Skip to content

Commit 73ac7ad

Browse files
tyler-dunkeltyler-dunkel
committed
chore(merge): resolve conflicts
2 parents 46c9483 + ec51380 commit 73ac7ad

134 files changed

Lines changed: 29459 additions & 40 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs‎

Lines changed: 28 additions & 0 deletions
Large diffs are not rendered by default.

‎.yarn/releases/yarn-3.2.0.cjs‎

Lines changed: 785 additions & 0 deletions
Large diffs are not rendered by default.

‎package.json‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"name": "policy-packs",
33
"version": "0.0.0",
44
"description": "CloudGraph CSPM policy packs monorepo",
5+
"packageManager": "yarn@3.2.0",
56
"private": true,
67
"repository": {
78
"type": "git",
@@ -11,12 +12,14 @@
1112
"src/**/*"
1213
],
1314
"devDependencies": {
15+
"@qiwi/multi-semantic-release": "^6.1.1",
1416
"@semantic-release/changelog": "^6.0.1",
1517
"@semantic-release/git": "^10.0.1",
1618
"@semantic-release/github": "^8.0.1",
17-
"semantic-release-pnpm": "^1.0.2",
18-
"semantic-release": "^19.0.2",
19-
"semantic-release-monorepo": "^7.0.5"
19+
"@semantic-release/npm": "^9.0.1",
20+
"@semrel-extra/npm": "^1.2.0",
21+
"npm": "^8.8.0",
22+
"semantic-release": "^19.0.2"
2023
},
2124
"resolutions": {
2225
"chalk": "^4.1.2"
@@ -29,12 +32,12 @@
2932
"singleQuote": true
3033
},
3134
"scripts": {
32-
"release": "NODE_AUTH_TOKEN=$NPM_TOKEN pnpm -r --workspace-concurrency=1 exec -- pnpm semantic-release -e semantic-release-monorepo",
33-
"install": "pnpm -r --workspace-concurrency=1 exec -- pnpm install",
34-
"clean": "pnpm -r --workspace-concurrency=1 exec -- pnpm clean",
35-
"lint": "pnpm -r --workspace-concurrency=1 exec -- pnpm lint",
36-
"build": "pnpm -r --workspace-concurrency=1 exec -- pnpm build",
37-
"test": "pnpm -r --workspace-concurrency=1 exec -- pnpm test"
35+
"release": "NODE_AUTH_TOKEN=$NPM_TOKEN NPM_CONFIG_IGNORE_SCRIPTS='true' NODE_JQ_SKIP_INSTALL_BINARY='true' multi-semantic-release --ignore-scripts",
36+
"clean": "yarn workspaces foreach -p run clean",
37+
"lint": "yarn workspaces foreach run lint",
38+
"lint:fix": "yarn workspaces foreach run lint:fix",
39+
"prebuild": "tsc -b",
40+
"build": "yarn workspaces foreach run build"
3841
},
3942
"dependencies": {
4043
"@cloudgraph/sdk": "0.21.1",

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,38 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
5757

