mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
chore(aws): enhance metadata for account service (#8715)
Co-authored-by: MrCloudSec <hello@mistercloudsec.com> Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
8814a0710a
commit
338a11eaaf
@@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
|
||||
- Update AWS Neptune service metadata to new format [(#8494)](https://github.com/prowler-cloud/prowler/pull/8494)
|
||||
- Update AWS Config service metadata to new format [(#8641)](https://github.com/prowler-cloud/prowler/pull/8641)
|
||||
- Update AWS Account service metadata to new format [(#8715)](https://github.com/prowler-cloud/prowler/pull/8715)
|
||||
- Update AWS AccessAnalyzer service metadata to new format [(#8688)](https://github.com/prowler-cloud/prowler/pull/8688)
|
||||
- Update AWS Api Gateway V2 service metadata to new format [(#8719)](https://github.com/prowler-cloud/prowler/pull/8719)
|
||||
- Update AWS AppSync service metadata to new format [(#8721)](https://github.com/prowler-cloud/prowler/pull/8721)
|
||||
|
||||
+23
-11
@@ -1,28 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "account_maintain_current_contact_details",
|
||||
"CheckTitle": "Maintain current contact details.",
|
||||
"CheckTitle": "AWS account contact information is current",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "account",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAccount",
|
||||
"Description": "Maintain current contact details.",
|
||||
"Risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.",
|
||||
"ResourceType": "Other",
|
||||
"Description": "**AWS account contact information** is current for the **primary contact** and the **alternate contacts** for `security`, `billing`, and `operations`, with accurate email addresses and phone numbers.",
|
||||
"Risk": "Outdated or single-person contacts delay **security notifications**, slow **incident response**, and complicate **account recovery**.\n\nAWS may throttle services during abuse mitigation, reducing **availability**. Missed alerts enable ongoing misuse, risking **data exfiltration** and unauthorized changes (**integrity**).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.prowler.com/checks/aws/iam-policies/iam_18-maintain-contact-details#aws-console",
|
||||
"https://repost.aws/knowledge-center/update-phone-number",
|
||||
"https://support.stax.io/docs/accounts/update-aws-account-contact-details",
|
||||
"https://maartenbruntink.nl/blog/2022/09/26/aws-account-hygiene-101-mass-updating-alternate-account-contacts/",
|
||||
"https://docs.aws.amazon.com/security-ir/latest/userguide/update-account-contact-info.html",
|
||||
"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-primary.html",
|
||||
"https://repost.aws/knowledge-center/add-update-billing-contact",
|
||||
"https://aws.amazon.com/blogs/security/update-the-alternate-security-contact-across-your-aws-accounts-for-timely-security-notifications/",
|
||||
"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_update_contacts.html",
|
||||
"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-alternate.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "No command available.",
|
||||
"CLI": "aws account put-alternate-contact --alternate-contact-type=SECURITY --email-address=<SECURITY_EMAIL> --name=\"<SECURITY_CONTACT_NAME>\" --phone-number=\"<SECURITY_PHONE>\" --title=\"Security\"",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/iam-policies/iam_18-maintain-contact-details#aws-console",
|
||||
"Terraform": ""
|
||||
"Other": "1. Sign in to the AWS Management Console\n2. Open Billing and Cost Management, then click your account name > Account\n3. Under Contact information, click Edit, update details, then Update\n4. Under Alternate contacts, click Edit\n5. Enter Security contact name, email, and phone (use a team alias), then Update\n6. Repeat for Billing and Operations if needed",
|
||||
"Terraform": "```hcl\n# Set the Security alternate contact for the AWS account\nresource \"aws_account_alternate_contact\" \"<example_resource_name>\" {\n alternate_contact_type = \"SECURITY\" # Critical: ensures AWS can reach your security team\n email_address = \"<SECURITY_EMAIL>\" # Critical: contact destination\n name = \"<SECURITY_CONTACT_NAME>\"\n phone_number = \"<SECURITY_PHONE>\"\n title = \"Security\"\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Using the Billing and Cost Management console complete contact details.",
|
||||
"Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html"
|
||||
"Text": "Adopt:\n- **Primary** and **alternate contacts** for `security`, `billing`, `operations`\n- Shared, monitored aliases and SMS-capable phone numbers (non-personal)\n- Centralized management across accounts with periodic reviews\n- **Least privilege** for who can modify contact data\n- Regular reachability tests and documented ownership",
|
||||
"Url": "https://hub.prowler.com/check/account_maintain_current_contact_details"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+24
-12
@@ -1,31 +1,43 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "account_maintain_different_contact_details_to_security_billing_and_operations",
|
||||
"CheckTitle": "Maintain different contact details to security, billing and operations.",
|
||||
