cloud-report
Version:
Collects and analyzes cloud resources
47 lines (46 loc) • 2.37 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const utils_1 = require("../../../utils");
const base_1 = require("../../base");
class InstanceProfilesUsageAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allInstances = params.instances;
if (!allInstances) {
return undefined;
}
const instance_profiles_used = { type: types_1.CheckAnalysisType.Security };
instance_profiles_used.what = "Are there any EC2 instances without IAM Instance Profile?";
instance_profiles_used.why = `We should use IAM Instance profile
roles for granting EC2 instances access to other AWS resources`;
instance_profiles_used.recommendation = `Recommended to assign IAM instance profile to
EC2 instances instead of hard coding IAM credentials`;
instance_profiles_used.benchmark = ['all', 'cis', 'hipaa'];
const allRegionsAnalysis = {};
for (const region in allInstances) {
const regionInstances = allInstances[region];
allRegionsAnalysis[region] = [];
for (const instance of regionInstances) {
const instanceAnalysis = {};
instanceAnalysis.resource = instance;
instanceAnalysis.resourceSummary = {
name: "Instance",
value: `${utils_1.ResourceUtil.getNameByTags(instance)} | ${instance.InstanceId}`,
};
if (instance.IamInstanceProfile) {
instanceAnalysis.severity = types_1.SeverityStatus.Good;
instanceAnalysis.message = "IAM Instance profile is assigned";
}
else {
instanceAnalysis.severity = types_1.SeverityStatus.Info;
instanceAnalysis.message = "IAM Instance profile is not assigned";
instanceAnalysis.action = "Assign IAM Instance profile to the instance";
}
allRegionsAnalysis[region].push(instanceAnalysis);
}
}
instance_profiles_used.regions = allRegionsAnalysis;
return { instance_profiles_used };
}
}
exports.InstanceProfilesUsageAnalyzer = InstanceProfilesUsageAnalyzer;