cloud-report/analyzers/aws/iam/groups_used.js

Collects and analyzes cloud resources

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class GroupsAnalyzerAnalyzer extends base_1.BaseAnalyzer {
    analyze(params, fullReport) {
        const allGroupUsers = params.group_users;
        const allUsers = params.users;
        if (!allGroupUsers || !allGroupUsers) {
            return undefined;
        }
        const iam_groups_used = { type: types_1.CheckAnalysisType.Security };
        iam_groups_used.what = "Are IAM groups used for granting permissions?";
        iam_groups_used.why = `When we use IAM groups to grant access to
        IAM users then it will be easy to manage access control`;
        iam_groups_used.recommendation = "Recommended to use IAM groups for granting access to the users";
        iam_groups_used.benchmark = ['all', 'cis', 'hipaa'];
        const groupsByUser = this.mapGroupsByUser(allGroupUsers);
        const allUserAnalysis = [];
        for (const user of allUsers) {
            const userAnalysis = {};
            userAnalysis.resource = { user, groups: groupsByUser[user.UserName] };
            userAnalysis.resourceSummary = {
                name: "User",
                value: user.UserName,
            };
            if (groupsByUser[user.UserName] && groupsByUser[user.UserName].length) {
                userAnalysis.severity = types_1.SeverityStatus.Good;
                userAnalysis.message = `User belongs to ${groupsByUser[user.UserName].join(", ")} groups`;
            }
            else {
                userAnalysis.severity = types_1.SeverityStatus.Failure;
                userAnalysis.message = "User doesn't belong to any group";
                userAnalysis.action = "User groups for granting access to the users";
            }
            allUserAnalysis.push(userAnalysis);
        }
        iam_groups_used.regions = { global: allUserAnalysis };
        return { iam_groups_used };
    }
    mapGroupsByUser(groups) {
        return Object.keys(groups).reduce((groupsMap, groupName) => {
            const groupUsers = groups[groupName];
            if (groupUsers && groupUsers.length) {
                groupUsers.forEach((user) => {
                    groupsMap[user.UserName] = groupsMap[user.UserName] || [];
                    groupsMap[user.UserName].push(groupName);
                });
            }
            return groupsMap;
        }, {});
    }
}
exports.GroupsAnalyzerAnalyzer = GroupsAnalyzerAnalyzer;