery Source > Regions
• AWS > Logs > Delivery Source > Tags
• AWS > Logs > Delivery Source > Tags > Template
• AWS > Logs > Destination > Active
• AWS > Logs > Destination > Active > Age
• AWS > Logs > Destination > Active > Budget
• AWS > Logs > Destination > Active > Last Modified
• AWS > Logs > Destination > CMDB
• AWS > Logs > Destination > Regions

Action Types

• AWS > Logs > Delivery > Delete
• AWS > Logs > Delivery > Router
• AWS > Logs > Delivery > Update Tags
• AWS > Logs > Delivery Destination > Delete
• AWS > Logs > Delivery Destination > Router
• AWS > Logs > Delivery Destination > Update Tags
• AWS > Logs > Delivery Source > Delete
• AWS > Logs > Delivery Source > Router
• AWS > Logs > Delivery Source > Update Tags
• AWS > Logs > Destination > Delete
• AWS > Logs > Destination > Router

Bug fixes

• Guardrails stack controls would fail to claim any existing OpenID Connect provider if the OpenID Connect provider was available in Guardrails CMDB and the stack's Source policy included the Terraform plan for the OpenID Connect provider. This is fixed and stack control will now be able to claim existing OpenID Connect providers correctly.

Enterprise plan now has tenant settings allowing owners to control direct access to Steampipe PostgreSQL endpoints.

For more information, check out the docs

Users can now create up to five tokens. You can also set an expiration for each token and optionally add a title to make them easier to identify in your token list.

For enterprise plan customers, we've introduced a new Maximum Token Expiration tenant setting. This lets you control the maximum lifespan of tokens created within your tenant.

For more information, check out the docs

What's new?

• Server
  • Added retry mechanism for Mod expired URL errors.

Bug Fixes

• Server

  • Turbot > Workspace > Background Tasks now ignore deleted resources.
  • Resolved an issue where the worker could crash while processing errors.
  • Addressed a cleanup script bug that was incorrectly removing active Lambda version aliases and associated topics. The script now deletes only unused resources.

• UI

  • Saving in the calculated policy editor is now prevented if there is an error.
  • Alignment of Note in the policy tab is now consistent across all entries.
  • Multi-step queries in the calculated policy editor are now displayed correctly as separate steps.
  • Policy packs no longer show a blank page when the description is missing.
  • Policy Pack details screen should not show summary when AI summary is disabled.

Note

Upgrade to 5.52.2 requires your workspace to be on 5.51.x; direct upgrades from older versions (e.g., 5.49.x) will fail.

Requirements

• TEF: 1.66.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

Bug fixes

• The Azure > Storage > Storage Account > CMDB control previously encountered errors with Premium storage accounts when attempting to access unsupported Table services. This has now been resolved.

Dependencies

• Azure plugin v1.6.0 or higher is now required.

Enhancements

• Added the following controls to All Azure Compliance Controls: (#328)
  • databricks_workspace_diagnostic_log_delivery_configured
  • databricks_workspace_subnet_with_nsg_configured
  • keyvault_key_automatic_rotation_enabled
  • network_security_group_https_port_80_443_access_restricted
  • storage_account_blob_and_container_soft_delete_enabled
  • storage_account_file_share_smb_channel_encryption_aes_256_gcm
  • storage_account_file_share_smb_protocol_version_3_1_1
• Added new automated query implementations for the following CIS controls: (#328)
  • cis_v400_10_1_2
  • cis_v400_10_1_3
  • cis_v400_3_1_7
  • cis_v400_6_2_1
  • cis_v400_7_1_1_7
  • cis_v400_9_3_9
• Updated all top-level benchmark titles to include Azure for clearer cloud provider identification. (#334)

Bug fixes

• Fixed several CIS controls to use the correct Azure service tags. (#328)

What's new?

• Turbot > Workspace > Background Tasks will no longer go into an error state if the resource does not exist.

Requirements

• TE: 5.35.4

What's new?

• Users can now create and manage cloud resources using Terraform 1.x via Guardrails, fully leveraging all features available in this version. To get started, set the Stack [Native] > * policies.

Bug fixes

• The Azure > Storage > Storage Account > CMDB control now stores details of API calls that fail due to insufficient permissions granted to Guardrails' service principal. This enables Guardrails to mark controls that depend on the respective data as invalid, rather than enforcing settings unnecessarily.

Control Types

• Azure > Storage > Storage Account > Stack [Native]

Policy Types

• Azure > Storage > Storage Account > Stack [Native]
• Azure > Storage > Storage Account > Stack [Native] > Drift Detection
• Azure > Storage > Storage Account > Stack [Native] > Drift Detection > Interval
• Azure > Storage > Storage Account > Stack [Native] > Modifier
• Azure > Storage > Storage Account > Stack [Native] > Secret Variables
• Azure > Storage > Storage Account > Stack [Native] > Source
• Azure > Storage > Storage Account > Stack [Native] > Timeout
• Azure > Storage > Storage Account > Stack [Native] > Variables
• Azure > Storage > Storage Account > Stack [Native] > Version

What's new?

• Users can now create and manage cloud resources using Terraform 1.x via Guardrails, fully leveraging all features available in this version. To get started, set the Stack [Native] > * policies.

Control Types

• Azure > Key Vault > Vault > Stack [Native]

Policy Types

• Azure > Key Vault > Vault > Stack [Native]
• Azure > Key Vault > Vault > Stack [Native] > Drift Detection
• Azure > Key Vault > Vault > Stack [Native] > Drift Detection > Interval
• Azure > Key Vault > Vault > Stack [Native] > Modifier
• Azure > Key Vault > Vault > Stack [Native] > Secret Variables
• Azure > Key Vault > Vault > Stack [Native] > Source
• Azure > Key Vault > Vault > Stack [Native] > Timeout
• Azure > Key Vault > Vault > Stack [Native] > Variables
• Azure > Key Vault > Vault > Stack [Native] > Version

Bug fixes

• Fixed invalid CMDB references for the Zone, Region, Multi-Region, and Global Region resource types that caused the Relationships and Import Set controls to enter an error state. The controls now run reliably without errors.

Bug fixes

• The AWS > Account > Budget > Budget control previously reran unnecessarily in workspaces with Turbot > Notifications enabled. This issue has been resolved, and the control now runs as expected.

