mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 20:42:02 +00:00
chore(aws): enhance metadata for appstream service (#8789)
Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
37f77bb778
commit
736badb284
@@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS ACM service metadata to new format [(#8716)](https://github.com/prowler-cloud/prowler/pull/8716)
|
||||
- HTML output now properly renders markdown syntax in Risk and Recommendation fields [(#8727)](https://github.com/prowler-cloud/prowler/pull/8727)
|
||||
- Update `moto` dependency from 5.0.28 to 5.1.11 [(#7100)](https://github.com/prowler-cloud/prowler/pull/7100)
|
||||
- Update AWS AppStream service metadata to new format [(#8789)](https://github.com/prowler-cloud/prowler/pull/8789)
|
||||
- Update AWS API Gateway service metadata to new format [(#8788)](https://github.com/prowler-cloud/prowler/pull/8788)
|
||||
- Update AWS Athena service metadata to new format [(#8790)](https://github.com/prowler-cloud/prowler/pull/8790)
|
||||
- Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825)
|
||||
|
||||
+23
-15
@@ -1,33 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "appstream_fleet_default_internet_access_disabled",
|
||||
"CheckTitle": "Ensure default Internet Access from your Amazon AppStream fleet streaming instances should remain unchecked.",
|
||||
"CheckTitle": "AppStream fleet has default internet access disabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS AWS Foundations Benchmark"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "appstream",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:appstream:region:account-id:fleet/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Ensure default Internet Access from your Amazon AppStream fleet streaming instances should remain unchecked.",
|
||||
"Risk": "Default Internet Access from your fleet streaming instances should be controlled using a NAT gateway in the VPC.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"Description": "**Amazon AppStream fleets** are assessed for the `EnableDefaultInternetAccess` setting, identifying fleets where streaming instances have default Internet connectivity.",
|
||||
"Risk": "**Direct Internet access** gives streaming instances public exposure. Threats include:\n- Remote exploitation and malware, undermining **confidentiality** and **integrity**\n- Uncontrolled egress enabling **data exfiltration**\n\nIt also enforces ~100-instance limits, reducing **availability** for high-concurrency deployments.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233540-ensure-default-internet-access-from-your-amazon-appstream-fleet-streaming-instances-remains-unchecked",
|
||||
"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appstream-fleet.html",
|
||||
"https://docs.aws.amazon.com/appstream2/latest/developerguide/internet-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws appstream update-fleet --name <example_resource_name> --no-enable-default-internet-access",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: disable default internet access on an AppStream fleet\nResources:\n <example_resource_name>:\n Type: AWS::AppStream::Fleet\n Properties:\n Name: <example_resource_name>\n InstanceType: <INSTANCE_TYPE>\n EnableDefaultInternetAccess: false # Critical: disables default internet access to pass the check\n```",
|
||||
"Other": "1. In the AWS console, go to Amazon AppStream 2.0 > Fleets\n2. Select the target fleet\n3. If the fleet is RUNNING, click Actions > Stop and wait until the state is Stopped\n4. Click Edit (or Modify)\n5. Uncheck \"Default internet access\" (Disable \"Enable default internet access\")\n6. Save/Update the fleet and start it if needed",
|
||||
"Terraform": "```hcl\n# Terraform: disable default internet access on an AppStream fleet\nresource \"aws_appstream_fleet\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n instance_type = \"stream.standard.small\"\n image_name = \"<IMAGE_NAME>\"\n compute_capacity { desired_instances = 1 }\n\n enable_default_internet_access = false # Critical: disables default internet access to pass the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Uncheck the default internet access for the AppStream Fleet.",
|
||||
"Url": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html"
|
||||
"Text": "Disable default Internet access (`EnableDefaultInternetAccess=false`) and place fleets in **private subnets**. Provide egress via **NAT gateways** or proxies, enforce **egress filtering**, and apply **least privilege** and **zero trust** to restrict outbound traffic. Use private connectivity to AWS services where possible.",
|
||||
"Url": "https://hub.prowler.com/check/appstream_fleet_default_internet_access_disabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": "Infrastructure Security"
|
||||
|
||||
+15
-12
