Release Notes¶

Fugue ensures that cloud infrastructure stays in continuous compliance with enterprise security policies.

2020.05.12¶

Support for CIS Controls 7.1¶

Fugue has added support for the CIS Controls 7.1 compliance family. CIS Controls are a set of actions for cyber defense based on common attack patterns, created by a group of experts such as NSA Red and Blue teams, the US Department of Energy nuclear energy labs, and law enforcement organizations. Refer to Compliance for more information on how to get started using the CIS Control compliance family.

Visualizer Updates¶

Updates include:

Added support for AWS Redshift and AWS EFS
Exporting a diagram of the visualizer now lists AWS regions
Added resource details for stubbed/implicit resources

Updates to Compliance Terminology¶

Fugue has updated terminology in our web user interface to provide more clarity on compliance across resources, rules, and controls.

Changes include:

Adjusting terminology to “controls” (from “rules”), where the product is referring to compliance controls.
Updating control evaluations and resource evaluations to have compliant/noncompliant values, as opposed to pass/fail.
Terminology definitions and explanations of how compliance evaluations are calculated are enumerated on the Compliance page.

2020.04.29¶

Scoping Environments to Multiple Regions¶

You can now create an AWS environment that spans multiple regions, as shown below. For more information on creating an environment that scans multiple regions, refer to Setup - AWS & AWS GovCloud.

Note: You cannot add multiple regions to existing environments. You need to create new environments through the API or UI. Once you have created the new environments, you can update their selected regions through the API. Refer to the AWS User Guide for more information.

You can filter by region on the Compliance by Resource page, as shown below.

When an environment contains more than one region, horizontal brackets labeled by region separate the infrastructure. Global resources, such as the CloudFront distributions below, are labeled global. Refer to Visualizer for more information.

Responsive Registration Page and More¶

The Registration and Forgot Password pages are now responsive, as shown below.

Visualizer Updates¶

Compliance view updates
New References portion in resource details panel

The entire VPC or VNet is no longer shaded all red when it has compliance violations, as shown below. Refer to Visualizing Resource Compliance State for more information.

When you select a resource to view the resource details, a References panel is added, which lists other resources related to the currently selected resource. For example, if you select a VPC, it lists the associated security groups, subnets, networks, and internet gateways. You can click on a resource listed in the Reference section and it redirects you to that resource, as shown below. Refer to Viewing Resource Details for more information.

2020.04.16¶

Role Based Access Control (RBAC)¶

Fugue added a new RBAC policy – Editor. The Editor policy grants all the permissions in the Read Only policy and some of the permissions in the Admin policy. Editors cannot create or delete environments, configure custom rules, manage users, or configure API clients. They can, however, take actions such as changing environment settings, running scans, and configuring notifications and reports. For more information on working with RBAC, refer to Role-Based Access Control.

Cloud Resource Visualization¶

Cloud resource visualization now supports visualizing VPC gateway endpoints (refer to our blog post on Cloud Network Security 101: AWS VPC Endpoints for more information on security for VPC endpoints). VPC gateway endpoints (ENDPT) are shown as a line between a VPC and all S3 buckets or all DDB tables in the same region, as shown below. Refer to Visualizer for more information on working with cloud resource visualization.

_images/viz-vpc-endpoint-buckets-annotated.png

2020.04.07¶

UX Improvements¶

In the environment search field, you can enter spaces when searching for an environment, as shown below:

Rule Engine Upgrade¶

All rules evaluated by Fugue now use the open source Fugue Regot Toolkit, also known as Fregot. This yields performance improvements that will increase scan speeds for some large environments. Check out Fregot on GitHub.

New IAM Permissions Required¶

Due to internal upgrades, additional permissions are needed to scan or enforce any of the following AWS services:

CloudWatch
ECR
EFS
MediaStore
S3
SNS
SSM
Step Functions (SFN)
WAF

If your environments are configured to scan or enforce any of these services, you should update your IAM role policy to include these read-only permissions for the services you’ve enabled:

"cloudwatch:ListTagsForResource",
"ecr:ListTagsForResource",
"elasticfilesystem:DescribeLifecycleConfiguration",
"mediastore:ListTagsForResource",
"s3:GetBucketObjectLockConfiguration",
"sns:ListTagsForResource",
"ssm:GetDocument",
"states:ListTagsForResource",
"waf:GetLoggingConfiguration",
"waf:ListTagsForResource",

If these permissions are not included, scans will not fail; however, you may see an Incomplete Scan Results message.

