Performing a CRUD operation using the REST API
This use case shows how to perform a create, read, update, delete (CRUD) operation on policies using the Cloud Security API.
You implement this example by completing the following steps:
Before you get started, ensure that you have completed the prerequisites for using the Policy API.
Before you begin
Ensure that the following prerequisites are met:
- You are a registered user within BMC Helix Cloud Security.
- A policy in BMC Helix Cloud Security is available against which a CRUD operation will be performed.
- Post Man Client is installed as required tool on the system.
High-Level process
Using the API, perform the following steps:
Log on to BMC Helix Cloud Security with your registered credentials:
https://bmchelix-cloudopsapi.onbmc.com/v3/users/loginGenerate the access token:
https://bmchelix-cloudopsapi.onbmc.com/v3/auth/tokensView a list of policies:
https://bmchelix-cloudopsapi.onbmc.com/v1/policies/getDefaultPoliciesCreate a policy:
https://bmchelix-cloudopsapi.onbmc.com/v1/policiesUpdate the policy:
https://bmchelix-cloudopsapi.onbmc.com/v1/policiesDelete policies:
https://bmchelix-cloudopsapi.onbmc.com/v1/policies/{policyName}
To log on to BMC Helix Cloud Security
API used: https://bmchelix-cloudopsapi.onbmc.com/v3/users/login
Request
Header
Content-Type:application/json
{
"id": "john_smith@companyabc.com",
"password": "P@ssw0rd"
}
"id": "john_smith@companyabc.com",
"password": "P@ssw0rd"
}
Response
{
"user_id": "26116073073078869423",
"first_name": "john",
"last_name": "smith",
"tenant_id": "97223027309016641763",
"tenant_name": "BMC Software",
"user_status": "ENABLE",
"last_login_time": 1568038988898,
"last_selected_tenant_id": "97223027309016641763",
"trial_expiry_time": 0,
"token": "eyJraWQiOiJmMjQyY2RhMi0wMGE3LTQyMWMtYWMzMy02MmQ3MzE4ODkxM2YiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiIyNjExNjA3MzA3MzA3ODg2OTQyMyIsImF1ZCI6ImJtY190cnVlc2lnaHRfY2xvdWRfc2VydmljZXMiLCJhbXIiOltdLCJpc3MiOiJibWNfdHJ1ZXNpZ2h0X2Nsb3VkX3NlcnZpY2VzX2lkbSIsInR5cGUiOiJSRUZfVE9LRU4iLCJleHAiOjE1NjgxMjU2MzEsImlhdCI6MTU2ODAzOTIzMSwianRpIjoiMTA4OGFhNmItMzY0ZC00MGMzLWI3MDQtNzNmOTk2MmZjZTgxIn0.TfXlfkq43ydCKXqt4cyX0refkMmA8mc8GA6rNTfVIkNgmA4fC7NMxqLb-YttkHzGTm0TmnuAY9hUzH-6bVnmzS8CLluo9AQY8wzWM7CLsfPFd_wnCD-Je0yRTEftspFj4b5ND_M_GnXbC6VYQpjbOthZbm-0wf_x3wuJGvI1XzqY-_8y4tMx-GfAlnyBVwmmXZb0ofl3vVpUZVRCLYtVApsjxfcMXNo6N5B2lJhk9e-4EajPGx21bDCTz5zwe4WeZ_-RO_Ve3NPSQayJ3PQzKD07w65MXFsohUyPH1DzD76CghR4EZt3hy7jDT7iLvBCH4MsGqV6FG9pnPxNWHAyCw",
"tenants": [
{
"tenant_id": "97223027309016641763",
"tenant_name": "BMC Software",
"is_msp_tenant": false,
"is_trial_tenant": false,
"trial_expiry_time": -1,
"organizations": [
{
"id": "1",
"name": "BMC Software"
},
{
"id": "2",
"name": "POV-TEST"
},
{
"id": "3",
"name": "POV-TEST-2"
},
{
"id": "4",
"name": "POV-TEST-3"
}
]
},
{
"tenant_id": "53230692198492071055",
"tenant_name": "BMC",
"is_msp_tenant": false,
"tenant_phone_number": "813-695-5599",
"is_trial_tenant": false,
"trial_expiry_time": -1,
"organizations": [
{
"id": "6",
"name": "Mobile Banking App Team"
},
{
"id": "7",
"name": "AWS Operations"
},
{
"id": "8",
"name": "AWSOperations"
},
{
"id": "2",
"name": "Stock Trader App Team"
},
{
"id": "3",
"name": "IT Service Team"
},
{
"id": "4",
"name": "COE Team"
},
{
"id": "9",
"name": "BT"
},
{
"id": "1",
"name": "BMC"
},
{
"id": "5",
"name": "Loan App Team"
}
]
}
]
}
"user_id": "26116073073078869423",
"first_name": "john",
"last_name": "smith",
"tenant_id": "97223027309016641763",
"tenant_name": "BMC Software",
"user_status": "ENABLE",
"last_login_time": 1568038988898,
