UNPKG

cloud-report

Version:

Collects and analyzes cloud resources

47 lines (46 loc) 2.37 kB
"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); const types_1 = require("../../../types"); const utils_1 = require("../../../utils"); const base_1 = require("../../base"); class InstanceProfilesUsageAnalyzer extends base_1.BaseAnalyzer { analyze(params, fullReport) { const allInstances = params.instances; if (!allInstances) { return undefined; } const instance_profiles_used = { type: types_1.CheckAnalysisType.Security }; instance_profiles_used.what = "Are there any EC2 instances without IAM Instance Profile?"; instance_profiles_used.why = `We should use IAM Instance profile roles for granting EC2 instances access to other AWS resources`; instance_profiles_used.recommendation = `Recommended to assign IAM instance profile to EC2 instances instead of hard coding IAM credentials`; instance_profiles_used.benchmark = ['all', 'cis', 'hipaa']; const allRegionsAnalysis = {}; for (const region in allInstances) { const regionInstances = allInstances[region]; allRegionsAnalysis[region] = []; for (const instance of regionInstances) { const instanceAnalysis = {}; instanceAnalysis.resource = instance; instanceAnalysis.resourceSummary = { name: "Instance", value: `${utils_1.ResourceUtil.getNameByTags(instance)} | ${instance.InstanceId}`, }; if (instance.IamInstanceProfile) { instanceAnalysis.severity = types_1.SeverityStatus.Good; instanceAnalysis.message = "IAM Instance profile is assigned"; } else { instanceAnalysis.severity = types_1.SeverityStatus.Info; instanceAnalysis.message = "IAM Instance profile is not assigned"; instanceAnalysis.action = "Assign IAM Instance profile to the instance"; } allRegionsAnalysis[region].push(instanceAnalysis); } } instance_profiles_used.regions = allRegionsAnalysis; return { instance_profiles_used }; } } exports.InstanceProfilesUsageAnalyzer = InstanceProfilesUsageAnalyzer;