cloud-report/analyzers/aws/iam/admins_count.js

Collects and analyzes cloud resources

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
const adminPolicyArn = "arn:aws:iam::aws:policy/AdministratorAccess";
class AdminCountAnalyzer extends base_1.BaseAnalyzer {
    analyze(params, fullReport) {
        const adminGroupNames = this.getAdminGroups(params.group_policies);
        let adminUsers = [];
        adminUsers = adminUsers.concat(this.getAdminsFromGroups(params.group_users, adminGroupNames));
        adminUsers = adminUsers.concat(this.getAdminsFromUsers(params.user_policies));
        const admin_count = { type: types_1.CheckAnalysisType.OperationalExcellence };
        admin_count.what = "Are there too many admins for the account?";
        admin_count.why = `It is hard to manage security goals
        when there too many admins as chances of mistakes increases`;
        admin_count.recommendation = "Recommended to have 2-3 admins per account";
        admin_count.benchmark = ['all', 'cis'];
        const analysis = {};
        analysis.resource = { adminUsers };
        analysis.resourceSummary = {
            name: "AdminUsers", value: adminUsers.length ? adminUsers.join(", ") : "None",
        };
        analysis.title = "Number of admins in the account";
        if (adminUsers.length > 3) {
            analysis.severity = types_1.SeverityStatus.Warning;
            analysis.message = "Account has more than 3 admins";
            analysis.action = "Keep only 3 admins";
        }
        else if (adminUsers.length === 0) {
            analysis.severity = types_1.SeverityStatus.Failure;
            analysis.message = "Account has no admins";
            analysis.action = "You should create at least one admin";
        }
        else {
            analysis.severity = types_1.SeverityStatus.Good;
            analysis.message = `Account has ${adminUsers.length} admins`;
        }
        admin_count.regions = { global: [analysis] };
        return { admin_count };
    }
    getAdminGroups(group_policies) {
        const adminGroups = [];
        for (const group_name in group_policies) {
            const adminPolicies = group_policies[group_name].filter((group_policy) => {
                return group_policy.PolicyArn === adminPolicyArn;
            });
            if (adminPolicies && adminPolicies.length) {
                adminGroups.push(group_name);
            }
        }
        return adminGroups;
    }
    getAdminsFromGroups(group_users, group_names) {
        let adminUsers = [];
        for (const group_name of group_names) {
            adminUsers = adminUsers.concat(group_users[group_name].map((user) => {
                return user.UserName;
            }));
        }
        return adminUsers;
    }
    getAdminsFromUsers(user_policies) {
        const adminUsers = [];
        for (const user_name in user_policies) {
            const adminPolicies = user_policies[user_name].filter((user_policy) => {
                return user_policy.PolicyArn === adminPolicyArn;
            });
            if (adminPolicies && adminPolicies.length) {
                adminUsers.push(user_name);
            }
        }
        return adminUsers;
    }
}
exports.AdminCountAnalyzer = AdminCountAnalyzer;