mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 23:05:05 +00:00
72 lines
3.8 KiB
Bash
72 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
CHECK_ID_check14="1.4"
|
|
CHECK_TITLE_check14="[check14] Ensure access keys are rotated every 90 days or less (Scored)"
|
|
CHECK_SCORED_check14="SCORED"
|
|
CHECK_TYPE_check14="LEVEL1"
|
|
CHECK_SEVERITY_check14="Medium"
|
|
CHECK_ASFF_TYPE_check14="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
|
CHECK_ASFF_RESOURCE_TYPE_check14="AwsIamUser"
|
|
CHECK_ALTERNATE_check104="check14"
|
|
CHECK_ASFF_COMPLIANCE_TYPE_check14="ens-op.acc.1.aws.iam.4 ens-op.acc.5.aws.iam.3"
|
|
CHECK_SERVICENAME_check14="iam"
|
|
CHECK_RISK_check14='Access keys consist of an access key ID and secret access key which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI)- Tools for Windows PowerShell- the AWS SDKs- or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.'
|
|
CHECK_REMEDIATION_check14='Use the credential report to ensure access_key_X_last_rotated is less than 90 days ago.'
|
|
CHECK_DOC_check14='https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html'
|
|
CHECK_CAF_EPIC_check14='IAM'
|
|
|
|
check14(){
|
|
# "Ensure access keys are rotated every 90 days or less (Scored)" # also checked by Security Monkey
|
|
LIST_OF_USERS_WITH_ACCESS_KEY1=$(cat $TEMP_REPORT_FILE| awk -F, '{ print $1, $9 }' |grep "\ true" | awk '{ print $1 }')
|
|
LIST_OF_USERS_WITH_ACCESS_KEY2=$(cat $TEMP_REPORT_FILE| awk -F, '{ print $1, $14 }' |grep "\ true" | awk '{ print $1 }')
|
|
C14_NUM_USERS1=0
|
|
C14_NUM_USERS2=0
|
|
if [[ $LIST_OF_USERS_WITH_ACCESS_KEY1 ]]; then
|
|
# textFail "Users with access key 1 older than 90 days:"
|
|
for user in $LIST_OF_USERS_WITH_ACCESS_KEY1; do
|
|
# check access key 1
|
|
DATEROTATED1=$(cat $TEMP_REPORT_FILE | grep -v user_creation_time | grep "^${user},"| awk -F, '{ print $10 }' | grep -v "N/A" | awk -F"T" '{ print $1 }')
|
|
HOWOLDER=$(how_older_from_today $DATEROTATED1)
|
|
|
|
if [ $HOWOLDER -gt "90" ];then
|
|
textFail "$user has not rotated access key 1 in over 90 days" "us-east-1" "$user"
|
|
C14_NUM_USERS1=$(expr $C14_NUM_USERS1 + 1)
|
|
fi
|
|
done
|
|
if [[ $C14_NUM_USERS1 -eq 0 ]]; then
|
|
textPass "No users with access key 1 older than 90 days"
|
|
fi
|
|
else
|
|
textPass "No users with access key 1"
|
|
fi
|
|
|
|
if [[ $LIST_OF_USERS_WITH_ACCESS_KEY2 ]]; then
|
|
# textFail "Users with access key 2 older than 90 days:"
|
|
for user in $LIST_OF_USERS_WITH_ACCESS_KEY2; do
|
|
# check access key 2
|
|
DATEROTATED2=$(cat $TEMP_REPORT_FILE | grep -v user_creation_time | grep "^${user},"| awk -F, '{ print $15 }' | grep -v "N/A" | awk -F"T" '{ print $1 }')
|
|
HOWOLDER=$(how_older_from_today $DATEROTATED2)
|
|
if [ $HOWOLDER -gt "90" ];then
|
|
textFail "$user has not rotated access key 2 in over 90 days" "us-east-1" "$user"
|
|
C14_NUM_USERS2=$(expr $C14_NUM_USERS2 + 1)
|
|
fi
|
|
done
|
|
if [[ $C14_NUM_USERS2 -eq 0 ]]; then
|
|
textPass "No users with access key 2 older than 90 days"
|
|
fi
|
|
else
|
|
textPass "No users with access key 2"
|
|
fi
|
|
}
|