mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 14:55:00 +00:00
40 lines
2.0 KiB
Bash
40 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (c) by Toni de la Fuente
|
|
#
|
|
# This Prowler check is licensed under a
|
|
# Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
|
|
#
|
|
# You should have received a copy of the license along with this
|
|
# work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
|
|
|
|
CHECK_ID_check112="1.12"
|
|
CHECK_TITLE_check112="[check112] Ensure no root account access key exists (Scored)"
|
|
CHECK_SCORED_check112="SCORED"
|
|
CHECK_TYPE_check112="LEVEL1"
|
|
CHECK_SEVERITY_check112="Critical"
|
|
CHECK_ASFF_TYPE_check112="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
|
CHECK_ALTERNATE_check112="check112"
|
|
CHECK_SERVICENAME_check112="iam"
|
|
CHECK_RISK_check112='The root account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the root account be removed. Removing access keys associated with the root account limits vectors by which the account can be compromised. Removing the root access keys encourages the creation and use of role based accounts that are least privileged.'
|
|
CHECK_REMEDIATION_check112='Use the credential report to that the user and ensure the access_key_1_active and access_key_2_active fields are set to FALSE .'
|
|
CHECK_DOC_check112='https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html'
|
|
CHECK_CAF_EPIC_check112='IAM'
|
|
|
|
check112(){
|
|
# "Ensure no root account access key exists (Scored)"
|
|
# ensure the access_key_1_active and access_key_2_active fields are set to FALSE.
|
|
ROOTKEY1=$(cat $TEMP_REPORT_FILE |grep root_account|awk -F',' '{ print $9 }')
|
|
ROOTKEY2=$(cat $TEMP_REPORT_FILE |grep root_account|awk -F',' '{ print $14 }')
|
|
if [ "$ROOTKEY1" == "false" ];then
|
|
textPass "No access key 1 found for root"
|
|
else
|
|
textFail "Found access key 1 for root"
|
|
fi
|
|
if [ "$ROOTKEY2" == "false" ];then
|
|
textPass "No access key 2 found for root"
|
|
else
|
|
textFail "Found access key 2 for root"
|
|
fi
|
|
}
|