diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py index a3b0d7a1b2..d4471ef8c5 100644 --- a/prowler/providers/aws/services/iam/iam_service.py +++ b/prowler/providers/aws/services/iam/iam_service.py @@ -274,16 +274,26 @@ class IAM(AWSService): if not self.audit_resources or ( is_resource_filtered(user["Arn"], self.audit_resources) ): - if "PasswordLastUsed" not in user: - users.append(User(name=user["UserName"], arn=user["Arn"])) - else: - users.append( - User( - name=user["UserName"], - arn=user["Arn"], - password_last_used=user["PasswordLastUsed"], - ) + try: + user_login_profile = self.client.get_login_profile( + UserName=user["UserName"] ) + except self.client.exceptions.NoSuchEntityException: + user_login_profile = None + except Exception as error: + user_login_profile = None + logger.error( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + users.append( + User( + name=user["UserName"], + arn=user["Arn"], + password_last_used=user.get("PasswordLastUsed", None), + console_access=True if user_login_profile else False, + ) + ) except Exception as error: logger.error( f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" @@ -935,6 +945,7 @@ class User(BaseModel): arn: str mfa_devices: list[MFADevice] = [] password_last_used: Optional[datetime] + console_access: Optional[bool] attached_policies: list[dict] = [] inline_policies: list[str] = [] tags: Optional[list] = [] diff --git a/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py b/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py index 7c7a12ce83..06ba44a107 100644 --- a/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py +++ b/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py @@ -16,7 +16,7 @@ class iam_user_console_access_unused(Check): report.resource_arn = user.arn report.resource_tags = user.tags report.region = iam_client.region - if user.password_last_used: + if user.console_access and user.password_last_used: time_since_insertion = ( datetime.datetime.now() - datetime.datetime.strptime( @@ -31,10 +31,7 @@ class iam_user_console_access_unused(Check): report.status_extended = f"User {user.name} has logged in to the console in the past {maximum_expiration_days} days ({time_since_insertion.days} days)." else: report.status = "PASS" - report.status_extended = ( - f"User {user.name} does not have a console password or is unused." - ) + report.status_extended = f"User {user.name} does not have console access enabled or is unused." - # Append report findings.append(report) return findings diff --git a/tests/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused_test.py b/tests/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused_test.py index d9df3142f9..75d9de9fd4 100644 --- a/tests/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused_test.py +++ b/tests/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused_test.py @@ -12,13 +12,15 @@ AWS_REGION = "us-east-1" class Test_iam_user_console_access_unused_test: @mock_aws - def test_iam_user_logged_45_days(self): + def test_iam_user_logged_2_days_ago(self): password_last_used = ( datetime.datetime.now() - datetime.timedelta(days=2) ).strftime("%Y-%m-%d %H:%M:%S+00:00") iam_client = client("iam") user = "test-user" arn = iam_client.create_user(UserName=user)["User"]["Arn"] + # Enable console access + iam_client.create_login_profile(UserName=user, Password="Test1234") from prowler.providers.aws.services.iam.iam_service import IAM @@ -59,6 +61,7 @@ class Test_iam_user_console_access_unused_test: iam_client = client("iam") user = "test-user" arn = iam_client.create_user(UserName=user)["User"]["Arn"] + iam_client.create_login_profile(UserName=user, Password="Test1234") from prowler.providers.aws.services.iam.iam_service import IAM @@ -116,14 +119,14 @@ class Test_iam_user_console_access_unused_test: ) service_client.users[0].password_last_used = "" - # raise Exception + check = iam_user_console_access_unused() result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" assert ( result[0].status_extended - == f"User {user} does not have a console password or is unused." + == f"User {user} does not have console access enabled or is unused." ) assert result[0].resource_id == user assert result[0].resource_arn == arn