"last_selected_tenant_id": "97223027309016641763",
"trial_expiry_time": 0,
"token": "eyJraWQiOiJmMjQyY2RhMi0wMGE3LTQyMWMtYWMzMy02MmQ3MzE4ODkxM2YiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiIyNjExNjA3MzA3MzA3ODg2OTQyMyIsImF1ZCI6ImJtY190cnVlc2lnaHRfY2xvdWRfc2VydmljZXMiLCJhbXIiOltdLCJpc3MiOiJibWNfdHJ1ZXNpZ2h0X2Nsb3VkX3NlcnZpY2VzX2lkbSIsInR5cGUiOiJSRUZfVE9LRU4iLCJleHAiOjE1NjgxMjU2MzEsImlhdCI6MTU2ODAzOTIzMSwianRpIjoiMTA4OGFhNmItMzY0ZC00MGMzLWI3MDQtNzNmOTk2MmZjZTgxIn0.TfXlfkq43ydCKXqt4cyX0refkMmA8mc8GA6rNTfVIkNgmA4fC7NMxqLb-YttkHzGTm0TmnuAY9hUzH-6bVnmzS8CLluo9AQY8wzWM7CLsfPFd_wnCD-Je0yRTEftspFj4b5ND_M_GnXbC6VYQpjbOthZbm-0wf_x3wuJGvI1XzqY-_8y4tMx-GfAlnyBVwmmXZb0ofl3vVpUZVRCLYtVApsjxfcMXNo6N5B2lJhk9e-4EajPGx21bDCTz5zwe4WeZ_-RO_Ve3NPSQayJ3PQzKD07w65MXFsohUyPH1DzD76CghR4EZt3hy7jDT7iLvBCH4MsGqV6FG9pnPxNWHAyCw",
"tenants": [
{
"tenant_id": "97223027309016641763",
"tenant_name": "BMC Software",
"is_msp_tenant": false,
"is_trial_tenant": false,
"trial_expiry_time": -1,
"organizations": [
{
"id": "1",
"name": "BMC Software"
},
{
"id": "2",
"name": "POV-TEST"
},
{
"id": "3",
"name": "POV-TEST-2"
},
{
"id": "4",
"name": "POV-TEST-3"
}
]
},
{
"tenant_id": "53230692198492071055",
"tenant_name": "BMC",
"is_msp_tenant": false,
"tenant_phone_number": "813-695-5599",
"is_trial_tenant": false,
"trial_expiry_time": -1,
"organizations": [
{
"id": "6",
"name": "Mobile Banking App Team"
},
{
"id": "7",
"name": "AWS Operations"
},
{
"id": "8",
"name": "AWSOperations"
},
{
"id": "2",
"name": "Stock Trader App Team"
},
{
"id": "3",
"name": "IT Service Team"
},
{
"id": "4",
"name": "COE Team"
},
{
"id": "9",
"name": "BT"
},
{
"id": "1",
"name": "BMC"
},
{
"id": "5",
"name": "Loan App Team"
}
]
}
]
}
Request
Response
To generate the access token
API used : https://bmchelix-cloudopsapi.onbmc.com/v3/auth/tokens
Request
{
"refresh_token": "eyJraWQiOiJmMjQyY2RhMi0wMGE3LTQyMWMtYWMzMy02MmQ3MzE4ODkxM2YiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiIyNjExNjA3MzA3MzA3ODg2OTQyMyIsImF1ZCI6ImJtY190cnVlc2lnaHRfY2xvdWRfc2VydmljZXMiLCJhbXIiOltdLCJpc3MiOiJibWNfdHJ1ZXNpZ2h0X2Nsb3VkX3NlcnZpY2VzX2lkbSIsInR5cGUiOiJSRUZfVE9LRU4iLCJleHAiOjE1NjgxMjQ3MDIsImlhdCI6MTU2ODAzODMwMiwianRpIjoiNzM5MGViZWUtNTFjNC00YTdmLThlM2MtMzRmMDE3MjQ2M2VkIn0.PUMSSwfMUzAY_DA4tnTE6X7VnwYvp13x3Gj4YlUwXuMq3YRep3oOUzYk1td87tSWlho2sRkL19UM4PbTSe7X2W3aN8PwfIm24Msmg5WuP416aoMKNQ8F3-WvXEh56UlDRKZdo87GICvHcpvCHvHy8gk8GW1cKGYlnzDNDrJNgnQTAtwxzO8DBenXU2STBbNa4gUCpUwJvGWWmv4NvkFj15MnnMT2Cbp_oOSVK_bQLMSQ8qHsnIS0yL9KHBaT4cQJ0ZA0iYO7o4HXe-6YxPhrRILHLLbB-ViDkgdEtg7fP6HjCQiLxT1eudqMHTaAz-ZPW3vHLwGUDG-chdaRQ8cE4Q",
"context": {
"tenant_id": "9722302730901664176334",
"org_id": 1
}
}
"refresh_token": "eyJraWQiOiJmMjQyY2RhMi0wMGE3LTQyMWMtYWMzMy02MmQ3MzE4ODkxM2YiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiIyNjExNjA3MzA3MzA3ODg2OTQyMyIsImF1ZCI6ImJtY190cnVlc2lnaHRfY2xvdWRfc2VydmljZXMiLCJhbXIiOltdLCJpc3MiOiJibWNfdHJ1ZXNpZ2h0X2Nsb3VkX3NlcnZpY2VzX2lkbSIsInR5cGUiOiJSRUZfVE9LRU4iLCJleHAiOjE1NjgxMjQ3MDIsImlhdCI6MTU2ODAzODMwMiwianRpIjoiNzM5MGViZWUtNTFjNC00YTdmLThlM2MtMzRmMDE3MjQ2M2VkIn0.PUMSSwfMUzAY_DA4tnTE6X7VnwYvp13x3Gj4YlUwXuMq3YRep3oOUzYk1td87tSWlho2sRkL19UM4PbTSe7X2W3aN8PwfIm24Msmg5WuP416aoMKNQ8F3-WvXEh56UlDRKZdo87GICvHcpvCHvHy8gk8GW1cKGYlnzDNDrJNgnQTAtwxzO8DBenXU2STBbNa4gUCpUwJvGWWmv4NvkFj15MnnMT2Cbp_oOSVK_bQLMSQ8qHsnIS0yL9KHBaT4cQJ0ZA0iYO7o4HXe-6YxPhrRILHLLbB-ViDkgdEtg7fP6HjCQiLxT1eudqMHTaAz-ZPW3vHLwGUDG-chdaRQ8cE4Q",
"context": {
"tenant_id": "9722302730901664176334",
"org_id": 1
}
}
Response
Failed to execute the [code] macro. Cause: [RuntimeError: maximum recursion limit exceeded]. Click on this message for details.
