From c575b5c24331624288afcddfb87e802e1f3a8dbd Mon Sep 17 00:00:00 2001 From: Gary Patterson Date: Tue, 11 Sep 2018 22:56:06 -0500 Subject: [PATCH 1/2] Update Check 1.16 based on CIS v1.2 05-23-2018 to include list-user-policies for Inline Polices --- checks/check116 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/checks/check116 b/checks/check116 index a70114ae..fb74e2db 100644 --- a/checks/check116 +++ b/checks/check116 @@ -24,6 +24,11 @@ check116(){ textFail "$user has policy directly attached " C116_NUM_USERS=$(expr $C116_NUM_USERS + 1) fi + USER_POLICY=$($AWSCLI iam list-user-policies --output text $PROFILE_OPT --region $REGION --user-name $user) + if [[ $USER_POLICY ]]; then + textFail "$user has inline policy directly attached " + C116_NUM_USERS=$(expr $C116_NUM_USERS + 1) + fi done if [[ $C116_NUM_USERS -eq 0 ]]; then textPass "No policies attached to users." From 5aad05b0ae5413b10e0d47007d05bca71d61435e Mon Sep 17 00:00:00 2001 From: Gary Patterson Date: Tue, 11 Sep 2018 23:06:00 -0500 Subject: [PATCH 2/2] Added managed to output --- checks/check116 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check116 b/checks/check116 index fb74e2db..ad51e34c 100644 --- a/checks/check116 +++ b/checks/check116 @@ -21,7 +21,7 @@ check116(){ for user in $LIST_USERS;do USER_POLICY=$($AWSCLI iam list-attached-user-policies --output text $PROFILE_OPT --region $REGION --user-name $user) if [[ $USER_POLICY ]]; then - textFail "$user has policy directly attached " + textFail "$user has managed policy directly attached " C116_NUM_USERS=$(expr $C116_NUM_USERS + 1) fi USER_POLICY=$($AWSCLI iam list-user-policies --output text $PROFILE_OPT --region $REGION --user-name $user)