Bug fixes

• Fixed the compliance queries to prevent ambiguous tag column references when joining multiple Azure tables. (#330)

Bug fixes

• Fixed an issue in the turbot_file resource where removed keys in the content field were incorrectly sent as "key": null in the update payload. The provider now sends the content exactly as specified in the Terraform configuration, ensuring that only the intended keys appear in the Turbot console.

What's new?

• Added CPU and memory settings for the PgBouncer task, giving you more control over resource allocation.

What's new?

• You can now configure cross-tenant replication for storage accounts. To get started, set the Azure > Storage > Storage Account > Cross-Tenant Replication policy.

Control Types

• Azure > Storage > Storage Account > Cross-Tenant Replication

Policy Types

• Azure > Storage > Storage Account > Cross-Tenant Replication

Action Types

• Azure > Storage > Storage Account > Set Cross-Tenant Replication

Bug fixes

• Guardrails previously failed to delete Azure > SQL > * resources due to limitations in the internal Node SDK package version. This issue has now been resolved, and the resources will be deleted as expected.
• The Azure > SQL > * tags controls will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

Enhancements

• Added diagnostic_settings column to the azure_databricks_workspace table. (#930)
• Added file_services column to the azure_storage_account table. (#933)
• Added rotation_policy column to the azure_key_vault_key table. (#931)

What's new?

• New tables added
  • github_security_log

Whats new

• Compiled with Go 1.24.

Bug Fixes

• Fix issue where the --where arg was not correctly filtering the benchmarks/controls when JSON path expressions were passed. (#740)
• Fix error handling for JSON output/export incase of database failures. (#665)

Dependencies

• Upgrade form-data and go-viper/mapstructure/v2 packages to remediate critical and high vulnerabilities.

What's new?

• You can now manage role bindings for service accounts. To get started, set the GCP > IAM > Service Account > Role Bindings > * policies.

Control Types

• GCP > IAM > Service Account > Role Bindings
• GCP > IAM > Service Account > Role Bindings > Approved

Policy Types

• GCP > IAM > Service Account > Role Bindings
• GCP > IAM > Service Account > Role Bindings > Approved
• GCP > IAM > Service Account > Role Bindings > Approved > Rules

Action Types

• GCP > IAM > Service Account > Update Role Bindings

Breaking changes

• Renamed the following controls to align with their focus on classic logging for the respective service types: (#322)
  • storage_account_blobs_logging_enabled to storage_account_blob_service_classic_logging_enabled
  • storage_account_queues_logging_enabled to storage_account_queue_service_classic_logging_enabled
  • storage_account_tables_logging_enabled to storage_account_table_service_classic_logging_enabled

Dependencies

• Azure plugin v1.5.1 or higher is now required.

Enhancements

• Added new automated queries for the following CIS controls: (#323)
  • cis_v150_3_3
  • cis_v200_3_3
  • cis_v200_5_1_7
  • cis_v210_5_1_6
  • cis_v300_4_3
  • cis_v300_6_1_6
  • cis_v400_10_3_1_1
  • cis_v400_7_1_1_6
• Added appservice_web_app_diagnostic_log_category_http_log_enabled and storage_account_key_rotation_reminder_enabled controls to the All Controls benchmark. (#323)

Bug fixes

• Fixed keyvault_logging_enabled query to correctly verify logging for Azure Key Vaults. (#320)

Bug fixes

• In the previous version, an issue was introduced in the CMDB control for Azure > Storage > Storage Account that prevented the retrieval of diagnostic settings. This has now been resolved, and the control successfully processes diagnostic settings for all storage services, including Blob, Table, Queue, and the primary account.

What's new?

• Compiled with Go 1.24.

Dependencies

• Upgrade golang.org/x/oauth2, form-data and vite packages to remediate critical vulnerabilities.

What's new?

• You can now manage role bindings for project users. To get started, set the GCP > IAM > Project User > Role Bindings > * policies.

Control Types

• GCP > IAM > Project User > Role Bindings
• GCP > IAM > Project User > Role Bindings > Approved

Policy Types

• GCP > IAM > Project User > Role Bindings
• GCP > IAM > Project User > Role Bindings > Approved
• GCP > IAM > Project User > Role Bindings > Approved > Rules

Action Types

• GCP > IAM > Project User > Update Role Bindings

What's new?

• Network rule set details will now be available in CMDB for namespaces.

What's new?