Request
Response
To view a list of policies
API used: https://bmchelix-cloudopsapi.onbmc.com/v1/policies/getDefaultPolicies
- Request
- On the Authorization Tab, choose the Bearer Token authorization type from the menu and provide authorization parameters:
- On the Authorization Tab, choose the Bearer Token authorization type from the menu and provide authorization parameters:
Request details:
{
"method": "GET",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policies/getDefaultPolicies",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
}
}
"method": "GET",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policies/getDefaultPolicies",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
}
}
Response
[
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 MS",
"lastUpdate": 1568039413958,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "Windows_2012_R2_MS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_MS"
},
{
"orgId": "BMCOPS",
"name": "GDPR Amazon Web Services Benchmark",
"lastUpdate": 1568039414157,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by The General Data Protection Regulation (EU) 2016/679.",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "GDPR"
},
{
"key": "benchmark",
"value": "General Data Protection Regulation (EU) 2016/679"
}
],
"_id": "BMCOPS_GDPR_Amazon_Web_Services_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "Kubernetes CVE-2018-1002105 CVE",
"lastUpdate": 1568039414158,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "Kubernetes CVE-2018-1002105 CVEs",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS , openshift"
}
],
"_id": "BMCOPS_Kubernetes_CVE-2018-1002105_CVE"
},
{
"orgId": "BMCOPS",
"name": "BMC OpenShift Benchmark - Worker",
"lastUpdate": 1568039413562,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended OpenShift worker settings defined by CIS Kubernetes Benchmark and OpenSCAP Security Guide",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OpenShift"
},
{
"key": "selectionHint",
"value": "openshift"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC OpenShift Benchmark"
}
],
"_id": "BMCOPS_BMC_OpenShift_Benchmark_-_Worker"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 DC",
"lastUpdate": 1568039413861,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "Windows_2012_R2_DC"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_DC"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 MS for chef",
"lastUpdate": 1568039413956,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_MS_for_chef"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - GKE",
"lastUpdate": 1568039414057,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations addressing Google Kubernetes Engine (GKE) on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_GKE"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Network",
"lastUpdate": 1568039414059,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around networking on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Network"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Projects",
"lastUpdate": 1568039414064,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around projects on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Projects"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Sinks",
"lastUpdate": 1568039414072,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Sink on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Sinks"
},
{
"orgId": "BMCOPS",
"name": "PCI DSS Amazon Web Services Benchmark",
"lastUpdate": 1568039414158,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Payment Card Industry Data Security Standard 3.2.1",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "PCI DSS"
},
{
"key": "benchmark",
"value": "Payment Card Industry Data Security Standard 3.2.1"
}
],
"_id": "BMCOPS_PCI_DSS_Amazon_Web_Services_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS S3 Bucket",
"lastUpdate": 1568039413560,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check AWS S3 bucket is not publicly accessible",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "S3_BUCKETS"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_S3_Bucket"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 MS",
"lastUpdate": 1568039413662,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This template is created based on the recommended settings defined by Microsoft Windows Server 2008 Security Configuration Benchmark Version 2.1.0, published on December 3rd, 2013.",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "BSA"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_MS"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 R2 DC",
"lastUpdate": 1568039413665,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2008 R2 Security Configuration Benchmark Version 3.0.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_R2_DC"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 R2 MS",
"lastUpdate": 1568039413858,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2008 R2 Security Configuration Benchmark Version 3.0.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_R2_MS"
},
{
"orgId": "BMCOPS",
"name": "CIS Docker 1.12.0 Benchmark",
"lastUpdate": 1568039413964,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy is created based on the recommended settings defined by CIS Docker 1.12.0 Benchmark Version 1.0.0, published on September 15th, 2016\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Docker 1.12.0 Benchmark"
}
],
"_id": "BMCOPS_CIS_Docker_1.12.0_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - IAM",
"lastUpdate": 1568039414058,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around IAM on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_IAM"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - SQL",
"lastUpdate": 1568039414065,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Cloud SQL Database Services on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_SQL"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Service Accounts",
"lastUpdate": 1568039414071,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Service Account on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Service_Accounts"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS ElasticSearch",
"lastUpdate": 1568039413559,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check AWS Elastic Search domain does not have open access",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "ES_DOMAINS"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_ElasticSearch"
},
{
"orgId": "BMCOPS",
"name": "BMC OpenShift Benchmark - Master",
