chore(iam): improve iam user console access check (#4211)

prowler/providers/aws/services/iam/iam_service.py

@@ -274,16 +274,26 @@ class IAM(AWSService):
                     if not self.audit_resources or (
                         is_resource_filtered(user["Arn"], self.audit_resources)
                     ):
-                        if "PasswordLastUsed" not in user:
-                            users.append(User(name=user["UserName"], arn=user["Arn"]))
-                        else:
-                            users.append(
-                                User(
-                                    name=user["UserName"],
-                                    arn=user["Arn"],
-                                    password_last_used=user["PasswordLastUsed"],
-                                )
+                        try:
+                            user_login_profile = self.client.get_login_profile(
+                                UserName=user["UserName"]
                             )
+                        except self.client.exceptions.NoSuchEntityException:
+                            user_login_profile = None
+                        except Exception as error:
+                            user_login_profile = None
+                            logger.error(
+                                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+
+                        users.append(
+                            User(
+                                name=user["UserName"],
+                                arn=user["Arn"],
+                                password_last_used=user.get("PasswordLastUsed", None),
+                                console_access=True if user_login_profile else False,
+                            )
+                        )
         except Exception as error:
             logger.error(
                 f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -935,6 +945,7 @@ class User(BaseModel):
     arn: str
     mfa_devices: list[MFADevice] = []
     password_last_used: Optional[datetime]
+    console_access: Optional[bool]
     attached_policies: list[dict] = []
     inline_policies: list[str] = []
     tags: Optional[list] = []

prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py

@@ -16,7 +16,7 @@ class iam_user_console_access_unused(Check):
             report.resource_arn = user.arn
             report.resource_tags = user.tags
             report.region = iam_client.region
-            if user.password_last_used:
+            if user.console_access and user.password_last_used:
                 time_since_insertion = (
                     datetime.datetime.now()
                     - datetime.datetime.strptime(
@@ -31,10 +31,7 @@ class iam_user_console_access_unused(Check):
                     report.status_extended = f"User {user.name} has logged in to the console in the past {maximum_expiration_days} days ({time_since_insertion.days} days)."
             else:
                 report.status = "PASS"
-                report.status_extended = (
-                    f"User {user.name} does not have a console password or is unused."
-                )
+                report.status_extended = f"User {user.name} does not have console access enabled or is unused."
 
-            # Append report
             findings.append(report)
         return findings

tests/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused_test.py

@@ -12,13 +12,15 @@ AWS_REGION = "us-east-1"
 
 class Test_iam_user_console_access_unused_test:
     @mock_aws
-    def test_iam_user_logged_45_days(self):
+    def test_iam_user_logged_2_days_ago(self):
         password_last_used = (
             datetime.datetime.now() - datetime.timedelta(days=2)
         ).strftime("%Y-%m-%d %H:%M:%S+00:00")
         iam_client = client("iam")
         user = "test-user"
         arn = iam_client.create_user(UserName=user)["User"]["Arn"]
+        # Enable console access
+        iam_client.create_login_profile(UserName=user, Password="Test1234")
 
         from prowler.providers.aws.services.iam.iam_service import IAM
 
@@ -59,6 +61,7 @@ class Test_iam_user_console_access_unused_test:
         iam_client = client("iam")
         user = "test-user"
         arn = iam_client.create_user(UserName=user)["User"]["Arn"]
+        iam_client.create_login_profile(UserName=user, Password="Test1234")
 
         from prowler.providers.aws.services.iam.iam_service import IAM
 
@@ -116,14 +119,14 @@ class Test_iam_user_console_access_unused_test:
                 )
 
                 service_client.users[0].password_last_used = ""
-                # raise Exception
+
                 check = iam_user_console_access_unused()
                 result = check.execute()
                 assert len(result) == 1
                 assert result[0].status == "PASS"
                 assert (
                     result[0].status_extended
-                    == f"User {user} does not have a console password or is unused."
+                    == f"User {user} does not have console access enabled or is unused."
                 )
                 assert result[0].resource_id == user
                 assert result[0].resource_arn == arn