🔃 DORA Compliance Made Simple with CloudQuery

1. Understanding DORA #

• ICT Risk Management: Build a framework to identify, assess, and manage risks across all digital assets, including critical assets managed by third parties.
• Rigorous Incident Reporting: Quickly detect and report any IT incidents to reduce downtime.
• Regular Resilience Testing: Simulate disruptions to ensure systems can recover quickly.
• Manage Third-Party Risks: Hold vendors accountable for meeting security standards.
• Threat Intelligence Sharing: Partner with peers and regulators to stay ahead of threats.

1. Why a Unified Asset Inventory Matters #

• Automated Asset Discovery: Connect AWS, Azure, GCP, or other providers to your Cloud Asset Inventory, and CloudQuery catalogs every VM, database, and storage bucket out of the box. No more spreadsheets, custom scripts or manual tracking.
• SQL-Powered Insights: CloudQuery transforms raw cloud data into a queryable database so you can write custom SQL queries to pinpoint issues relevant to DORA. Want to know which resources are misconfigured or have outdated security settings? A few SQL statements can provide those answers as will be shown in the upcoming sections.
• Benchmark Against Best Practices: CloudQuery offers pre-built security and compliance policies based on standards like CIS and NIST, so you can use these policies to quickly assess your environment without having to write every query from scratch.

2. Building Your Cloud Asset Inventory #

3. Identify and Manage Risk with SQL Queries #

A. Identify Publicly Accessible Resources #

SELECT
 instance_id, instance_type, public_ip_address, region
FROM
 aws_ec2_instances
WHERE
 public_ip_address IS NOT NULL;

B. Audit S3 Bucket Policies #

SELECT
   b.name AS bucket_name,
   b.arn AS bucket_arn,
   p.policy_json AS access_details
FROM
   aws_s3_buckets AS b
LEFT JOIN
   aws_s3_bucket_policies AS p
ON
   b.arn = p.bucket_arn
WHERE
   JSONExtractString(p.policy_json, 'Statement[0].Principal') = '*'
   OR JSONExtractString(p.policy_json, 'Statement[0].Effect') = 'Allow';

C. Identify Untagged Resources #

SELECT
    cloud, account, name, region, resource_type
FROM
    cloud_assets
WHERE
    tags = '{}'
    OR tags is null;

D. Check RDS Backup Configurations #

SELECT
    db_instance_arn, backup_retention_period, region
FROM
    aws_rds_instances
WHERE
    backup_retention_period = 0;

4. Leverage Security & Compliance Policies #