For instructions, see How To: Update the Fugue IAM Role.

For more information about how Fugue handles IAM permissions, see IAM Policy Permissions.

Compliance Event Notifications¶

Previously, Fugue generated notifications when the following events occurred:

Existing resource transitions from compliant to noncompliant, or vice versa
Newly added resource is noncompliant
Existing resource that was missing data transitions to compliant, or vice versa
Existing resource that was missing data transitions to noncompliant, or vice versa

We are changing notifications logic to only summarize events where:

Existing resource transitions from compliant to noncompliant, or vice versa
Newly added resource is noncompliant

Bug Fixes¶

Fixed scan failure when no resources were detected in an environment and drift detection was enabled.
Improved the rules that check for inappropriate port 80 and 5800 ingress to work with ELBv2 and to describe what additional resources are relevant to the failure, if any.

2020.03.17¶

The visualizer now allows selection of VPCs and auto-scaling groups (ASGs) in order to view the resource configuration details for those types.
Fugue now supports indicating a resource is transient in nature. When a resource is tagged with the key fugue:transient and value true in AWS or Azure, drift events are not generated for changes to that resource. This is useful in situations where resources are created and destroyed dynamically.

AWS:

Azure:

2020.03.03¶

On-Demand Scan via the UI¶

Previously, you could only kick off an on-demand scan via the API. Now, Fugue enables you to use the UI to initiate on-demand scans. From the Actions drop-down, select Start New Scan within an environment to start a scan, as shown below.

Cloud Resource Visualization – View Resource Details¶

You can view configuration details about your resources within the cloud resource visualization. To view the resource details, zoom in and click on a resource, as shown below. See Visualizer for more information.

UX Improvements to Settings and Setting a Baseline¶

The Establish Baseline button and Settings are under the new Actions button, as shown below.

Bug Fixes¶

A bug has been resolved where the custom rule family would still display within an environment even after you delete all custom rules. Now if you delete all custom rules, the custom rule family no longer displays.

Removed Obsolete VPC Flow Logs Rule¶

The rules for confirming VPC flow logs are correctly enabled have been updated. Overall compliance results will remain unchanged; however, you may see compliance events relating to this change to the underlying rules.

2020.02.14¶

Cloud Resource Visualization – Collections & Additional Resource Support¶

An improvement has been made to cloud resource visualization to illustrate a resource that contains other resources, and this is known as a collection. For example, AWS auto scaling groups containing EC2 instances, and ECS services containing tasks, are rendered as collections. A collection is depicted as a square with a thick border containing zero or more nodes. Collections may also be expanded or collapsed to view individual nodes.

Additionally, the cloud resource visualizer now supports visualizing AWS.ECS.Task resources, as well as AWS.EC2.Instance resources belonging to auto scaling groups.

Rule Updates¶

The CIS 1-16 rule was updated to be more comprehensive by flagging users with inline policies.

2020.01.31¶

Additional AWS Resources - Beta¶

Fugue launched support for resources in the following AWS services:

Systems Manager
Directory Service
Kinesis
Kinesis Data Firehose
Elastic File System
Inspector
ACM PCA
Glacier

If you are interested in gaining access to these beta resources, please email support@fugue.co.

Bug Fixes¶

The release also includes fixes including:

Ability to query by the “custom” family when retrieving compliance using the API
Optimize a Fugue Best Practices rule that ran slowly in some environments
Allow values greater than or equal to 24 for the CIS 1-10 password reuse control
Fix drift detection with some Cognito User Pool Clients, KMS grants, and Load Balancer Listener Rules

2020.01.13¶

Cloud Resource Visualization – Keyboard Shortcuts¶

The visualizer supports keyboard shortcuts. These shortcuts include:

Arrow Keys: Pan around the visualizer.
Plus (Equals) / Minus (Underscore) Keys: Zoom in and out.
Period Key: Open/close the sidebar.
Spacebar (Double Tap): Recenter the visualizer.

