cloud-report
Version:
Collects and analyzes cloud resources
70 lines (69 loc) • 3.81 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
const millsIn180Days = 180 * 24 * 60 * 60 * 1000;
class UsersAccessKeysOldAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const credentials = params.credentials;
if (!credentials) {
return;
}
const userCredentials = credentials.filter((credential) => {
return credential.user !== "<root_account>" &&
(credential.access_key_1_active === "true" || credential.access_key_2_active === "true");
});
const users_access_keys_old = { type: types_1.CheckAnalysisType.Security };
users_access_keys_old.what = "Are user access keys are too old?";
users_access_keys_old.why = "It is important to rotate access keys regularly as it will reduce improper use";
users_access_keys_old.recommendation = "Recommended to rotate user access keys regularly";
users_access_keys_old.benchmark = ['all', 'cis', 'hipaa'];
const allUsersAccessKeysAnalysis = [];
userCredentials.forEach((credential) => {
const user_access_keys_old = {};
user_access_keys_old.resource = credential;
user_access_keys_old.resourceSummary = {
name: "User",
value: user_access_keys_old.resource.user,
};
const access_key_1_old = this.isUserAccessKeysOld(credential.access_key_1_last_rotated);
const access_key_2_old = this.isUserAccessKeysOld(credential.access_key_2_last_rotated);
if (credential.access_key_1_active === "true") {
const user_access_key1_old = Object.assign({}, user_access_keys_old);
if (access_key_1_old) {
user_access_key1_old.severity = types_1.SeverityStatus.Failure;
user_access_key1_old.message = "User access key 1 is not rotated from last 180 days";
user_access_key1_old.action = "Rotate user access key 1";
}
else {
user_access_key1_old.severity = types_1.SeverityStatus.Good;
user_access_key1_old.message = "User access key 1 is rotated within last 180 days";
}
allUsersAccessKeysAnalysis.push(user_access_key1_old);
}
if (credential.access_key_2_active === "true") {
const user_access_key2_old = Object.assign({}, user_access_keys_old);
if (access_key_2_old) {
user_access_key2_old.severity = types_1.SeverityStatus.Failure;
user_access_key2_old.message = "User access key 2 is not rotated from last 180 days";
user_access_key2_old.action = "Rotate user access key 2";
}
else {
user_access_key2_old.severity = types_1.SeverityStatus.Good;
user_access_key2_old.message = "User access key 2 is rotated within last 180 days";
}
allUsersAccessKeysAnalysis.push(user_access_key2_old);
}
});
users_access_keys_old.regions = { global: allUsersAccessKeysAnalysis };
return { users_access_keys_old };
}
isUserAccessKeysOld(access_key_last_rotated) {
if (access_key_last_rotated === "N/A") {
return false;
}
const access_key_last_rotated_time = new Date(access_key_last_rotated).getTime();
return (access_key_last_rotated_time < Date.now() - millsIn180Days);
}
}
exports.UsersAccessKeysOldAnalyzer = UsersAccessKeysOldAnalyzer;