"lastUpdate": 1568039413561,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended OpenShift Master settings defined by CIS Kubernetes Benchmark and OpenSCAP Security Guide",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OpenShift"
},
{
"key": "selectionHint",
"value": "openshift"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC OpenShift Benchmark"
}
],
"_id": "BMCOPS_BMC_OpenShift_Benchmark_-_Master"
},
{
"orgId": "BMCOPS",
"name": "CIS - Red Hat Enterprise Linux 6",
"lastUpdate": 1568039413656,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Red Hat Enterprise Security Configuration Benchmark Settings for Linux 6 Version 2.0.2, published on June 02, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "CIS_RHEL_6"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Red Hat Enterprise Linux 6 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Red_Hat_Enterprise_Linux_6"
},
{
"orgId": "BMCOPS",
"name": "CIS Docker 1.13.0 Benchmark",
"lastUpdate": 1568039413967,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy is created based on the recommended Docker settings defined by CIS Docker 1.13.0 Benchmark Version 1.0.0, published on January 19th, 2017\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Docker 1.13.0 Benchmark"
}
],
"_id": "BMCOPS_CIS_Docker_1.13.0_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - DNS",
"lastUpdate": 1568039414057,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around networking DNS on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_DNS"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - VM",
"lastUpdate": 1568039414073,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically recommendations around Virtual Machines on Google Cloud Platform.\nReference:\nhttps://workbench.cisecurity.org/benchmarks/429\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_VM"
},
{
"orgId": "BMCOPS",
"name": "CIS Kubernetes Benchmark - Master",
"lastUpdate": 1568039414073,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended kubernetes master settings defined by CIS Kubernetes Benchmark 1.2.0 \n\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Kubernetes Benchmark"
}
],
"_id": "BMCOPS_CIS_Kubernetes_Benchmark_-_Master"
},
{
"orgId": "BMCOPS",
"name": "CIS Kubernetes Benchmark - Worker",
"lastUpdate": 1568039414082,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended kubernetes worker settings defined by CIS Kubernetes Benchmark 1.2.0 \n\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Kubernetes Benchmark"
}
],
"_id": "BMCOPS_CIS_Kubernetes_Benchmark_-_Worker"
},
{
"orgId": "BMCOPS",
"name": "AWS CFN CaaS Portal",
"lastUpdate": 1568039413557,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "AWS policy for validating CAAS portal",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "CFN_PORTAL"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_AWS_CFN_CaaS_Portal"
},
{
"orgId": "BMCOPS",
"name": "App Vulcanizer Policy",
"lastUpdate": 1568039413558,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy finds lists all the applications and their CVEs if present.",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OWASP"
},
{
"key": "selectionHint",
"value": "DepChecker"
}
],
"_id": "BMCOPS_App_Vulcanizer_Policy"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS RDS",
"lastUpdate": 1568039413560,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check RDS database instance is not publically accessible and is enabled for data encryption and backup",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "RDS_DB_INSTANCES"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_RDS"
},
{
"orgId": "BMCOPS",
"name": "CIS Amazon Web Services Foundations Benchmark",
"lastUpdate": 1568039413962,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Amazon Web Services Foundations Benchmark"
}
],
"_id": "BMCOPS_CIS_Amazon_Web_Services_Foundations_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Amazon Web Services Three-tier Web Architecture Benchmark",
"lastUpdate": 1568039413963,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Amazon Web Services Three-tier Web Architecture v1.0.0, publihed on 29 nov 2016.",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Amazon Web Services Three-tier Web Architecture Benchmark"
}
],
"_id": "BMCOPS_CIS_Amazon_Web_Services_Three-tier_Web_Architecture_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - KMS",
"lastUpdate": 1568039414058,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers KMS recommendations settings on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_KMS"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Storage",
"lastUpdate": 1568039414072,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers overs recommendations around log buckets and Storage\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Storage"
},
{
"orgId": "BMCOPS",
"name": "CIS Microsoft Azure Foundations Benchmark",
"lastUpdate": 1568039414083,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Microsoft Azure Foundations Benchmark v1.0.0, published on 20 feb 2018.",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Microsoft Azure"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Azure Foundations Benchmark"
}
],
"_id": "BMCOPS_CIS_Microsoft_Azure_Foundations_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "Docker CVE-2019-5736",
"lastUpdate": 1568039414156,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "Docker CVE-2019-5736 CVEs",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "selectionHint",
"value": "custom-config"
}
],
"_id": "BMCOPS_Docker_CVE-2019-5736"
}
]
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 MS",
"lastUpdate": 1568039413958,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "Windows_2012_R2_MS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_MS"
},
{
"orgId": "BMCOPS",
"name": "GDPR Amazon Web Services Benchmark",
"lastUpdate": 1568039414157,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by The General Data Protection Regulation (EU) 2016/679.",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "GDPR"
},
{
"key": "benchmark",
"value": "General Data Protection Regulation (EU) 2016/679"
}
],
"_id": "BMCOPS_GDPR_Amazon_Web_Services_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "Kubernetes CVE-2018-1002105 CVE",
"lastUpdate": 1568039414158,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "Kubernetes CVE-2018-1002105 CVEs",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS , openshift"
}
],
"_id": "BMCOPS_Kubernetes_CVE-2018-1002105_CVE"
},
{
"orgId": "BMCOPS",
"name": "BMC OpenShift Benchmark - Worker",
"lastUpdate": 1568039413562,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended OpenShift worker settings defined by CIS Kubernetes Benchmark and OpenSCAP Security Guide",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OpenShift"
