Skip to content

Commit ad1bd9c

Browse files
ivan-morgunMaffooch
ivan-morgun
and
Maffooch
authored
prowler_v4.py Prowler v4.5.0 changed the 'event_time' key with 'time_dt' (#11213)
* #11210 prowler_v4.py Prowler v4.5.0 changed the 'event_time' key in finding with 'time_dt' * #11210 prowler_v4.py Prowler v4.5.0 changed the 'event_time' key in finding with 'time_dt' * Add tesst to support prowler version <4.5.0 * Return new-line * Update tests, clean up scans * Fix ruff * Rename some stuff --------- Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
1 parent c4c80e4 commit ad1bd9c

4 files changed

Lines changed: 361 additions & 1 deletion

File tree

‎dojo/tools/aws_prowler_v3plus/prowler_v4.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ def process_ocsf_json(self, file, test):
3737
documentation = deserialized.get("remediation", {}).get("references", "")
3838
documentation = str(documentation) + "\n" + str(deserialized.get("unmapped", {}).get("related_url", ""))
3939
security_domain = deserialized.get("resources", [{}])[0].get("type", "")
40-
timestamp = deserialized.get("event_time")
40+
# Prowler v4.5.0 changed 'event_time' key in report with 'time_dt'
41+
timestamp = deserialized.get("time_dt") or deserialized.get("event_time")
4142
resource_arn = deserialized.get("resources", [{}])[0].get("uid", "")
4243
resource_id = deserialized.get("resources", [{}])[0].get("name", "")
4344
unique_id_from_tool = deserialized.get("finding_info", {}).get("uid", "")

