<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-network-policy-automation
description: >-
  Automate Kubernetes NetworkPolicy and cloud VPC firewall rule generation,
  audit existing policies for gaps, detect overly permissive rules, and
  enforce micro-segmentation across cloud-native environments.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - network-policy
  - calico
  - cilium
  - vpc-firewall
  - micro-segmentation
  - zero-trust
  - automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.004"]
---

# Implementing Cloud Network Policy Automation

## Overview

Automate Kubernetes NetworkPolicy and cloud VPC firewall rule generation, audit existing policies for gaps, detect overly permissive rules, and enforce micro-segmentation across cloud-native environments.

Mode: `[MODE: ARCHITECT]` — Design network segmentation. `[MODE: BLUE]` — Detect policy gaps.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster with CNI supporting NetworkPolicy (Calico, Cilium) | Required |
| kubectl configured with appropriate access | Required |
| Cloud CLI for VPC firewall audit (aws/gcloud/az) | Required |

## Key Concepts

### Audit Existing Network Policies

```bash
# List all network policies
kubectl get networkpolicy -A -o json | \
  jq '.items[] | {{namespace: .metadata.namespace, name: .metadata.name}}'

# Find namespaces without any network policy
comm -23 \
  <(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | sort) \
  <(kubectl get netpol -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\n"}{end}' | sort -u)

# Detect overly permissive policies
kubectl get networkpolicy -A -o json | \
  jq '.items[] | select(.spec.ingress == [{{}}]) |
  {{namespace: .metadata.namespace, name: .metadata.name}}'
```

### Generate Default-Deny Policies

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {{}}
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: production
spec:
  podSelector: {{}}
  policyTypes:
  - Egress
```

### AWS VPC Security Group Audit

```bash
# Find security groups with 0.0.0.0/0 ingress
aws ec2 describe-security-groups --query \
  'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]]' \
  --output json | jq '.[].GroupId'

# Check for unrestricted SSH
aws ec2 describe-security-groups --filters \
  Name=ip-permission.from-port,Values=22 \
  Name=ip-permission.cidr,Values=0.0.0.0/0
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/implementing-cloud-network-policy-automation-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Cloud Network Policy Automation Detection
id: edd38b5a-435e-45af-9168-b0fc731c8d3b
status: experimental
description: Detects suspicious activity related to implementing cloud network policy automation techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1562.004
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Network Policy Automation Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562.004 |

## Verification

- [ ] Default-deny NetworkPolicy in every production namespace
- [ ] No overly permissive allow-all policies
- [ ] Egress restricted to known endpoints
- [ ] VPC security groups follow least-privilege
- [ ] No 0.0.0.0/0 ingress on non-public ports
- [ ] Policy audit runs in CI/CD pipeline

## References

- [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [Calico Network Policy Guide](https://docs.tigera.io/calico/latest/network-policy/)
- [Cilium Network Policy](https://docs.cilium.io/en/stable/security/policy/)
- [CIS AWS Benchmark — VPC](https://www.cisecurity.org/benchmark/amazon_web_services)