},
{
"key": "selectionHint",
"value": "openshift"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC OpenShift Benchmark"
}
],
"_id": "BMCOPS_BMC_OpenShift_Benchmark_-_Worker"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 DC",
"lastUpdate": 1568039413861,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "Windows_2012_R2_DC"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_DC"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2012 R2 MS for chef",
"lastUpdate": 1568039413956,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2012 R2 Security Configuration Benchmark Version 2.2.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2012 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2012_R2_MS_for_chef"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - GKE",
"lastUpdate": 1568039414057,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations addressing Google Kubernetes Engine (GKE) on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_GKE"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Network",
"lastUpdate": 1568039414059,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around networking on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Network"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Projects",
"lastUpdate": 1568039414064,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around projects on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Projects"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Sinks",
"lastUpdate": 1568039414072,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Sink on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Sinks"
},
{
"orgId": "BMCOPS",
"name": "PCI DSS Amazon Web Services Benchmark",
"lastUpdate": 1568039414158,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Payment Card Industry Data Security Standard 3.2.1",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "PCI DSS"
},
{
"key": "benchmark",
"value": "Payment Card Industry Data Security Standard 3.2.1"
}
],
"_id": "BMCOPS_PCI_DSS_Amazon_Web_Services_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS S3 Bucket",
"lastUpdate": 1568039413560,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check AWS S3 bucket is not publicly accessible",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "S3_BUCKETS"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_S3_Bucket"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 MS",
"lastUpdate": 1568039413662,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This template is created based on the recommended settings defined by Microsoft Windows Server 2008 Security Configuration Benchmark Version 2.1.0, published on December 3rd, 2013.",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "BSA"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_MS"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 R2 DC",
"lastUpdate": 1568039413665,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2008 R2 Security Configuration Benchmark Version 3.0.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_R2_DC"
},
{
"orgId": "BMCOPS",
"name": "CIS - Windows Server 2008 R2 MS",
"lastUpdate": 1568039413858,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Microsoft Windows Server 2008 R2 Security Configuration Benchmark Version 3.0.0, published on April 28th, 2016\nReference#:\nhttp://cisecurity.org\n",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Windows Server 2008 R2 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Windows_Server_2008_R2_MS"
},
{
"orgId": "BMCOPS",
"name": "CIS Docker 1.12.0 Benchmark",
"lastUpdate": 1568039413964,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy is created based on the recommended settings defined by CIS Docker 1.12.0 Benchmark Version 1.0.0, published on September 15th, 2016\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Docker 1.12.0 Benchmark"
}
],
"_id": "BMCOPS_CIS_Docker_1.12.0_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - IAM",
"lastUpdate": 1568039414058,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around IAM on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_IAM"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - SQL",
"lastUpdate": 1568039414065,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Cloud SQL Database Services on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_SQL"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Service Accounts",
"lastUpdate": 1568039414071,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around Service Account on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Service_Accounts"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS ElasticSearch",
"lastUpdate": 1568039413559,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check AWS Elastic Search domain does not have open access",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "ES_DOMAINS"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_ElasticSearch"
},
{
"orgId": "BMCOPS",
"name": "BMC OpenShift Benchmark - Master",
"lastUpdate": 1568039413561,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended OpenShift Master settings defined by CIS Kubernetes Benchmark and OpenSCAP Security Guide",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OpenShift"
},
{
"key": "selectionHint",
"value": "openshift"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC OpenShift Benchmark"
}
],
"_id": "BMCOPS_BMC_OpenShift_Benchmark_-_Master"
},
{
"orgId": "BMCOPS",
"name": "CIS - Red Hat Enterprise Linux 6",
"lastUpdate": 1568039413656,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by Red Hat Enterprise Security Configuration Benchmark Settings for Linux 6 Version 2.0.2, published on June 02, 2016\nReference#:\nhttp://cisecurity.org",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Server"
},
{
"key": "selectionHint",
"value": "CIS_RHEL_6"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Red Hat Enterprise Linux 6 Benchmark"
}
],
"_id": "BMCOPS_CIS_-_Red_Hat_Enterprise_Linux_6"
},
{
"orgId": "BMCOPS",
"name": "CIS Docker 1.13.0 Benchmark",
"lastUpdate": 1568039413967,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy is created based on the recommended Docker settings defined by CIS Docker 1.13.0 Benchmark Version 1.0.0, published on January 19th, 2017\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Docker 1.13.0 Benchmark"
}
],
"_id": "BMCOPS_CIS_Docker_1.13.0_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - DNS",
