mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 14:55:00 +00:00
43 lines
2.5 KiB
Bash
43 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
CHECK_ID_check112="1.12"
|
|
CHECK_TITLE_check112="[check112] Ensure no root account access key exists"
|
|
CHECK_SCORED_check112="SCORED"
|
|
CHECK_TYPE_check112="LEVEL1"
|
|
CHECK_SEVERITY_check112="Critical"
|
|
CHECK_ASFF_TYPE_check112="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
|
CHECK_ALTERNATE_check112="check112"
|
|
CHECK_SERVICENAME_check112="iam"
|
|
CHECK_RISK_check112='The root account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the root account be removed. Removing access keys associated with the root account limits vectors by which the account can be compromised. Removing the root access keys encourages the creation and use of role based accounts that are least privileged.'
|
|
CHECK_REMEDIATION_check112='Use the credential report to that the user and ensure the access_key_1_active and access_key_2_active fields are set to FALSE .'
|
|
CHECK_DOC_check112='https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html'
|
|
CHECK_CAF_EPIC_check112='IAM'
|
|
|
|
check112(){
|
|
# "Ensure no root account access key exists (Scored)"
|
|
# ensure the access_key_1_active and access_key_2_active fields are set to FALSE.
|
|
ROOTKEY1=$(cat $TEMP_REPORT_FILE |grep root_account|awk -F',' '{ print $9 }')
|
|
ROOTKEY2=$(cat $TEMP_REPORT_FILE |grep root_account|awk -F',' '{ print $14 }')
|
|
if [ "$ROOTKEY1" == "false" ];then
|
|
textPass "$REGION: No access key 1 found for root" "$REGION" "root access key1"
|
|
else
|
|
textFail "$REGION: Found access key 1 for root" "$REGION" "root access key1"
|
|
fi
|
|
if [ "$ROOTKEY2" == "false" ];then
|
|
textPass "$REGION: No access key 2 found for root" "$REGION" "root access key2"
|
|
else
|
|
textFail "$REGION: Found access key 2 for root" "$REGION" "root access key2"
|
|
fi
|
|
}
|