diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index c8420d43a4..26d30938f2 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -28,6 +28,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS AppStream service metadata to new format [(#8789)](https://github.com/prowler-cloud/prowler/pull/8789) - Update AWS API Gateway service metadata to new format [(#8788)](https://github.com/prowler-cloud/prowler/pull/8788) - Update AWS Athena service metadata to new format [(#8790)](https://github.com/prowler-cloud/prowler/pull/8790) +- Update AWS CloudFormation service metadata to new format [(#8828)](https://github.com/prowler-cloud/prowler/pull/8828) - Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825) ### Fixed diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.metadata.json b/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.metadata.json index 494daa3337..0feb6b73a2 100644 --- a/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.metadata.json +++ b/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.metadata.json @@ -1,29 +1,40 @@ { "Provider": "aws", "CheckID": "cloudformation_stack_cdktoolkit_bootstrap_version", - "CheckTitle": "Ensure that CDKToolkit stacks have a Bootstrap version of 21 or higher to mitigate security risks.", - "CheckType": [], + "CheckTitle": "CDKToolkit CloudFormation stack has Bootstrap version 21 or higher", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Patch Management" + ], "ServiceName": "cloudformation", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:cloudformation:region:account-id:stack/resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsCloudFormationStack", - "Description": "Ensure that CDKToolkit stacks have a Bootstrap version of 21 or higher to mitigate security risks.", - "Risk": "Using outdated CDKToolkit Bootstrap versions can expose accounts to risks such as bucket takeover or privilege escalation.", - "RelatedUrl": "https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html", + "Description": "**CloudFormation CDKToolkit** stack's `BootstrapVersion` is compared to a recommended minimum (default `21`). A lower value indicates the environment uses legacy bootstrap resources and IAM roles from older templates.", + "Risk": "**Outdated bootstrap stacks** can lack recent hardening. Asset buckets or ECR repos may be easier to misuse, and deployment roles may have broader trust.\n\nAdversaries could tamper artifacts or assume privileged roles, compromising integrity/confidentiality and enabling privilege escalation.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://towardsthecloud.com/blog/aws-cdk-bootstrap", + "https://support.icompaas.com/support/solutions/articles/62000233694-ensure-that-cdktoolkit-stacks-have-a-bootstrap-version-of-21-or-higher-to-mitigate-security-risks", + "https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-bootstrap.html", + "https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping-customizing.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "cdk bootstrap aws:///", + "NativeIaC": "```yaml\n# Minimal CloudFormation to expose BootstrapVersion >= 21 for CDKToolkit\n# Deploy this template as a stack named \"CDKToolkit\"\nResources:\n CdkBootstrapVersion:\n Type: AWS::SSM::Parameter\n Properties:\n Type: String\n Name: /cdk-bootstrap/hnb659fds/version # critical: stores the bootstrap version used by CDK\n Value: \"21\" # critical: set to 21 (or higher) to satisfy the check\nOutputs:\n BootstrapVersion:\n Value: !GetAtt CdkBootstrapVersion.Value # critical: exposes the version in stack outputs so the check passes\n```", + "Other": "1. Sign in to the AWS Console and open CloudShell\n2. Run: cdk bootstrap aws:///\n3. In the console, go to CloudFormation > Stacks > CDKToolkit > Outputs\n4. Confirm Output \"BootstrapVersion\" is 21 or higher", + "Terraform": "```hcl\n# Create/Update the CDKToolkit stack with BootstrapVersion >= 21\nresource \"aws_cloudformation_stack\" \"cdktoolkit\" {\n name = \"CDKToolkit\"\n # critical: template sets the BootstrapVersion output to 21 (or higher) so the check passes\n template_body = <= 21\nOutputs:\n BootstrapVersion:\n Value: !GetAtt CdkBootstrapVersion.Value # critical: exposes version via stack output\nYAML\n}\n```" }, "Recommendation": { - "Text": "Update the CDKToolkit stack Bootstrap version to 21 or later by running the cdk bootstrap command with the latest CDK version.", - "Url": "https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html" + "Text": "Standardize on the modern bootstrap at or above the recommended version (e.g., `>= 21`) in every account and Region.\n\nApply **least privilege** to bootstrap roles, limit trusted accounts, enable termination protection, and periodically review for version drift to strengthen **defense in depth**.", + "Url": "https://hub.prowler.com/check/cloudformation_stack_cdktoolkit_bootstrap_version" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.metadata.json b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.metadata.json index 1ec5211876..ee1d39c7ca 100644 --- a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.metadata.json +++ b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.metadata.json @@ -1,26 +1,36 @@ { "Provider": "aws", "CheckID": "cloudformation_stack_outputs_find_secrets", - "CheckTitle": "Find secrets in CloudFormation outputs", - "CheckType": [], + "CheckTitle": "CloudFormation stack outputs do not contain secrets", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Sensitive Data Identifications/Passwords", + "Sensitive Data Identifications/Security", + "Effects/Data Exposure" + ], "ServiceName": "cloudformation", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:cloudformation:region:account-id:stack/resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsCloudFormationStack", - "Description": "Find secrets in CloudFormation outputs", - "Risk": "Secrets hardcoded into CloudFormation outputs can be used by malware and bad actors to gain lateral access to other services.