Control Types

• Azure > CIS v3.0
• Azure > CIS v3.0 > 02 - Identity
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA)
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.01 - Ensure Security Defaults is enabled on Microsoft Entra ID
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.02 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.03 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.04 - Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.01 - Ensure Trusted Locations Are Defined
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.02 - Ensure that an exclusionary Geographic Access Policy is considered
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.03 - Ensure that an exclusionary Device code flow policy is considered
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.04 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.05 - Ensure that A Multi-factor Authentication Policy Exists for All Users
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.06 - Ensure Multi-factor Authentication is Required for Risky Sign-ins
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.07 - Ensure Multi-factor Authentication is Required for Windows Azure Service Management API
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.08 - Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals
• Azure > CIS v3.0 > 02 - Identity > 02.03 - Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.04 - Ensure Guest Users Are Reviewed on a Regular Basis
• Azure > CIS v3.0 > 02 - Identity > 02.05 - Ensure That 'Number of methods required to reset' is set to '2'
• Azure > CIS v3.0 > 02 - Identity > 02.06 - Ensure that account 'Lockout Threshold' is less than or equal to '10'
• Azure > CIS v3.0 > 02 - Identity > 02.07 - Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'
• Azure > CIS v3.0 > 02 - Identity > 02.08 - Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization
• Azure > CIS v3.0 > 02 - Identity > 02.09 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
• Azure > CIS v3.0 > 02 - Identity > 02.10 - Ensure that 'Notify users on password resets?' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.11 - Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.12 - Ensure User consent for applications is set to Do not allow user consent
• Azure > CIS v3.0 > 02 - Identity > 02.13 - Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
• Azure > CIS v3.0 > 02 - Identity > 02.14 - Ensure That 'Users Can Register Applications' Is Set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.15 - Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
• Azure > CIS v3.0 > 02 - Identity > 02.16 - Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
• Azure > CIS v3.0 > 02 - Identity > 02.17 - Ensure That 'Restrict access to Microsoft Entra admin center' is Set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.18 - Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.19 - Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.20 - Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.21 - Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.22 - Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.23 - Ensure That No Custom Subscription Administrator Roles Exist
• Azure > CIS v3.0 > 02 - Identity > 02.24 - Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
• Azure > CIS v3.0 > 02 - Identity > 02.25 - Ensure That 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' Is Set To 'Permit no one'
• Azure > CIS v3.0 > 02 - Identity > 02.26 - Ensure fewer than 5 users have global administrator assignment
• Azure > CIS v3.0 > 03 - Security
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM)
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM) > 03.01.01.01 - Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM) > 03.01.01.02 - Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.02 - Defender Plan APIs
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.01 - Ensure That Microsoft Defender for Servers Is Set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.02 - Ensure that 'Vulnerability assessment for machines' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.03 - Ensure that 'Endpoint protection' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.04 - Ensure that 'Agentless scanning for machines' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.05 - Ensure that 'File Integrity Monitoring' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.01 - Ensure That Microsoft Defender for Containers Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.02 - Ensure that 'Agentless discovery for Kubernetes' component status 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.03 - Ensure that 'Agentless container vulnerability assessment' component status is 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.05 - Defender Plan - Storage
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.05 - Defender Plan - Storage > 03.01.05.01 - Ensure That Microsoft Defender for Storage Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.06 - Defender Plan - App Service
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.06 - Defender Plan - App Service > 03.01.06.01 - Ensure That Microsoft Defender for App Services Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.01 - Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.02 - Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.03 - Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.04 - Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.08 - Defender Plan - Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.08 - Defender Plan - Key Vault > 03.01.08.01 - Ensure That Microsoft Defender for Key Vault Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.09 - Defender Plan - Resource Manager
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.09 - Defender Plan - Resource Manager > 03.01.09.01 - Ensure That Microsoft Defender for Resource Manager Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.10 - Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.11 - Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.12 - Ensure That 'All users with the following roles' is set to 'Owner'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.13 - Ensure 'Additional email addresses' is Configured with a Security Contact Email
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.14 - Ensure That 'Notify about alerts with the following severity' is Set to 'High'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.15 - Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.16 - [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.02 - Microsoft Defender for IoT
• Azure > CIS v3.0 > 03 - Security > 03.02 - Microsoft Defender for IoT > 03.02.01 - Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.01 - Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.02 - Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.03 - Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.04 - Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.05 - Ensure the Key Vault is Recoverable
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.06 - Enable Role Based Access Control for Azure Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.07 - Ensure that Private Endpoints are Used for Azure Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.08 - Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
• Azure > CIS v3.0 > 04 - Storage Accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.01 - Ensure that 'Secure transfer required' is set to 'Enabled'
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.02 - Ensure that Enable Infrastructure Encryption for Each Storage Account in Azure Storage is Set to enabled
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.03 - Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.04 - Ensure that Storage Account Access Keys are Periodically Regenerated
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.05 - Ensure that Shared Access Signature Tokens Expire Within an Hour
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.06 - Ensure that 'Public Network Access' is 'Disabled' for storage accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.07 - Ensure Default Network Access Rule for Storage Accounts is Set to Deny
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.08 - Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.09 - Ensure Private Endpoints are used to access Storage Accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.10 - Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.11 - Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK)
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.12 - Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.13 - Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.14 - Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.15 - Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.16 - Ensure 'Cross Tenant Replication' is not enabled
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.17 - Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
• Azure > CIS v3.0 > 05 - Database Services
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.01 - Ensure that 'Auditing' is set to 'On'
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.02 - Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.03 - Ensure SQL Server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.04 - Ensure that Microsoft Entra authentication is Configured for SQL Servers
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.05 - Ensure that 'Data encryption' is set to 'On' on a SQL Database
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.06 - Ensure that 'Auditing' Retention is 'greater than 90 days'
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.07 - Ensure Public Network Access is Disabled
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.01 - Ensure server parameter 'require_secure_transport' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.02 - Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.03 - Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.04 - Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.05 - Ensure 'Allow public access from any Azure service within Azure to this server' for PostgreSQL flexible server is disabled
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.06 - [LEGACY] Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.07 - [LEGACY] Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL single server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.08 - [LEGACY] Ensure 'Infrastructure double encryption' for PostgreSQL single server is 'Enabled'
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.01 - Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.02 - Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.03 - Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.04 - Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.01 - Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.02 - Ensure That Private Endpoints Are Used Where Possible
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.03 - Use Entra ID Client Authentication and Azure RBAC where possible
• Azure > CIS v3.0 > 06 - Logging & Monitoring
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.01 - Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.02 - Ensure Diagnostic Setting captures appropriate categories
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.03 - Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK)
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.04 - Ensure that logging for Azure Key Vault is 'Enabled'
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.05 - Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.06 - Ensure that logging for Azure AppService 'HTTP logs' is enabled
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.01 - Ensure that Activity Log Alert exists for Create Policy Assignment
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.02 - Ensure that Activity Log Alert exists for Delete Policy Assignment
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.03 - Ensure that Activity Log Alert exists for Create or Update Network Security Group
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.04 - Ensure that Activity Log Alert exists for Delete Network Security Group
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.05 - Ensure that Activity Log Alert exists for Create or Update Security Solution
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.06 - Ensure that Activity Log Alert exists for Delete Security Solution
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.07 - Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.08 - Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.09 - Ensure that Activity Log Alert exists for Create or Update Public IP Address rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.10 - Ensure that Activity Log Alert exists for Delete Public IP Address rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.03 - Configuring Application Insights
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.03 - Configuring Application Insights > 06.03.01 - Ensure Application Insights are Configured
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
• Azure > CIS v3.0 > 07 - Networking
• Azure > CIS v3.0 > 07 - Networking > 07.01 - Ensure that RDP access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.02 - Ensure that SSH access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.03 - Ensure that UDP access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.04 - Ensure that HTTP(S) access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.05 - Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
• Azure > CIS v3.0 > 07 - Networking > 07.06 - Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use
• Azure > CIS v3.0 > 07 - Networking > 07.07 - Ensure that Public IP addresses are evaluated on a periodic basis
• Azure > CIS v3.0 > 08 - Virtual Machines
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.01 - Ensure an Azure Bastion Host Exists
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.02 - Ensure Virtual Machines are utilizing Managed Disks
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.03 - Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.04 - Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.05 - Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks'
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.06 - Ensure that 'Enable Data Access Authentication Mode' is 'Checked'
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.07 - Ensure that Only Approved Extensions Are Installed
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.08 - Ensure that Endpoint Protection for all Virtual Machines is installed
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.09 - [Legacy] Ensure that VHDs are Encrypted
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.10 - Ensure only MFA enabled identities can access privileged Virtual Machine
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.11 - Ensure Trusted Launch is enabled on Virtual Machines
• Azure > CIS v3.0 > 09 - Application Services
• Azure > CIS v3.0 > 09 - Application Services > 09.01 - Ensure 'HTTPS Only' is set to On
• Azure > CIS v3.0 > 09 - Application Services > 09.02 - Ensure App Service Authentication is set up for apps in Azure App Service
• Azure > CIS v3.0 > 09 - Application Services > 09.03 - Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
• Azure > CIS v3.0 > 09 - Application Services > 09.04 - Ensure Web App is using the latest version of TLS encryption
• Azure > CIS v3.0 > 09 - Application Services > 09.05 - Ensure that Register with Entra ID is enabled on App Service
• Azure > CIS v3.0 > 09 - Application Services > 09.06 - Ensure that 'Basic Authentication' is 'Disabled'
• Azure > CIS v3.0 > 09 - Application Services > 09.07 - Ensure that 'PHP version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.08 - Ensure that 'Python version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.09 - Ensure that 'Java version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.10 - Ensure that 'HTTP20enabled' is set to 'true' (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.11 - Ensure Azure Key Vaults are Used to Store Secrets
• Azure > CIS v3.0 > 09 - Application Services > 09.12 - Ensure that 'Remote debugging' is set to 'Off'
• Azure > CIS v3.0 > 10 - Miscellaneous
• Azure > CIS v3.0 > 10 - Miscellaneous > 10.01 - Ensure that Resource Locks are set for Mission-Critical Azure Resources

