cloud-report
Version:
Collects and analyzes cloud resources
71 lines (70 loc) • 3.88 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
const millsIn60Days = 60 * 24 * 60 * 60 * 1000;
class UsersAccessKeysUnusedAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const credentials = params.credentials;
if (!credentials) {
return;
}
const userCredentials = credentials.filter((credential) => {
return credential.user !== "<root_account>" &&
(credential.access_key_1_active === "true" || credential.access_key_2_active === "true");
});
const users_access_keys_unused = { type: types_1.CheckAnalysisType.Security };
users_access_keys_unused.what = "Are there any user access keys unused?";
users_access_keys_unused.why = `It is important to delete unused or
unneeded access keys as it reduces risk of misusing them`;
users_access_keys_unused.recommendation = "Recommended to delete unused user access keys regularly";
users_access_keys_unused.benchmark = ['all', 'cis'];
const allUsersAccessKeysAnalysis = [];
userCredentials.forEach((credential) => {
const user_access_keys_unused = {};
user_access_keys_unused.resource = credential;
user_access_keys_unused.resourceSummary = {
name: "User",
value: user_access_keys_unused.resource.user,
};
const access_key_1_used = this.isUserAccessKeysActivelyUsed(credential.access_key_1_last_used_date);
const access_key_2_used = this.isUserAccessKeysActivelyUsed(credential.access_key_2_last_used_date);
if (credential.access_key_1_active === "true") {
const user_access_key1_unused = Object.assign({}, user_access_keys_unused);
if (access_key_1_used) {
user_access_key1_unused.severity = types_1.SeverityStatus.Good;
user_access_key1_unused.message = "User access key 1 is actively used";
}
else {
user_access_key1_unused.severity = types_1.SeverityStatus.Failure;
user_access_key1_unused.message = "User access key 1 is unused";
user_access_key1_unused.action = "Delete unused user access key 1";
}
allUsersAccessKeysAnalysis.push(user_access_key1_unused);
}
if (credential.access_key_2_active === "true") {
const user_access_key2_unused = Object.assign({}, user_access_keys_unused);
if (access_key_2_used) {
user_access_key2_unused.severity = types_1.SeverityStatus.Good;
user_access_key2_unused.message = "User access key 2 is actively used";
}
else {
user_access_key2_unused.severity = types_1.SeverityStatus.Failure;
user_access_key2_unused.message = "User access key 2 is unused";
user_access_key2_unused.action = "Delete unused user access key 2";
}
allUsersAccessKeysAnalysis.push(user_access_key2_unused);
}
});
users_access_keys_unused.regions = { global: allUsersAccessKeysAnalysis };
return { users_access_keys_unused };
}
isUserAccessKeysActivelyUsed(access_key_last_used_date) {
if (access_key_last_used_date === "N/A") {
return false;
}
const last_used_date_time = new Date(access_key_last_used_date).getTime();
return (last_used_date_time > Date.now() - millsIn60Days);
}
}
exports.UsersAccessKeysUnusedAnalyzer = UsersAccessKeysUnusedAnalyzer;