"lastUpdate": 1568039414057,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers recommendations around networking DNS on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_DNS"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - VM",
"lastUpdate": 1568039414073,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically recommendations around Virtual Machines on Google Cloud Platform.\nReference:\nhttps://workbench.cisecurity.org/benchmarks/429\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_VM"
},
{
"orgId": "BMCOPS",
"name": "CIS Kubernetes Benchmark - Master",
"lastUpdate": 1568039414073,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended kubernetes master settings defined by CIS Kubernetes Benchmark 1.2.0 \n\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Kubernetes Benchmark"
}
],
"_id": "BMCOPS_CIS_Kubernetes_Benchmark_-_Master"
},
{
"orgId": "BMCOPS",
"name": "CIS Kubernetes Benchmark - Worker",
"lastUpdate": 1568039414082,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended kubernetes worker settings defined by CIS Kubernetes Benchmark 1.2.0 \n\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Kubernetes"
},
{
"key": "selectionHint",
"value": "level1-linuxhostOS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Kubernetes Benchmark"
}
],
"_id": "BMCOPS_CIS_Kubernetes_Benchmark_-_Worker"
},
{
"orgId": "BMCOPS",
"name": "AWS CFN CaaS Portal",
"lastUpdate": 1568039413557,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "AWS policy for validating CAAS portal",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "CFN_PORTAL"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_AWS_CFN_CaaS_Portal"
},
{
"orgId": "BMCOPS",
"name": "App Vulcanizer Policy",
"lastUpdate": 1568039413558,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy finds lists all the applications and their CVEs if present.",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "OWASP"
},
{
"key": "selectionHint",
"value": "DepChecker"
}
],
"_id": "BMCOPS_App_Vulcanizer_Policy"
},
{
"orgId": "BMCOPS",
"name": "BMC AWS RDS",
"lastUpdate": 1568039413560,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "BMC recommended policy to check RDS database instance is not publically accessible and is enabled for data encryption and backup",
"version": "1.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "selectionHint",
"value": "RDS_DB_INSTANCES"
},
{
"key": "vendor",
"value": "BMC"
},
{
"key": "benchmark",
"value": "BMC AWS Best Practices"
}
],
"_id": "BMCOPS_BMC_AWS_RDS"
},
{
"orgId": "BMCOPS",
"name": "CIS Amazon Web Services Foundations Benchmark",
"lastUpdate": 1568039413962,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\n\nReference:\nhttp://cisecurity.org\n",
"version": "1.0.0",
"documentVersion": "717",
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Amazon Web Services Foundations Benchmark"
}
],
"_id": "BMCOPS_CIS_Amazon_Web_Services_Foundations_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Amazon Web Services Three-tier Web Architecture Benchmark",
"lastUpdate": 1568039413963,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Amazon Web Services Three-tier Web Architecture v1.0.0, publihed on 29 nov 2016.",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "AWS"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Amazon Web Services Three-tier Web Architecture Benchmark"
}
],
"_id": "BMCOPS_CIS_Amazon_Web_Services_Three-tier_Web_Architecture_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - KMS",
"lastUpdate": 1568039414058,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers KMS recommendations settings on Google Cloud Platform.\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_KMS"
},
{
"orgId": "BMCOPS",
"name": "CIS Google Cloud Platform Foundation Benchmark - Storage",
"lastUpdate": 1568039414072,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This policy specifically covers overs recommendations around log buckets and Storage\nReference:\nhttp://cisecurity.org\n",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "GCP"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Google Cloud Platform Foundation Benchmark"
}
],
"_id": "BMCOPS_CIS_Google_Cloud_Platform_Foundation_Benchmark_-_Storage"
},
{
"orgId": "BMCOPS",
"name": "CIS Microsoft Azure Foundations Benchmark",
"lastUpdate": 1568039414083,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "This Policy is created based on the recommended settings defined by CIS Microsoft Azure Foundations Benchmark v1.0.0, published on 20 feb 2018.",
"version": "1.0.0",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Microsoft Azure"
},
{
"key": "vendor",
"value": "CIS"
},
{
"key": "benchmark",
"value": "CIS Microsoft Azure Foundations Benchmark"
}
],
"_id": "BMCOPS_CIS_Microsoft_Azure_Foundations_Benchmark"
},
{
"orgId": "BMCOPS",
"name": "Docker CVE-2019-5736",
"lastUpdate": 1568039414156,
"userGroupId": "IDMService",
"userId": "IDMServiceUser",
"description": "Docker CVE-2019-5736 CVEs",
"documentVersion": 1,
"tags": [
{
"key": "provider",
"value": "Docker"
},
{
"key": "selectionHint",
"value": "custom-config"
}
],
"_id": "BMCOPS_Docker_CVE-2019-5736"
}
]
Request
Response details
To create a policy
- ==
API used: https://bmchelix-cloudopsapi.onbmc.com/v1/policies
Request
On the Authorization Tab, choose the Bearer Token authorization type from the menu and provide authorization parameters:
Request Body Example
{
"method": "POST",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policydocuments/evaluateFeed",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
},
"body":{
"name": "AWS CIS S3 fooPolicy3",
"yaml":"---\r\nauthor: \"BMC Software\"\r\nname: \"AWS CIS S3 Buckets\"\r\nversion: '1.2.0'\r\nbenchmark: \"CIS Amazon Web Services Foundations\"\r\nprovider:\r\n - AWS\r\nvendor:\r\n - CIS\r\ndescription: \"This Policy is created based on the recommended S3 settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\\n\\nReference:\\nhttp:\/\/cisecurity.org\\n\"\r\ndateOfCreation: \"Thu Feb 18 02:47:49 PST 2016\"\r\nselectionHint: S3_BUCKETS\r\nresourceSpec :\r\n expression : $.resources.[*]\r\n nameExpression : $.Name\r\n typeExpression : S3 Buckets\r\noriginSpec:\r\n expression : $\r\n nameExpression: $.origin\r\nexportedVariables:\r\n - Grantee_uris\r\n - region\r\n - inderminateReason\r\ngroups:\r\n -\r\n description: \"AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).\"\r\n id: 1\r\n name: \"2 Logging\"\r\n rules:\r\n -\r\n description: \"CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.\\n Note: This part of rule will check granted privileges to buckets.\\n Note: we are checking Public Access Block Configuration along with Acl and bucket policy\"\r\n id: 1\r\n name: \"2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BlockPublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicAcls\" AND\r\n ??BlockPublicPolicy?