Policy Types

• Azure > CIS v3.0
• Azure > CIS v3.0 > 02 - Identity
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA)
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.01 - Ensure Security Defaults is enabled on Microsoft Entra ID
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.01 - Ensure Security Defaults is enabled on Microsoft Entra ID > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.02 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.02 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.03 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.03 - Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.04 - Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled
• Azure > CIS v3.0 > 02 - Identity > 02.01 - Security Defaults (Per-User MFA) > 02.01.04 - Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.01 - Ensure Trusted Locations Are Defined
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.02 - Ensure that an exclusionary Geographic Access Policy is considered
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.02 - Ensure that an exclusionary Geographic Access Policy is considered > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.03 - Ensure that an exclusionary Device code flow policy is considered
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.03 - Ensure that an exclusionary Device code flow policy is considered > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.04 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.04 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.05 - Ensure that A Multi-factor Authentication Policy Exists for All Users
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.05 - Ensure that A Multi-factor Authentication Policy Exists for All Users > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.06 - Ensure Multi-factor Authentication is Required for Risky Sign-ins
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.06 - Ensure Multi-factor Authentication is Required for Risky Sign-ins > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.07 - Ensure Multi-factor Authentication is Required for Windows Azure Service Management API
• Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.08 - Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals
• Azure > CIS v3.0 > 02 - Identity > 02.03 - Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.03 - Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.04 - Ensure Guest Users Are Reviewed on a Regular Basis
• Azure > CIS v3.0 > 02 - Identity > 02.05 - Ensure That 'Number of methods required to reset' is set to '2'
• Azure > CIS v3.0 > 02 - Identity > 02.05 - Ensure That 'Number of methods required to reset' is set to '2' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.06 - Ensure that account 'Lockout Threshold' is less than or equal to '10'
• Azure > CIS v3.0 > 02 - Identity > 02.06 - Ensure that account 'Lockout Threshold' is less than or equal to '10' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.07 - Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'
• Azure > CIS v3.0 > 02 - Identity > 02.07 - Ensure that account 'Lockout duration in seconds' is greater than or equal to '60' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.08 - Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization
• Azure > CIS v3.0 > 02 - Identity > 02.08 - Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.09 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
• Azure > CIS v3.0 > 02 - Identity > 02.09 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.10 - Ensure that 'Notify users on password resets?' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.10 - Ensure that 'Notify users on password resets?' is set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.11 - Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.11 - Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.12 - Ensure User consent for applications is set to Do not allow user consent
• Azure > CIS v3.0 > 02 - Identity > 02.12 - Ensure User consent for applications is set to Do not allow user consent > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.13 - Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
• Azure > CIS v3.0 > 02 - Identity > 02.13 - Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.14 - Ensure That 'Users Can Register Applications' Is Set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.15 - Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
• Azure > CIS v3.0 > 02 - Identity > 02.15 - Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.16 - Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
• Azure > CIS v3.0 > 02 - Identity > 02.16 - Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.17 - Ensure That 'Restrict access to Microsoft Entra admin center' is Set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.17 - Ensure That 'Restrict access to Microsoft Entra admin center' is Set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.18 - Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.18 - Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.19 - Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.20 - Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.20 - Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.21 - Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
• Azure > CIS v3.0 > 02 - Identity > 02.21 - Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.22 - Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'
• Azure > CIS v3.0 > 02 - Identity > 02.22 - Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.23 - Ensure That No Custom Subscription Administrator Roles Exist
• Azure > CIS v3.0 > 02 - Identity > 02.24 - Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
• Azure > CIS v3.0 > 02 - Identity > 02.24 - Ensure a Custom Role is Assigned Permissions for Administering Resource Locks > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.25 - Ensure That 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' Is Set To 'Permit no one'
• Azure > CIS v3.0 > 02 - Identity > 02.25 - Ensure That 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' Is Set To 'Permit no one' > Attestation
• Azure > CIS v3.0 > 02 - Identity > 02.26 - Ensure fewer than 5 users have global administrator assignment
• Azure > CIS v3.0 > 02 - Identity > Maximum Attestation Duration
• Azure > CIS v3.0 > 03 - Security
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM)
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM) > 03.01.01.01 - Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.01 - Microsoft Cloud Security Posture Management (CSPM) > 03.01.01.02 - Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.02 - Defender Plan APIs
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.01 - Ensure That Microsoft Defender for Servers Is Set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.02 - Ensure that 'Vulnerability assessment for machines' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.02 - Ensure that 'Vulnerability assessment for machines' component status is set to 'On' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.03 - Ensure that 'Endpoint protection' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.04 - Ensure that 'Agentless scanning for machines' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.04 - Ensure that 'Agentless scanning for machines' component status is set to 'On' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.05 - Ensure that 'File Integrity Monitoring' component status is set to 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.03 - Defender Plan Servers > 03.01.03.05 - Ensure that 'File Integrity Monitoring' component status is set to 'On' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.01 - Ensure That Microsoft Defender for Containers Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.02 - Ensure that 'Agentless discovery for Kubernetes' component status 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.02 - Ensure that 'Agentless discovery for Kubernetes' component status 'On' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.03 - Ensure that 'Agentless container vulnerability assessment' component status is 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.04 - Defender Plan Containers > 03.01.04.03 - Ensure that 'Agentless container vulnerability assessment' component status is 'On' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.05 - Defender Plan - Storage
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.05 - Defender Plan - Storage > 03.01.05.01 - Ensure That Microsoft Defender for Containers Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.06 - Defender Plan App - Service
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.06 - Defender Plan App - Service > 03.01.06.01 - Ensure That Microsoft Defender for App Services Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.01 - Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.02 - Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.03 - Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.07 - Defender Plan - Databases > 03.01.07.04 - Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.08 - Defender Plan - Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.08 - Defender Plan - Key Vault > 03.01.08.01 - Ensure That Microsoft Defender for Key Vault Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.09 - Defender Plan - Resource Manager
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.09 - Defender Plan - Resource Manager > 03.01.09.01 - Ensure That Microsoft Defender for Resource Manager Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.10 - Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.10 - Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.11 - Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.11 - Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.12 - Ensure That 'All users with the following roles' is set to 'Owner'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.13 - Ensure 'Additional email addresses' is Configured with a Security Contact Email
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.14 - Ensure That 'Notify about alerts with the following severity' is Set to 'High'
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.15 - Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.15 - Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.01 - Microsoft Defender for Cloud > 03.01.16 - [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.02 - Microsoft Defender for IoT
• Azure > CIS v3.0 > 03 - Security > 03.02 - Microsoft Defender for IoT > 03.02.01 - Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
• Azure > CIS v3.0 > 03 - Security > 03.02 - Microsoft Defender for IoT > Attestation
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.01 - Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.02 - Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.03 - Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.04 - Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.05 - Ensure the Key Vault is Recoverable
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.06 - Enable Role Based Access Control for Azure Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.07 - Ensure that Private Endpoints are Used for Azure Key Vault
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.08 - Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
• Azure > CIS v3.0 > 03 - Security > 03.03 - Key Vault > 03.03.08 - Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services > Attestation
• Azure > CIS v3.0 > 03 - Security > Maximum Attestation Duration
• Azure > CIS v3.0 > 04 - Storage Accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.01 - Ensure that 'Secure transfer required' is set to 'Enabled'
