cloud-report/analyzers/aws/iam/roles_without_external_id.js

Collects and analyzes cloud resources

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const utils_1 = require("../../../utils");
const base_1 = require("../../base");
class RolesWithoutExternalIDAnalyzer extends base_1.BaseAnalyzer {
    analyze(params, fullReport) {
        const allRolesPolicies = this.getAssumeRolePolicyDocument(params.roles);
        const mainAccountID = this.getAccountIDs(params.roles[0].Arn)[0];
        const permittedAccounts = this.getPermittedAccounts(allRolesPolicies);
        const cross_accounts_without_external_id = { type: types_1.CheckAnalysisType.Security };
        cross_accounts_without_external_id.what = "Are there cross account roles without ExternalId?";
        cross_accounts_without_external_id.why = `It is important to associate
        ExternalId for cross account role access`;
        cross_accounts_without_external_id.recommendation = `Recommended to use ExternalId for
        roles which give access to third party accounts`;
        cross_accounts_without_external_id.benchmark = ['all', 'cis'];
        const analysis = [];
        permittedAccounts.forEach((roleAccountsObject) => {
            roleAccountsObject.Accounts.forEach((account) => {
                account.accountIDs = this.removeAccountIDFromList(account.accountIDs, mainAccountID);
                if (!account.accountIDs || !account.accountIDs.length) {
                    return;
                }
                const crossAccountAnalysis = {
                    resourceSummary: {
                        name: "Roles",
                        value: roleAccountsObject.Role,
                    },
                };
                if (account.ExternalID) {
                    crossAccountAnalysis.severity = types_1.SeverityStatus.Good;
                    crossAccountAnalysis.message = `Accounts ${account.accountIDs} has ExternalId`;
                }
                else {
                    crossAccountAnalysis.severity = types_1.SeverityStatus.Failure;
                    crossAccountAnalysis.action = "Add an ExternalId";
                    crossAccountAnalysis.message = `Accounts ${account.accountIDs} does not have ExternalId`;
                }
                analysis.push(crossAccountAnalysis);
            });
        });
        cross_accounts_without_external_id.regions = { global: analysis };
        return { cross_accounts_without_external_id };
    }
    getAssumeRolePolicyDocument(roles) {
        if (!roles) {
            return [];
        }
        return roles.map((role) => {
            const rolePolicies = {};
            rolePolicies.Role = role.RoleName;
            rolePolicies.AssumeRolePolicyDocument = role.AssumeRolePolicyDocument;
            return rolePolicies;
        });
    }
    getPermittedAccounts(allPolicies) {
        if (!allPolicies) {
            return [];
        }
        return allPolicies.map((eachPolicy) => {
            return this.getRoleAccountsObject(eachPolicy.Role, eachPolicy.AssumeRolePolicyDocument.Statement);
        });
    }
    getRoleAccountsObject(role, Statements) {
        const roleAccountsObject = {};
        roleAccountsObject.Role = role;
        roleAccountsObject.Accounts = Statements.filter((statement) => {
            return statement.Principal.AWS;
        }).map((statement) => {
            const accountDetails = {};
            accountDetails.accountIDs = this.getAccountIDs(statement.Principal.AWS);
            if (statement.Condition && statement.Condition.StringEquals) {
                accountDetails.ExternalID = statement.Condition.StringEquals["sts:ExternalId"];
            }
            return accountDetails;
        });
        return roleAccountsObject;
    }
    getAccountIDs(arns) {
        const arnsArray = utils_1.CommonUtil.toArray(arns);
        return arnsArray.map((arn) => {
            return arn.split(":")[4];
        });
    }
    removeAccountIDFromList(accountIds, accountIdToBeRemoved) {
        if (!accountIds || !accountIds.length) {
            return [];
        }
        else {
            return accountIds.filter((accountId) => {
                return accountId !== accountIdToBeRemoved;
            });
        }
    }
}
exports.RolesWithoutExternalIDAnalyzer = RolesWithoutExternalIDAnalyzer;