5858
| Rule | Description |
5959
| ------------- | --------------------------------------------------------------------------------------------------------------------------- |
60+
| AWS CIS 1.1 | Maintain current contact details |
61+
| AWS CIS 1.2 | Ensure security contact information is registered |
62+
| AWS CIS 1.3 | Ensure security questions are registered in the AWS account |
63+
| AWS CIS 1.4 | Ensure no 'root' user account access key exists |
64+
| AWS CIS 1.5 | Ensure MFA is enabled for the 'root' user account |
65+
| AWS CIS 1.6 | Ensure hardware MFA is enabled for the 'root' user account |
66+
| AWS CIS 1.7 | Eliminate use of the 'root' user for administrative and daily tasks |
67+
| AWS CIS 1.8 | Ensure IAM password policy requires minimum length of 14 or greater |
68+
| AWS CIS 1.9 | Ensure IAM password policy prevents password reuse |
69+
| AWS CIS 1.10 | Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password |
70+
| AWS CIS 1.11 | Do not setup access keys during initial user setup for all IAM users that have a console password |
71+
| AWS CIS 1.12 | Ensure credentials unused for 45 days or greater are disabled |
72+
| AWS CIS 1.13 | Ensure there is only one active access key available for any single IAM user |
73+
| AWS CIS 1.14 | Ensure access keys are rotated every 90 days or less |
74+
| AWS CIS 1.15 | Ensure IAM Users Receive Permissions Only Through Groups |
75+
| AWS CIS 1.16 | Ensure IAM policies that allow full "*:*" administrative privileges are not attached |
76+
| AWS CIS 1.17 | Ensure a support role has been created to manage incidents with AWS Support |
77+
| AWS CIS 1.18 | Ensure IAM instance roles are used for AWS resource access from instances |
78+
| AWS CIS 1.19 | Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed |
79+
| AWS CIS 1.20 | Ensure that IAM Access analyzer is enabled for all regions |
80+
| AWS CIS 1.21 | Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments |
81+
| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |
82+
| AWS CIS 3.2 | Ensure CloudTrail log file validation is enabled |
83+
| AWS CIS 3.3 | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |
84+
| AWS CIS 3.4 | Ensure CloudTrail trails are integrated with CloudWatch Logs |
85+
| AWS CIS 3.5 | Ensure AWS Config is enabled in all regions |
86+
| AWS CIS 3.6 | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket |
87+
| AWS CIS 3.7 | Ensure CloudTrail logs are encrypted at rest using KMS CMKs |
88+
| AWS CIS 3.8 | Ensure rotation for customer created CMKs is enabled |
89+
| AWS CIS 3.9 | Ensure VPC flow logging is enabled in all VPCs |
90+
| AWS CIS 3.10 | Ensure that Object-level logging for write events is enabled for S3 bucket |
91+
| AWS CIS 3.11 | Ensure that Object-level logging for read events is enabled for S3 bucket |
6092
| AWS CIS 4.1 | Ensure a log metric filter and alarm exist for unauthorized API calls |
6193
| AWS CIS 4.2 | Ensure a log metric filter and alarm exist for Management Console sign-in without MFA |
6294
| AWS CIS 4.3 | Ensure a log metric filter and alarm exist for usage of 'root' account |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-1.1.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-1.',
3+
title: 'AWS CIS 1.1 Maintain current contact details',
4+
5+
description: `Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.
6+
7+
An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.`,
8+
9+
audit: `This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )
10+
11+
1. Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.
12+
2. On the navigation bar, choose your account name, and then choose My Account.
13+
3. On the Account Settings page, review and verify the current details.
14+
4. Under Contact Information, review and verify the current details.`,
15+
16+
rationale: 'If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers\' and AWS\' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.',
17+
18+
remediation: `This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).
19+
20+
1. Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.
21+
2. On the navigation bar, choose your account name, and then choose My Account.
22+
3. On the Account Settings page, next to Account Settings, choose Edit.
23+
4. Next to the field that you need to update, choose Edit.
24+
5. After you have entered your changes, choose Save changes.
25+
6. After you have made your changes, choose Done.
26+
7. To edit your contact information, under Contact Information, choose Edit.
27+
8. For the fields that you want to change, type your updated information, and then choose Update.`,
28+
29+
references: ['https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#contact-info'],
30+
31+
severity: 'high',
32+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-1.10.ts‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// AWS CIS 1.2.0 Rule equivalent 1.2
2+
export default {
3+
id: 'aws-cis-1.5.0-1.10',
4+
title: 'AWS CIS 1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password',
5+
6+
description: 'Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.',
7+
8+
audit: `Perform the following to determine if a MFA device is enabled for all IAM users having a console password:
9+
10+
**From Console:**
11+
12+
1. Open the IAM console at https://console.aws.amazon.com/iam/.
13+
2. In the left pane, select *Users*
14+
3. If the *MFA* or *Password age* columns are not visible in the table, click the gear icon at the upper right corner of the table and ensure a checkmark is next to both, then click *Close*.
15+
4. Ensure that for each user where the *Password age* column shows a password age, the MFA column shows *Virtual*, *U2F Security Key*, or *Hardware*.
16+
17+
**From Command Line:**
18+
19+
1. Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their password and MFA status:
20+
21+
aws iam generate-credential-report
22+
23+
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8
24+
25+
2. The output of this command will produce a table similar to the following:
26+
27+
user,password_enabled,mfa_active
28+
elise,false,false
29+
brandon,true,true
30+
rakesh,false,false
31+
helene,false,false
32+
paras,true,true
33+
anitha,false,false
34+
35+
3. For any column having *password_enabled* set to *true*, ensure *mfa_active* is also set to *true*.`,
36+
37+
rationale: 'Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that displays a time-sensitive key and have knowledge of a credential.',
38+
39+
remediation: `Perform the following to enable MFA:
40+
41+
**From Console:**
42+
43+
1. Sign in to the AWS Management Console and open the IAM console at 'https://console.aws.amazon.com/iam/'
44+
2. In the left pane, select *Users*.
45+
3. In the *User Name* list, choose the name of the intended MFA user.
46+
4. Choose the *Security Credentials* tab, and then choose *Manage MFA Device*.
47+
5. In the *Manage MFA Device wizard*, choose *Virtual MFA* device, and then choose *Continue*.
48+
49+
IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes.
50+
51+
6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see Virtual MFA Applications at https://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications). If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device).
52+
7. Determine whether the MFA app supports QR codes, and then do one of the following:
53+
54+
- Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code.
55+
- In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application.
56+
57+
When you are finished, the virtual MFA device starts generating one-time passwords.
58+
59+
8. In the *Manage MFA Device wizard*, in the *MFA Code 1 box*, type the *one-time password* that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second *one-time password* into the *MFA Code 2 box*.
60+
9. Click *Assign MFA*.`,
61+
62+
references: [
63+
'https://tools.ietf.org/html/rfc6238',
64+
'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html',
65+
'https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#enable-mfa-for-privileged-users',
66+
'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html',
67+
'CCE-78901-6',
68+
'https://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users',
69+
],
70+
gql: `{
71+
queryawsIamUser {
72+
id
73+
arn
74+
accountId
75+
__typename
76+
passwordEnabled
77+
mfaActive
78+
}
79+
}`,
80+
resource: 'queryawsIamUser[*]',
81+
severity: 'high',
82+
conditions: {
83+
or: [
84+
{
85+
path: '@.passwordEnabled',
86+
equal: false,
87+
},
88+
{
89+
path: '@.mfaActive',
90+
equal: true,
91+
}
92+
]
93+
},
94+
}

