From bb068f1c7a19f748fda6cbe0a6d0a64668a7fd2c Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Tue, 26 Oct 2021 13:57:25 +0200 Subject: [PATCH] feat(group): include new AWS FTR checks group --- README.md | 13 +++++++++++++ groups/group25_FTR | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 groups/group25_FTR diff --git a/README.md b/README.md index 727b7242..5ea5c99a 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,7 @@ Read more about [CIS Amazon Web Services Foundations Benchmark v1.2.0 - 05-23-20 - Internet exposed resources - EKS-CIS - Also includes PCI-DSS, ISO-27001, FFIEC, SOC2, ENS (Esquema Nacional de Seguridad of Spain). +- AWS FTR [FTR] Read more [here](#aws-ftr-checks) With Prowler you can: @@ -558,6 +559,18 @@ The `gdpr` group of checks uses existing and extra checks. To get a GDPR report, ./prowler -g gdpr ``` +## AWS FTR Checks + +With this group of checks, Prowler shows result of checks related to the AWS Foundational Technical Review, more information [here](https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html). The list of checks can be seen in the group file at: + +[groups/group25_ftr](groups/group25_ftr) + +The `ftr` group of checks uses existing and extra checks. To get a AWS FTR report, run this command: + +```sh +./prowler -g ftr +``` + ## HIPAA Checks With this group of checks, Prowler shows results of controls related to the "Security Rule" of the Health Insurance Portability and Accountability Act aka [HIPAA](https://www.hhs.gov/hipaa/for-professionals/security/index.html) as defined in [45 CFR Subpart C - Security Standards for the Protection of Electronic Protected Health Information](https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C) within [PART 160 - GENERAL ADMINISTRATIVE REQUIREMENTS](https://www.law.cornell.edu/cfr/text/45/part-160) and [Subpart A](https://www.law.cornell.edu/cfr/text/45/part-164/subpart-A) and [Subpart C](https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C) of PART 164 - SECURITY AND PRIVACY diff --git a/groups/group25_FTR b/groups/group25_FTR new file mode 100644 index 00000000..7ca694f7 --- /dev/null +++ b/groups/group25_FTR @@ -0,0 +1,46 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. + +GROUP_ID[25]='ftr' +GROUP_NUMBER[25]='25.0' +GROUP_TITLE[25]='Amazon FTR related security checks - [ftr] ******************' +GROUP_RUN_BY_DEFAULT[9]='N' # run it when execute_all is called +GROUP_CHECKS[9]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73' + +# Checks from AWS FTR https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html +# 1.1 [check11] Avoid the use of the root account - iam [High] +# 1.2 [check12] Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password - iam [High] +# 1.3 [check13] Ensure credentials unused for 90 days or greater are disabled - iam [Medium] +# 1.4 [check14] Ensure access keys are rotated every 90 days or less - iam [Medium] +# 1.5 [check15] Ensure IAM password policy requires at least one uppercase letter - iam [Medium] +# 1.6 [check16] Ensure IAM password policy require at least one lowercase letter - iam [Medium] +# 1.7 [check17] Ensure IAM password policy require at least one symbol - iam [Medium] +# 1.8 [check18] Ensure IAM password policy require at least one number - iam [Medium] +# 1.9 [check19] Ensure IAM password policy requires minimum length of 14 or greater - iam [Medium] +# 1.10 [check110] Ensure IAM password policy prevents password reuse: 24 or greater - iam [Medium] +# 1.11 [check111] Ensure IAM password policy expires passwords within 90 days or less - iam [Medium] +# 1.12 [check112] Ensure no root account access key exists - iam [Critical] +# 1.13 [check113] Ensure MFA is enabled for the root account - iam [Critical] +# 1.17 [check117] Maintain current contact details - support [Medium] +# 1.18 [check118] Ensure security contact information is registered - support [Medium] +# 1.22 [check122] Ensure IAM policies that allow full "*:*" administrative privileges are not created - iam [Medium] +# 2.1 [check21] Ensure CloudTrail is enabled in all regions - cloudtrail [High] +# 2.2 [check22] Ensure CloudTrail log file validation is enabled - cloudtrail [Medium] +# 7.59 [extra759] Find secrets in Lambda functions variables - lambda [Critical] +# 7.60 [extra760] Find secrets in Lambda functions code - lambda [Critical] +# 7.68 [extra768] Find secrets in ECS task definitions variables - ecs [Critical] +# 7.75 [extra775] Find secrets in EC2 Auto Scaling Launch Configuration - autoscaling [Critical] +# 7.97 [extra797] Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) - eks [Medium] +# 7.141 [extra7141] Find secrets in SSM Documents - ssm [Critical] +# 7.3 [extra73] Ensure there are no S3 buckets open to Everyone or Any AWS user - s3 [Critical] +