‎unittests/scans/aws_prowler_v3plus/many_vuln_after_4_5_0.ocsf.json‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
[{
2+
"metadata": {
3+
"event_code": "iam_role_administratoraccess_policy_permissive_trust_relationship",
4+
"product": {
5+
"name": "Prowler",
6+
"vendor_name": "Prowler",
7+
"version": "4.2.1"
8+
},
9+
"version": "1.2.0"
10+
},
11+
"severity_id": 4,
12+
"severity": "High",
13+
"status": "New",
14+
"status_code": "FAIL",
15+
"status_detail": "IAM Role myAdministratorExecutionRole has AdministratorAccess policy attached that has too permissive trust relationship.",
16+
"status_id": 3,
17+
"unmapped": {
18+
"check_type": "",
19+
"related_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator",
20+
"categories": "trustboundaries",
21+
"depends_on": "",
22+
"related_to": "",
23+
"notes": "CAF Security Epic: IAM",
24+
"compliance": {}
25+
},
26+
"activity_name": "Create",
27+
"activity_id": 1,
28+
"finding_info": {
29+
"created_time": "2024-06-03T14:15:19.382075",
30+
"desc": "Ensure IAM Roles with attached AdministratorAccess policy have a well defined trust relationship",
31+
"product_uid": "prowler",
32+
"title": "Ensure IAM Roles with attached AdministratorAccess policy have a well defined trust relationship",
33+
"uid": "prowler-aws-iam_role_administratoraccess_policy_permissive_trust_relationship-123456789012-us-east-1-myAdministratorExecutionRole"
34+
},
35+
"resources": [
36+
{
37+
"cloud_partition": "aws",
38+
"region": "us-east-1",
39+
"data": {
40+
"details": ""
41+
},
42+
"group": {
43+
"name": "iam"
44+
},
45+
"labels": [],
46+
"name": "myAdministratorExecutionRole",
47+
"type": "AwsIamRole",
48+
"uid": "arn:aws:iam::123456789012:role/myAdministratorExecutionRole"
49+
}
50+
],
51+
"category_name": "Findings",
52+
"category_uid": 2,
53+
"class_name": "DetectionFinding",
54+
"class_uid": 2004,
55+
"cloud": {
56+
"account": {
57+
"name": "",
58+
"type": "AWS_Account",
59+
"type_id": 10,
60+
"uid": "123456789012",
61+
"labels": []
62+
},
63+
"org": {
64+
"name": "",
65+
"uid": ""
66+
},
67+
"provider": "aws",
68+
"region": "us-east-1"
69+
},
70+
"time_dt": "2024-06-03T14:15:19.382075",
71+
"remediation": {
72+
"desc": "Apply the principle of least privilege. Instead of AdministratorAccess, assign only the permissions necessary for specific roles and tasks. Create custom IAM policies with minimal permissions based on the principle of least privilege. If a role really needs AdministratorAccess, the trust relationship must be well defined to restrict it usage only to the Principal, Action, Audience and Subject intended for it.",
73+
"references": [
74+
"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege"
75+
]
76+
},
77+
"risk_details": "The AWS-managed AdministratorAccess policy grants all actions for all AWS services and for all resources in the account and as such exposes the customer to a significant data leakage threat. It is therefore particularly important that the trust relationship is well defined to restrict it usage only to the Principal, Action, Audience and Subject intended for it.",
78+
"type_uid": 200401,
79+
"type_name": "Create"
80+
},{
81+
"metadata": {
82+
"event_code": "iam_role_cross_account_readonlyaccess_policy",
83+
"product": {
84+
"name": "Prowler",
85+
"vendor_name": "Prowler",
86+
"version": "4.2.1"
87+
},
88+
"version": "1.2.0"
89+
},
90+
"severity_id": 4,
91+
"severity": "High",
92+
"status": "New",
93+
"status_code": "FAIL",
94+
"status_detail": "IAM Role AuditRole gives cross account read-only access.",
95+
"status_id": 3,
96+
"unmapped": {
97+
"check_type": "",
98+
"related_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#awsmp_readonlyaccess",
99+
"categories": "trustboundaries",
100+
"depends_on": "",
101+
"related_to": "",
102+
"notes": "CAF Security Epic: IAM",
103+
"compliance": {
104+
"MITRE-ATTACK": [
105+
"T1078"
106+
],
107+
"AWS-Foundational-Technical-Review": [
108+
"IAM-0012"
109+
]
110+
}
111+
},
112+
"activity_name": "Create",
113+
"activity_id": 1,
114+
"finding_info": {
115+
"created_time": "2024-06-03T14:15:19.382075",
116+
"desc": "Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts",
117+
"product_uid": "prowler",
118+
"title": "Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts",
119+
"uid": "prowler-aws-iam_role_cross_account_readonlyaccess_policy-123456789012-us-east-1-AuditRole"
120+
},
121+
"resources": [
122+
{
123+
"cloud_partition": "aws",
124+
"region": "us-east-1",
125+
"data": {
126+
"details": ""
127+
},
128+
"group": {
129+
"name": "iam"
130+
},
131+
"labels": [
132+
"some-label=some value"
133+
],
134+
"name": "AuditRole",
135+
"type": "AwsIamRole",
136+
"uid": "arn:aws:iam::123456789012:role/AuditRole"
137+
}
138+
],
139+
"category_name": "Findings",
140+
"category_uid": 2,
141+
"class_name": "DetectionFinding",
142+
"class_uid": 2004,
143+
"cloud": {
144+
"account": {
145+
"name": "",
146+
"type": "AWS_Account",
147+
"type_id": 10,
148+
"uid": "123456789012",
149+
"labels": []
150+
},
151+
"org": {
152+
"name": "",
153+
"uid": ""
154+
},
155+
"provider": "aws",
156+
"region": "us-east-1"
157+
},
158+
"time_dt": "2024-06-03T14:15:19.382075",
159+
"remediation": {
160+
"desc": "Remove the AWS-managed ReadOnlyAccess policy from all roles that have a trust policy, including third-party cloud accounts, or remove third-party cloud accounts from the trust policy of all roles that need the ReadOnlyAccess policy.",
161+
"references": [
162+
"https://docs.securestate.vmware.com/rule-docs/aws-iam-role-cross-account-readonlyaccess-policy"
163+
]
164+
},
165+
"risk_details": "The AWS-managed ReadOnlyAccess policy is highly potent and exposes the customer to a significant data leakage threat. It should be granted very conservatively. For granting access to 3rd party vendors, consider using alternative managed policies, such as ViewOnlyAccess or SecurityAudit.",
166+
"type_uid": 200401,
167+
"type_name": "Create"
168+
},{
169+
"metadata": {
170+
"event_code": "iam_role_permissive_trust_relationship",
171+
"product": {
172+
"name": "Prowler",
173+
"vendor_name": "Prowler",
174+
"version": "4.2.1"
175+
},
176+
"version": "1.2.0"
177+
},
178+
"severity_id": 4,
179+
"severity": "High",
180+
"status": "Suppressed",
181+
"status_code": "FAIL",
182+
"status_detail": "IAM Role CrossAccountResourceAccessRole has permissive trust relationship to other accounts",
183+
"status_id": 3,
184+
"unmapped": {
185+
"check_type": "",
186+
"related_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts",
187+
"categories": "trustboundaries",
188+
"depends_on": "",
189+
"related_to": "",
190+
"notes": "CAF Security Epic: IAM",
191+
"compliance": {}
192+
},
193+
"activity_name": "Create",
194+
"activity_id": 1,
195+
"finding_info": {
196+
"created_time": "2024-06-03T14:15:19.382075",
197+
"desc": "Ensure IAM Roles do not allow assume role from any role of a cross account",
198+
"product_uid": "prowler",
199+
"title": "Ensure IAM Roles do not allow assume role from any role of a cross account",
200+
"uid": "prowler-aws-iam_role_permissive_trust_relationship-123456789012-us-east-1-CrossAccountResourceAccessRole"
201+
},
202+
"resources": [
203+
{
204+
"cloud_partition": "aws",
205+
"region": "us-east-1",
206+
"data": {
207+
"details": ""
208+
},
209+
"group": {
210+
"name": "iam"
211+
},
212+
"labels": [],
213+
"name": "CrossAccountResourceAccessRole",
214+
"type": "AwsIamRole",
215+
"uid": "arn:aws:iam::123456789012:role/CrossAccountResourceAccessRole"
216+
}
217+
],
218+
"category_name": "Findings",
219+
"category_uid": 2,
220+
"class_name": "DetectionFinding",
221+
"class_uid": 2004,
222+
"cloud": {
223+
"account": {
224+
"name": "",
225+
"type": "AWS_Account",
226+
"type_id": 10,
227+
"uid": "123456789012",
228+
"labels": []
229+
},
230+
"org": {
231+
"name": "",
232+
"uid": ""
233+
},
234+
"provider": "aws",
235+
"region": "us-east-1"
236+
},
237+
"time_dt": "2024-06-03T14:15:19.382075",
238+
"remediation": {
239+
"desc": "Ensure IAM Roles do not allow assume role from any role of a cross account but only from specific roles of specific accounts.",
240+
"references": [
241+
"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-roles"
242+
]
243+
},
244+
"risk_details": "If an IAM role allows assume role from any role of a cross account, it can lead to privilege escalation.",
245+
"type_uid": 200401,
246+
"type_name": "Create"
247+
}]

