From ca55d4ce86b5ed0650f9a4ff390d7da2427b9315 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 20 Oct 2025 12:20:16 +0200 Subject: [PATCH] chore(aws): enhance metadata for `directoryservice` service (#8859) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...ctory_log_forwarding_enabled.metadata.json | 31 ++++++++++------ ...ectory_monitor_notifications.metadata.json | 30 ++++++++++------ ...ce_directory_snapshots_limit.metadata.json | 29 +++++++++------ ..._ldap_certificate_expiration.metadata.json | 31 ++++++++++------ ...ius_server_security_protocol.metadata.json | 35 ++++++++++++------- ...supported_mfa_radius_enabled.metadata.json | 35 ++++++++++++------- 7 files changed, 125 insertions(+), 67 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index c107c68b1b..8e07798608 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -36,6 +36,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS Backup service metadata to new format [(#8826)](https://github.com/prowler-cloud/prowler/pull/8826) - Update AWS CloudFormation service metadata to new format [(#8828)](https://github.com/prowler-cloud/prowler/pull/8828) - Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825) +- Update AWS Directory Service service metadata to new format [(#8859)](https://github.com/prowler-cloud/prowler/pull/8859) - Update AWS CloudFront service metadata to new format [(#8829)](https://github.com/prowler-cloud/prowler/pull/8829) - Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865) - Update AWS EFS service metadata to new format [(#8889)](https://github.com/prowler-cloud/prowler/pull/8889) diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.metadata.json index 153e8d3600..02f7b89c45 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.metadata.json @@ -1,26 +1,35 @@ { "Provider": "aws", "CheckID": "directoryservice_directory_log_forwarding_enabled", - "CheckTitle": "Directory Service monitoring with CloudWatch logs.", - "CheckType": [], + "CheckTitle": "Directory Service directory has log forwarding to CloudWatch Logs enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Directory Service monitoring with CloudWatch logs.", - "Risk": "As a best practice, monitor your organization to ensure that changes are logged. This helps you to ensure that any unexpected change can be investigated and unwanted changes can be rolled back.", - "RelatedUrl": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/incident-response.html", + "Description": "**AWS Directory Service directories** are configured to forward domain controller security event logs to **CloudWatch Logs** using log subscriptions.\n\nEvaluation identifies directories with or without this forwarding in place.", + "Risk": "Without forwarding, visibility into AD security events is lost, delaying detection of suspicious authentications, policy changes, or privilege grants. Attackers can escalate and persist unnoticed, risking unauthorized access (confidentiality) and identity/policy manipulation (integrity), while hampering forensics and response.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.amazonaws.cn/en_us/directoryservice/latest/admin-guide/ms_ad_enable_log_forwarding.html", + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/incident-response.html", + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_log_forwarding.html", + "https://support.icompaas.com/support/solutions/articles/62000233528--ensure-directory-service-monitoring-with-cloudwatch-logs" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: enable Directory Service log forwarding to CloudWatch Logs\nResources:\n LogGroup:\n Type: AWS::Logs::LogGroup\n Properties:\n LogGroupName: /aws/directoryservice/\n\n LogsResourcePolicy:\n Type: AWS::Logs::ResourcePolicy\n Properties:\n PolicyName: DSLogSubscription\n PolicyDocument: |\n {\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ds.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\",\"logs:DescribeLogStreams\"],\"Resource\":\"arn:aws:logs:*:*:log-group:/aws/directoryservice/*\"}]}\n\n DirectoryLogSubscription:\n Type: AWS::DirectoryService::LogSubscription\n Properties:\n DirectoryId: # CRITICAL: target Directory Service ID to enable log forwarding\n LogGroupName: /aws/directoryservice/ # CRITICAL: CloudWatch Logs destination\n```", + "Other": "1. In the AWS Console, go to Directory Service > Directories and open your directory\n2. On the Directory details page, select the Networking & security tab\n3. In Log forwarding, click Enable\n4. Choose Create a new CloudWatch log group (or select an existing one)\n5. Click Enable to start forwarding logs", + "Terraform": "```hcl\n# Enable Directory Service log forwarding to CloudWatch Logs\nresource \"aws_cloudwatch_log_group\" \"ds\" {\n name = \"/aws/directoryservice/\"\n}\n\nresource \"aws_cloudwatch_log_resource_policy\" \"ds\" {\n policy_name = \"DSLogSubscription\"\n policy_document = jsonencode({\n Version = \"2012-10-17\",\n Statement = [{\n Effect = \"Allow\",\n Principal = { Service = \"ds.amazonaws.com\" },\n Action = [\"logs:CreateLogStream\", \"logs:PutLogEvents\", \"logs:DescribeLogStreams\"],\n Resource = \"arn:aws:logs:*:*:log-group:/aws/directoryservice/*\"\n }]\n })\n}\n\nresource \"aws_directory_service_log_subscription\" \"enable\" {\n directory_id = \"\" # CRITICAL: enables log forwarding for this directory\n log_group_name = aws_cloudwatch_log_group.ds.name # CRITICAL: CloudWatch Logs destination\n}\n```" }, "Recommendation": { - "Text": "It is recommended that that the export of logs is enabled.", - "Url": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/incident-response.html" + "Text": "Enable and maintain **log forwarding** to CloudWatch Logs.