aws-resource-remediation/src/remediators/IAMPasswordPolicyRemediator.js

A module to remediate AWS resources.

/**
 * Created by kpadmawa on 1/19/2017.
 */

const AWS = require('aws-sdk');
const constants = require('../constants');
var logger = require('node-generic-logger');
const missingRegex = /The Password Policy with domain name [\d]+ cannot be found/;

function IAMPasswordPolicyRemediator(iam) {
    this.iam = iam;
}

var getPasswordPolicy = function(iam, cb){
    var params = {
        MaxPasswordAge: 0,
        MinimumPasswordLength: 0,
        PasswordReusePrevention: 0,
        RequireLowercaseCharacters: true,
        RequireNumbers: true,
        RequireSymbols: true,
        RequireUppercaseCharacters: true
    };

    iam.getAccountPasswordPolicy(function(err , data){
        if(err){
            if(!missingRegex.test(err.message)){
                return cb(err);
            }
        }
        var pwdPolicy = data.PasswordPolicy
        for(var property in params) {
            if (params.hasOwnProperty(property) && pwdPolicy.hasOwnProperty(property)) {
                params[property] = pwdPolicy[property];
            } else {
                params[property] = undefined;
            }
        }
        logger.info("new password policy .." + JSON.stringify(params));
        return cb(null, params);
    });
}

IAMPasswordPolicyRemediator.prototype.updateAccountPasswordPolicy = function (invocation, context, lastResult , cb) {
    var self = this;
    if (this.iam == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey'],
        };
        this.iam = new AWS.IAM({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey});
    }
    getPasswordPolicy(this.iam, function(err, pwdPolicy){
        if(err){
            return cb(err);
        }
        if(invocation.payload){
            for (var property in invocation.payload) {
                if (invocation.payload.hasOwnProperty(property)) {
                    pwdPolicy[property] = invocation.payload[property];
                }
            }
        }
        logger.info("Modified Password policy from action parameters.." + JSON.stringify(pwdPolicy));
        self.iam.updateAccountPasswordPolicy(pwdPolicy, function (err, data) {
            if (err) {
                logger.error('Failed to update password policy' + err.stack);
                return cb(err);
            } else {
                logger.info('Successfully updated password policy' + JSON.stringify(data));
                return cb(null, data);
            }
        });
    });
};

module.exports = IAMPasswordPolicyRemediator;