aws-resource-remediation/tests/IAMPasswordPolicyRemediatorTests.js

A module to remediate AWS resources.

/**
 * Created by kpadmawa on 1/23/2017.
 */

const constants = require('../src/constants');
var logger = require('node-generic-logger');

logger.init({
    file: {
        name: 'aws-resource-remediation-test.log',
        level: 'info'
    },
    console: {
        level: 'debug'
    }
});

function IAMPasswordPolicyRemediatorTests (remediator) {
    this.resourceRemediator = remediator;
}

IAMPasswordPolicyRemediatorTests.prototype.test = function () {
    var self = this;
    describe('IAMPasswordPolicyRemediator:test', function () {
        it('IAMPasswordPolicyRemediator:remediateRuleOne', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "1",
                "ruleName": "1.5 Ensure IAM password policy requires at least one uppercase letter",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set uppercase letter rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "RequireUppercaseCharacters": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleTwo', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "2",
                "ruleName": "1.6 Ensure IAM password policy require at least one lowercase letter",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set lowercase letter rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "RequireLowercaseCharacters": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleThree', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "3",
                "ruleName": "1.7 Ensure IAM password policy require at least one symbol",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set one symbol rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "RequireSymbols": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleFour', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "4",
                "ruleName": "1.8 Ensure IAM password policy require at least one number",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set one number rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "RequireNumbers": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleFive', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "5",
                "ruleName": "1.9 Ensure IAM password policy requires minimum length of 14 or greater",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set minimum length password rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "MinimumPasswordLength": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleSix', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "6",
                "ruleName": "1.10 Ensure IAM password policy prevents password reuse",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set password reuse prevention rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "PasswordReusePrevention": "true"
                }
            };
            self.callRemediate(params, done);
        });
        it('IAMPasswordPolicyRemediator:remediateRuleSeven', function (done) {
            var params = {
                "policyId": "AWS CIS Password Policy",
                "ruleId": "7",
                "ruleName": "1.11 Ensure IAM password policy expires passwords within 90 days or less",
                "resourceId": "vl-pun-1989",
                "connectorId": "AKIAIIDS4HIAUHM6SEYA",
                "actionContent": "AWS Password Policy Remediation_1.0.0",
                "actionDefinition": "Update the password policy",
                "action": "Update password policy to set password maximum age rule",
                "result": {
                    "origin": "93534757",
                    "resourceType": "PASSWORD_POLICY"
                },
                "aws.credentials.accessKeyId":"abc",
                "aws.credentials.secretAccessKey":"xyz",
                "region": "us-east-1",
                "moduleName": "passwordPolicy",
                "method": "updateAccountPasswordPolicy",
                "payload": {
                    "MaxPasswordAge": "true"
                }
            };
            self.callRemediate(params, done);
        });
    })
};

IAMPasswordPolicyRemediatorTests.prototype.callRemediate = function (params, done) {
    this.resourceRemediator.remediate(params, function (err, data) {
        if (err) {
            logger.error('Got error in remediating IAM password policy for rule :' + params.ruleId, err);
            logger.error(err.stack);
        } else {
            logger.info('Successfully remediated IAM password policy for rule :'+params.ruleId);
        }
    });
    done();
};

module.exports = IAMPasswordPolicyRemediatorTests;