Network security requirements

1. View the organizations available to you and copy the required ID:

   yc organization-manager organization list
   

2. Run the command to find all VMs without associated security groups:

   export ORG_ID=<organization ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id');
   do for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id');
   do echo "VMs without SG in FOLDER_ID " $FOLDER_ID ":" && yc compute instance list --folder-id=$FOLDER_ID --format=json |
   jq -r '.[] | select( (.network_interfaces[].security_group_ids | length) == 0 ) | .id' \
   && echo "-----"
   done;
   done
   

3. If the result is empty or does not contain virtual machine IDs, the check is passed. If VMs without associated security groups are found, proceed to "Guides and solutions to use".

1. See what organizations are available to you and write down the ID you need:

   yc organization-manager organization list
   

2. Run the command below to search for folders with no security group:

   export ORG_ID=<organization_ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id'); do
     for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); do
       echo "Checking FOLDER_ID " $FOLDER_ID ":"
       for NET_ID in $(yc vpc network list --folder-id=$FOLDER_ID --format=json | jq -r '.[].id'); do
         USER_SGS=$(yc vpc security-group list --folder-id=$FOLDER_ID --format=json | jq -r "[.[] | select(.network_id == \"$NET_ID\" and .default_for_network != true)] | length")
         if [ "$USER_SGS" -eq "0" ]; then
           echo "Network $NET_ID has NO custom security groups!"
         fi
       done
       echo "-----"
     done
   done
   

3. If the script does not output any networks with missing security groups, the check is passed. Otherwise, proceed to "Guides and solutions to use".

1. See what organizations are available to you and write down the ID you need:

   yc organization-manager organization list
   

2. Find security groups with a dangerous access rule:

   export ORG_ID=<organization_ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id'); do
     for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); do
       echo "Checking SG in FOLDER_ID " $FOLDER_ID ":" && yc vpc security-group list --folder-id=$FOLDER_ID --format=json | \
       jq -r 'map(select(
         .rules != null and (
           .rules[] | select(
             .direction == "INGRESS" and
             (.ports == null or .ports.to_port == "65535" or .ports.to_port == null) and
             .cidr_blocks != null and
             .cidr_blocks.v4_cidr_blocks != null and
             (.cidr_blocks.v4_cidr_blocks | index("0.0.0.0/0") != null)
           )
         )
       )) | .[].id' \
       && echo "-----"
     done
   done
   

3. If an empty string is output, the recommendation is fulfilled. If you see a list of security group IDs, proceed to the "Guides and solutions to use".

1. See what organizations are available to you and write down the ID you need:

   yc organization-manager organization list
   

2. Run the command below to search for security groups with dangerous access rules:

   export ORG_ID=<organization_ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id'); do
     for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); do
       echo "SG_ID: " && yc vpc security-group list --folder-id=$FOLDER_ID \
       --format=json | jq -r '.[] | select(.rules[].direction=="INGRESS" and (.rules[].ports.to_port=="22" or .rules[].ports.to_port=="3389" or .rules[].ports.to_port=="21") and .rules[].cidr_blocks.v4_cidr_blocks[]=="0.0.0.0/0")' | jq -r '.id' \
       && echo "FOLDER_ID: " $FOLDER_ID && echo "-----"
     done
   done
   

3. If there is an empty value for SG_ID next to FOLDER_ID, the recommendation is fulfilled. If the SG_ID is not empty, proceed to "Guides and solutions to use".

1. See what organizations are available to you and write down the ID you need:

   yc organization-manager organization list
   

2. Find external public IP addresses without basic protection (Qrator):

   export ORG_ID=<organization_ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id'); do
   for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); do
   yc vpc address list --folder-id=$FOLDER_ID --format=json | jq -r 'map(select(
   .external_ipv4_address != null and
   (.external_ipv4_address.requirements == null or .external_ipv4_address.requirements.ddos_protection_provider != "qrator")
   )) | .[].address'
   done
   done
   

3. Find SWS (L7) profiles:

   export ORG_ID=<organization_ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id'); do
   for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); do
   yc smartwebsecurity security-profile list --folder-id=$FOLDER_ID --format=json | jq -r '.[].id'
   done
   done
   

1. View the list of available organizations and copy the ID of the one you need:

   yc organization-manager organization list
   

2. Run this command to check if OS Login is on at the organization level:

   yc organization-manager oslogin get-settings --organization-id <organization_ID> --format json | jq -r '.ssh_certificate_settings.enabled'
   

   If the command returns true, the OS Login functionality is enabled globally. If false or null, look up the guide.

Contact your account manager to find out if you have Cloud Interconnect activated. If yes, check if remote access is used.

1. See what organizations are available to you and write down the ID you need:

   yc organization-manager organization list
   

2. Run the command below to search for all VMs with public IPs:

   export ORG_ID=<organization ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id');
   do for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id');
   do echo "VM_ID in FOLDER_ID " $FOLDER_ID ":" && yc compute instance list --folder-id=$FOLDER_ID --format=json | jq -r '.[]
   | select(.network_interfaces[].primary_v4_address.one_to_one_nat.address)' | jq -r '.id' \
   && echo "-----"
   done;
   done
   

3. If there is an empty value for VM_ID next to FOLDER_ID, the recommendation is fulfilled. Otherwise, proceed to Guides and solutions to use.

4. Run the command below to see if there is Egress NAT (NAT gateway):

   export ORG_ID=<organization ID>
   for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id');
   do for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); \
   do echo "NAT_GW in FOLDER_ID " $FOLDER_ID ":" && yc vpc gateway list --folder-id=$FOLDER_ID --format=json | jq -r '.[] |
   select(.id)' | jq -r '.id' && echo "-----"
   done;
   done
   

5. If an empty value is set in NAT_GW next to FOLDER_ID, the recommendation is fulfilled. Otherwise, proceed to Guides and solutions to use.