"CheckTitle": "AWS account has distinct Security, Billing, and Operations contact details, different from each other and from the root contact",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "account",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAccount",
|
||||
"Description": "Maintain different contact details to security, billing and operations.",
|
||||
"Risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html",
|
||||
"ResourceType": "Other",
|
||||
"Description": "**AWS account alternate contacts** are defined for **Security**, **Billing**, and **Operations** with `name`, `email`, and `phone`. The finding evaluates that all three exist, are distinct from one another, and differ from the **primary (root) contact**.",
|
||||
"Risk": "Missing or shared contacts can delay response to abuse alerts, credential compromise, or billing anomalies, reducing **availability** (possible AWS traffic throttling) and raising **confidentiality** and **integrity** risk through extended exposure. If AWS cannot reach you, urgent mitigation may disrupt service.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/account_alternate_contact",
|
||||
"https://docs.prowler.com/checks/aws/iam-policies/iam_18-maintain-contact-details#aws-console",
|
||||
"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-alternate.html",
|
||||
"https://builder.aws.com/content/2qRw97fe8JFwfk2AbpJ3sYNpNvM/aws-bulk-update-alternate-contacts-across-organization",
|
||||
"https://github.com/aws-samples/aws-account-alternate-contact-with-terraform",
|
||||
"https://trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/account-security-alternate-contacts.html",
|
||||
"https://repost.aws/articles/ARDFbpt-bvQ8iuErnqVVcCXQ/managing-aws-organization-alternate-contacts-via-csv"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/iam-policies/iam_18-maintain-contact-details#aws-console",
|
||||
"Terraform": ""
|
||||
"Other": "1. Sign in to the AWS Management Console with a user that can edit account contacts (root, or IAM with account:PutAlternateContact)\n2. In the upper right, click your account name > Account\n3. Scroll to \"Alternate contacts\" and click Edit\n4. Add all three contacts with unique details:\n - Billing contact (distinct name, email, phone)\n - Operations contact (distinct name, email, phone)\n - Security contact (distinct name, email, phone)\n5. Ensure each contact’s email/phone differs from each other and from the primary (root) contact, then click Update",
|
||||
"Terraform": "```hcl\n# Set distinct alternate contacts for SECURITY, BILLING, and OPERATIONS\n# Critical: each resource sets a required contact type to satisfy the check\n\nresource \"aws_account_alternate_contact\" \"security\" {\n alternate_contact_type = \"SECURITY\" # Sets SECURITY contact\n email_address = \"security@example.com\"\n name = \"Security Team\"\n phone_number = \"+1-555-0100\"\n title = \"Security\"\n}\n\nresource \"aws_account_alternate_contact\" \"billing\" {\n alternate_contact_type = \"BILLING\" # Sets BILLING contact\n email_address = \"billing@example.com\"\n name = \"Billing Team\"\n phone_number = \"+1-555-0101\"\n title = \"Billing\"\n}\n\nresource \"aws_account_alternate_contact\" \"operations\" {\n alternate_contact_type = \"OPERATIONS\" # Sets OPERATIONS contact\n email_address = \"operations@example.com\"\n name = \"Operations Team\"\n phone_number = \"+1-555-0102\"\n title = \"Operations\"\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Using the Billing and Cost Management console complete contact details.",
|
||||
"Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html"
|
||||
"Text": "Maintain distinct, monitored **Security**, **Billing**, and **Operations** alternate contacts that differ from the root contact.\n- Use team aliases and 24x7 phones\n- Review and test contact paths regularly\n- Centralize at org level for consistency\n\nApplies **operational resilience** and **separation of duties**.",
|
||||
"Url": "https://hub.prowler.com/check/account_maintain_different_contact_details_to_security_billing_and_operations"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+19
-11
@@ -1,28 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "account_security_contact_information_is_registered",
|
||||
"CheckTitle": "Ensure security contact information is registered.",
|
||||
"CheckTitle": "AWS account has security alternate contact registered",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "account",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAccount",
|
||||
"Description": "Ensure security contact information is registered.",
|
||||
"Risk": "AWS provides customers with the option of specifying the contact information for accounts security team. It is recommended that this information be provided. Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Account settings contain a **Security alternate contact** in Alternate Contacts (name, `EmailAddress`, `PhoneNumber`) for targeted AWS security notifications.",
|
||||
"Risk": "Missing or outdated **security contact** can delay or prevent AWS advisories from reaching responders, increasing risk to:\n- Confidentiality: data exfiltration from undetected compromise\n- Integrity: unauthorized changes persist longer\n- Availability: resource abuse (e.g., cryptomining) and outages",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/account_alternate_contact",
|
||||