@@ -1,28 +1,31 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "appstream_fleet_maximum_session_duration",
|
||||
"CheckTitle": "Ensure user maximum session duration is no longer than 10 hours.",
|
||||
"CheckTitle": "AppStream fleet maximum user session duration is less than 10 hours",
|
||||
"CheckType": [
|
||||
"Infrastructure Security"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "appstream",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:appstream:region:account-id:fleet/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Ensure user maximum session duration is no longer than 10 hours.",
|
||||
"Risk": "Having a session duration lasting longer than 10 hours should not be necessary and if running for any malicious reasons provides a greater time for usage than should be allowed.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"Description": "**AppStream fleets** enforce a **maximum user session duration**. This finding evaluates each fleet's configured limit against a threshold-default `10 hours` (`36000` seconds)-and identifies fleets whose session duration exceeds that limit.",
|
||||
"Risk": "Overlong sessions widen the window for **session hijacking**, **lateral movement**, and **data exfiltration** if endpoints or tokens are compromised. Reduced reauthentication weakens **confidentiality** and **integrity**, and extended access can increase **costs** and resource contention.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws appstream update-fleet --name <example_resource_name> --max-user-duration-in-seconds 3600",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Set AppStream Fleet session duration below 10 hours\nResources:\n AppStreamFleet:\n Type: AWS::AppStream::Fleet\n Properties:\n Name: \"<example_resource_name>\"\n MaxUserDurationInSeconds: 3600 # CRITICAL: ensures max session duration is < 10h to pass the check\n```",
|
||||
"Other": "1. Open the AWS Console and go to Amazon AppStream 2.0\n2. Click Fleets and select <example_resource_name>\n3. Click Edit\n4. Set Maximum session duration to a value under 10 hours (e.g., 3600 seconds)\n5. Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: Set AppStream Fleet session duration below 10 hours\nresource \"aws_appstream_fleet\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n max_user_duration_in_seconds = 3600 # CRITICAL: ensures max session duration is < 10h to pass the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Change the Maximum session duration is set to 600 minutes or less for the AppStream Fleet.",
|
||||
"Url": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html"
|
||||
"Text": "Configure the **maximum session duration** to `<= 10 hours` (e.g., `600` minutes) or less based on data sensitivity. Prefer shorter limits, enforce **reauthentication** on renewal, apply **least privilege**, and enable **idle timeouts**. Monitor session activity as part of **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/appstream_fleet_maximum_session_duration"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+17
-14
@@ -1,30 +1,33 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "appstream_fleet_session_disconnect_timeout",
|
||||
"CheckTitle": "Ensure session disconnect timeout is set to 5 minutes or less.",
|
||||
"CheckTitle": "AppStream fleet session disconnect timeout is 5 minutes or less",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS AWS Foundations Benchmark"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||||
],
|
||||
"ServiceName": "appstream",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:appstream:region:account-id:fleet/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Ensure session disconnect timeout is set to 5 minutes or less",
|
||||
"Risk": "Disconnect timeout in minutes, is the amount of of time that a streaming session remains active after users disconnect.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"Description": "**AppStream fleets** are evaluated for `DisconnectTimeoutInSeconds` being at or below `300` seconds (5 minutes), which defines how long a streaming session remains active after a user disconnects.",
|
||||
"Risk": "Long disconnect times keep sessions active, enabling **session hijacking** or unintended reconnection on lost/stolen devices. This raises data exposure (confidentiality), permits unauthorized actions (integrity), and ties up capacity and costs (availability/operations).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/2.9.6/reference/appstream/update-fleet.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws appstream update-fleet --name <example_resource_name> --disconnect-timeout-in-seconds 300",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Set AppStream Fleet disconnect timeout to 5 minutes or less\nResources:\n ExampleFleet:\n Type: AWS::AppStream::Fleet\n Properties:\n Name: <example_resource_name>\n InstanceType: stream.standard.medium\n ImageName: <example_image_name>\n ComputeCapacity:\n DesiredInstances: 1\n DisconnectTimeoutInSeconds: 300 # CRITICAL: ensures session disconnect timeout is <= 300s\n```",
