diff --git a/checks/check_extra774 b/checks/check_extra774 index 83e2aa6f..0f882b45 100644 --- a/checks/check_extra774 +++ b/checks/check_extra774 @@ -24,11 +24,23 @@ extra774(){ user=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep "^$i " |awk '{ print $1 }') last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep "^$i " |awk '{ print $2 }') - days_not_in_use=$(how_many_days_from_today ${last_login_date%T*}) - if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then - textFail "User $user has not used console login for more then ${MAX_DAYS#-} days" + # If the user has never logged into the console, their last login date is 'no_information'. See: + # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html#id_credentials_understanding_the_report_format + if [[ "${last_login_date}" == "no_information" ]]; then + user_created_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $2 }') + days_since_user_created=$(how_many_days_from_today ${user_created_date%T*}) + if [ "$days_since_user_created" -lt "$MAX_DAYS" ];then + textFail "User $user has never used console login since they were created ${days_since_user_created} days ago" + else + textInfo "User $user has not used console login since they were created ${days_since_user_created} days ago" + fi + else + days_not_in_use=$(how_many_days_from_today ${last_login_date%T*}) + if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then + textFail "User $user has not used console login for more than ${MAX_DAYS#-} days" else textPass "User $user has used console login in the past ${MAX_DAYS#-} days" + fi fi done }