ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(aws): exclude member accounts in IAM Root Credentials check (#5813)

Browse Source
This commit is contained in:
Sergio Garcia
2024-11-19 10:06:12 -04:00
committed by GitHub
parent 7a4f5f34f7
commit a5f5967bb2
6 changed files with 31 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py
+4 -1
View File
@@ -6,7 +6,10 @@ class iam_no_root_access_key(Check):
def execute(self) -> Check_Report_AWS:
findings = []
# Check if the root credentials are managed by AWS Organizations
if "RootCredentialsManagement" not in iam_client.organization_features:
if (
iam_client.organization_features is not None
and "RootCredentialsManagement" not in iam_client.organization_features
):
for user in iam_client.credential_report:
if user["user"] == "<root_account>":
report = Check_Report_AWS(self.metadata())
prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json
+3 -2
View File
@@ -27,7 +27,8 @@
"DependsOn": [],
"RelatedTo": [
"iam_root_hardware_mfa_enabled",
"iam_root_mfa_enabled"
"iam_root_mfa_enabled",
"iam_no_root_access_key"
],
"Notes": ""
"Notes": "This check skips findings for member accounts as they cannot execute the ListOrganizationsFeatures API call, which is restricted to the management account or delegated administrators."
}
prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py
+1
View File
@@ -11,6 +11,7 @@ class iam_root_credentials_management_enabled(Check):
if (
organizations_client.organization
and organizations_client.organization.status == "ACTIVE"
and iam_client.organization_features is not None
):
report = Check_Report_AWS(self.metadata())
report.region = iam_client.region
prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py
+4 -1
View File
@@ -8,7 +8,10 @@ class iam_root_hardware_mfa_enabled(Check):
# This check is only available in Commercial Partition
if iam_client.audited_partition == "aws":
# Check if the root credentials are managed by AWS Organizations
if "RootCredentialsManagement" not in iam_client.organization_features:
if (
iam_client.organization_features is not None
and "RootCredentialsManagement" not in iam_client.organization_features
):
if iam_client.account_summary:
virtual_mfa = False
report = Check_Report_AWS(self.metadata())
prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py
+4 -1
View File
@@ -6,7 +6,10 @@ class iam_root_mfa_enabled(Check):
def execute(self) -> Check_Report_AWS:
findings = []
# Check if the root credentials are managed by AWS Organizations
if "RootCredentialsManagement" not in iam_client.organization_features:
if (
iam_client.organization_features is not None
and "RootCredentialsManagement" not in iam_client.organization_features
):
if iam_client.credential_report:
for user in iam_client.credential_report:
if user["user"] == "<root_account>":
prowler/providers/aws/services/iam/iam_service.py
+15
View File
@@ -982,6 +982,21 @@ class IAM(AWSService):
logger.warning(
f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
elif (
error.response["Error"]["Code"]
== "OrganizationNotInAllFeaturesModeException"
):
logger.warning(
f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
elif (
error.response["Error"]["Code"]
== "AccountNotManagementOrDelegatedAdministratorException"
):
logger.warning(
f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
self.organization_features = None
else:
logger.error(
f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"