cloud-report
Version:
Collects and analyzes cloud resources
59 lines (58 loc) • 2.7 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class ESDomainsOpenToWorldAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allDomains = params.domains;
if (!allDomains) {
return undefined;
}
const domains_open_to_world = { type: types_1.CheckAnalysisType.Security };
domains_open_to_world.what = "Are there any Elasticsearch service domains open to world?";
domains_open_to_world.why = `Domains open to world posses serious security
threat so we need to allow only intended parties to access`;
domains_open_to_world.recommendation = "Recommended to restrict domain access as per your application needs";
domains_open_to_world.benchmark = ['all'];
const allRegionsAnalysis = {};
for (const region in allDomains) {
const regionDomains = allDomains[region];
allRegionsAnalysis[region] = [];
for (const domain of regionDomains) {
const domainAnalysis = {};
domainAnalysis.resource = domain;
domainAnalysis.resourceSummary = {
name: "Domain",
value: domain.DomainName,
};
if (this.isOpenToWorld(domain)) {
domainAnalysis.severity = types_1.SeverityStatus.Failure;
domainAnalysis.message = "Domain is open to the world";
domainAnalysis.action = 'Remove access policy statement containing AWS: ["*"]';
}
else {
domainAnalysis.severity = types_1.SeverityStatus.Good;
domainAnalysis.message = "Domain is not open to the world";
}
allRegionsAnalysis[region].push(domainAnalysis);
}
}
domains_open_to_world.regions = allRegionsAnalysis;
return { domains_open_to_world };
}
isOpenToWorld(domain) {
if (!domain.AccessPolicies) {
return false;
}
const accessPolicy = JSON.parse(domain.AccessPolicies);
if (!accessPolicy.Statement || !accessPolicy.Statement.length) {
return false;
}
return accessPolicy.Statement.some((statementLine) => {
return statementLine.Principal &&
statementLine.Principal.AWS &&
statementLine.Principal.AWS.includes("*");
});
}
}
exports.ESDomainsOpenToWorldAnalyzer = ESDomainsOpenToWorldAnalyzer;