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.02 - Ensure that Enable Infrastructure Encryption for Each Storage Account in Azure Storage is Set to enabled
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.03 - Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.04 - Ensure that Storage Account Access Keys are Periodically Regenerated
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.04 - Ensure that Storage Account Access Keys are Periodically Regenerated > Attestation
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.05 - Ensure that Shared Access Signature Tokens Expire Within an Hour
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.05 - Ensure that Shared Access Signature Tokens Expire Within an Hour > Attestation
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.06 - Ensure that 'Public Network Access' is 'Disabled' for storage accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.07 - Ensure Default Network Access Rule for Storage Accounts is Set to Deny
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.08 - Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.09 - Ensure Private Endpoints are used to access Storage Accounts
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.10 - Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.11 - Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK)
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.12 - Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.13 - Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.14 - Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.15 - Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.16 - Ensure 'Cross Tenant Replication' is not enabled
• Azure > CIS v3.0 > 04 - Storage Accounts > 04.17 - Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
• Azure > CIS v3.0 > 04 - Storage Accounts > Maximum Attestation Duration
• Azure > CIS v3.0 > 05 - Database Services
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.01 - Ensure that 'Auditing' is set to 'On'
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.02 - Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.03 - Ensure SQL Server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.04 - Ensure that Microsoft Entra authentication is Configured for SQL Servers
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.05 - Ensure that 'Data encryption' is set to 'On' on a SQL Database
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.06 - Ensure that 'Auditing' Retention is 'greater than 90 days'
• Azure > CIS v3.0 > 05 - Database Services > 05.01 - Azure SQL Database > 05.01.07 - Ensure Public Network Access is Disabled
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.01 - Ensure server parameter 'require_secure_transport' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.02 - Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.03 - Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.04 - Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.05 - Ensure 'Allow public access from any Azure service within Azure to this server' for PostgreSQL flexible server is disabled
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.07 - [LEGACY] Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL single server
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 05.02.08 - [LEGACY] Ensure 'Infrastructure double encryption' for PostgreSQL single server is 'Enabled'
• Azure > CIS v3.0 > 05 - Database Services > 05.02 - Azure Database for PostgreSQL > 5.2.6 - [LEGACY] Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.01 - Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.02 - Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.03 - Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.03 - Azure Database for MySQL > 05.03.04 - Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL flexible server
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.01 - Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.02 - Ensure That Private Endpoints Are Used Where Possible
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.03 - Use Entra ID Client Authentication and Azure RBAC where possible
• Azure > CIS v3.0 > 05 - Database Services > 05.04 - Azure Cosmos DB > 05.04.03 - Use Entra ID Client Authentication and Azure RBAC where possible > Attestation
• Azure > CIS v3.0 > 05 - Database Services > Maximum Attestation Duration
• Azure > CIS v3.0 > 06 - Logging & Monitoring
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.01 - Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.01 - Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs > Attestation
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.02 - Ensure Diagnostic Setting captures appropriate categories
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.03 - Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.04 - Ensure that logging for Azure Key Vault is 'Enabled'
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.05 - Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.06 - Ensure that logging for Azure AppService 'HTTP logs' is enabled
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.01 - Ensure that Activity Log Alert exists for Create Policy Assignment
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.02 - Ensure that Activity Log Alert exists for Delete Policy Assignment
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.03 - Ensure that Activity Log Alert exists for Create or Update Network Security Group
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.04 - Ensure that Activity Log Alert exists for Delete Network Security Group
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.05 - Ensure that Activity Log Alert exists for Create or Update Security Solution
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.06 - Ensure that Activity Log Alert exists for Delete Security Solution
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.07 - Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.08 - Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.09 - Ensure that Activity Log Alert exists for Create or Update Public IP Address rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.02 - Monitoring using Activity Log Alerts > 06.02.10 - Ensure that Activity Log Alert exists for Delete Public IP Address rule
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.03 - Configuring Application Insights
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.03 - Configuring Application Insights > 06.03.01 - Ensure Application Insights are Configured
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it > Attestation
• Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
• Azure > CIS v3.0 > 06 - Logging & Monitoring > Maximum Attestation Duration
• Azure > CIS v3.0 > 07 - Networking
• Azure > CIS v3.0 > 07 - Networking > 07.01 - Ensure that RDP access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.02 - Ensure that SSH access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.03 - Ensure that UDP access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.04 - Ensure that HTTP(S) access from the Internet is evaluated and restricted
• Azure > CIS v3.0 > 07 - Networking > 07.05 - Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
• Azure > CIS v3.0 > 07 - Networking > 07.06 - Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use
• Azure > CIS v3.0 > 07 - Networking > 07.07 - Ensure that Public IP addresses are evaluated on a periodic basis
• Azure > CIS v3.0 > 07 - Networking > Maximum Attestation Duration
• Azure > CIS v3.0 > 08 - Virtual Machines
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.01 - Ensure Virtual Machines are utilizing Managed Disks
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.02 - Ensure Virtual Machines are utilizing Managed Disks
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.03 - Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.04 - Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.05 - Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks'
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.06 - Ensure that 'Enable Data Access Authentication Mode' is 'Checked'
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.07 - Ensure that Only Approved Extensions Are Installed
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.07 - Ensure that Only Approved Extensions Are Installed > Attestation
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.08 - Ensure that Endpoint Protection for all Virtual Machines is installed
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.08 - Ensure that Endpoint Protection for all Virtual Machines is installed > Attestation
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.09 - [Legacy] Ensure that VHDs are Encrypted
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.09 - [Legacy] Ensure that VHDs are Encrypted > Attestation
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.10 - Ensure only MFA enabled identities can access privileged Virtual Machine
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.10 - Ensure only MFA enabled identities can access privileged Virtual Machine > Attestation
• Azure > CIS v3.0 > 08 - Virtual Machines > 08.11 - Ensure Trusted Launch is enabled on Virtual Machines
• Azure > CIS v3.0 > 08 - Virtual Machines > Maximum Attestation Duration
• Azure > CIS v3.0 > 09 - Application Services
• Azure > CIS v3.0 > 09 - Application Services > 09.01 - Ensure 'HTTPS Only' is set to On
• Azure > CIS v3.0 > 09 - Application Services > 09.02 - Ensure App Service Authentication is set up for apps in Azure App Service
• Azure > CIS v3.0 > 09 - Application Services > 09.03 - Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
• Azure > CIS v3.0 > 09 - Application Services > 09.04 - Ensure Web App is using the latest version of TLS encryption
• Azure > CIS v3.0 > 09 - Application Services > 09.05 - Ensure that Register with Entra ID is enabled on App Service
• Azure > CIS v3.0 > 09 - Application Services > 09.06 - Ensure that 'Basic Authentication' is 'Disabled'
• Azure > CIS v3.0 > 09 - Application Services > 09.06 - Ensure that 'Basic Authentication' is 'Disabled' > Attestation
• Azure > CIS v3.0 > 09 - Application Services > 09.07 - Ensure that 'PHP version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.07 - Ensure that 'PHP version' is currently supported (if in use) > Attestation
• Azure > CIS v3.0 > 09 - Application Services > 09.08 - Ensure that 'Python version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.08 - Ensure that 'Python version' is currently supported (if in use) > Attestation
• Azure > CIS v3.0 > 09 - Application Services > 09.09 - Ensure that 'Java version' is currently supported (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.09 - Ensure that 'Java version' is currently supported (if in use) > Attestation
• Azure > CIS v3.0 > 09 - Application Services > 09.10 - Ensure that 'HTTP20enabled' is set to 'true' (if in use)
• Azure > CIS v3.0 > 09 - Application Services > 09.11 - Ensure Azure Key Vaults are Used to Store Secrets
• Azure > CIS v3.0 > 09 - Application Services > 09.11 - Ensure Azure Key Vaults are Used to Store Secrets > Attestation
• Azure > CIS v3.0 > 09 - Application Services > 09.12 - Ensure that 'Remote debugging' is set to 'Off'
• Azure > CIS v3.0 > 09 - Application Services > Maximum Attestation Duration
• Azure > CIS v3.0 > 10 - Miscellaneous
• Azure > CIS v3.0 > 10 - Miscellaneous > 10.01 - Ensure that Resource Locks are set for Mission-Critical Azure Resources
• Azure > CIS v3.0 > 10 - Miscellaneous > 10.01 - Ensure that Resource Locks are set for Mission-Critical Azure Resources > Attestation
• Azure > CIS v3.0 > 10 - Miscellaneous > Maximum Attestation Duration
• Azure > CIS v3.0 > Maximum Attestation Duration

