cloud-report/analyzers/aws/s3/bucket_access_logs.js

Collects and analyzes cloud resources

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class CloudTrailsBucketAccessLogsAnalyzer extends base_1.BaseAnalyzer {
    analyze(params, fullReport) {
        const allBucketAccessLogs = params.bucket_access_logs;
        if (!allBucketAccessLogs || !fullReport["aws.trails"] || !fullReport["aws.trails"].cloud_trails) {
            return undefined;
        }
        const allCloudTrails = fullReport["aws.trails"].cloud_trails;
        const bucket_access_logs = { type: types_1.CheckAnalysisType.Security };
        bucket_access_logs.what = "Are access logs enabled for buckets containing Cloud Trails?";
        bucket_access_logs.recommendation = "Recommended to enable access logs for buckets containing Cloud Trails";
        bucket_access_logs.benchmark = ['all'];
        const allBucketsAnalysis = [];
        const cloudTrailBuckets = this.getCloudTrailBuckets(allCloudTrails);
        for (const bucketName of cloudTrailBuckets) {
            const bucketAccessLogs = allBucketAccessLogs[bucketName];
            const bucketAnalysis = {};
            bucketAnalysis.resourceSummary = { name: "Bucket", value: bucketName };
            if (bucketAccessLogs && bucketAccessLogs.LoggingEnabled) {
                bucketAnalysis.resource = { bucketName, bucketAccessLogs };
                bucketAnalysis.severity = types_1.SeverityStatus.Good;
                bucketAnalysis.message = "Access logs are enabled";
            }
            else {
                bucketAnalysis.resource = { bucketName };
                bucketAnalysis.severity = types_1.SeverityStatus.Failure;
                bucketAnalysis.message = "Access logs are not enabled";
                bucketAnalysis.action = "Enable access logs";
            }
            allBucketsAnalysis.push(bucketAnalysis);
        }
        bucket_access_logs.regions = { global: allBucketsAnalysis };
        return { bucket_access_logs };
    }
    getCloudTrailBuckets(cloudTrails) {
        const s3Buckets = {};
        for (const region in cloudTrails) {
            cloudTrails[region].forEach((trail) => {
                s3Buckets[trail.S3BucketName] = 1;
            });
        }
        return Object.keys(s3Buckets);
    }
}
exports.CloudTrailsBucketAccessLogsAnalyzer = CloudTrailsBucketAccessLogsAnalyzer;