cloud-report
Version:
Collects and analyzes cloud resources
43 lines (42 loc) • 1.87 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class RootUserMfaEnabledAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const credentials = params.credentials;
if (!credentials) {
return;
}
const rootUserIndex = credentials.findIndex((credential) => {
return credential.user === "<root_>";
});
if (rootUserIndex === -1) {
return;
}
const root_user_mfa_enabled = { type: types_1.CheckAnalysisType.Security };
root_user_mfa_enabled.what = "Is MFA enabled root user?";
root_user_mfa_enabled.why = `Root user should always use MFA when they login via AWS console as access
can't be restricted so damage caused by leakage will be determental`;
root_user_mfa_enabled.recommendation = "Recommended to enable MFA for root user";
root_user_mfa_enabled.benchmark = ['all', 'cis'];
const analysis = {};
analysis.resource = credentials[rootUserIndex];
analysis.resourceSummary = {
name: "User",
value: analysis.resource.user,
};
if (credentials[rootUserIndex].mfa_active === "true") {
analysis.severity = types_1.SeverityStatus.Good;
analysis.message = "Root user is MFA enabled";
}
else {
analysis.severity = types_1.SeverityStatus.Failure;
analysis.message = "Root is not MFA enabled";
analysis.action = "Enable MFA for the root user";
}
root_user_mfa_enabled.regions = { global: [analysis] };
return { root_user_mfa_enabled };
}
}
exports.RootUserMfaEnabledAnalyzer = RootUserMfaEnabledAnalyzer;