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html", + "Description": "**CloudFormation stack Outputs** are analyzed for hardcoded secrets-passwords, API keys, tokens-using pattern-based detection across output values. A finding indicates potential secret strings present within `Outputs` of the template or stack.", + "Risk": "**Secrets in Outputs** are readable to anyone with stack metadata access, enabling credential theft, unauthorized API calls, and lateral movement. Exposure via consoles, exports, or CI logs undermines confidentiality and can lead to privilege escalation and data exfiltration.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html", + "https://support.icompaas.com/support/solutions/articles/62000127093-ensure-no-secrets-are-found-in-cloudformation-outputs", + "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_2", - "Terraform": "" + "CLI": "aws cloudformation update-stack --stack-name --template-body file://.yaml", + "NativeIaC": "```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nOutputs:\n # Critical: remove outputs that expose secrets (passwords/tokens/keys)\n # Keeping only non-sensitive values in Outputs remediates the finding\n SafeInfo:\n Value: \"non-sensitive\"\n```", + "Other": "1. In the AWS Console, go to CloudFormation > Stacks and select the stack\n2. Click Update > Replace current template\n3. Upload or paste the template with any secret-bearing Outputs removed (do not output passwords/tokens/keys)\n4. Click Next through the wizard and choose Submit to apply the change set\n5. Verify the stack Outputs tab no longer shows sensitive values", + "Terraform": "```hcl\n# Critical: the embedded CloudFormation template removes secret outputs\nresource \"aws_cloudformation_stack\" \"\" {\n name = \"\"\n template_body = <<-YAML\n AWSTemplateFormatVersion: '2010-09-09'\n # Critical: delete Outputs that expose secrets; keep only non-sensitive values\n Outputs:\n SafeInfo:\n Value: \"non-sensitive\" # Avoids exposing secrets in stack outputs\n YAML\n}\n```" }, "Recommendation": { - "Text": "Implement automated detective control to scan accounts for passwords and secrets. Use secrets manager service to store and retrieve passwords and secrets.", - "Url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html" + "Text": "Remove secrets from `Outputs`. Store credentials in **Secrets Manager** or **Parameter Store** and reference them via dynamic references; set `NoEcho` for sensitive parameters. Apply **least privilege** to view stack metadata, avoid exporting sensitive values, and add automated IaC secret scanning for **defense in depth**.", + "Url": "https://hub.prowler.com/check/cloudformation_stack_outputs_find_secrets" } }, "Categories": [ diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stacks_termination_protection_enabled/cloudformation_stacks_termination_protection_enabled.metadata.json b/prowler/providers/aws/services/cloudformation/cloudformation_stacks_termination_protection_enabled/cloudformation_stacks_termination_protection_enabled.metadata.json index 03011fc315..c9d43bcb7e 100644 --- a/prowler/providers/aws/services/cloudformation/cloudformation_stacks_termination_protection_enabled/cloudformation_stacks_termination_protection_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudformation/cloudformation_stacks_termination_protection_enabled/cloudformation_stacks_termination_protection_enabled.metadata.json @@ -1,29 +1,38 @@ { "Provider": "aws", "CheckID": "cloudformation_stacks_termination_protection_enabled", - "CheckTitle": "Enable termination protection for Cloudformation Stacks", - "CheckType": [], + "CheckTitle": "CloudFormation stack has termination protection enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Destruction" + ], "ServiceName": "cloudformation", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:cloudformation:region:account-id:stack/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsCloudFormationStack", - "Description": "Enable termination protection for Cloudformation Stacks", - "Risk": "Without termination protection enabled, a critical cloudformation stack can be accidently deleted.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html", + "Description": "**AWS CloudFormation root stacks** are evaluated for **termination protection**. The detection identifies whether `termination protection` is enabled to block stack deletions on non-nested stacks.", + "Risk": "Without **termination protection**, human error or automation can delete entire stacks, causing immediate **availability** loss and potential **data destruction** of managed resources.\n\nAttackers with delete rights can more easily trigger outages and hinder recovery.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFormation/stack-termination-protection.html" + ], "Remediation": { "Code": { - "CLI": "aws cloudformation update-termination-protection --region --stack-name --enable-termination-protection", + "CLI": "aws cloudformation update-termination-protection --stack-name --enable-termination-protection", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. Open the AWS CloudFormation console\n2. Select the target stack\n3. Choose Stack actions > Edit termination protection\n4. Select Enable and Save", + "Terraform": "```hcl\nresource \"aws_cloudformation_stack\" \"\" {\n name = \"\"\n template_url = \"https://s3.amazonaws.com//