diff --git a/providers/aws/services/account/__init__.py b/providers/aws/services/account/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/providers/aws/services/account/account_client.py b/providers/aws/services/account/account_client.py new file mode 100644 index 00000000..4a92ee4b --- /dev/null +++ b/providers/aws/services/account/account_client.py @@ -0,0 +1,4 @@ +from providers.aws.lib.audit_info.audit_info import current_audit_info +from providers.aws.services.account.account_service import Account + +account_client = Account(current_audit_info) diff --git a/providers/aws/services/account/account_maintain_current_contact_details/__init__.py b/providers/aws/services/account/account_maintain_current_contact_details/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.metadata.json b/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.metadata.json new file mode 100644 index 00000000..baf2e6aa --- /dev/null +++ b/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.metadata.json @@ -0,0 +1,35 @@ +{ + "Provider": "aws", + "CheckID": "account_maintain_current_contact_details", + "CheckTitle": "Maintain current contact details.", + "CheckType": ["IAM"], + "ServiceName": "account", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Maintain current contact details.", + "Risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details; and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner; AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation; proactive measures may be taken; including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.", + "RelatedUrl": "", + "Remediation": { + "Code": { + "CLI": "No command available.", + "NativeIaC": "", + "Other": "https://docs.bridgecrew.io/docs/iam_18-maintain-contact-details#aws-console", + "Terraform": "" + }, + "Recommendation": { + "Text": "Using the Billing and Cost Management console complete contact details.", + "Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html" + } + }, + "Categories": [], + "Tags": { + "Tag1Key": "value", + "Tag2Key": "value" + }, + "DependsOn": [], + "RelatedTo": [], + "Notes": "", + "Compliance": [] +} diff --git a/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py b/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py new file mode 100644 index 00000000..116d72bf --- /dev/null +++ b/providers/aws/services/account/account_maintain_current_contact_details/account_maintain_current_contact_details.py @@ -0,0 +1,13 @@ +from colorama import Fore, Style + +from lib.check.models import Check + +### This check has no findings since it is manual + + +class account_maintain_current_contact_details(Check): + def execute(self): + print( + f"\t{Fore.YELLOW}INFO{Style.RESET_ALL} Manual check: Login to the AWS Console. Choose your account name on the top right of the window -> My Account -> Contact Information." + ) + return [] diff --git a/providers/aws/services/account/account_security_contact_information_is_registered/__init__.py b/providers/aws/services/account/account_security_contact_information_is_registered/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.metadata.json b/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.metadata.json new file mode 100644 index 00000000..8fbb6055 --- /dev/null +++ b/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.metadata.json @@ -0,0 +1,35 @@ +{ + "Provider": "aws", + "CheckID": "account_security_contact_information_is_registered", + "CheckTitle": "Ensure security contact information is registered.", + "CheckType": ["IAM"], + "ServiceName": "account", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Ensure security contact information is registered.", + "Risk": "AWS provides customers with the option of specifying the contact information for accounts security team. It is recommended that this information be provided. Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.", + "RelatedUrl": "", + "Remediation": { + "Code": { + "CLI": "No command available.", + "NativeIaC": "", + "Other": "https://docs.bridgecrew.io/docs/iam_19#aws-console", + "Terraform": "" + }, + "Recommendation": { + "Text": "Go to the My Account section and complete alternate contacts.", + "Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html" + } + }, + "Categories": [], + "Tags": { + "Tag1Key": "value", + "Tag2Key": "value" + }, + "DependsOn": [], + "RelatedTo": [], + "Notes": "", + "Compliance": [] +} diff --git a/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py b/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py new file mode 100644 index 00000000..c6c3837d --- /dev/null +++ b/providers/aws/services/account/account_security_contact_information_is_registered/account_security_contact_information_is_registered.py @@ -0,0 +1,13 @@ +from colorama import Fore, Style + +from lib.check.models import Check + +### This check has no findings since it is manual + + +class account_security_contact_information_is_registered(Check): + def execute(self): + print( + f"\t{Fore.YELLOW}INFO{Style.RESET_ALL} Manual check: Login to the AWS Console. Choose your account name on the top right of the window -> My Account -> Alternate Contacts -> Security Section." + ) + return [] diff --git a/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/__init__.py b/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.metadata.json b/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.metadata.json new file mode 100644 index 00000000..936d59a6 --- /dev/null +++ b/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.metadata.json @@ -0,0 +1,35 @@ +{ + "Provider": "aws", + "CheckID": "account_security_questions_are_registered_in_the_aws_account", + "CheckTitle": "Ensure security questions are registered in the AWS account.", + "CheckType": ["IAM"], + "ServiceName": "account", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Ensure security questions are registered in the AWS account.", + "Risk": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established. When creating a new AWS account a default super user is automatically created. This account is referred to as the root account. It is recommended that the use of this account be limited and highly controlled. During events in which the root password is no longer accessible or the MFA token associated with root is lost/destroyed it is possible through authentication using secret questions and associated answers to recover root login access.", + "RelatedUrl": "", + "Remediation": { + "Code": { + "CLI": "No command available.", + "NativeIaC": "", + "Other": "https://docs.bridgecrew.io/docs/iam_15", + "Terraform": "" + }, + "Recommendation": { + "Text": "Login as root account and from My Account configure Security questions.", + "Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-security-challenge.html" + } + }, + "Categories": [], + "Tags": { + "Tag1Key": "value", + "Tag2Key": "value" + }, + "DependsOn": [], + "RelatedTo": [], + "Notes": "", + "Compliance": [] +} diff --git a/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py b/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py new file mode 100644 index 00000000..577f28cc --- /dev/null +++ b/providers/aws/services/account/account_security_questions_are_registered_in_the_aws_account/account_security_questions_are_registered_in_the_aws_account.py @@ -0,0 +1,13 @@ +from colorama import Fore, Style + +from lib.check.models import Check + +### This check has no findings since it is manual + + +class account_security_questions_are_registered_in_the_aws_account(Check): + def execute(self): + print( + f"\t{Fore.YELLOW}INFO{Style.RESET_ALL} Manual check: Login to the AWS Console as root. Choose your account name on the top right of the window -> My Account -> Configure Security Challenge Questions." + ) + return [] diff --git a/providers/aws/services/account/account_service.py b/providers/aws/services/account/account_service.py new file mode 100644 index 00000000..051e51ed --- /dev/null +++ b/providers/aws/services/account/account_service.py @@ -0,0 +1,12 @@ +################## Account +class Account: + def __init__(self, audit_info): + self.service = "account" + self.session = audit_info.audit_session + self.audited_account = audit_info.audited_account + + def __get_session__(self): + return self.session + + +### This service don't need boto3 calls diff --git a/providers/aws/services/support/check115 b/providers/aws/services/support/check115 deleted file mode 100644 index 65448e5b..00000000 --- a/providers/aws/services/support/check115 +++ /dev/null @@ -1,34 +0,0 @@ -#!/usr/bin/env bash - -# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente -# -# Licensed under the Apache License, Version 2.0 (the "License"); you may not -# use this file except in compliance with the License. You may obtain a copy -# of the License at http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software distributed -# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR -# CONDITIONS OF ANY KIND, either express or implied. See the License for the -# specific language governing permissions and limitations under the License. - -CHECK_ID_check115="1.15" -CHECK_TITLE_check115="[check115] Ensure security questions are registered in the AWS account" -CHECK_SCORED_check115="NOT_SCORED" -CHECK_CIS_LEVEL_check115="LEVEL1" -CHECK_SEVERITY_check115="Medium" -CHECK_ASFF_TYPE_check115="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" -CHECK_ALTERNATE_check115="check115" -CHECK_SERVICENAME_check115="support" -CHECK_RISK_check115='The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established. When creating a new AWS account a default super user is automatically created. This account is referred to as the "root" account. It is recommended that the use of this account be limited and highly controlled. During events in which the root password is no longer accessible or the MFA token associated with root is lost/destroyed it is possible through authentication using secret questions and associated answers to recover root login access.' -CHECK_REMEDIATION_check115='Login as root account and from My Account configure Security questions.' -CHECK_DOC_check115='https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys_retrieve.html' -CHECK_CAF_EPIC_check115='IAM' - -check115(){ - if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." - else - # "Ensure security questions are registered in the AWS account (Not Scored)" - textInfo "${REGION}: No command available for check 1.15. Login to the AWS Console as root & click on the Account. Name -> My Account -> Configure Security Challenge Questions." - fi -} diff --git a/providers/aws/services/support/check117 b/providers/aws/services/support/check117 deleted file mode 100644 index b3dfd214..00000000 --- a/providers/aws/services/support/check117 +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env bash - -# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente -# -# Licensed under the Apache License, Version 2.0 (the "License"); you may not -# use this file except in compliance with the License. You may obtain a copy -# of the License at http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software distributed -# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR -# CONDITIONS OF ANY KIND, either express or implied. See the License for the -# specific language governing permissions and limitations under the License. - -CHECK_ID_check117="1.17" -CHECK_TITLE_check117="[check117] Maintain current contact details" -CHECK_SCORED_check117="NOT_SCORED" -CHECK_CIS_LEVEL_check117="LEVEL1" -CHECK_SEVERITY_check117="Medium" -CHECK_ASFF_TYPE_check117="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" -CHECK_ALTERNATE_check117="check117" -CHECK_SERVICENAME_check117="support" -CHECK_RISK_check117='Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details; and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner; AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation; proactive measures may be taken; including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.' -CHECK_REMEDIATION_check117='Using the Billing and Cost Management console complete contact details.' -CHECK_DOC_check117='https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#contact-info' -CHECK_CAF_EPIC_check117='IAM' - -check117(){ - if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." - else - # "Maintain current contact details (Scored)" - # No command available - textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details." - fi -} diff --git a/providers/aws/services/support/check118 b/providers/aws/services/support/check118 deleted file mode 100644 index c01ed801..00000000 --- a/providers/aws/services/support/check118 +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env bash - -# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente -# -# Licensed under the Apache License, Version 2.0 (the "License"); you may not -# use this file except in compliance with the License. You may obtain a copy -# of the License at http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software distributed -# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR -# CONDITIONS OF ANY KIND, either express or implied. See the License for the -# specific language governing permissions and limitations under the License. - -CHECK_ID_check118="1.18" -CHECK_TITLE_check118="[check118] Ensure security contact information is registered" -CHECK_SCORED_check118="NOT_SCORED" -CHECK_CIS_LEVEL_check118="LEVEL1" -CHECK_SEVERITY_check118="Medium" -CHECK_ASFF_TYPE_check118="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" -CHECK_ALTERNATE_check118="check118" -CHECK_SERVICENAME_check118="support" -CHECK_RISK_check118='AWS provides customers with the option of specifying the contact information for accounts security team. It is recommended that this information be provided. Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.' -CHECK_REMEDIATION_check118='Go to the My Account section and complete alternate contacts.' -CHECK_DOC_check118='https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html' -CHECK_CAF_EPIC_check118='IAM' - -check118(){ - if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." - else - # "Ensure security contact information is registered (Scored)" - # No command available - textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details." - fi -}