Note

To ensure compatibility and proper functioning of the Guardrails Azure CIS v3 mod, we recommend updating all dependent mods to their latest versions.

Bug fixes

• Fixed the azure_network_watcher_flow_log table to correctly return data instead of an error. (#926)

Deprecations

• The following columns of the azure_security_center_contact have now been deprecated due to the lack of API support:
  • alert_notifications
  • alerts_to_admins

What's new?

• New tables added
  • azure_network_profile (#892)

Enhancements

• Added rate-limiter tags to all tables which can be used to smooth request rates and limit the number of parallel requests to avoid hitting API rate limits. (#904)
• Added diagnostic_settings column to azure_app_service_web_app table. (#921)
• Added default_blob_diagnostic_settings, default_file_diagnostic_settings, default_table_diagnostic_settings and default_queue_diagnostic_settings columns to azure_storage_account table. (#918)
• Added key_policy column to azure_storage_account table. (#922)

Bug fixes

• Fixed the azure_storage_account table to correctly handle the no such host error for premium type storage account. (#922)
• Fixed the diagnostic_settings column in azure_key_vault table to correctly return data instead of null. (#915)
• Fixed azure_data_protection_backup_vault and azure_security_center_contact tables to correctly return data instead of an error. (#917)
• Fixed the azure_security_center_contact table to correctly return data instead of null. (#902)

Dependencies

• Recompiled plugin with Go version 1.24. (#912)
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages. (#912)

Enhancements

• Added new automated queries for the following manual CIS controls: (#317)
  • cis_v150_1_2_1
  • cis_v200_1_2_1
  • cis_v200_5_1_7
  • cis_v210_1_2_1
  • cis_v210_5_1_6
  • cis_v210_7_9
  • cis_v300_2_2_1
  • cis_v300_4_16
  • cis_v300_6_1_6
  • cis_v300_8_11
• Added compute_vm_trust_launch_enabled and iam_conditional_access_trusted_location_configured controls to the All Controls benchmark. (#317)
• Added variable support for App Service controls to improve configurability: (#317)
  • appservice_web_app_latest_python_version - Configurable Python version validation for web app
  • appservice_web_app_latest_java_version - Configurable Java version validation for web app
  • appservice_function_app_latest_python_version - Configurable Python version validation for function app
  • appservice_function_app_latest_java_version - Configurable Java version validation for function app

Bug fixes

• Fixed iam_global_administrator_max_5 query to correctly check for a minimum of 2 and a maximum of 5 administrators. (#318)
• Fixed cis_v300_3_1_4_2 control by removing the invalid query reference and marking it as manual. (#317)
• Fixed appservice_function_app_latest_java_version query to correctly check results for both Linux and Windows operating system function app. (#317)
• Fixed appservice_web_app_latest_java_version query to correctly check results for both Linux and Windows operating system web app. (#317)

What's new?