Multi-Factor Authentication Support (MFA)¶

Fugue supports multi-factor authentication (MFA). After you enable MFA, the next time you log in, you are prompted to scan a QR code using an authenticator app, as shown below. When you log into Fugue anytime subsequently, you are prompted to enter a one-time code after authenticating:

2019.12.23¶

Cloud Resource Visualization - Export Functionality¶

Improvements have been made to the export functionality for cloud resource visualization. When you export a .PNG of resources, the environment name, date/time of the scan, and account ID for AWS or subscription ID for Azure are included, as shown below. This makes it easier to identify the environment that you are looking at.

Additionally, the image filename includes the name of the environment, as well as the date/time of the scan.

Cloud Resource Visualization - VPC Peering¶

Cloud resource visualization now shows VPC peering, as shown below. This allows you to see which VPCs have peering relationships.

Search By Environment¶

The All Environments landing page now allows you to search by environment name or ID:

2019.11.21¶

Rule Remediation Steps in Documentation¶

The online documentation includes rule remediation steps for many common compliance violations. Follow the steps to manually bring resources back into compliance using the AWS Management Console, AWS CLI, Azure Portal, or Azure CLI. For the list of rule remediation steps, refer here.

Exporting Visualizer Diagrams and Customizing Your Visualizer View¶

You can export an image of your Fugue visualized environment, as well as customize what information displays within the visualizer, such as compliance information, and collapse/expand all groups. See Exporting a Diagram.

Ability to Delete User Groups¶

You can delete user groups, as shown below. See How to Delete Groups.

_images/rbac-delete-groups-release-notes.png

Fugue Developer and Fugue Enterprise¶

Fugue is now available in two plans: Developer and Enterprise. For more information, see the documentation in Fugue Plans.

New Account Overview Page¶

The Account Overview page lists your plan type, which is Enterprise for existing customers. Refer to the online documentation for more information.

2019.10.31¶

Single Sign-On (Beta)¶

Fugue is excited to announce support for single sign-on (SSO) in beta. SSO allows users to provision and deprovision users from an existing identity provider (IdP).

The Fugue login page is changing, as shown below. Non-SSO users enter their username and password to log into Fugue:

Once SSO is enabled on your organization, users enter their email address and log into Fugue using your IdP. If you are interested in gaining access to SSO beta, please contact support@fugue.co.

Additional Compliance Family Support for Azure¶

Fugue now supports the following compliance families for Azure: ISO 27001, SOC 2, HIPAA, GDPR, NIST SP 800-53, and PCI-DSS.

Fugue Best Practices¶

Fugue released a set of Best Practices checks to complement existing controls to detect critical misconfigurations that can be exploited.

Some rules that are part of the Fugue Best Practices compliance family include:

IAM policies should not allow broad list actions on S3 buckets
IAM role trust policies should not allow all principals to assume the role
IAM roles attached to instance profiles should not allow broad list actions on S3 buckets
S3 bucket policies should not allow all actions for all principals
S3 bucket policies should not allow list actions for all principals
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9200 (Elasticsearch)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9300 (Elasticsearch)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 2379 (etcd)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27017 (MongoDB)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27018 (MongoDB)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27019 (MongoDB)

2019.10.17¶

Expanded AWS Service Coverage¶

Fugue now supports the following AWS services:

ACM
API Gateway
Cognito
ECR
ECS
EKS
Guard Duty
Lambda
Macie
MediaStore
RedShift
Route53
Step Functions (SFN)
Secrets Manager
S3: Attributes to block public access

To start scanning for these newly supported services, you should either:

