CloudSploit version 3.2.0 introduces the most latest version on 2023-12-08. The update includes new category plugins for Azure Media Services and Service Bus for Azure. And new category plugins for Bedrock for AWS. Along with this there are new plugins for existing services of Azure, AWS with the hotfixes and enhancements in the existing plugins. The details are as follows.
New Plugins
AWS
Bedrock
- Custom Model Encryption Enabled
- Private Custom Model
- Custom Model In VPC
- Bedrock Model Invocation Logging Enabled
Azure
Application Gateway
- Application Gateway SSL Policy
- Application Gateway Security Logging
- Application Gateway Request Body Inspection
Front Door
- Front Door HTTPS only
- Front Door Security Logging
- Front Door Waf Enabled
- Front Door WAF Bot Protection
- Front Door Request Body Inspection
- Front Door WAF Detection Mode
- Front Door WAF Rate limit
- Front Door Domain Managed DNS
Media Services
- Media Services Public Access Disabled
- Media Services Diagnostic Logs Enabled
- Media Services Managed Identity Enabled
- Media Services Storage Account Managed Identity
- Media Services Classic API Disabled
PostgreSQL Server
- PostgreSQL Flexible Server SCRAM Enabled
- PostgreSQL Diagnostic Logging Enabled
- PostgreSQL Minimum TLS Version
- PostgreSQL Server Private Endpoints Configured
- PostgreSQL Encryption At Rest with BYOK
- PostgreSQL Flexible Server Services Access Disabled
- PostgreSQL Flexible Server Diagnostic Logging
Redis Cache
- Redis Cache Private Endpoint
Service Bus
- Namespace Encryption At Rest with CMK
- Namespace Minimum TLS Version
- Namespace Local Authentication Disabled
- Namespace Logging Enabled
SQL Databases
- Transparent Data Encryption Enabled
- Database Private Link Enabled
- Ledger Automatic Digest Storage
- Database Secure Enclaves Encryption Enabled
- Database Ledger Enabled
- SQL Databases Data Masking Enabled
SQL Server
- Microsoft Support Operations Auditing Enabled
- Server Outbound Networking Restricted
Virtual Machines
- VM vTPM Enabled
- VM Security Type
- VM Secure Boot Enabled
- VM Disks Deletion Config
Hot fixes and enhancements
Aws
- All Open Ports Plugins
Added settings to check for associated ENIs with open ports security groups. Enabling this setting produces fail result. if ENI is exposed to public. - S3 Bucket Has Tags
Updated the plugin to produce the result on regional basis instead of global. - SSM Managed Instances
Updated the plugin to produce pass results if the instance is not in running state.
Azure
- Client Certificates Enabled
When HTTP version 2.0 is enabled, client certificates are ignored by default from azure. Updated the plugin to only check for Client Certificates when HTTP2.0 is not enabled. In case of HTTP2.0 plugin produces pass result.