|
||||
"Other": "1. In the AWS console, go to Amazon AppStream 2.0 > Fleets\n2. Select the fleet <example_resource_name> and choose Edit\n3. Set Disconnect timeout to 5 minutes (300 seconds) or less\n4. Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: Set AppStream Fleet disconnect timeout to 5 minutes or less\nresource \"aws_appstream_fleet\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n instance_type = \"stream.standard.medium\"\n image_name = \"<example_image_name>\"\n\n compute_capacity {\n desired_instances = 1\n }\n\n disconnect_timeout_in_seconds = 300 # CRITICAL: ensures timeout is <= 300s\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Change the Disconnect timeout to 5 minutes or less for the AppStream Fleet.",
|
||||
"Url": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html"
|
||||
"Text": "Set `DisconnectTimeoutInSeconds` to `300` or less across fleets. Pair with a short `IdleDisconnectTimeoutInSeconds`, require re-authentication on reconnect, and enforce **least privilege**. Monitor session events and use **defense in depth** (network restrictions, device posture) to reduce takeover risk.",
|
||||
"Url": "https://hub.prowler.com/check/appstream_fleet_session_disconnect_timeout"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+20
-15
@@ -1,33 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "appstream_fleet_session_idle_disconnect_timeout",
|
||||
"CheckTitle": "Ensure session idle disconnect timeout is set to 10 minutes or less.",
|
||||
"CheckTitle": "AppStream fleet session idle disconnect timeout is 10 minutes or less",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS AWS Foundations Benchmark"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "appstream",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:appstream:region:account-id:fleet/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Ensure session idle disconnect timeout is set to 10 minutes or less.",
|
||||
"Risk": "Idle disconnect timeout in minutes is the amount of time that users can be inactive before they are disconnected from their streaming session and the Disconnect timeout in minutes time begins.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"Description": "**Amazon AppStream fleets** are evaluated for the **idle disconnect timeout** setting, confirming it is configured to `10 minutes` (`<=600s`) or less before inactive users are dropped and the session's `disconnect_timeout` window begins.",
|
||||
"Risk": "**Long idle sessions** keep desktops/apps accessible without user presence, enabling **session hijacking**, **shoulder surfing**, and **data exposure**. They also **consume capacity** and extend **billing**, reducing **availability** for other users.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html",
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/2.9.6/reference/appstream/update-fleet.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws appstream update-fleet --name <FLEET_NAME> --idle-disconnect-timeout-in-seconds 600",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::AppStream::Fleet\n Properties:\n Name: <example_resource_name>\n InstanceType: stream.standard.small\n ComputeCapacity:\n DesiredInstances: 1\n IdleDisconnectTimeoutInSeconds: 600 # Critical: set to 10 minutes or less to pass the check\n```",
|
||||
"Other": "1. Open the AWS Console and go to AppStream 2.0 > Fleets\n2. Select your fleet and click Edit\n3. Find \"Idle disconnect timeout\"\n4. Set it to 10 minutes (600 seconds) or less\n5. Click Save",
|
||||
"Terraform": "```hcl\nresource \"aws_appstream_fleet\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n instance_type = \"stream.standard.small\"\n image_name = \"<IMAGE_NAME>\"\n\n compute_capacity {\n desired_instances = 1\n }\n\n idle_disconnect_timeout_in_seconds = 600 # Critical: enforce <= 10 minutes to pass the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Change the session idle timeout to 10 minutes or less for the AppStream Fleet.",
|
||||
"Url": "https://docs.aws.amazon.com/appstream2/latest/developerguide/set-up-stacks-fleets.html"
|
||||
"Text": "Configure an **idle disconnect timeout 10 minutes**. Pair with a short `disconnect_timeout`, require **re-authentication** on reconnect, and enforce **least privilege**. Monitor session metrics and adjust per role to balance **security**, **cost**, and **user experience**.",
|
||||
"Url": "https://hub.prowler.com/check/appstream_fleet_session_idle_disconnect_timeout"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": "Infrastructure Security"
|
||||
|
||||
Reference in New Issue
Block a user