Release Notes¶

Fugue ensures that cloud infrastructure stays in continuous compliance with enterprise security policies.

2019.11.21¶

Rule Remediation Steps in Documentation¶

The online documentation includes rule remediation steps for many common compliance violations. Follow the steps to manually bring resources back into compliance using the AWS Management Console, AWS CLI, Azure Portal, or Azure CLI. For the list of rule remediation steps, refer here.

Exporting Visualizer Diagrams and Customizing Your Visualizer View¶

You can export an image of your Fugue visualized environment, as well as customize what information displays within the visualizer, such as compliance information, and collapse/expand all groups. See Exporting a Diagram.

Ability to Delete User Groups¶

You can delete user groups, as shown below. See How to Delete Groups.

_images/rbac-delete-groups-release-notes.png

Fugue Developer and Fugue Enterprise¶

Fugue is now available in two plans: Developer and Enterprise. For more information, see the documentation in Fugue Plans.

New Account Overview Page¶

The Account Overview page lists your plan type, which is Enterprise for existing customers. Refer to the online documentation for more information.

2019.10.31¶

Single Sign-On (Beta)¶

Fugue is excited to announce support for single sign-on (SSO) in beta. SSO allows users to provision and deprovision users from an existing identity provider (IdP).

The Fugue login page is changing, as shown below. Non-SSO users enter their username and password to log into Fugue:

Once SSO is enabled on your organization, users enter their email address and log into Fugue using your IdP. If you are interested in gaining access to SSO beta, please contact support@fugue.co.

Additional Compliance Family Support for Azure¶

Fugue now supports the following compliance families for Azure: ISO 27001, SOC 2, HIPAA, GDPR, NIST SP 800-53, and PCI-DSS.

Fugue Best Practices¶

Fugue released a set of Best Practices checks to complement existing controls to detect critical misconfigurations that can be exploited.

Some rules that are part of the Fugue Best Practices compliance family include:

IAM policies should not allow broad list actions on S3 buckets
IAM role trust policies should not allow all principals to assume the role
IAM roles attached to instance profiles should not allow broad list actions on S3 buckets
S3 bucket policies should not allow all actions for all principals
S3 bucket policies should not allow list actions for all principals
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9200 (Elasticsearch)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 9300 (Elasticsearch)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 2379 (etcd)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27017 (MongoDB)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27018 (MongoDB)
VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 27019 (MongoDB)

2019.10.17¶

Expanded AWS Service Coverage¶

Fugue now supports the following AWS services:

ACM
API Gateway
Cognito
ECR
ECS
EKS
Guard Duty
Lambda
Macie
MediaStore
RedShift
Route53
Step Functions (SFN)
Secrets Manager
S3: Attributes to block public access

To start scanning for these newly supported services, you should either:

Option 1: Launch a new CloudFormation stack that contains the SecurityAudit read-only policy and add the following resources listed below as part of your inline policy:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Action": [
               "apigateway:GET",
               "cloudwatch:GetDashboard",
               "cloudwatch:ListDashboards",
               "cognito-idp:DescribeIdentityProvider",
               "cognito-idp:DescribeResourceServer",
               "cognito-idp:DescribeUserPool",
               "cognito-idp:DescribeUserPoolClient",
               "cognito-idp:DescribeUserPoolDomain",
               "cognito-idp:GetGroup",
               "cognito-idp:ListGroups",
               "cognito-idp:ListIdentityProviders",
               "cognito-idp:ListResourceServers",
               "cognito-idp:ListUserPoolClients",
               "dynamodb:ListTagsOfResource",
               "elasticache:ListTagsForResource",
               "lambda:GetAlias",
               "lambda:GetEventSourceMapping",
               "lambda:GetFunction",
               "macie:ListMemberAccounts",
               "macie:ListS3Resources",
               "mediastore:DescribeContainer",
               "s3:ListBucket",
               "secretsmanager:DescribeSecret",
               "sns:GetSubscriptionAttributes",
               "sns:ListSubscriptions",
               "states:DescribeStateMachine",
               "waf:GetWebACL"
           ],
           "Resource": "*",
           "Effect": "Allow",
           "Sid": "0"
       }
   ]
}

Option 2: Update your existing AWS IAM policy to include the SecurityAudit read-only policy if it is already not attached and add the following resources listed below as part of your inline policy:

Refer to AWS IAM Permissions and Add an Inline Policy for more information.