Option 1: Launch a new CloudFormation stack that contains the SecurityAudit read-only policy and add the following resources listed below as part of your inline policy:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Action": [
               "apigateway:GET",
               "cloudwatch:GetDashboard",
               "cloudwatch:ListDashboards",
               "cognito-idp:DescribeIdentityProvider",
               "cognito-idp:DescribeResourceServer",
               "cognito-idp:DescribeUserPool",
               "cognito-idp:DescribeUserPoolClient",
               "cognito-idp:DescribeUserPoolDomain",
               "cognito-idp:GetGroup",
               "cognito-idp:ListGroups",
               "cognito-idp:ListIdentityProviders",
               "cognito-idp:ListResourceServers",
               "cognito-idp:ListUserPoolClients",
               "dynamodb:ListTagsOfResource",
               "elasticache:ListTagsForResource",
               "lambda:GetAlias",
               "lambda:GetEventSourceMapping",
               "lambda:GetFunction",
               "macie:ListMemberAccounts",
               "macie:ListS3Resources",
               "mediastore:DescribeContainer",
               "s3:ListBucket",
               "secretsmanager:DescribeSecret",
               "sns:GetSubscriptionAttributes",
               "sns:ListSubscriptions",
               "states:DescribeStateMachine",
               "waf:GetWebACL"
           ],
           "Resource": "*",
           "Effect": "Allow",
           "Sid": "0"
       }
   ]
}

Option 2: Update your existing AWS IAM policy to include the SecurityAudit read-only policy if it is already not attached and add the following resources listed below as part of your inline policy:

Refer to AWS IAM Permissions and Add an Inline Policy for more information.

Updates to the Visualizer¶

Added the ability to pinch on your trackpad to zoom in and out on the visualizer.

2019.10.03¶

Custom Rules¶

Users can now write custom rules to extend Fugue functionality to specific enterprise requirements, with CRUD actions and syntax/testing available via UI, API, and CLI.
Custom rules are written with Open Policy Agent’s Rego query language. OPA is a policy-as-code framework and CNCF open source project commonly used for policy on Kubernetes and other cloud technologies.

CLI¶

Fugue now supports CLI functionality, with feature parity with our API.

Visualizer¶

Collapsed nodes that have a mix of compliant and non compliant resources display as stacks with red and black coloring, as highlighted below:

2019.09.13¶

Visualizer updates¶

Visualizer UX improvements — Added an expand icon and number of resources that exist within a collapsed node. For example, if you have 13 S3 buckets collapsed in a node, the number 13 is shown, as shown below. Clicking the icon expands the collapsed S3 buckets.

Clicking the (warning) icon displays the compliance violations for a resource.
Clicking on a subnet or security group within a node or on the list on the side, highlights all the places within your infrastructure where the security group or subnet resides, as shown below.

Displaying the compliance violations for subnets and security groups.
Performance improvements

IAM role generation updates¶

Updates to IAM role generation for read-only permissions, which allows Fugue to scan and detect drift for your environments. When you create a new IAM role utilizing the Fugue UI, the Security Audit read-only policy is attached to the role along with inline policies to cover other permissions that are not covered by the Security Audit policy. If you have existing environments, you can continue to use your existing IAM role as is or choose to attach the SecurityAudit policy and remove the inline policies covered by the Security Audit policy.

2019.08.23¶

Updates to the navigation within the Environment Details page— the visualizer is located on its own page, Environment Settings have been moved to the top level navigation, and the Drift Events page is renamed to Events.

Updates to the user interface. The Organizations tab is now located at the same level as Environments and updates were made to the environment cards, as shown below. Additionally, on the Environment Landing page, selecting View in Visualizer redirects users to the Visualizer page.

_images/release-notes-environments-page.png

Baseline enforcement is now supported for Azure.
Displaying compliance errors within the visualizer on VPC.
The /resources API endpoint now requires authorization. Previously, users were able to hit this endpoint without authenticating with Fugue. To use the /resources endpoint authentication is now required.

2019.08.07¶

Docs site: The Fugue Documentation site has been redesigned, moved to https://docs.fugue.co, and features the following new content:
- Getting Started: Tutorial
- Example: Fugue Notifications in Slack
The visualizer includes security group and subnet labeling within VPCs. This makes it easier to identify which security groups and subnets are associated with a particular VPC, as shown below. To learn more about the visualizer, refer here.

The visualizer “full screen” fills the browser window, rather than the entire screen.
The visualizer supports Azure, as shown below.

Azure notifications are available to alert on compliance, drift, and baseline enforcement events. To get started using notifications, refer here.
Fixed an issue with the CIS AWS 2-5 rule: “Ensure AWS Config is Enabled in all Regions.”