\n\n- Centralize logs in a protected group with strict access and retention\n- Apply least privilege for delivery roles and readers; prevent tampering (immutability)\n- Alert on high-risk events and aggregate across Regions/accounts for defense in depth", + "Url": "https://hub.prowler.com/check/directoryservice_directory_log_forwarding_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.metadata.json index 55d1c393c0..beafbd81da 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "directoryservice_directory_monitor_notifications", - "CheckTitle": "Directory Service has SNS Notifications enabled.", - "CheckType": [], + "CheckTitle": "Directory Service directory has SNS notifications enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Directory Service has SNS Notifications enabled.", - "Risk": "As a best practice, monitor status of Directory Service. This helps to avoid late actions to fix Directory Service issues.", - "RelatedUrl": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_notifications.html", + "Description": "**AWS Directory Service** directories are associated with **Amazon SNS topics** to send status change notifications (e.g., `Active` `Impaired`).\n\nThe evaluation looks for directories that have SNS event topics configured for monitoring alerts.", + "Risk": "Missing directory notifications reduces visibility into health changes, causing delayed response to `Impaired` states. This threatens availability of authentication, Kerberos/LDAP lookups, and domain joins; increases MTTR; and can enable silent replication or trust failures that impact integrity across dependent workloads.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_notifications.html", + "https://support.icompaas.com/support/solutions/articles/62000233533-ensure-directory-service-has-sns-notifications-enabled" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ds register-event-topic --directory-id --topic-name ", "NativeIaC": "", - "Other": "", + "Other": "1. Open AWS Console > Directory Service > Directories and select your directory\n2. Go to the Maintenance or Monitoring/Notifications section\n3. Click Actions > Create notification (or Set up notifications)\n4. Select an existing SNS topic (or create one) and Save", "Terraform": "" }, "Recommendation": { - "Text": "It is recommended set up SNS messaging to send email or text messages when the status of your directory changes.", - "Url": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_notifications.html" + "Text": "Configure **AWS Directory Service** to publish directory status changes to an **SNS topic**, and subscribe your operations channels for timely alerts.\n\nApply **least privilege** on topic permissions, integrate alerts with incident response, and use **defense in depth** by pairing notifications with logs and dashboards.", + "Url": "https://hub.prowler.com/check/directoryservice_directory_monitor_notifications" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.metadata.json index 7693461252..85d6057f14 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.metadata.json @@ -1,29 +1,38 @@ { "Provider": "aws", "CheckID": "directoryservice_directory_snapshots_limit", - "CheckTitle": "Directory Service Manual Snapshots limit reached.", - "CheckType": [], + "CheckTitle": "Directory Service directory has adequate remaining manual snapshot quota", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Resource Consumption" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "Other", - "Description": "Directory Service Manual Snapshots limit reached.", - "Risk": "A limit reached can bring unwanted results. The maximum number of manual snapshots is a hard limit.", - "RelatedUrl": "https://docs.aws.amazon.com/general/latest/gr/ds_region.html", + "Description": "**AWS Directory Service** directories with **manual snapshot capacity** fully consumed or nearly exhausted, based on current snapshot count relative to the directory's maximum allowed.", + "Risk": "With no remaining snapshot capacity, you cannot create new recovery points:\n- Reduced availability during outages or ransomware\n- Higher RPO from failed scheduled backups\n- Greater change risk (schema/OS updates) without a safe rollback", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233531--ensure-directory-service-manual-snapshots-limit-reached", + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_limits.html" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "", + "Other": "1. In the AWS Console, go to Directory Service > Directories and