Updates to the Visualizer¶

Added the ability to pinch on your trackpad to zoom in and out on the visualizer.

2019.10.03¶

Custom Rules¶

Users can now write custom rules to extend Fugue functionality to specific enterprise requirements, with CRUD actions and syntax/testing available via UI, API, and CLI.
Custom rules are written with Open Policy Agent’s Rego query language. OPA is a policy-as-code framework and CNCF open source project commonly used for policy on Kubernetes and other cloud technologies.

CLI¶

Fugue now supports CLI functionality, with feature parity with our API.

Visualizer¶

Collapsed nodes that have a mix of compliant and non compliant resources display as stacks with red and black coloring, as highlighted below:

2019.09.13¶

Visualizer updates¶

Visualizer UX improvements — Added an expand icon and number of resources that exist within a collapsed node. For example, if you have 13 S3 buckets collapsed in a node, the number 13 is shown, as shown below. Clicking the icon expands the collapsed S3 buckets.

Clicking the (warning) icon displays the compliance violations for a resource.
Clicking on a subnet or security group within a node or on the list on the side, highlights all the places within your infrastructure where the security group or subnet resides, as shown below.

Displaying the compliance violations for subnets and security groups.
Performance improvements

IAM role generation updates¶

Updates to IAM role generation for read-only permissions, which allows Fugue to scan and detect drift for your environments. When you create a new IAM role utilizing the Fugue UI, the Security Audit read-only policy is attached to the role along with inline policies to cover other permissions that are not covered by the Security Audit policy. If you have existing environments, you can continue to use your existing IAM role as is or choose to attach the SecurityAudit policy and remove the inline policies covered by the Security Audit policy.

2019.08.23¶

Updates to the navigation within the Environment Details page— the visualizer is located on its own page, Environment Settings have been moved to the top level navigation, and the Drift Events page is renamed to Events.

Updates to the user interface. The Organizations tab is now located at the same level as Environments and updates were made to the environment cards, as shown below. Additionally, on the Environment Landing page, selecting View in Visualizer redirects users to the Visualizer page.

_images/release-notes-environments-page.png

Auto-remediation is now supported for Azure.
Displaying compliance errors within the visualizer on VPC.
The /resources API endpoint now requires authorization. Previously, users were able to hit this endpoint without authenticating with Fugue. To use the /resources endpoint authentication is now required.

2019.08.07¶

Docs site: The Fugue Documentation site has been redesigned, moved to https://docs.fugue.co, and features the following new content:
- Getting Started: Tutorial
- Example: Fugue Notifications in Slack
The visualizer includes security group and subnet labeling within VPCs. This makes it easier to identify which security groups and subnets are associated with a particular VPC, as shown below. To learn more about the visualizer, refer here.

The visualizer “full screen” fills the browser window, rather than the entire screen.
The visualizer supports Azure, as shown below.

Azure notifications are available to alert on compliance, drift, and auto-remediation events. To get started using notifications, refer here.
Fixed an issue with the CIS AWS 2-5 rule: “Ensure AWS Config is Enabled in all Regions.”

2019.07.08¶

Visualization: Cloud resource visualization displays resources that are not compliant within an environment, as shown below:

Expanded rule coverage:
- IAM root account should not be used. Corresponds to the following compliance controls:
  - ISO27001_A.6.1.2;ISO27001_A.9.2.3;ISO27001_A.9.4.1
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-1
  - HIPAA_§164.308(a)(1)(ii)(D);HIPAA_§164.308(a)(6)(i);HIPAA_§164.312(b)
  - GDPR_30-(1)
- Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password. Corresponds to the following compliance control:
  - CIS_AWS_1.2.0_1-2
- Ensure credentials unused for 90 days or greater are disabled. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.2.4;ISO27001_A.9.3.1
  - SOC2_CC6.1;SOC2_CC6.2;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-3
  - NIST-800-53_IA-4d;NIST-800-53_IA-4d
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1):HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.1.4
- Ensure access keys are rotated every 90 days or less. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.2.4;ISO27001_A.9.3.1
  - SOC2_CC6.1;SOC2_CC6.2;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-4
  - NIST-800-53_IA-4d;NIST-800-53_IA-5 (1)(d)
  - HIPAA_§164.308(a)(5)(ii)(D);HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.2.4
- Ensure no root account access key exists. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-12
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1)
  - PCI_DSS_8.1
- Ensure hardware MFA is enabled for the “root” account. Corresponds to the following compliance controls:
  - ISO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1;ISO27001_A.9.4.1;ISO27001_A.9.4.3
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-14
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1)
- Ensure MFA is enabled for the “root” account. Corresponds to the following compliance controls:
  - SO27001_A.9.2.3;ISO27001_A.9.3.1;ISO27001_A.9.4.1;ISO27001_A.9.4.1;ISO27001_A.9.4.3
  - SOC2_CC5.2;SOC2_CC6.1;SOC2_CC6.3
  - CIS_AWS_1.2.0_1-13
  - NIST-800-53_IA-2 (1)
  - HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(i);HIPAA_§164.312(a)(1);HIPAA_§164.308(a)(3)(ii)(B),HIPAA_§164.308(a)(3)(ii)(C),HIPAA_§164.308(a)(4)(i),HIPAA_§164.308(a)(4)(ii)(B),HIPAA_§164.308(a)(4)(ii)(C),HIPAA_§164.312(a)(2)(i),HIPAA_§164.312(a)(2)(ii),HIPAA_§164.312(a)(2)(iii),HIPAA_§164.312(d)
  - PCI_DSS_8.1
Expanded service coverage: Fugue now supports the following resource: IAM.CredentialReport. To start scanning for IAM.CredentialReport, update your Fugue IAM role to include:

"iam:GenerateCredentialReport",
"iam:GetCredentialReport",
"iam:ListVirtualMFADevices"

Refer to the Service Coverage page to see the full list of supported service coverage. If you have any questions, reach out to support@fugue.co.

Improvements to the Compliance by Resource modal: The compliance controls that fail are displayed under the description of the rule, as shown below:

2019.07.03¶

Features¶

Support for Azure: Cloud service coverage is being expanded to include Azure in addition to AWS. This makes Fugue a multi-cloud solution. For setup instructions, see Setup - Azure. For general information, see Azure.

2019.06.26¶

Features¶

Notifications: Fugue offers notifications for compliance, drift, and auto-remediation (baseline enforcement) events within environments, allowing you to be alerted to infrastructure changes detected during a scan without having to log into Fugue.

Within Organization Settings, you may add notifications and choose to be notified by email, AWS SNS topic, or both. By using the SNS integration, you can connect Fugue notifications to third-party tools such as Slack.

Full screen visualizer: You can expand cloud resource visualization to a full screen view. This allows you to better interact with and view your infrastructure. Clicking the f button, as highlighted below, opens the full screen visualization experience.

Here’s an example of full screen mode:

Updates to the “Create Environment” workflow: The “create environment” workflow has been updated as follows. In the first step, you enter your environment’s name and select the cloud service provider:

In the second step, you select the region and resource types, and then enter the AWS IAM role ARN:

In the third step, you select the compliance libraries you want Fugue to use to assess your infrastructure:

In the fourth step, you can view a summary of the environment name, region, AWS IAM role ARN, the selected compliance standards, and the selected resource types to scan and enforce, as shown below:

For full setup instructions, see Setup.

2019.06.10¶

Fugue Risk Manager is now simply Fugue.

Features¶

AWS GovCloud regions: Fugue now supports AWS GovCloud regions via the Fugue application and API. All existing functionality for other commercial AWS regions is supported for AWS GovCloud regions including:
- Assess AWS GovCloud regions for compliance violations against the following compliance standards: CIS AWS, NIST SP 800-53, PCI-DSS, HIPAA, GDPR, SOC 2, and ISO 27001.
- Enable configuration drift detection and optionally, enforcement on baselines.
Cloud resource visualization: Fugue’s new cloud resource visualization feature creates detailed, interactive diagrams of your cloud resources. This allows you to quickly visualize cloud infrastructure configurations and relationships without having to create diagrams by hand, which can be a painstaking and error-prone process. Diagrams are generated and updated automatically. You can zoom in or out to more closely inspect the resources:

Improved compliance control messages: The compliance control message contains additional information about what caused a resource to be noncompliant and violate the control, as shown below.

