cloud-report
Version:
Collects and analyzes cloud resources
44 lines (43 loc) • 2.31 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class CloudTrailsCMKEncryptionAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allTrails = params.trail_with_key_manager;
if (!allTrails) {
return undefined;
}
const cloud_trails_cmk_encryption_at_rest = { type: types_1.CheckAnalysisType.Security };
cloud_trails_cmk_encryption_at_rest.what = "Are Cloud trails encrypted using KMS CMK at rest?";
cloud_trails_cmk_encryption_at_rest.why = "Critical data should always be encrypted at rest";
cloud_trails_cmk_encryption_at_rest.recommendation = "Recommended to enable KMS CMK encryption at rest for CloudTrails";
cloud_trails_cmk_encryption_at_rest.benchmark = ['all', 'hipaa'];
const allRegionsAnalysis = {};
for (const region in allTrails) {
const regionTrails = allTrails[region];
allRegionsAnalysis[region] = [];
for (const trail of regionTrails) {
const trail_analysis = {};
trail_analysis.resource = trail;
trail_analysis.resourceSummary = {
name: "CloudTrail", value: trail.Name,
};
if (trail.KmsKeyWithDescription && trail.KmsKeyWithDescription.KeyMetadata &&
(trail.KmsKeyWithDescription.KeyMetadata.KeyManager !== 'AWS')) {
trail_analysis.severity = types_1.SeverityStatus.Good;
trail_analysis.message = "Encryption enabled";
}
else {
trail_analysis.severity = types_1.SeverityStatus.Failure;
trail_analysis.message = "Encryption not enabled using CMK";
trail_analysis.action = "Enable encryption at rest using KMS CMK";
}
allRegionsAnalysis[region].push(trail_analysis);
}
}
cloud_trails_cmk_encryption_at_rest.regions = allRegionsAnalysis;
return { cloud_trails_cmk_encryption_at_rest };
}
}
exports.CloudTrailsCMKEncryptionAnalyzer = CloudTrailsCMKEncryptionAnalyzer;