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicPolicy\" AND\r\n ??IgnorePublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.IgnorePublicAcls\" AND\r\n ??RestrictPublicBuckets?? assign \"$resource.PublicAccessBlockConfiguration.RestrictPublicBuckets\" AND\r\n if\r\n ??BlockPublicAcls?? does not equal true OR ??BlockPublicPolicy?? does not equal true OR ??IgnorePublicAcls?? does not equal true OR ??RestrictPublicBuckets?? does not equal true\r\n then\r\n ??Grantee_uris?? assign \"$resource.Grants[*].Grantee.URI\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AllUsers\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AuthenticatedUsers\" and\r\n ??statements?? assign \"$resource.Policies[*].Statement[*]\" AND\r\n if\r\n ??statements?? != null\r\n then\r\n foreach statement IN #statements#\r\n statement != null AND\r\n ??principal?? assign \"$statement.Principal\" and\r\n ??effect?? assign \"$statement.Effect\" and\r\n ??notPrincipal?? assign \"$statement.NotPrincipal\" and\r\n ??notResource?? assign \"$statement.NotResource\" and\r\n ??notAction?? assign \"$statement.NotAction\" and\r\n ( ??effect?? != \"Allow\" OR\r\n ??principal?? != \"*\" ) AND\r\n if\r\n ??notAction?? != null or\r\n ??notResource?? != null or\r\n ??notPrincipal?? != null\r\n then\r\n ??inderminateReason?? assign \"The Access Policy json contains unsupported elements such as - NotPrincipal, NotResource, NotAction\" and\r\n ??ManualReview?? > 0\r\n end\r\n end\r\n else\r\n ??statements?? != null\r\n end\r\n end\r\n end\r\n -\r\n description: \"S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.\"\r\n id: 2\r\n name: \"2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BucketLogging?? assign \"$resource.BucketLogging\" AND\r\n ??BucketLogging?? != null\r\n end" ,
"isUpdate": true
}
}
"method": "POST",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policydocuments/evaluateFeed",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
},
"body":{
"name": "AWS CIS S3 fooPolicy3",
"yaml":"---\r\nauthor: \"BMC Software\"\r\nname: \"AWS CIS S3 Buckets\"\r\nversion: '1.2.0'\r\nbenchmark: \"CIS Amazon Web Services Foundations\"\r\nprovider:\r\n - AWS\r\nvendor:\r\n - CIS\r\ndescription: \"This Policy is created based on the recommended S3 settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\\n\\nReference:\\nhttp:\/\/cisecurity.org\\n\"\r\ndateOfCreation: \"Thu Feb 18 02:47:49 PST 2016\"\r\nselectionHint: S3_BUCKETS\r\nresourceSpec :\r\n expression : $.resources.[*]\r\n nameExpression : $.Name\r\n typeExpression : S3 Buckets\r\noriginSpec:\r\n expression : $\r\n nameExpression: $.origin\r\nexportedVariables:\r\n - Grantee_uris\r\n - region\r\n - inderminateReason\r\ngroups:\r\n -\r\n description: \"AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).\"\r\n id: 1\r\n name: \"2 Logging\"\r\n rules:\r\n -\r\n description: \"CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.\\n Note: This part of rule will check granted privileges to buckets.\\n Note: we are checking Public Access Block Configuration along with Acl and bucket policy\"\r\n id: 1\r\n name: \"2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BlockPublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicAcls\" AND\r\n ??BlockPublicPolicy?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicPolicy\" AND\r\n ??IgnorePublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.IgnorePublicAcls\" AND\r\n ??RestrictPublicBuckets?? assign \"$resource.PublicAccessBlockConfiguration.RestrictPublicBuckets\" AND\r\n if\r\n ??BlockPublicAcls?? does not equal true OR ??BlockPublicPolicy?? does not equal true OR ??IgnorePublicAcls?? does not equal true OR ??RestrictPublicBuckets?? does not equal true\r\n then\r\n ??Grantee_uris?? assign \"$resource.Grants[*].Grantee.URI\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AllUsers\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AuthenticatedUsers\" and\r\n ??statements?? assign \"$resource.Policies[*].Statement[*]\" AND\r\n if\r\n ??statements?? != null\r\n then\r\n foreach statement IN #statements#\r\n statement != null AND\r\n ??principal?? assign \"$statement.Principal\" and\r\n ??effect?? assign \"$statement.Effect\" and\r\n ??notPrincipal?? assign \"$statement.NotPrincipal\" and\r\n ??notResource?? assign \"$statement.NotResource\" and\r\n ??notAction?? assign \"$statement.NotAction\" and\r\n ( ??effect?? != \"Allow\" OR\r\n ??principal?? != \"*\" ) AND\r\n if\r\n ??notAction?? != null or\r\n ??notResource?? != null or\r\n ??notPrincipal?? != null\r\n then\r\n ??inderminateReason?? assign \"The Access Policy json contains unsupported elements such as - NotPrincipal, NotResource, NotAction\" and\r\n ??ManualReview?? > 0\r\n end\r\n end\r\n else\r\n ??statements?? != null\r\n end\r\n end\r\n end\r\n -\r\n description: \"S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.\"\r\n id: 2\r\n name: \"2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BucketLogging?? assign \"$resource.BucketLogging\" AND\r\n ??BucketLogging?? != null\r\n end" ,
"isUpdate": true
}
}
Response
Failed to execute the [code] macro. Cause: [RuntimeError: maximum recursion limit exceeded]. Click on this message for details.
Request details
Response details
To update a policy
- ==
API used: https://bmchelix-cloudopsapi.onbmc.com/v1/policies
On the Authorization Tab, choose the Bearer Token authorization type from the menu and provide authorization parameters:Request
Request Body Example
{
"method": "POST",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policydocuments/evaluateFeed",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
},
"body":{
"name": "AWS CIS S3 fooPolicy3",