_images/ImprovedComplianceFailureMessage.png

2019.05.29¶

Features¶

Added service coverage support for ElastiCache.Cluster, ElastiCache.ParameterGroup, and ElastiCache.ReplicationGroup resources.
- To scan for ElastiCache clusters, parameter groups, and replication groups, update your Fugue IAM role to include the following permissions:

"elasticache:DescribeCacheClusters",
"elasticache:DescribeCacheParameterGroups",
"elasticache:DescribeCacheParameters",
"elasticache:DescribeReplicationGroups",
"elasticache:ListTagsForResource"

Note

When ElastiCache.Cluster resources belong to an ElastiCache.ReplicationGroup, the clusters themselves are not scanned but the replication group is. The replication group manages the clusters and contains all of the relevant settings, so there is no need to scan the clusters individually.

In contrast, ElastiCache clusters that do not belong to a replication group are scanned individually.

Refer to the Service Coverage page to see the full list of supported services. If you have any questions, reach out to support@fugue.co.

Created the Fugue API Reference, which contains Swagger documentation and examples.

2019.05.09¶

Features¶

Added service coverage support for AWS S3 bucket ACLs. The new functionality will provide more protection for S3 buckets.
- Users who have enabled scanning on S3 buckets must update their Fugue IAM role to include the following permission, or scans involving S3 buckets will be incomplete:

"s3:GetBucketACL"

If you have any questions, reach out to support@fugue.co.

Added service coverage support for SNS subscriptions and CloudWatch Metric Alarms.
- To scan for SNS subscriptions and CloudWatch Metric Alarms, update your Fugue IAM role to include the following permissions:

"cloudwatch:DescribeAlarms",
"sns:GetSubscriptionAttributes",
"sns:ListSubscriptions"

Refer to the Service Coverage page to see the full list of supported services. If you have any questions, reach out to support@fugue.co.

Added support for SOC 2 and ISO 27001 compliance standards.
- SOC 2 governance applies to organizations storing customer data in the cloud.
- ISO 27001 is a specification for an information security management system that includes controls for information risk management processes.

Bug Fixes and Improvements¶

Fugue automatically logs users out of the application every 24 hoursinstead of once a month.
Other bug fixes and improvements.

2019.04.25¶

Features¶

Improved API Clients table to display the client secret age and last activity of the API client. In the previously released API Clients table, the client secret’s age and the last activity of the client secret did not display within the table. It is important to know your client secret’s age so you can properly rotate it according to your organization’s security policy. Additionally, displaying the last activity for the client secret allows you to revoke and/or delete client secrets that are no longer in use. For more information, see the API page.

Improved page load times of the environment list and environment detail pages
Improved link to “Edit IAM Role in AWS Console” to point directly to list of roles in the console

Bug Fixes¶

Fixed an issue where the list compliance results by rule API endpoint would return no results when no compliance family was selected
Various scan fixes

2019.03.28¶

Features¶

The API has 4 main areas of functionality:
- Create, update, and delete environments
- Run scans on demand or on a specific schedule
- Retrieve scan results by compliance rule or resource type
- Retrieve drift and enforcement events

For more information, refer to the API user guide and the API documentation.