2019.07.08¶

Visualization: Cloud resource visualization displays resources that are not compliant within an environment, as shown below:

Expanded rule coverage:
- IAM root account should not be used. Corresponds to the following compliance controls:
  - ISO27001_A.6.1.2;ISO27001_A.9.2.3;ISO27001_A.9.4.1
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-1
  - HIPAA_§164.308(a)(1)(ii)(D);HIPAA_§164.308(a)(6)(i);HIPAA_§164.312(b)
  - GDPR_30-(1)
- Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password. Corresponds to the following compliance control:
  - CIS_AWS_1.2.0_1-2
- Ensure credentials unused for 90 days or greater are disabled. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.2.4;ISO27001_A.9.3.1
  - SOC2_CC6.1;SOC2_CC6.2;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-3
  - NIST-800-53_IA-4d;NIST-800-53_IA-4d
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1):HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.1.4
- Ensure access keys are rotated every 90 days or less. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.2.4;ISO27001_A.9.3.1
  - SOC2_CC6.1;SOC2_CC6.2;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-4
  - NIST-800-53_IA-4d;NIST-800-53_IA-5 (1)(d)
  - HIPAA_§164.308(a)(5)(ii)(D);HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.2.4
- Ensure no root account access key exists. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-12
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1)
  - PCI_DSS_8.1
- Ensure hardware MFA is enabled for the “root” account. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1;ISO27001_A.9.4.1;ISO27001_A.9.4.3
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-14
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1)
- Ensure MFA is enabled for the “root” account. Corresponds to the following compliance controls:
  - SO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1;ISO27001_A.9.4.1;ISO27001_A.9.4.3
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-13
  - NIST-800-53_IA-2 (1)
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.1
Expanded service coverage: Fugue now supports the following resource: IAM.CredentialReport. To start scanning for IAM.CredentialReport, update your Fugue IAM role to include:

"iam:GenerateCredentialReport",
"iam:GetCredentialReport",
"iam:ListVirtualMFADevices"

Refer to the Service Coverage page to see the full list of supported service coverage. If you have any questions, reach out to support@fugue.co.

Improvements to the Compliance by Resource modal: The compliance controls that fail are displayed under the description of the rule, as shown below:

2019.07.03¶

Features¶

Support for Azure: Cloud service coverage is being expanded to include Azure in addition to AWS. This makes Fugue a multi-cloud solution. For setup instructions, see Setup - Azure. For general information, see Azure.

2019.06.26¶

Features¶

Notifications: Fugue offers notifications for compliance, drift, and baseline enforcement events within environments, allowing you to be alerted to infrastructure changes detected during a scan without having to log into Fugue.

Within Organization Settings, you may add notifications and choose to be notified by email, AWS SNS topic, or both. By using the SNS integration, you can connect Fugue notifications to third-party tools such as Slack.

Full screen visualizer: You can expand cloud resource visualization to a full screen view. This allows you to better interact with and view your infrastructure. Clicking the f button, as highlighted below, opens the full screen visualization experience.

Here’s an example of full screen mode:

Updates to the “Create Environment” workflow: The “create environment” workflow has been updated as follows. In the first step, you enter your environment’s name and select the cloud service provider:

In the second step, you select the region and resource types, and then enter the AWS IAM role ARN:

In the third step, you select the compliance libraries you want Fugue to use to assess your infrastructure:

In the fourth step, you can view a summary of the environment name, region, AWS IAM role ARN, the selected compliance standards, and the selected resource types to scan and enforce, as shown below:

For full setup instructions, see Setup.

2019.06.10¶

Fugue Risk Manager is now simply Fugue.

