github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/accessanalyzer/enable_access_analyzer.go (about)

     1  package accessanalyzer
     2  
     3  import (
     4  	"github.com/khulnasoft-lab/defsec/internal/rules"
     5  	"github.com/khulnasoft-lab/defsec/pkg/framework"
     6  	"github.com/khulnasoft-lab/defsec/pkg/providers"
     7  	"github.com/khulnasoft-lab/defsec/pkg/scan"
     8  	"github.com/khulnasoft-lab/defsec/pkg/severity"
     9  	"github.com/khulnasoft-lab/defsec/pkg/state"
    10  	defsecTypes "github.com/khulnasoft-lab/defsec/pkg/types"
    11  )
    12  
    13  var CheckEnableAccessAnalyzer = rules.Register(
    14  	scan.Rule{
    15  		AVDID:     "AVD-AWS-0175",
    16  		Provider:  providers.AWSProvider,
    17  		Service:   "accessanalyzer",
    18  		ShortCode: "enable-access-analyzer",
    19  		Frameworks: map[framework.Framework][]string{
    20  			framework.CIS_AWS_1_4: {"1.20"},
    21  		},
    22  		Summary:    "Enable IAM Access analyzer for IAM policies about all resources in each region.",
    23  		Impact:     "Reduced visibility of externally shared resources.",
    24  		Resolution: "Enable IAM Access analyzer across all regions.",
    25  		Explanation: `
    26  AWS IAM Access Analyzer helps you identify the resources in your organization and
    27  accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity.
    28  This lets you identify unintended access to your resources and data. Access Analyzer
    29  identifies resources that are shared with external principals by using logic-based reasoning
    30  to analyze the resource-based policies in your AWS environment. IAM Access Analyzer
    31  continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service)
    32  keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.
    33  `,
    34  		Links: []string{
    35  			"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
    36  		},
    37  		Severity: severity.Low,
    38  	},
    39  	func(s *state.State) (results scan.Results) {
    40  		var enabled bool
    41  		for _, analyzer := range s.AWS.AccessAnalyzer.Analyzers {
    42  			if analyzer.Active.IsTrue() {
    43  				enabled = true
    44  				break
    45  			}
    46  		}
    47  		if !enabled {
    48  			results.Add(
    49  				"Access Analyzer is not enabled.",
    50  				defsecTypes.NewUnmanagedMetadata(),
    51  			)
    52  		} else {
    53  			results.AddPassed(defsecTypes.NewUnmanagedMetadata())
    54  		}
    55  		return
    56  	},
    57  )