"yaml":"---\r\nauthor: \"BMC Software\"\r\nname: \"AWS CIS S3 Buckets\"\r\nversion: '1.2.0'\r\nbenchmark: \"CIS Amazon Web Services Foundations\"\r\nprovider:\r\n - AWS\r\nvendor:\r\n - CIS\r\ndescription: \"This Policy is created based on the recommended S3 settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\\n\\nReference:\\nhttp:\/\/cisecurity.org\\n\"\r\ndateOfCreation: \"Thu Feb 18 02:47:49 PST 2016\"\r\nselectionHint: S3_BUCKETS\r\nresourceSpec :\r\n expression : $.resources.[*]\r\n nameExpression : $.Name\r\n typeExpression : S3 Buckets\r\noriginSpec:\r\n expression : $\r\n nameExpression: $.origin\r\nexportedVariables:\r\n - Grantee_uris\r\n - region\r\n - inderminateReason\r\ngroups:\r\n -\r\n description: \"AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).\"\r\n id: 1\r\n name: \"2 Logging\"\r\n rules:\r\n -\r\n description: \"CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.\\n Note: This part of rule will check granted privileges to buckets.\\n Note: we are checking Public Access Block Configuration along with Acl and bucket policy\"\r\n id: 1\r\n name: \"2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BlockPublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicAcls\" AND\r\n ??BlockPublicPolicy?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicPolicy\" AND\r\n ??IgnorePublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.IgnorePublicAcls\" AND\r\n ??RestrictPublicBuckets?? assign \"$resource.PublicAccessBlockConfiguration.RestrictPublicBuckets\" AND\r\n if\r\n ??BlockPublicAcls?? does not equal true OR ??BlockPublicPolicy?? does not equal true OR ??IgnorePublicAcls?? does not equal true OR ??RestrictPublicBuckets?? does not equal true\r\n then\r\n ??Grantee_uris?? assign \"$resource.Grants[*].Grantee.URI\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AllUsers\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AuthenticatedUsers\" and\r\n ??statements?? assign \"$resource.Policies[*].Statement[*]\" AND\r\n if\r\n ??statements?? != null\r\n then\r\n foreach statement IN #statements#\r\n statement != null AND\r\n ??principal?? assign \"$statement.Principal\" and\r\n ??effect?? assign \"$statement.Effect\" and\r\n ??notPrincipal?? assign \"$statement.NotPrincipal\" and\r\n ??notResource?? assign \"$statement.NotResource\" and\r\n ??notAction?? assign \"$statement.NotAction\" and\r\n ( ??effect?? != \"Allow\" OR\r\n ??principal?? != \"*\" ) AND\r\n if\r\n ??notAction?? != null or\r\n ??notResource?? != null or\r\n ??notPrincipal?? != null\r\n then\r\n ??inderminateReason?? assign \"The Access Policy json contains unsupported elements such as - NotPrincipal, NotResource, NotAction\" and\r\n ??ManualReview?? > 0\r\n end\r\n end\r\n else\r\n ??statements?? != null\r\n end\r\n end\r\n end\r\n -\r\n description: \"S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.\"\r\n id: 2\r\n name: \"2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BucketLogging?? assign \"$resource.BucketLogging\" AND\r\n ??BucketLogging?? != null\r\n end" ,
"isUpdate": true
}
}
"method": "POST",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policydocuments/evaluateFeed",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
},
"body":{
"name": "AWS CIS S3 fooPolicy3",
"yaml":"---\r\nauthor: \"BMC Software\"\r\nname: \"AWS CIS S3 Buckets\"\r\nversion: '1.2.0'\r\nbenchmark: \"CIS Amazon Web Services Foundations\"\r\nprovider:\r\n - AWS\r\nvendor:\r\n - CIS\r\ndescription: \"This Policy is created based on the recommended S3 settings defined by CIS Amazon Web Services Foundations Version 1.2.0, published on 23 May 2018\\n\\nReference:\\nhttp:\/\/cisecurity.org\\n\"\r\ndateOfCreation: \"Thu Feb 18 02:47:49 PST 2016\"\r\nselectionHint: S3_BUCKETS\r\nresourceSpec :\r\n expression : $.resources.[*]\r\n nameExpression : $.Name\r\n typeExpression : S3 Buckets\r\noriginSpec:\r\n expression : $\r\n nameExpression: $.origin\r\nexportedVariables:\r\n - Grantee_uris\r\n - region\r\n - inderminateReason\r\ngroups:\r\n -\r\n description: \"AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).\"\r\n id: 1\r\n name: \"2 Logging\"\r\n rules:\r\n -\r\n description: \"CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.\\n Note: This part of rule will check granted privileges to buckets.\\n Note: we are checking Public Access Block Configuration along with Acl and bucket policy\"\r\n id: 1\r\n name: \"2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BlockPublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicAcls\" AND\r\n ??BlockPublicPolicy?? assign \"$resource.PublicAccessBlockConfiguration.BlockPublicPolicy\" AND\r\n ??IgnorePublicAcls?? assign \"$resource.PublicAccessBlockConfiguration.IgnorePublicAcls\" AND\r\n ??RestrictPublicBuckets?? assign \"$resource.PublicAccessBlockConfiguration.RestrictPublicBuckets\" AND\r\n if\r\n ??BlockPublicAcls?? does not equal true OR ??BlockPublicPolicy?? does not equal true OR ??IgnorePublicAcls?? does not equal true OR ??RestrictPublicBuckets?? does not equal true\r\n then\r\n ??Grantee_uris?? assign \"$resource.Grants[*].Grantee.URI\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AllUsers\" and\r\n ??Grantee_uris?? does not contain \"http:\/\/acs.amazonaws.com\/groups\/global\/AuthenticatedUsers\" and\r\n ??statements?? assign \"$resource.Policies[*].Statement[*]\" AND\r\n if\r\n ??statements?? != null\r\n then\r\n foreach statement IN #statements#\r\n statement != null AND\r\n ??principal?? assign \"$statement.Principal\" and\r\n ??effect?? assign \"$statement.Effect\" and\r\n ??notPrincipal?? assign \"$statement.NotPrincipal\" and\r\n ??notResource?? assign \"$statement.NotResource\" and\r\n ??notAction?? assign \"$statement.NotAction\" and\r\n ( ??effect?? != \"Allow\" OR\r\n ??principal?? != \"*\" ) AND\r\n if\r\n ??notAction?? != null or\r\n ??notResource?? != null or\r\n ??notPrincipal?? != null\r\n then\r\n ??inderminateReason?? assign \"The Access Policy json contains unsupported elements such as - NotPrincipal, NotResource, NotAction\" and\r\n ??ManualReview?? > 0\r\n end\r\n end\r\n else\r\n ??statements?? != null\r\n end\r\n end\r\n end\r\n -\r\n description: \"S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.\"\r\n id: 2\r\n name: \"2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket\"\r\n refNumber: ~\r\n severity: 9\r\n ruleExpression: |-\r\n ??region?? assign \"$resource.region\" and\r\n ??isCTBucket?? assign \"false\" AND\r\n ??Services?? assign \"$resource.Policies[*].Statement[*].Principal.Service\" AND \r\n if \r\n ??Services?? != null \r\n then\r\n foreach Service IN #Services#\r\n if\r\n ??Service?? equals \"cloudtrail.amazonaws.com\"\r\n then\r\n ??isCTBucket?? assign \"true\"\r\n end\r\n end\r\n end AND\r\n if\r\n ??isCTBucket?? equals \"true\" \r\n then\r\n ??BucketLogging?? assign \"$resource.BucketLogging\" AND\r\n ??BucketLogging?? != null\r\n end" ,
"isUpdate": true
}
}
Response details
To delete a policy
- ==
API used: https://bmchelix-cloudopsapi.onbmc.com/v1/policies/{policyName}
- Request
On the Authorization Tab, choose the Bearer Token authorization type from the menu and provide authorization parameters:
{
"method": "DELETE",
"url": "https://bmchelix-cloudopsapi.onbmc.com/v1/policies/AWS CIS S3 fooPolicy3",
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer <TOKEN>"
}
}
- Request
Response details
{"message":"Successfully deleted policy AWS CIS S3 fooPolicy3, the processed results related to this policy are being deleted and might take some time"}
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*