mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-11 07:15:15 +00:00
38 lines
2.2 KiB
Bash
38 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
CHECK_ID_extra733="7.33"
|
|
CHECK_TITLE_extra733="[extra733] Check if there are SAML Providers then STS can be used"
|
|
CHECK_SCORED_extra733="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_extra733="EXTRA"
|
|
CHECK_SEVERITY_extra733="Low"
|
|
CHECK_ALTERNATE_check733="extra733"
|
|
CHECK_ASFF_COMPLIANCE_TYPE_extra733="ens-op.acc.1.aws.iam.1"
|
|
CHECK_SERVICENAME_extra733="iam"
|
|
CHECK_RISK_extra733='Without SAML provider users with AWS CLI or AWS API access can use IAM static credentials. SAML helps users to assume role by default each time they authenticate.'
|
|
CHECK_REMEDIATION_extra733='Enable SAML provider and use temporary credentials. You can use temporary security credentials to make programmatic requests for AWS resources using the AWS CLI or AWS API (using the AWS SDKs ). The temporary credentials provide the same permissions that you have with use long-term security credentials such as IAM user credentials. In case of not having SAML provider capabilities prevent usage of long-lived credentials.'
|
|
CHECK_DOC_extra733='https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html'
|
|
CHECK_CAF_EPIC_extra733='IAM'
|
|
|
|
extra733(){
|
|
LIST_SAML_PROV=$($AWSCLI iam list-saml-providers $PROFILE_OPT --query 'SAMLProviderList[*].Arn' --output text |grep -v ^None)
|
|
if [[ $LIST_SAML_PROV ]]; then
|
|
for provider in $LIST_SAML_PROV; do
|
|
PROVIDER_NAME=$(echo $provider| cut -d/ -f2)
|
|
textInfo "$REGION: SAML Provider $PROVIDER_NAME has been found" "$REGION" "$PROVIDER_NAME"
|
|
done
|
|
else
|
|
textFail "$REGION: No SAML Provider found. Add one and use STS" "$REGION" "$PROVIDER_NAME"
|
|
fi
|
|
}
|