Features¶

AWS GovCloud regions: Fugue now supports AWS GovCloud regions via the Fugue application and API. All existing functionality for other commercial AWS regions is supported for AWS GovCloud regions including:
- Assess AWS GovCloud regions for compliance violations against the following compliance standards: CIS AWS, NIST SP 800-53, PCI-DSS, HIPAA, GDPR, SOC 2, and ISO 27001.
- Enable configuration drift detection and optionally, enforcement on baselines.
Cloud resource visualization: Fugue’s new cloud resource visualization feature creates detailed, interactive diagrams of your cloud resources. This allows you to quickly visualize cloud infrastructure configurations and relationships without having to create diagrams by hand, which can be a painstaking and error-prone process. Diagrams are generated and updated automatically. You can zoom in or out to more closely inspect the resources:

Improved compliance control messages: The compliance control message contains additional information about what caused a resource to be noncompliant and violate the control, as shown below.

_images/ImprovedComplianceFailureMessage.png

2019.05.29¶

Features¶

Added service coverage support for ElastiCache.Cluster, ElastiCache.ParameterGroup, and ElastiCache.ReplicationGroup resources.
- To scan for ElastiCache clusters, parameter groups, and replication groups, update your Fugue IAM role to include the following permissions:

"elasticache:DescribeCacheClusters",
"elasticache:DescribeCacheParameterGroups",
"elasticache:DescribeCacheParameters",
"elasticache:DescribeReplicationGroups",
"elasticache:ListTagsForResource"

Note

When ElastiCache.Cluster resources belong to an ElastiCache.ReplicationGroup, the clusters themselves are not scanned but the replication group is. The replication group manages the clusters and contains all of the relevant settings, so there is no need to scan the clusters individually.

In contrast, ElastiCache clusters that do not belong to a replication group are scanned individually.

Refer to the Service Coverage page to see the full list of supported services. If you have any questions, reach out to support@fugue.co.

Created the Fugue API Reference, which contains Swagger documentation and examples.

2019.05.09¶

Features¶

Added service coverage support for AWS S3 bucket ACLs. The new functionality will provide more protection for S3 buckets.
- Users who have enabled scanning on S3 buckets must update their Fugue IAM role to include the following permission, or scans involving S3 buckets will be incomplete:

"s3:GetBucketACL"

If you have any questions, reach out to support@fugue.co.

Added service coverage support for SNS subscriptions and CloudWatch Metric Alarms.
- To scan for SNS subscriptions and CloudWatch Metric Alarms, update your Fugue IAM role to include the following permissions:

"cloudwatch:DescribeAlarms",
"sns:GetSubscriptionAttributes",
"sns:ListSubscriptions"

Refer to the Service Coverage page to see the full list of supported services. If you have any questions, reach out to support@fugue.co.

Added support for SOC 2 and ISO 27001 compliance standards.
- SOC 2 governance applies to organizations storing customer data in the cloud.
- ISO 27001 is a specification for an information security management system that includes controls for information risk management processes.

Bug Fixes and Improvements¶

Fugue automatically logs users out of the application every 24 hoursinstead of once a month.
Other bug fixes and improvements.

2019.04.25¶

Features¶

Improved API Clients table to display the client secret age and last activity of the API client. In the previously released API Clients table, the client secret’s age and the last activity of the client secret did not display within the table. It is important to know your client secret’s age so you can properly rotate it according to your organization’s security policy. Additionally, displaying the last activity for the client secret allows you to revoke and/or delete client secrets that are no longer in use. For more information, see the API page.

Improved page load times of the environment list and environment detail pages
Improved link to “Edit IAM Role in AWS Console” to point directly to list of roles in the console

Bug Fixes¶

Fixed an issue where the list compliance results by rule API endpoint would return no results when no compliance family was selected
Various scan fixes

2019.03.28¶

Features¶

The API has 4 main areas of functionality:
- Create, update, and delete environments
- Run scans on demand or on a specific schedule
- Retrieve scan results by compliance rule or resource type
- Retrieve drift and enforcement events

For more information, refer to the API user guide and the API documentation.