• Added proxy support for GitHub API requests.

Bug fixes

• Guardrails previously failed to fetch all diagnosticSettings details for storage accounts control due to limitations in the internal Node SDK package version. This has now been resolved, and the CMDB control will successfully fetch all details as expected.

Renamed:

• diagnosticSettings.value to diagnosticSettings

Bug fixes

• Guardrails previously failed to fetch all diagnosticSettings details for vaults control due to limitations in the internal Node SDK package version. This has now been resolved, and the CMDB control will successfully fetch all details as expected.

Bug fixes

• Guardrails previously failed to fetch all diagnosticSettings details for web apps control due to limitations in the internal Node SDK package version. This has now been resolved, and the CMDB control will successfully fetch all details as expected.

What's new?

• New tables added
  • aws_bedrock_agent (#2580)
  • aws_bedrock_foundation_model (#2581)
  • aws_bedrock_imported_model (#2581)
  • aws_bedrock_knowledge_base (#2580)
  • aws_elasticache_serverless_cache (#2538) (Thanks @michalpl-monday for the contribution!)

What's new?

• Diagnostic Settings for blob, queue, and table will now be available in CMDB for storage accounts.
• Users can now update access tier to cold for storage accounts. To get started, set the Azure > Storage > Storage Account > Access Tier policy to Enforce: Cold.

Bug fixes

• The Azure > Storage > Storage Account > Tags control will no longer pass unnecessary arguments as parameter to the API call while updating tags for the resource.

What's new?

• You can now configure guest configuration extension for virtual machines. To get started, set the Azure > Compute > Virtual Machine > Extensions > Guest Configuration policy.

Control Types

• Azure > Compute > Virtual Machine > Extensions
• Azure > Compute > Virtual Machine > Extensions > Guest Configuration

Policy Types

• Azure > Compute > Virtual Machine > Extensions
• Azure > Compute > Virtual Machine > Extensions > Guest Configuration

Action Types

• Azure > Compute > Virtual Machine > Update Guest Configuration

What's new?

• Added controls for sections 5.01.01, 5.01.02 and 7.01.

Control Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.01 - Ensure that a 'Diagnostic Setting' exists
• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.02 - Ensure Diagnostic Setting captures appropriate categories
• Azure > CIS v2.0 > 07 - Virtual Machines > 7.01 - Ensure an Azure Bastion Host Exists

Policy Types

• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.01 - Ensure that a 'Diagnostic Setting' exists
• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.01 - Ensure that a 'Diagnostic Setting' exists > Attestation
• Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.01 - Configuring Diagnostic Settings > 5.01.02 - Ensure Diagnostic Setting captures appropriate categories
• Azure > CIS v2.0 > 07 - Virtual Machines > 7.01 - Ensure an Azure Bastion Host Exists

Bug fixes

• CIS controls previously entered an invalid or TBD state when the CMDB controls for associated resources were in a skipped or TBD state, even if the corresponding CIS policies were set to Skip. This issue has been resolved; such controls will now correctly transition to a skipped state.

All Tailpipe plugins have been updated to use tailpipe-plugin-sdk v0.9.2, which includes:

• Fixed data collections pulling wrong date ranges, leading to duplicate or missing results. (#264)
• Fixed a crash that occurred when a collection state contained null trunk states. (#261)
• Upgraded golang.org/x/oauth2 to address high-severity vulnerabilities.

Bug fixes

• The CMDB data for buckets did not refresh automatically when intelligent tiering configurations were removed from the buckets. This issue has now been fixed.

Bug fixes

• Fixed the containers_resources_limits_std and containers_resources_requests_std columns in the kubernetes_pod table to correctly return data when pod resource limits or requests are expressed in scientific notation, preventing errors. (#315)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

What's new?

• New tables added
  • hudsonrock_search_by_domain
  • hudsonrock_search_by_email
  • hudsonrock_search_by_ip
  • hudsonrock_search_by_username
  • hudsonrock_url_by_domain

Bug fixes

• Fix issue where --to was not respected for zero granularity data. (#483)
• Fix issue where the relative time passed to from/to args were getting parsed incorrectly. (#485)
• Fix issue where Tailpipe was crashing if the collection state file had nil trunk states from the previous collection. (#489)
• Fix .inspect output to show the plugin name for custom tables. (#360)
• Fix query JSON outputs to be consistent with DuckDB. (#432)

Dependencies

• Upgrade go-viper/mapstructure/v2 and oauth2 packages to remediate high and moderate vulnerabilities.

Bug fixes

• Fixed the account_alternate_contact_security_registered query to correctly list all the available accounts. (#917)
• Fixed the iam_user_access_key_age_90 query to skip the inactive access keys. (#912)
• Fixed config_enabled_all_regions, iam_access_analyzer_enabled_without_findings and securityhub_enabled queries to skip regions not defined in the aws.spc file. (#908)

What's new?

• Added support for PostgreSQL version 15.9, 15.10, 15.11, 15.12 and 15.13.

Bug fixes

• Fixed gcp_compute_ssl_policy table to return regional along with global SSL policies. (#773)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

What's new?

• New tables added
  • aws_bedrock_custom_model (#2569)

Enhancements

• Added export column to the aws_acm_certificate table. (#2571)
• Added ignore_error_messages config arg to provide users the ability to set a list of additional AWS error messages to ignore while running queries. For more information, please see AWS plugin configuration (#2560)

Dependencies

• Recompiled plugin with Go version 1.24.
• Recompiled plugin with steampipe-plugin-sdk v5.13.0 that addresses critical and high vulnerabilities in dependent packages.

Custom tenant settings now allow owners to control session timeouts for Console (browser) and CLI logins.

For more information, check out the docs

Bug fixes

• Resolved a bug where destroying a policy pack via Terraform did not delete the policy pack if it was still attached to resources. The terraform destroy command now provides a clear and meaningful error message when such attachments exist.

  Minimum version requirements:

  • TE v5.52.1

What's new?

• Diagnostic Settings details will now be available in CMDB for Subscriptions.

