Skip to content

Commit 7eb3e06

Browse files
author
Aruneko
authored
feat: Implement CIS AWS v1.5.0 Section 1.16 and 1.20 (#13290)
#### Summary I have implemented CIS AWS v1.5.0 Section 1.16 and 1.20 - Section 1.16 - I use existing one. - Section 1.20 - I fixed existing query for the current table definition.
1 parent 2d9abfb commit 7eb3e06

4 files changed

Lines changed: 38 additions & 58 deletions

File tree

‎plugins/source/aws/policies/cis_v1.5.0/section_1.sql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@
4040
\echo "Executing check 1.15"
4141
\ir ../queries/iam/policies_attached_to_groups_roles.sql
4242
\set check_id '1.16'
43-
-- todo svc.ListPolicies is not used (implement it and then do a check)
43+
\echo "Executing check 1.16"
44+
\ir ../queries/iam/no_star.sql
4445
\set check_id '1.17'
4546
-- todo svc.ListPolicies is not used (implement it and then do a check)
4647
\set check_id '1.18'
@@ -50,6 +51,6 @@
5051
\ir ../queries/iam/server_certificates_expired.sql
5152
\set check_id '1.20'
5253
\echo "Executing check 1.20"
53-
-- \ir ../queries/accessanalyzer/regions_with_no_accessanalyzers.sql
54+
\ir ../queries/accessanalyzer/regions_with_no_accessanalyzers.sql
5455
\set check_id '1.21'
5556
-- manual

‎plugins/source/aws/policies/queries/accessanalyzer/regions_with_no_accessanalyzers.sql‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,20 @@
11
insert into aws_policy_results
2-
WITH regions_with_enabled_accessanalyzer
3-
AS (SELECT ar.region AS analyzed_region
4-
FROM aws_regions ar
5-
LEFT JOIN aws_accessanalyzer_analyzers aaaa ON
6-
ar.region = aaaa.region
7-
WHERE aaaa.status = 'ACTIVE')
8-
SELECT :'execution_time' AS execution_time,
9-
:'framework' AS framework,
10-
:'check_id' AS check_id,
11-
'Ensure that IAM Access analyzer is enabled for all regions (Automated)' AS title,
12-
account_id,
13-
region AS resource_id,
14-
CASE
15-
WHEN
16-
aregion.analyzed_region IS NULL
17-
AND ar.enabled = TRUE
18-
THEN 'fail'
19-
ELSE 'pass'
20-
END AS status
21-
FROM aws_regions ar
22-
LEFT JOIN regions_with_enabled_accessanalyzer aregion ON
23-
ar.region = aregion.analyzed_region;
2+
SELECT
3+
:'execution_time' AS execution_time,
4+
:'framework' AS framework,
5+
:'check_id' AS check_id,
6+
'Ensure that IAM Access analyzer is enabled for all regions (Automated)' AS title,
7+
ar.account_id,
8+
ar.region AS resource_id,
9+
CASE
10+
WHEN
11+
ar.enabled
12+
AND aregion.region IS NULL
13+
AND aregion.status IS DISTINCT FROM 'ACTIVE'
14+
THEN 'fail'
15+
ELSE 'pass'
16+
END AS status
17+
FROM
18+
aws_regions ar
19+
LEFT JOIN aws_accessanalyzer_analyzers aregion ON
20+
ar.region = aregion.region;

‎website/tables/aws/aws_accessanalyzer_analyzers.md‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -37,32 +37,23 @@ These SQL queries are sampled from CloudQuery policies and are compatible with P
3737
### Ensure that IAM Access analyzer is enabled for all regions (Automated)
3838

3939
```sql
40-
WITH
41-
regions_with_enabled_accessanalyzer
42-
AS (
43-
SELECT
44-
ar.region AS analyzed_region
45-
FROM
46-
aws_regions AS ar
47-
LEFT JOIN aws_accessanalyzer_analyzers AS aaaa ON
48-
ar.region = aaaa.region
49-
WHERE
50-
aaaa.status = 'ACTIVE'
51-
)
5240
SELECT
5341
'Ensure that IAM Access analyzer is enabled for all regions (Automated)'
5442
AS title,
55-
account_id,
56-
region AS resource_id,
43+
ar.account_id,
44+
ar.region AS resource_id,
5745
CASE
58-
WHEN aregion.analyzed_region IS NULL AND ar.enabled = true THEN 'fail'
46+
WHEN ar.enabled
47+
AND aregion.region IS NULL
48+
AND aregion.status IS DISTINCT FROM 'ACTIVE'
49+
THEN 'fail'
5950
ELSE 'pass'
6051
END
6152
AS status
6253
FROM
6354
aws_regions AS ar
64-
LEFT JOIN regions_with_enabled_accessanalyzer AS aregion ON
65-
ar.region = aregion.analyzed_region;
55+
LEFT JOIN aws_accessanalyzer_analyzers AS aregion ON
56+
ar.region = aregion.region;
6657
```
6758

6859

‎website/tables/aws/aws_regions.md‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,32 +27,23 @@ These SQL queries are sampled from CloudQuery policies and are compatible with P
2727
### Ensure that IAM Access analyzer is enabled for all regions (Automated)
2828

2929
```sql
30-
WITH
31-
regions_with_enabled_accessanalyzer
32-
AS (
33-
SELECT
34-
ar.region AS analyzed_region
35-
FROM
36-
aws_regions AS ar
37-
LEFT JOIN aws_accessanalyzer_analyzers AS aaaa ON
38-
ar.region = aaaa.region
39-
WHERE
40-
aaaa.status = 'ACTIVE'
41-
)
4230
SELECT
4331
'Ensure that IAM Access analyzer is enabled for all regions (Automated)'
4432
AS title,
45-
account_id,
46-
region AS resource_id,
33+
ar.account_id,
34+
ar.region AS resource_id,
4735
CASE
48-
WHEN aregion.analyzed_region IS NULL AND ar.enabled = true THEN 'fail'
36+
WHEN ar.enabled
37+
AND aregion.region IS NULL
38+
AND aregion.status IS DISTINCT FROM 'ACTIVE'
39+
THEN 'fail'
4940
ELSE 'pass'
5041
END
5142
AS status
5243
FROM
5344
aws_regions AS ar
54-
LEFT JOIN regions_with_enabled_accessanalyzer AS aregion ON
55-
ar.region = aregion.analyzed_region;
45+
LEFT JOIN aws_accessanalyzer_analyzers AS aregion ON
46+
ar.region = aregion.region;
5647
```
5748

5849
### GuardDuty should be enabled

0 commit comments

Comments
 (0)