open \n2. Click Snapshots\n3. Select older snapshots with Type = Manual and click Delete snapshot, confirm\n4. Repeat until the number of manual snapshots is less than (manual limit - 2). For the default limit of 5, keep at most 2 manual snapshots\n5. Verify Remaining manual snapshots > 2 on the Snapshots page", "Terraform": "" }, "Recommendation": { - "Text": "Monitor manual snapshots limit to ensure capacity when you need it.", - "Url": "https://docs.aws.amazon.com/general/latest/gr/ds_region.html" + "Text": "Adopt a **snapshot lifecycle policy**: rotate/expire old manual snapshots after verifying restores, and alert on low headroom. Prefer **automated backups** for cadence and retention. Enforce **least privilege** for snapshot creation. Design operations within the *hard per-directory cap* to prevent capacity exhaustion.", + "Url": "https://hub.prowler.com/check/directoryservice_directory_snapshots_limit" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.metadata.json index 982ab9091f..7e8510d0f3 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.metadata.json @@ -1,29 +1,38 @@ { "Provider": "aws", "CheckID": "directoryservice_ldap_certificate_expiration", - "CheckTitle": "Directory Service LDAP Certificates expiration.", - "CheckType": [], + "CheckTitle": "Directory Service LDAP certificate expires in more than 90 days", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Directory Service Manual Snapshots limit reached.", - "Risk": "Expired certificates can impact service availability.", - "RelatedUrl": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_ldap.html", + "Description": "**AWS Directory Service** Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory's certificate expiration to the current time and identifying those with `<= 90` days remaining.", + "Risk": "Expired LDAPS certificates cause TLS handshakes to fail, blocking directory binds and queries and disrupting authentication and app integrations (availability). If clients fall back to plain LDAP, credentials and directory data can be intercepted or altered (confidentiality and integrity).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_ldap.html", + "https://support.icompaas.com/support/solutions/articles/62000229587-ensure-to-monitor-directory-service-ldap-certificates-expiration" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ds register-certificate --directory-id --certificate-data file://certificate.pem", "NativeIaC": "", - "Other": "", + "Other": "1. In the AWS Console, open Directory Service and select your AWS Managed Microsoft AD ()\n2. Go to Networking & security > Secure LDAP\n3. Click Edit (Manage certificate)\n4. Choose Replace certificate (or Upload certificate)\n5. Upload a new LDAPS server certificate with private key from a trusted CA (valid for >90 days); enter the password if using a .pfx\n6. Save and wait until the certificate status is Active", "Terraform": "" }, "Recommendation": { - "Text": "Monitor certificate expiration and take automated action to alarm responsible team for taking care of the replacement or remove.", - "Url": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_ldap.html" + "Text": "Adopt certificate lifecycle management: inventory LDAPS certificates, alert well before expiry, and automate renewal with staged rollout and overlap. Enforce TLS-only LDAP and disable plaintext fallback. Apply **least privilege** and **separation of duties** to certificate issuance and deployment.", + "Url": "https://hub.prowler.com/check/directoryservice_ldap_certificate_expiration" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.metadata.json index a3f04834e3..60ffbc26da 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.metadata.json @@ -1,29 +1,40 @@ { "Provider": "aws", "CheckID": "directoryservice_radius_server_security_protocol", - "CheckTitle": "Ensure Radius server in DS is using the recommended security protocol.", - "CheckType": [], + "CheckTitle": "Directory Service directory RADIUS server uses MS-CHAPv2", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Credential Access" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Ensure Radius server in DS is using the recommended security protocol.", - "Risk": "As a best practice, you might need to configure the authentication protocol between the Microsoft AD DCs and the RADIUS/MFA server. Supported protocols are PAP, CHAP MS-CHAPv1, and MS-CHAPv2. MS-CHAPv2 is recommended because it provides the strongest security of the three options.", - "RelatedUrl": "https://aws.amazon.com/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/", + "Description": "AWS Directory Service RADIUS configuration uses the **authentication protocol** defined for MFA integration. The finding evaluates whether directories with RADIUS enabled are set to `MS-CHAPv2` instead of weaker options like `PAP`, `CHAP`, or `MS-CHAPv1`.", + "Risk": "Using `PAP`, `CHAP`, or `MS-CHAPv1` weakens RADIUS-based MFA.\n\n`PAP` exposes cleartext credentials, while legacy CHAP variants permit offline cracking and replay, enabling unauthorized access to AD-integrated services and lateral movement, degrading confidentiality and integrity.