mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
chore(aws): enhance metadata for accessanalyzer service (#8688)
Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
6e89c301b2
commit
a087dd9b85
@@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
|
||||
- Update AWS Neptune service metadata to new format [(#8494)](https://github.com/prowler-cloud/prowler/pull/8494)
|
||||
- Update AWS Config service metadata to new format [(#8641)](https://github.com/prowler-cloud/prowler/pull/8641)
|
||||
- Update AWS AccessAnalyzer service metadata to new format [(#8688)](https://github.com/prowler-cloud/prowler/pull/8688)
|
||||
- Update AWS Api Gateway V2 service metadata to new format [(#8719)](https://github.com/prowler-cloud/prowler/pull/8719)
|
||||
- Update AWS AppSync service metadata to new format [(#8721)](https://github.com/prowler-cloud/prowler/pull/8721)
|
||||
- Update AWS ACM service metadata to new format [(#8716)](https://github.com/prowler-cloud/prowler/pull/8716)
|
||||
|
||||
+27
-13
@@ -1,31 +1,45 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "accessanalyzer_enabled",
|
||||
"CheckTitle": "Check if IAM Access Analyzer is enabled",
|
||||
"CheckTitle": "IAM Access Analyzer is enabled",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "accessanalyzer",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:access-analyzer:region:account-id:analyzer/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Check if IAM Access Analyzer is enabled",
|
||||
"Risk": "AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses a form of mathematical analysis called automated reasoning, which applies logic and mathematical inference to determine all possible access paths allowed by a resource policy.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"Description": "**IAM Access Analyzer** presence and status are evaluated per account and Region. An analyzer in `ACTIVE` state indicates continuous analysis of supported resources and IAM activity to identify external, internal, and unused access.",
|
||||
"Risk": "Without an active analyzer, visibility into unintended public, cross-account, or risky internal access is lost. Adversaries can exploit exposed S3, snapshots, KMS keys, or permissive role trusts for data exfiltration and escalation. Unused permissions persist, enlarging the attack surface. This degrades confidentiality and integrity.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-manage-external.html",
|
||||
"https://aws.amazon.com/iam/access-analyzer/",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html",
|
||||
"https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAnalyzer.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-external.html",
|
||||
"https://docs.aws.amazon.com/access-analyzer/latest/APIReference/Welcome.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-internal.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws accessanalyzer create-analyzer --analyzer-name <NAME> --type <ACCOUNT|ORGANIZATION>",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "aws accessanalyzer create-analyzer --analyzer-name example_resource --type ACCOUNT",
|
||||
"NativeIaC": "```yaml\nResources:\n example_resource:\n Type: AWS::AccessAnalyzer::Analyzer # This resource enables IAM Access Analyzer\n Properties:\n AnalyzerName: example_resource\n Type: ACCOUNT # This line fixes the security issue\n```",
|
||||
"Other": "1. In the AWS Console, open IAM\n2. Go to Access analyzer > Analyzer settings\n3. Confirm the desired Region\n4. Click Create analyzer\n5. Select Resource analysis - External access\n6. Set Name to \"example_resource\" and Zone of trust to \"Current account\"\n7. Click Create",
|
||||
"Terraform": "```hcl\nresource \"aws_accessanalyzer_analyzer\" \"example_resource\" {\n analyzer_name = \"example_resource\"\n type = \"ACCOUNT\" # This line fixes the security issue\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable IAM Access Analyzer for all accounts, create analyzer and take action over it is recommendations (IAM Access Analyzer is available at no additional cost).",
|
||||
"Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
|
||||
"Text": "Enable **IAM Access Analyzer** across all accounts and active Regions (*or organization-wide*). Operate on least privilege: continuously review findings, remove unintended access, and trim unused permissions. Use archive rules sparingly, integrate reviews into change/CI/CD workflows, and enforce separation of duties on policy changes.",
|
||||
"Url": "https://hub.prowler.com/check/accessanalyzer_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access",
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+32
-13
@@ -1,31 +1,50 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "accessanalyzer_enabled_without_findings",
|
||||
"CheckTitle": "Check if IAM Access Analyzer is enabled without findings",
|
||||
"CheckTitle": "IAM Access Analyzer analyzer is active and has no active findings",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Initial Access/Unauthorized Access",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "accessanalyzer",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:access-analyzer:region:account-id:analyzer/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Check if IAM Access Analyzer is enabled without findings",
|
||||
"Risk": "AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses a form of mathematical analysis called automated reasoning, which applies logic and mathematical inference to determine all possible access paths allowed by a resource policy.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"Description": "**IAM Access Analyzer** analyzers are in `Active` state and currently report zero `Active` findings within their scope of monitored resources.",
|
||||
"Risk": "Unresolved `Active` findings indicate unintended external or internal access paths.\n- **Confidentiality**: public/cross-account reads of data (buckets, snapshots, secrets)\n- **Integrity**: rogue role assumption or KMS use enabling policy/data changes\n- **Lateral movement** across accounts",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings-remediate.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings-view.html",
|
||||
"https://aws.amazon.com/iam/access-analyzer/",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-concepts.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-dashboard.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings.html",
|
||||
"https://aws.amazon.com/blogs/security/automate-resolution-for-iam-access-analyzer-cross-account-access-findings-on-iam-roles/",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/AccessAnalyzer/findings.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws accessanalyzer create-analyzer --analyzer-name <NAME> --type <ACCOUNT|ORGANIZATION>",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"CLI": "",
|
||||
"NativeIaC": "```yaml\nResources:\n example_resource:\n Type: AWS::AccessAnalyzer::Analyzer\n Properties:\n AnalyzerName: example_resource\n Type: ACCOUNT # This line fixes the security issue\n```",
|
||||
"Other": "1. In the AWS Console, go to IAM > Access analyzer\n2. If no analyzer exists, click Create analyzer, select Type: Account, name it example_resource, and click Create\n3. To clear active findings: under Resource analysis, select your analyzer, select all Active findings, choose Actions > Archive\n4. For unintended access findings, open the finding and follow the linked resource to remove the offending permission (edit the resource policy or role trust policy), then return to the finding and choose Rescan\n5. Confirm the dashboard shows 0 Active findings",
|
||||
"Terraform": "```hcl\nresource \"aws_accessanalyzer_analyzer\" \"example_resource\" {\n analyzer_name = \"example_resource\"\n type = \"ACCOUNT\" # This line fixes the security issue\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable IAM Access Analyzer for all accounts, create analyzer and take action over it is recommendations (IAM Access Analyzer is available at no additional cost).",
|
||||
"Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
|
||||
"Text": "Enable **IAM Access Analyzer** in all relevant Regions and org/account scopes. Triage every `Active` finding:\n- Remove unintended access by tightening resource and trust policies\n- Enforce **least privilege** and separation of duties\n- Archive only validated, intended access\n- Continuously monitor and automate reviews",
|
||||
"Url": "https://hub.prowler.com/check/accessanalyzer_enabled_without_findings"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"identity-access",
|
||||
"trust-boundaries",
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
Reference in New Issue
Block a user