Additional compliance checks for PCI and HIPAA have been added.
- The new PCI compliance rules include:
  - AWS Glacier requires that AWS S3 bucket policy only accepts HTTPS. This applies to PCI_DSS_4.1.
  - Point in time recovery is enabled on the AWS Dynamo database. This applies to PCI_DSS_3.1.
  - Users specified backup retention periods for AWS RDS. This applies to PCI_DSS_3.1.
  - Any security group for a private subnet does not have CIDR ingress from 0.0.0.0/0. This applies to PCI_1.2.1 and PCI_1.3.1.
- The new HIPAA compliance rules include:
  - AWS Glacier requires that AWS S3 bucket policy only accepts HTTPS.
    - Enable transport encryption for AWS ElastiCache.
AWS service coverage has been expanded to support SNS Topics, WAF Web ACLs, and CloudFront Distributions. If you want to scan for these newly released services, you will want to update your IAM Role to include:

"cloudfront:GetDistribution",
"cloudfront:ListDistributions",
"cloudfront:ListTagsForResource",
"sns:GetTopicAttributes",
"sns:ListTopics",
"waf:GetWebACL",
"waf:ListWebACLs"

Refer to the Service Coverage page to see the full list of supported service coverage. If you have any questions, reach out to support@fugue.co.

2019.03.15¶

Features¶

The compliance report email allows you to view the compliance state of your environment without having to log into Fugue.

Additional Payment Card Industry (PCI) rules have been added within Fugue. These rules include:
- PCI DSS 8.1.4, which requires that users have a password that contains at least 7 characters and includes both alphabetic and numeric characters.
- PCI DSS 8.2.5, which requires users do not submit a new password/phrase that is the same as any of the last four passwords/phrases they used.
- PCI DSS 4.1, which requires that AWS CloudWatch metric filter alarms is via SQS and not via HTTPS.
- PCI DSS 8.2.4, which requires users to change their passwords/phrases at least once every 90 days.
- PCI DSS 10.5.3 and PCI DSS 10.7, which requires that versioning and lifecycle policy be enabled for AWS S3 buckets.

Bug Fixes¶

Addressed an issue where clicking outside a modal window failed to close it.
Addressed an issue where selecting Edit Environment Setting on the Environment landing page failed to redirect users to the Edit Environment Settings modal window.
Addressed an issue where selecting a resource that was not included in your IAM role ARN would cause the scan to fail. Now, the scan completes and the resources not included in your role ARN are listed in a message.

2019.02.25¶

The multi-user feature allows users to invite other parties in their organization to access and collaborate on the same Fugue environments.

2019.02.12¶

PCI DSS rules are now supported within Fugue.
Added service coverage support for CloudTrail, Config, SQS, VPC, and KMS.

2019.01.28¶

Users can select the specific resources that they want to manage within Fugue. Compliance scanning, drift detection, and baseline enforcement only occur on the selected resources. For details, see Setup.
Rules that pertain to resources that Fugue isn’t permitted to scan now display with an “Unknown” label.
Service coverage has been expanded to support RDS.
Users can see when their next scan is scheduled to start.

2018.11.26¶

Features¶

Scan cloud environments for risks and generate risk reports¶

Use Fugue to scan your cloud environment and produce comprehensive reports identifying compliance violations in your cloud infrastructure. Use this report in conjunction with an auditor to address these violations. Once all violations are addressed, the security teams can demonstrate Fugue’s functionality to both the CISO and the auditor. Fugue supports scanning and identifying compliance violations for the following compliance standards or benchmarks: CIS, NIST, HIPAA, and GDPR. The report also provides a snapshot of your infrastructure at any point in time.

Scan cloud environments for drift based on the declared baseline¶

Once you work with an auditor to address the compliance violations in your cloud infrastructure, you can establish a baseline. This lets Fugue know that this is the declared baseline and Fugue scans the environment for any changes to this declared baseline. If a change is detected, which is also known as drift, Fugue notifies you via the Drift Detection page.This allows you to proactively review and fix drift in your cloud environment. Use this drift report to show your CISO, security team, and auditor that Fugue detected the drift and enabled you to manually correct the issue. To learn more about enabling drift detection with Fugue, refer to details in Configuration.

Enable baseline enforcement on resources in cloud environments¶

Once you establish a baseline, you can enable self-healing, which is known as baseline enforcement within Fugue. When baseline enforcement is enabled, Fugue scans your environment and if any resources in your baseline are modified, they are reverted back to the baseline state. You can use the Drift report to show your CISO, security team, and auditor that drift occurred, and it was reverted back to the baseline state. To learn more about enabling baseline enforcement, refer to details in Configuration.