What's new?

• Server
  • Introduced LAMBDA_IN_VPC_GITHUB flag to enable deployment of GitHub mod lambdas inside a VPC.

Bug Fixes

• Server
  • Optimized mod type installation to distribute event execution more evenly over time, minimizing the risk of throttling.
  • Fixed an issue where controls or actions could get stuck if their notification templates were empty or failed to render correctly.
  • The Delete Policy Pack API now throws a clear error when attempting to delete a policy pack that still has attached resources.
  • The maintenance container now ensures the index_list table is populated with any missing indexes, improving database reliability.
  • Unused Lambda functions are now correctly deleted when no aliases remain.

Note

Upgrade to 5.52.1 requires your workspace to be on 5.51.x; direct upgrades from older versions (e.g., 5.49.x) will fail.

Requirements

• TEF: 1.66.0
• TED: 1.9.1

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

What's new?

• Resource Types:

  • Azure > Network > Bastion Host

• Control Types:

  • Azure > Network > Bastion Host > Active
  • Azure > Network > Bastion Host > CMDB
  • Azure > Network > Bastion Host > Discovery
  • Azure > Network > Bastion Host > Tags

• Policy Types:

  • Azure > Network > Bastion Host > Active
  • Azure > Network > Bastion Host > Active > Age
  • Azure > Network > Bastion Host > Active > Last Modified
  • Azure > Network > Bastion Host > CMDB
  • Azure > Network > Bastion Host > Regions
  • Azure > Network > Bastion Host > Tags
  • Azure > Network > Bastion Host > Tags > Template

• Action Types:

  • Azure > Network > Bastion Host > Delete
  • Azure > Network > Bastion Host > Router
  • Azure > Network > Bastion Host > Set Tags

What's new?

• HyperVGeneration details will now be available in the CMDB for Virtual Machines.

What's new?

• Conditional Access Policy and Directory Role details will now be available in CMDB for Directories.

Action Types

• Azure > Active Directory > Directory > Router

What's new?

• Resource Types:

  • AWS > Bedrock > Agent
  • AWS > Bedrock > Custom Model
  • AWS > Bedrock > Foundation Model
  • AWS > Bedrock > Imported Model
  • AWS > Bedrock > Knowledge Base
  • AWS > Bedrock > Settings

• Control Types:

  • AWS > Bedrock > Agent > Active
  • AWS > Bedrock > Agent > CMDB
  • AWS > Bedrock > Agent > Discovery
  • AWS > Bedrock > Agent > Tags
  • AWS > Bedrock > Custom Model > Active
  • AWS > Bedrock > Custom Model > CMDB
  • AWS > Bedrock > Custom Model > Discovery
  • AWS > Bedrock > Custom Model > Tags
  • AWS > Bedrock > Foundation Model > CMDB
  • AWS > Bedrock > Foundation Model > Discovery
  • AWS > Bedrock > Imported Model > Active
  • AWS > Bedrock > Imported Model > CMDB
  • AWS > Bedrock > Imported Model > Discovery
  • AWS > Bedrock > Imported Model > Tags
  • AWS > Bedrock > Knowledge Base > Active
  • AWS > Bedrock > Knowledge Base > CMDB
  • AWS > Bedrock > Knowledge Base > Discovery
  • AWS > Bedrock > Knowledge Base > Tags
  • AWS > Bedrock > Settings > CMDB
  • AWS > Bedrock > Settings > Discovery
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration

• Policy Types:

  • AWS > Bedrock > Agent > Active
  • AWS > Bedrock > Agent > Active > Age
  • AWS > Bedrock > Agent > Active > Last Modified
  • AWS > Bedrock > Agent > CMDB
  • AWS > Bedrock > Agent > Regions
  • AWS > Bedrock > Agent > Tags
  • AWS > Bedrock > Agent > Tags > Template
  • AWS > Bedrock > Custom Model > Active
  • AWS > Bedrock > Custom Model > Active > Age
  • AWS > Bedrock > Custom Model > Active > Last Modified
  • AWS > Bedrock > Custom Model > CMDB
  • AWS > Bedrock > Custom Model > Regions
  • AWS > Bedrock > Custom Model > Tags
  • AWS > Bedrock > Custom Model > Tags > Template
  • AWS > Bedrock > Foundation Model > CMDB
  • AWS > Bedrock > Foundation Model > Regions
  • AWS > Bedrock > Imported Model > Active
  • AWS > Bedrock > Imported Model > Active > Age
  • AWS > Bedrock > Imported Model > Active > Last Modified
  • AWS > Bedrock > Imported Model > CMDB
  • AWS > Bedrock > Imported Model > Regions
  • AWS > Bedrock > Imported Model > Tags
  • AWS > Bedrock > Imported Model > Tags > Template
  • AWS > Bedrock > Knowledge Base > Active
  • AWS > Bedrock > Knowledge Base > Active > Age
  • AWS > Bedrock > Knowledge Base > Active > Last Modified
  • AWS > Bedrock > Knowledge Base > CMDB
  • AWS > Bedrock > Knowledge Base > Regions
  • AWS > Bedrock > Knowledge Base > Tags
  • AWS > Bedrock > Knowledge Base > Tags > Template
  • AWS > Bedrock > Settings > CMDB
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Data Delivery
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Logging Destination
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Logging Destination > CloudWatch Log Group Name
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Logging Destination > S3 Location
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Logging Destination > S3 Location for Large Data Delivery
  • AWS > Bedrock > Settings > Model Invocation Logging Configuration > Logging Destination > Service Role ARN
  • AWS > Bedrock > Settings > Regions
  • AWS > Bedrock > Tags Template [Default]
  • AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-bedrock

• Action Types:

  • AWS > Bedrock > Agent > Delete
  • AWS > Bedrock > Agent > Router
  • AWS > Bedrock > Agent > Update Tags
  • AWS > Bedrock > Custom Model > Delete
  • AWS > Bedrock > Custom Model > Router
  • AWS > Bedrock > Custom Model > Update Tags
  • AWS > Bedrock > Imported Model > Delete
  • AWS > Bedrock > Imported Model > Router
  • AWS > Bedrock > Imported Model > Update Tags
  • AWS > Bedrock > Knowledge Base > Delete
  • AWS > Bedrock > Knowledge Base > Router
  • AWS > Bedrock > Knowledge Base > Update Tags
  • AWS > Bedrock > Settings > Router
  • AWS > Bedrock > Settings > Update Model Invocation Logging Configuration