Additional compliance checks for PCI and HIPAA have been added.
- The new PCI compliance rules include:
  - AWS Glacier requires that AWS S3 bucket policy only accepts HTTPS. This applies to PCI_DSS_4.1.
  - Point in time recovery is enabled on the AWS Dynamo database. This applies to PCI_DSS_3.1.
  - Users specified backup retention periods for AWS RDS. This applies to PCI_DSS_3.1.
  - Any security group for a private subnet does not have CIDR ingress from 0.0.0.0/0. This applies to PCI_1.2.1 and PCI_1.3.1.
- The new HIPAA compliance rules include:
  - AWS Glacier requires that AWS S3 bucket policy only accepts HTTPS.
    - Enable transport encryption for AWS ElastiCache.
AWS service coverage has been expanded to support SNS Topics, WAF Web ACLs, and CloudFront Distributions. If you want to scan for these newly released services, you will want to update your IAM Role to include:

"cloudfront:GetDistribution",
"cloudfront:ListDistributions",
"cloudfront:ListTagsForResource",
"sns:GetTopicAttributes",
"sns:ListTopics",
"waf:GetWebACL",
"waf:ListWebACLs"

Refer to the Service Coverage page to see the full list of supported service coverage. If you have any questions, reach out to support@fugue.co.

2019.03.15¶

Features¶

The compliance report email allows you to view the compliance state of your environment without having to log into Fugue.

Additional Payment Card Industry (PCI) rules have been added within Fugue. These rules include:
- PCI DSS 8.1.4, which requires that users have a password that contains at least 7 characters and includes both alphabetic and numeric characters.
- PCI DSS 8.2.5, which requires users do not submit a new password/phrase that is the same as any of the last four passwords/phrases they used.
- PCI DSS 4.1, which requires that AWS CloudWatch metric filter alarms is via SQS and not via HTTPS.
- PCI DSS 8.2.4, which requires users to change their passwords/phrases at least once every 90 days.
- PCI DSS 10.5.3 and PCI DSS 10.7, which requires that versioning and lifecycle policy be enabled for AWS S3 buckets.

Bug Fixes¶

Addressed an issue where clicking outside a modal window failed to close it.
Addressed an issue where selecting Edit Environment Setting on the Environment landing page failed to redirect users to the Edit Environment Settings modal window.
Addressed an issue where selecting a resource that was not included in your IAM role ARN would cause the scan to fail. Now, the scan completes and the resources not included in your role ARN are listed in a message.

2019.02.25¶

The multi-user feature allows users to invite other parties in their organization to access and collaborate on the same Fugue environments.

2019.02.12¶

PCI DSS rules are now supported within Fugue.
Added service coverage support for CloudTrail, Config, SQS, VPC, and KMS.

2019.01.28¶

Users can select the specific resources that they want to manage within Fugue. Compliance scanning, drift detection, and remediation only occur on the selected resources. For details, see Setup.
Rules that pertain to resources that Fugue isn’t permitted to scan now display with an “Unknown” label.
Service coverage has been expanded to support RDS.
Users can see when their next scan is scheduled to start.

2018.11.26¶

Features¶

Scan cloud environments for risks and generate risk reports¶

Use Fugue to scan your cloud environment and produce comprehensive reports identifying compliance violations in your cloud infrastructure. Use this report in conjunction with an auditor to address these violations. Once all violations are addressed, the security teams can demonstrate Fugue’s functionality to both the CISO and the auditor. Fugue supports scanning and identifying compliance violations for the following compliance standards or benchmarks: CIS, NIST, HIPAA, and GDPR. The report also provides a snapshot of your infrastructure at any point in time.

Scan cloud environments for drift based on the declared baseline¶

Once you work with an auditor to address the compliance violations in your cloud infrastructure, you can establish a baseline. This lets Fugue know that this is the declared baseline and Fugue scans the environment for any changes to this declared baseline. If a change is detected, which is also known as drift, Fugue notifies you via the Drift Detection page.This allows you to proactively review and fix drift in your cloud environment. Use this drift report to show your CISO, security team, and auditor that Fugue detected the drift and enabled you to manually correct the issue. To learn more about enabling drift detection with Fugue, refer to details in Configuration.

Enable automated remediation on resources in cloud environments¶

Once you establish a baseline, you can enable self-healing, which is known as baseline enforcement within Fugue. When baseline enforcement is enabled, Fugue scans your environment and if any resources in your baseline are modified, they are reverted back to the baseline state. You can use the Drift report to show your CISO, security team, and auditor that drift occurred, and it was reverted back to the baseline state. To learn more about enabling automated remediation, refer to details in Configuration.