ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 23:05:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #538 from marcjay/fix-no-information-extra774-501

Browse Source 
Extra 774 - Handle IAM credential report containing 'no_information' for a user's last console login date
This commit is contained in:
Toni de la Fuente
2020-04-13 13:30:24 +02:00
committed by GitHub
parent 3e1d9ea0d3 ce1058dfed
commit d855432f28
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
checks/check_extra774
View File

@@ -24,11 +24,23 @@ extra774(){
user=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep "^$i " |awk '{ print $1 }')
last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep "^$i " |awk '{ print $2 }')
days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then
textFail "User $user has not used console login for more then ${MAX_DAYS#-} days"
# If the user has never logged into the console, their last login date is 'no_information'. See:
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html#id_credentials_understanding_the_report_format
if [[ "${last_login_date}" == "no_information" ]]; then
user_created_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $2 }')
days_since_user_created=$(how_many_days_from_today ${user_created_date%T*})
if [ "$days_since_user_created" -lt "$MAX_DAYS" ];then
textFail "User $user has never used console login since they were created over ${MAX_DAYS#-} days ago"
else
textInfo "User $user has not used console login since they were created"
fi
else
days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then
textFail "User $user has not used console login for more than ${MAX_DAYS#-} days"
else
textPass "User $user has used console login in the past ${MAX_DAYS#-} days"
fi
fi
done
}