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-1.11.ts‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-1.11',
3+
title: 'AWS CIS 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password',
4+
5+
description: `AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require.
6+
7+
Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user.
8+
9+
AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.`,
10+
11+
audit: `Perform the following to determine if access keys were created upon user creation and are being used and rotated as prescribed:
12+
13+
**From Console:**
14+
15+
1. Login to the AWS Management Console
16+
2. Click Services
17+
3. Click IAM
18+
4. Click on a User where column Password age and Access key age is not set to None
19+
5. Click on Security credentials Tab
20+
6. Compare the user 'Creation timeto the Access KeyCreated date.
21+
7. For any that match, the key was created during initial user setup.
22+
- Keys that were created at the same time as the user profile and do not have a last used date should be deleted. Refer to the remediation below.
23+
24+
**From Command Line:**
25+
26+
1. Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:
27+
28+
aws iam generate-credential-report
29+
30+
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16
31+
32+
2. The output of this command will produce a table similar to the following:
33+
34+
user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_key_2_active,access_key_2_last_used_date elise,false,true,2015-04-16T15:14:00+00:00,false,N/A brandon,true,true,N/A,false,N/A rakesh,false,false,N/A,false,N/A helene,false,true,2015-11-18T17:47:00+00:00,false,N/A paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A
35+
36+
3. For any user having password_enabled set to true AND access_key_last_used_date set to N/A refer to the remediation below.`,
37+
38+
rationale: `Requiring the additional steps be taken by the user for programmatic access after their profile has been created will give a stronger indication of intent that access keys are [a] necessary for their work and [b] once the access key is established on an account that the keys may be in use somewhere in the organization.
39+
40+
**Note:** Even if it is known the user will need access keys, require them to create the keys themselves or put in a support ticket to have them created as a separate step from user creation.`,
41+
42+
remediation: `Perform the following to delete access keys that do not pass the audit:
43+
44+
**From Console:**
45+
46+
1. Login to the AWS Management Console:
47+
2. Click Services
48+
3. Click IAM
49+
4. Click on Users
50+
5. Click on Security Credentials
51+
6. As an Administrator
52+
- Click on the X (Delete) for keys that were created at the same time as the user profile but have not been used.
53+
7. As an IAM User
54+
- Click on the X (Delete) for keys that were created at the same time as the user profile but have not been used.
55+
56+
**From Command Line:**
57+
58+
aws iam delete-access-key --access-key-id <access-key-id-listed> --user-name <users-name>`,
59+
60+
references: [
61+
'https://docs.aws.amazon.com/cli/latest/reference/iam/delete-access-key.html',
62+
'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html',
63+
],
64+
65+
severity: 'high',
66+
}

0 commit comments

Comments
 (0)