cloud-report/analyzers/aws/vpc/subnets_with_igw_route.js

Collects and analyzes cloud resources

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class SubnetsWithIgwRouteAnalyzer extends base_1.BaseAnalyzer {
    analyze(params, fullReport) {
        const allSubnets = params.subnets;
        const allRoutes = params.route_tables;
        if (!allSubnets || !allRoutes) {
            return undefined;
        }
        const subnets_with_igw_route = { type: types_1.CheckAnalysisType.Security };
        subnets_with_igw_route.what = "Which subnets have route to public?";
        subnets_with_igw_route.why = `It is important to know which subnets have routes to
        public and can become valnerable to attacks. Also sometimes we misconfigure private subnets with public routes.`;
        subnets_with_igw_route.recommendation = `Recommended to keep only private routes for private
        subnets and protect public subnets with network acls.`;
        subnets_with_igw_route.benchmark = ['all', 'hipaa'];
        const allRegionsAnalysis = {};
        for (const region in allSubnets) {
            const regionSubnets = allSubnets[region];
            allRegionsAnalysis[region] = [];
            for (const subnet of regionSubnets) {
                if (subnet.DefaultForAz) {
                    continue;
                }
                const subnetAnalysis = {};
                const subnetRouteTable = this.getSubnetRouteTable(subnet.SubnetId, subnet.VpcId, allRoutes[region]);
                subnetAnalysis.resource = {
                    id: subnet.SubnetId, route_table: subnetRouteTable,
                    subnetName: this.getName(subnet),
                };
                subnetAnalysis.resourceSummary = {
                    name: "Subnet",
                    value: `${subnetAnalysis.resource.subnetName} | ${subnet.SubnetId}`,
                };
                if (this.doesRouteTableContainIgwRoute(subnetRouteTable)) {
                    subnetAnalysis.severity = types_1.SeverityStatus.Warning;
                    subnetAnalysis.message = "Subnet has route to the world.";
                    subnetAnalysis.action = "If the subnet is private then it shouldn't have route to the world.";
                }
                else {
                    subnetAnalysis.severity = types_1.SeverityStatus.Good;
                    subnetAnalysis.message = "Subnet does not have route to the world.";
                }
                allRegionsAnalysis[region].push(subnetAnalysis);
            }
        }
        subnets_with_igw_route.regions = allRegionsAnalysis;
        return { subnets_with_igw_route };
    }
    doesRouteTableContainIgwRoute(routeTable) {
        return routeTable.Routes.filter((route) => {
            if (route.GatewayId) {
                return route.GatewayId.startsWith("igw-") && route.State === "active";
            }
            return false;
        }).length > 0;
    }
    getName(subnet) {
        const nameTags = subnet.Tags.filter((tag) => {
            return tag.Key === "Name";
        });
        if (nameTags.length) {
            return nameTags[0].Value;
        }
        else {
            return "Unassigned";
        }
    }
    getSubnetRouteTable(subnetId, vpcId, routeTables) {
        return routeTables.filter((routeTable) => {
            if (routeTable.VpcId !== vpcId) {
                return false;
            }
            return routeTable.Associations.filter((association) => {
                return association.SubnetId === subnetId;
            }).length || routeTable.Associations.filter((association) => {
                return association.Main;
            }).length;
        })[0];
    }
}
exports.SubnetsWithIgwRouteAnalyzer = SubnetsWithIgwRouteAnalyzer;