mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 23:05:05 +00:00
4961498562
Added a third parameter to checks textFail and textPass to identify resource name in finding.
46 lines
2.5 KiB
Bash
46 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (c) by Toni de la Fuente
|
|
#
|
|
# This Prowler check is licensed under a
|
|
# Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
|
|
#
|
|
# You should have received a copy of the license along with this
|
|
# work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
|
|
|
|
CHECK_ID_check116="1.16"
|
|
CHECK_TITLE_check116="[check116] Ensure IAM policies are attached only to groups or roles (Scored)"
|
|
CHECK_SCORED_check116="SCORED"
|
|
CHECK_TYPE_check116="LEVEL1"
|
|
CHECK_SEVERITY_check116="Low"
|
|
CHECK_ASFF_TYPE_check116="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
|
CHECK_ASFF_RESOURCE_TYPE_check116="AwsIamUser"
|
|
CHECK_ALTERNATE_check116="check116"
|
|
CHECK_ASFF_COMPLIANCE_TYPE_check116="ens-op.acc.3.aws.iam.1"
|
|
CHECK_SERVICENAME_check116="iam"
|
|
CHECK_RISK_check116='By default IAM users; groups; and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users; groups; or roles. It is recommended that IAM policies be applied directly to groups and roles but not users. Assigning privileges at the group or role level reduces the complexity of access management as the number of users grow. Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.'
|
|
CHECK_REMEDIATION_check116='Remove any policy attached directly to the user. Use groups or roles instead.'
|
|
CHECK_DOC_check116='https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html'
|
|
CHECK_CAF_EPIC_check116='IAM'
|
|
|
|
check116(){
|
|
# "Ensure IAM policies are attached only to groups or roles (Scored)"
|
|
LIST_USERS=$($AWSCLI iam list-users --query 'Users[*].UserName' --output text $PROFILE_OPT --region $REGION)
|
|
C116_NUM_USERS=0
|
|
for user in $LIST_USERS;do
|
|
USER_POLICY=$($AWSCLI iam list-attached-user-policies --output text $PROFILE_OPT --region $REGION --user-name $user)
|
|
if [[ $USER_POLICY ]]; then
|
|
textFail "$user has managed policy directly attached" "us-east-1" "$user"
|
|
C116_NUM_USERS=$(expr $C116_NUM_USERS + 1)
|
|
fi
|
|
USER_POLICY=$($AWSCLI iam list-user-policies --output text $PROFILE_OPT --region $REGION --user-name $user)
|
|
if [[ $USER_POLICY ]]; then
|
|
textFail "$user has inline policy directly attached" "us-east-1" "$user"
|
|
C116_NUM_USERS=$(expr $C116_NUM_USERS + 1)
|
|
fi
|
|
done
|
|
if [[ $C116_NUM_USERS -eq 0 ]]; then
|
|
textPass "No policies attached to users"
|
|
fi
|
|
}
|