"https://docs.prowler.com/checks/aws/iam-policies/iam_19/",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000234161-1-2-ensure-security-contact-information-is-registered-manual-",
|
||||
"https://www.plerion.com/cloud-knowledge-base/ensure-security-contact-information-is-registered",
|
||||
"https://repost.aws/articles/ARDFbpt-bvQ8iuErnqVVcCXQ/managing-aws-organization-alternate-contacts-via-csv"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "No command available.",
|
||||
"CLI": "aws account put-alternate-contact --alternate-contact-type SECURITY --email-address <EMAIL_ADDRESS> --name <CONTACT_NAME> --phone-number <PHONE_NUMBER>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/iam-policies/iam_19#aws-console",
|
||||
"Terraform": ""
|
||||
"Other": "1. Sign in to the AWS Management Console as the root user or an admin with account:PutAlternateContact\n2. Click your account name (top-right) and select My Account (or Account)\n3. Scroll to Alternate Contacts and click Edit in the Security section\n4. Enter Security Email, Name, and Phone Number\n5. Click Update (or Save changes)",
|
||||
"Terraform": "```hcl\n# Set the SECURITY alternate contact for the current AWS account\nresource \"aws_account_alternate_contact\" \"<example_resource_name>\" {\n alternate_contact_type = \"SECURITY\" # Critical: sets Security contact type\n email_address = \"security@example.com\" # Contact email\n name = \"Security Team\" # Contact name\n phone_number = \"+1-555-0100\" # Contact phone\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Go to the My Account section and complete alternate contacts.",
|
||||
"Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html"
|
||||
"Text": "Define and maintain a **Security alternate contact**:\n- Use a monitored alias (e.g., `security@domain`) and team phone\n- Apply to every account (prefer Org-wide automation)\n- Review after org/personnel changes and test delivery\n- Document ownership and escalation paths\nAlign with **incident response** and **least privilege** principles.",
|
||||
"Url": "https://hub.prowler.com/check/account_security_contact_information_is_registered"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+14
-10
@@ -1,28 +1,32 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "account_security_questions_are_registered_in_the_aws_account",
|
||||
"CheckTitle": "Ensure security questions are registered in the AWS account.",
|
||||
"CheckTitle": "[DEPRECATED] AWS root user has security challenge questions configured",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "account",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAccount",
|
||||
"Description": "Ensure security questions are registered in the AWS account.",
|
||||
"Risk": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established. When creating a new AWS account a default super user is automatically created. This account is referred to as the root account. It is recommended that the use of this account be limited and highly controlled. During events in which the root password is no longer accessible or the MFA token associated with root is lost/destroyed it is possible through authentication using secret questions and associated answers to recover root login access.",
|
||||
"ResourceType": "Other",
|
||||
"Description": "[DEPRECATED] **AWS account root** configuration may include legacy **security challenge questions** for support identity verification. This evaluates whether those questions are set on the account. *New configuration is discontinued by AWS and remaining support for this feature is time-limited.*",
|
||||
"Risk": "Absence of these questions can limit support-assisted recovery if root credentials or MFA are lost, reducing **availability** and slowing **incident response**. Reliance on KBA also weakens **confidentiality** due to **social engineering**. Treat this as a recovery gap and adopt stronger, phishing-resistant factors.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.prowler.com/checks/aws/iam-policies/iam_15",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/security-challenge-questions.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "No command available.",
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/iam-policies/iam_15",
|
||||
"Other": "1. Sign in to the AWS Management Console\n2. Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/\n3. Scroll down to Configure Security Challenge Questions section and click the Edit link\n4. Select three different questions made available by Amazon and provide appropriate answers\n5. Store the answers in a secure but accessible location\n6. Click the Update button to save the changes",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Login as root account and from My Account configure Security questions.",
|
||||
"Url": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-security-challenge.html"
|
||||
"Text": "Favor stronger recovery instead of KBA:\n- Enforce **MFA for root** and minimize root use\n- Keep **alternate contacts** and root email current and protected\n- Establish a tightly controlled **break-glass role**, applying least privilege and separation of duties\n- Document and test recovery procedures; monitor root activity",
|
||||
"Url": "https://hub.prowler.com/check/account_security_questions_are_registered_in_the_aws_account"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
Reference in New Issue
Block a user