aws-resource-remediation/src/remediators/IAMCredentialsRemediator.js

A module to remediate AWS resources.

/**
 * Created by kpadmawa on 1/19/2017.
 */
/**
 * Created by kpadmawa on 1/19/2017.
 */
const AWS = require('aws-sdk');
var logger = require('node-generic-logger');
const MILLIS_IN_DAY = 24 * 60 * 60 * 1000;

function IAMCredentialsRemediator (iam) {
    this.iam = iam;
}

var getAccessKey = function(params, iam, cb){
    var getAccessKeyParams = {};
    if(params){
        for (var property in params) {
            if (params.hasOwnProperty(property)) {
                getAccessKeyParams[property] = params[property];
            }
        }
    }
    logger.info('In getAccessKey:'+JSON.stringify(getAccessKeyParams));
    iam.listAccessKeys(getAccessKeyParams, function(err , accessKeys){
        if(err){
            return cb(err);
        }
        logger.debug("Got access key .." + JSON.stringify(accessKeys));
        return cb(null, accessKeys);
    });
};

var isodate2days = function(dateStr){
    var days = 0;
    var now = new Date();
    if(dateStr != null && dateStr !== 'N/A'){
        var date = new Date(dateStr);
        days = Math.round((now.getTime() - date.getTime())/MILLIS_IN_DAY);
    }
    return days;
};

IAMCredentialsRemediator.prototype.createAccessKey = function (invocation, context, lastResult , cb) {
    if (!invocation['aws.credentials.accessKeyId']) {
        logger.error('Missing AWS account access key');
        throw new Error('Missing AWS account access key');
    }
    if (!invocation['aws.credentials.secretAccessKey']) {
        logger.error('Missing AWS account secrete access key');
        throw new Error('Missing AWS account secrete access key');
    }
    if (!invocation['region']) {
        logger.info('Missing AWS account region. Considering default region.');
        invocation['region'] = 'us-east-1';
    }
    if(invocation.payload.UserName === "<root_account>"){
        logger.error("Can not remediate root account. It needs root account access.");
        return cb("Can not remediate root account. It needs root account access.");
    }
    if (this.iam == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey']
        };
        this.iam = new AWS.IAM({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey});
    }
    if(lastResult != null && lastResult.canCreate){
        var createAccessKeyParams = {};
        if(invocation.payload){
            for (var property in invocation.payload) {
                if (invocation.payload.hasOwnProperty(property)) {
                    createAccessKeyParams[property] = invocation.payload[property];
                }
            }
        }
        this.iam.createAccessKey(createAccessKeyParams, function (err, data) {
            if (err) {
                logger.error('Failed to create access key' + err.stack);
                return cb(err);
            } else {
                return cb(null, data);
            }
        });
    }
}

IAMCredentialsRemediator.prototype.deleteAccessKey = function (invocation, context, lastResult , cb) {
    if (!invocation['aws.credentials.accessKeyId']) {
        logger.error('Missing AWS account access key');
        throw new Error('Missing AWS account access key');
    }
    if (!invocation['aws.credentials.secretAccessKey']) {
        logger.error('Missing AWS account secrete access key');
        throw new Error('Missing AWS account secrete access key');
    }
    if (!invocation['region']) {
        logger.info('Missing AWS account region. Considering default region.');
        invocation['region'] = 'us-east-1';
    }
    if(invocation.payload.UserName === "<root_account>"){
        logger.error("Can not remediate root account. It needs root account access.");
        return cb("Can not remediate root account. It needs root account access.");
    }
    if (this.iam == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey']
        };
        this.iam = new AWS.IAM({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey});
    }
    var self = this;
    if(lastResult != null && lastResult.updatedAccessKeys != null && lastResult.updatedAccessKeys.length > 0){
        var accessKeyTobeDeleted = lastResult.updatedAccessKeys[0];
        var deleteAccessKeyParams = {
            "AccessKeyId":accessKeyTobeDeleted
        };
        if(invocation.payload){
            for (var property in invocation.payload) {
                if (invocation.payload.hasOwnProperty(property)) {
                    deleteAccessKeyParams[property] = invocation.payload[property];
                }
            }
        }
        self.iam.deleteAccessKey(deleteAccessKeyParams, function (err, data) {
            if (err) {
                logger.error('Failed to delete access key' + err.stack);
                return cb(err);
            }
            logger.debug('Successfully deleted access key' + JSON.stringify(data));
        });
        return cb(null, {"canCreate":true})
    }
}

IAMCredentialsRemediator.prototype.updateAccessKey = function (invocation, context, lastResult , cb) {
    var self= this;
    logger.debug('In updateAccessKey:'+JSON.stringify(invocation));
    if(invocation.payload.UserName === "<root_account>"){
        logger.error("Can not remediate root account. It needs root account access.");
        return cb("Can not remediate root account. It needs root account access.");
    }
    if (this.iam == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey'],
        };
        this.iam = new AWS.IAM({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey});
    }
    getAccessKey(invocation.payload, this.iam, function(err, accessKeysData){
        if(err){
            return cb(err);
        }
        var accessKeys = accessKeysData.AccessKeyMetadata;
        var updatedAccessKeys =[];
        accessKeys.forEach(function(key){
            var accessKeyLastUsedParams = {
                AccessKeyId: key.AccessKeyId
            };
            logger.debug('invoking getAccessKeyLastUsed:'+JSON.stringify(accessKeyLastUsedParams));
            self.iam.getAccessKeyLastUsed(accessKeyLastUsedParams, function(err, lastUse) {
                if (err) return cb(err);
                var lastUsedDays = isodate2days(lastUse.AccessKeyLastUsed.LastUsedDate);
                if(lastUsedDays > 0){
                    var updateAccessKeyParams = {
                        Status: 'Inactive',
                        AccessKeyId:key.AccessKeyId
                    };
                    if(invocation.payload){
                        for (var property in invocation.payload) {
                            if (invocation.payload.hasOwnProperty(property)) {
                                updateAccessKeyParams[property] = invocation.payload[property];
                            }
                        }
                    }
                    logger.info('Updating access keys with :'+JSON.stringify(updateAccessKeyParams));
                    self.iam.updateAccessKey(updateAccessKeyParams, function (err, data) {
                        if (err) {
                            logger.error('Failed to update access key' + err.stack);
                            return cb(err);
                        } else {
                            //return cb(null, data);
                            updatedAccessKeys.push(key.AccessKeyId);
                        }
                    });
                }
            });
        })
        return cb(null, updatedAccessKeys);
    });
};

module.exports = IAMCredentialsRemediator;