From 81b6e27eb8af636933e3883128ecb64563f02ca1 Mon Sep 17 00:00:00 2001
From: Jonathan Jenkyn <jonathan@belial.co.uk>
Date: Tue, 2 Aug 2022 08:18:46 +0100
Subject: [PATCH] feat(checks): Adding commands for checks 117 and 118 (#1289)

* Adding commands for checks 117 and 118

* fix(check118): Minor fixes and error handling

* fix(check117): Minor fixes and error handling

Co-authored-by: Pepe Fagoaga <pepe@verica.io>
---
 checks/check117                    | 16 ++++++++++++----
 checks/check118                    | 16 ++++++++++++----
 iam/create_role_to_assume_cfn.yaml |  2 ++
 iam/prowler-additions-policy.json  |  1 +
 4 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/checks/check117 b/checks/check117
index 2a635e1e2e..1cb508fbc5 100644
--- a/checks/check117
+++ b/checks/check117
@@ -13,7 +13,7 @@
 
 CHECK_ID_check117="1.17"
 CHECK_TITLE_check117="[check117] Maintain current contact details"
-CHECK_SCORED_check117="NOT_SCORED"
+CHECK_SCORED_check117="SCORED"
 CHECK_CIS_LEVEL_check117="LEVEL1"
 CHECK_SEVERITY_check117="Medium"
 CHECK_ASFF_TYPE_check117="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
@@ -26,10 +26,18 @@ CHECK_CAF_EPIC_check117='IAM'
 
 check117(){
   if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then
-    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root"
+    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "${REGION}" "root"
   else
     # "Maintain current contact details (Scored)"
-    # No command available
-    textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details." "$REGION" "root"
+    GET_CONTACT_DETAILS=$($AWSCLI account get-contact-information --output text $PROFILE_OPT --region "${REGION}" 2>&1)
+    if grep -E -q 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${GET_CONTACT_DETAILS}"; then
+      textInfo "${REGION}: Access Denied trying to get account contact information" "${REGION}"
+    else
+      if [[ ${GET_CONTACT_DETAILS} ]];then
+        textPass "${REGION}: Account has contact information. Perhaps check for freshness of these details." "${REGION}" "root"
+      else
+        textFail "${REGION}: Unable to get account contact details. See section 1.17 on the CIS Benchmark guide for details." "${REGION}" "root"
+      fi
+    fi
   fi
 }
diff --git a/checks/check118 b/checks/check118
index 32a041c3b9..6b6a2d589b 100644
--- a/checks/check118
+++ b/checks/check118
@@ -13,7 +13,7 @@
 
 CHECK_ID_check118="1.18"
 CHECK_TITLE_check118="[check118] Ensure security contact information is registered"
-CHECK_SCORED_check118="NOT_SCORED"
+CHECK_SCORED_check118="SCORED"
 CHECK_CIS_LEVEL_check118="LEVEL1"
 CHECK_SEVERITY_check118="Medium"
 CHECK_ASFF_TYPE_check118="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
@@ -26,10 +26,18 @@ CHECK_CAF_EPIC_check118='IAM'
 
 check118(){
   if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then
-    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root"
+    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "${REGION}" "root"
   else
     # "Ensure security contact information is registered (Scored)"
-    # No command available
-    textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details." "$REGION" "root"
+    GET_SECURITY_CONTACT_DETAILS=$("${AWSCLI}" account get-alternate-contact --alternate-contact-type SECURITY --output text ${PROFILE_OPT} --region "${REGION}" 2>&1)
+    if grep -E -q 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${GET_SECURITY_CONTACT_DETAILS}"; then
+      textInfo "${REGION}: Access Denied trying to get account contact information" "${REGION}"
+    else
+      if grep "SECURITY" <<< "${GET_SECURITY_CONTACT_DETAILS}"; then
+        textPass "${REGION}: Account has security contact information. Perhaps check for freshness of these details." "${REGION}" "root"
+      else
+        textFail "${REGION}: Account has not security contact information, or it was unable to capture. See section 1.18 on the CIS Benchmark guide for details." "${REGION}" "root"
+      fi
+    fi
   fi
 }
diff --git a/iam/create_role_to_assume_cfn.yaml b/iam/create_role_to_assume_cfn.yaml
index ee09ad3bf4..9bf5b0bf43 100644
--- a/iam/create_role_to_assume_cfn.yaml
+++ b/iam/create_role_to_assume_cfn.yaml
@@ -55,6 +55,8 @@ Resources:
             Statement:
             - Effect: Allow
               Action:
+                - 'account:GetContactInformation'
+                - 'account:GetAlternateContact'
                 - 'ds:ListAuthorizedApplications'
                 - 'ec2:GetEbsEncryptionByDefault'
                 - 'ecr:Describe*'
diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json
index 2f66778fc6..0f74328cea 100644
--- a/iam/prowler-additions-policy.json
+++ b/iam/prowler-additions-policy.json
@@ -3,6 +3,7 @@
     "Statement": [
         {
             "Action": [
+                "account:Get*",
                 "ds:Get*",
                 "ds:Describe*",
                 "ds:List*",