diff --git a/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py b/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py index 365a9f2fda..12666439b2 100644 --- a/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py +++ b/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py @@ -6,7 +6,10 @@ class iam_no_root_access_key(Check): def execute(self) -> Check_Report_AWS: findings = [] # Check if the root credentials are managed by AWS Organizations - if "RootCredentialsManagement" not in iam_client.organization_features: + if ( + iam_client.organization_features is not None + and "RootCredentialsManagement" not in iam_client.organization_features + ): for user in iam_client.credential_report: if user["user"] == "": report = Check_Report_AWS(self.metadata()) diff --git a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json index 69a71f9510..530f211ec6 100644 --- a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json +++ b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json @@ -27,7 +27,8 @@ "DependsOn": [], "RelatedTo": [ "iam_root_hardware_mfa_enabled", - "iam_root_mfa_enabled" + "iam_root_mfa_enabled", + "iam_no_root_access_key" ], - "Notes": "" + "Notes": "This check skips findings for member accounts as they cannot execute the ListOrganizationsFeatures API call, which is restricted to the management account or delegated administrators." } diff --git a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py index 5895c0e08a..c5fcc0896e 100644 --- a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py @@ -11,6 +11,7 @@ class iam_root_credentials_management_enabled(Check): if ( organizations_client.organization and organizations_client.organization.status == "ACTIVE" + and iam_client.organization_features is not None ): report = Check_Report_AWS(self.metadata()) report.region = iam_client.region diff --git a/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py b/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py index 284ad86b98..03d14d15cf 100644 --- a/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py @@ -8,7 +8,10 @@ class iam_root_hardware_mfa_enabled(Check): # This check is only available in Commercial Partition if iam_client.audited_partition == "aws": # Check if the root credentials are managed by AWS Organizations - if "RootCredentialsManagement" not in iam_client.organization_features: + if ( + iam_client.organization_features is not None + and "RootCredentialsManagement" not in iam_client.organization_features + ): if iam_client.account_summary: virtual_mfa = False report = Check_Report_AWS(self.metadata()) diff --git a/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py b/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py index 2db6c4bfff..4710d47689 100644 --- a/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py @@ -6,7 +6,10 @@ class iam_root_mfa_enabled(Check): def execute(self) -> Check_Report_AWS: findings = [] # Check if the root credentials are managed by AWS Organizations - if "RootCredentialsManagement" not in iam_client.organization_features: + if ( + iam_client.organization_features is not None + and "RootCredentialsManagement" not in iam_client.organization_features + ): if iam_client.credential_report: for user in iam_client.credential_report: if user["user"] == "": diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py index 2fc4ef4795..ae6eba3b86 100644 --- a/prowler/providers/aws/services/iam/iam_service.py +++ b/prowler/providers/aws/services/iam/iam_service.py @@ -982,6 +982,21 @@ class IAM(AWSService): logger.warning( f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + elif ( + error.response["Error"]["Code"] + == "OrganizationNotInAllFeaturesModeException" + ): + logger.warning( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + elif ( + error.response["Error"]["Code"] + == "AccountNotManagementOrDelegatedAdministratorException" + ): + logger.warning( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + self.organization_features = None else: logger.error( f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"