Merge pull request #137 from cloudgraphdev/alpha

Beta branch release

Author: tyler-dunkel

src/aws/pci-dss-3.2.1/rules/pci-dss-3.2.1-ec2-check-4.ts

@@ -34,9 +34,7 @@ export default {
       accountId
       __typename
       instanceId
-      ec2Instance {
-        arn
-      }
+      ec2InstanceAssociationId
     }
   }`,
   resource: 'queryawsEip[*]',
@@ -48,8 +46,8 @@ export default {
         notEqual: null,
       },
       {
-        path: '@.ec2Instance',
-        isEmpty: false,
+        path: '@.ec2InstanceAssociationId',
+        notEqual: null,
       },
     ],
   },

src/aws/pci-dss-3.2.1/rules/pci-dss-3.2.1-iam-check-1.ts

@@ -34,18 +34,19 @@ export default {
     'https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html',
   ],
   gql: `{
-    queryawsIamUser {
+    queryawsIamUser(filter: { name: { eq: "root" } }) {
       id
       arn
       accountId
-      __typename
-      name
+       __typename
+      accessKeysActive
     }
   }`,
+  exclude: { not: { path: '@.name', equal: 'root' } },
   resource: 'queryawsIamUser[*]',
   severity: 'high',
   conditions: {
-    path: '@.name',
-    notEqual: 'root',
+    path: '@.accessKeysActive',
+    equal: false,
   },
 }

src/aws/pci-dss-3.2.1/rules/pci-dss-3.2.1-iam-check-3.ts

@@ -45,24 +45,32 @@ export default {
   resource: 'queryawsIamPolicy[*]',
   severity: 'high',
   conditions: {
-    not: {
-      path: '@.policyContent.statement',
-      array_any: {
-        and: [
-          {
-            path: '[*].effect',
-            equal: 'Allow',
-          },
-          {
-            path: '[*].action',
-            contains: '*',
-          },
-          {
-            path: '[*].resource',
-            contains: '*',
-          },
-        ],
+    or: [
+      {
+        path: '@.name',
+        equal: 'AdministratorAccess',
       },
-    },
+      {
+        not: {
+          path: '@.policyContent.statement',
+          array_any: {
+            and: [
+              {
+                path: '[*].effect',
+                equal: 'Allow',
+              },
+              {
+                path: '[*].action',
+                contains: '*',
+              },
+              {
+                path: '[*].resource',
+                contains: '*',
+              },
+            ],
+          },
+        },
+      }
+    ]
   },
 }

src/aws/pci-dss-3.2.1/tests/pci-dss-3.2.1-ec2-checks.test.ts

@@ -199,11 +199,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
           {
             id: cuid(),
             instanceId: cuid(),
-            ec2Instance: [
-              {
-                arn: cuid(),
-              },
-            ],
+            ec2InstanceAssociationId: cuid(),
           },
         ],
       }
@@ -222,7 +218,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
           {
             id: cuid(),
             instanceId: null,
-            ec2Instance: [],
+            ec2InstanceAssociationId: null,
           },
         ],
       }

src/aws/pci-dss-3.2.1/tests/pci-dss-3.2.1-iam-checks.test.ts

@@ -18,12 +18,13 @@ describe('PCI Data Security Standard: 3.2.1', () => {
   })
 
   describe('IAM Check 1: IAM root user access key should not exist', () => {
-    test('Should fail when it finds a user called root', async () => {
+    test('Should fail when root account has at least one access key active', async () => {
       const data = {
         queryawsIamUser: [
           {
             id: cuid(),
             name: 'root',
+            accessKeysActive: true,
           },
         ],
       }
@@ -36,12 +37,13 @@ describe('PCI Data Security Standard: 3.2.1', () => {
       expect(processedRule.result).toBe(Result.FAIL)
     })
 
-    test('Should pass when it does not find a user called root', async () => {
+    test('Should pass when a root account does not have any access key active', async () => {
       const data = {
         queryawsIamUser: [
           {
             id: cuid(),
-            name: 'user',
+            name: 'root',
+            accessKeysActive: false,
           },
         ],
       }
@@ -101,6 +103,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
         queryawsIamPolicy: [
           {
             id: cuid(),
+            name: 'AdministratorAccess-Amplify',
             policyContent: {
               statement: [
                 {
@@ -131,6 +134,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
         queryawsIamPolicy: [
           {
             id: cuid(),
+            name: 'AdministratorAccess-Amplify',
             policyContent: {
               statement: [
                 {
@@ -157,6 +161,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
         queryawsIamPolicy: [
           {
             id: cuid(),
+            name: 'AdministratorAccess-Amplify',
             policyContent: {
               statement: [
                 {
@@ -187,6 +192,7 @@ describe('PCI Data Security Standard: 3.2.1', () => {
         queryawsIamPolicy: [
           {
             id: cuid(),
+            name: 'AdministratorAccess-Amplify',
             policyContent: {
               statement: [
                 {
@@ -207,6 +213,33 @@ describe('PCI Data Security Standard: 3.2.1', () => {
 
       expect(processedRule.result).toBe(Result.FAIL)
     })
+
+    test('Should pass when IAM policies that allow full "*:*" administrative privileges for AdministratorAccess policy', async () => {
+      const data = {
+        queryawsIamPolicy: [
+          {
+            id: cuid(),
+            name: 'AdministratorAccess',
+            policyContent: {
+              statement: [
+                {
+                  effect: 'Allow',
+                  action: ['*'],
+                  resource: ['*'],
+                },
+              ],
+            },
+          },
+        ],
+      }
+
+      const [processedRule] = await rulesEngine.processRule(
+        Aws_PCI_DSS_321_IAM_3 as Rule,
+        { ...data } as any
+      )
+
+      expect(processedRule.result).toBe(Result.PASS)
+    })
   })
 
   describe('IAM Check 4: Hardware MFA should be enabled for the root user', () => {