‎unittests/scans/aws_prowler_v3plus/one_vuln_after_4_5_0.ocsf.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
[{
2+
"metadata": {
3+
"event_code": "iam_role_administratoraccess_policy_permissive_trust_relationship",
4+
"product": {
5+
"name": "Prowler",
6+
"vendor_name": "Prowler",
7+
"version": "4.2.1"
8+
},
9+
"version": "1.2.0"
10+
},
11+
"severity_id": 4,
12+
"severity": "High",
13+
"status": "New",
14+
"status_code": "FAIL",
15+
"status_detail": "IAM Role myAdministratorExecutionRole has AdministratorAccess policy attached that has too permissive trust relationship.",
16+
"status_id": 3,
17+
"unmapped": {
18+
"check_type": "",
19+
"related_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator",
20+
"categories": "trustboundaries",
21+
"depends_on": "",
22+
"related_to": "",
23+
"notes": "CAF Security Epic: IAM",
24+
"compliance": {}
25+
},
26+
"activity_name": "Create",
27+
"activity_id": 1,
28+
"finding_info": {
29+
"created_time": "2024-06-03T14:15:19.382075",
30+
"desc": "Ensure IAM Roles with attached AdministratorAccess policy have a well defined trust relationship",
31+
"product_uid": "prowler",
32+
"title": "Ensure IAM Roles with attached AdministratorAccess policy have a well defined trust relationship",
33+
"uid": "prowler-aws-iam_role_administratoraccess_policy_permissive_trust_relationship-123456789012-us-east-1-myAdministratorExecutionRole"
34+
},
35+
"resources": [
36+
{
37+
"cloud_partition": "aws",
38+
"region": "us-east-1",
39+
"data": {
40+
"details": ""
41+
},
42+
"group": {
43+
"name": "iam"
44+
},
45+
"labels": [],
46+
"name": "myAdministratorExecutionRole",
47+
"type": "AwsIamRole",
48+
"uid": "arn:aws:iam::123456789012:role/myAdministratorExecutionRole"
49+
}
50+
],
51+
"category_name": "Findings",
52+
"category_uid": 2,
53+
"class_name": "DetectionFinding",
54+
"class_uid": 2004,
55+
"cloud": {
56+
"account": {
57+
"name": "",
58+
"type": "AWS_Account",
59+
"type_id": 10,
60+
"uid": "123456789012",
61+
"labels": []
62+
},
63+
"org": {
64+
"name": "",
65+
"uid": ""
66+
},
67+
"provider": "aws",
68+
"region": "us-east-1"
69+
},
70+
"time_dt": "2024-06-03T14:15:19.382075",
71+
"remediation": {
72+
"desc": "Apply the principle of least privilege. Instead of AdministratorAccess, assign only the permissions necessary for specific roles and tasks. Create custom IAM policies with minimal permissions based on the principle of least privilege. If a role really needs AdministratorAccess, the trust relationship must be well defined to restrict it usage only to the Principal, Action, Audience and Subject intended for it.",
73+
"references": [
74+
"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege"
75+
]
76+
},
77+
"risk_details": "The AWS-managed AdministratorAccess policy grants all actions for all AWS services and for all resources in the account and as such exposes the customer to a significant data leakage threat. It is therefore particularly important that the trust relationship is well defined to restrict it usage only to the Principal, Action, Audience and Subject intended for it.",
78+
"type_uid": 200401,
79+
"type_name": "Create"
80+
}]

0 commit comments

Comments
 (0)