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.secureauth.com/0903/en/ms-chapv2-and-radius--sp-initiated--for-cisco-and-netscaler-configuration-guide.html", + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html", + "https://www.freeradius.org/documentation/freeradius-server/4.0~alpha1/raddb/mods-available/mschap.html" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ds update-radius --directory-id --radius-settings AuthenticationProtocol=MS-CHAPv2", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the AWS Console, open Directory Service and select your directory\n2. Open the Networking & security tab (Multi-factor authentication section)\n3. Click Actions > Edit (or Enable)\n4. Set Protocol to MS-CHAPv2\n5. Click Save (or Enable) to apply", + "Terraform": "```hcl\nresource \"aws_directory_service_radius_settings\" \"\" {\n directory_id = \"\"\n radius_servers = [\"\"]\n shared_secret = \"\"\n\n authentication_protocol = \"MS-CHAPv2\" # Critical: sets the RADIUS auth protocol to MS-CHAPv2 to pass the check\n}\n```" }, "Recommendation": { - "Text": "MS-CHAPv2 provides the strongest security of the options supported, and is therefore recommended.", - "Url": "https://aws.amazon.com/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/" + "Text": "Standardize on `MS-CHAPv2` for RADIUS authentication to MFA providers. Disable `PAP`, `CHAP`, and `MS-CHAPv1` to prevent downgrades. Apply least privilege and defense in depth: use strong shared secrets, restrict network access to RADIUS endpoints, and monitor authentication logs for anomalies.", + "Url": "https://hub.prowler.com/check/directoryservice_radius_server_security_protocol" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json b/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json index a5db8db7ad..35716021fd 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json +++ b/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json @@ -1,29 +1,40 @@ { "Provider": "aws", "CheckID": "directoryservice_supported_mfa_radius_enabled", - "CheckTitle": "Ensure Multi-Factor Authentication (MFA) using Radius Server is enabled in DS.", - "CheckType": [], + "CheckTitle": "AWS Directory Service directory has RADIUS-based MFA enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access", + "TTPs/Credential Access" + ], "ServiceName": "directoryservice", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:codeartifact:region:account-id:directory/directory-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Ensure Multi-Factor Authentication (MFA) using Radius Server is enabled in DS.", - "Risk": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional username and password.", - "RelatedUrl": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html", + "Description": "**AWS Directory Service directories** are evaluated for **RADIUS-backed multi-factor authentication**, confirming that MFA is configured and the RADIUS integration is active.", + "Risk": "Without **RADIUS MFA**, directory-based sign-ins to AWS-integrated services rely on a single factor, enabling credential stuffing and phishing to succeed. Compromised passwords can grant unauthorized access, drive data exfiltration, and enable privilege escalation, undermining confidentiality and integrity.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html", + "https://support.icompaas.com/support/solutions/articles/62000233537-ensure-multi-factor-authentication-mfa-using-a-radius-server-is-enabled-in-directory-service" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ds enable-radius --directory-id --radius-settings '{\"RadiusServers\":[\"\"],\"SharedSecret\":\"\"}'", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. Sign in to the AWS Console and open Directory Service\n2. Select your directory and open it\n3. Go to the Networking & security tab\n4. In Multi-factor authentication, click Actions > Enable\n5. Enter RADIUS server IP(s) and the Shared secret, then click Enable\n6. Wait until the RADIUS status shows Completed", + "Terraform": "```hcl\nresource \"aws_directory_service_radius_settings\" \"\" {\n directory_id = \"\" # Directory to enable RADIUS MFA on\n radius_servers = [\"\"] # Critical: RADIUS server endpoint(s)\n shared_secret = \"\" # Critical: Shared secret for RADIUS\n}\n```" }, "Recommendation": { - "Text": "Enabling MFA provides increased security to a user name and password as it requires the user to possess a solution that displays a time-sensitive authentication code.", - "Url": "https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html" + "Text": "Enable and enforce **RADIUS-based MFA** for all Directory Service authentications. Apply **least privilege**, harden and monitor the RADIUS infrastructure, rotate shared secrets, and restrict network access (e.g., `UDP/1812`). Use **defense in depth** with segmentation and session controls to limit lateral movement and reduce blast radius.", + "Url": "https://hub.prowler.com/check/directoryservice_supported_mfa_radius_enabled" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""