aws-cis-controls-assessment 1.0.3__py3-none-any.whl

aws_cis_assessment/controls/ig1/control_cloudtrail_logging.py

@@ -0,0 +1,197 @@
+"""
+CIS Control 8.2 - CloudTrail and Logging Controls
+Critical logging and audit trail controls for compliance and security monitoring.
+"""
+
+import logging
+from typing import List, Dict, Any, Optional
+import boto3
+import json
+from botocore.exceptions import ClientError, NoCredentialsError
+
+from aws_cis_assessment.controls.base_control import BaseConfigRuleAssessment
+from aws_cis_assessment.core.models import ComplianceResult, ComplianceStatus
+from aws_cis_assessment.core.aws_client_factory import AWSClientFactory
+
+logger = logging.getLogger(__name__)
+
+
+class CloudTrailEnabledAssessment(BaseConfigRuleAssessment):
+    """
+    CIS Control 8.2 - Collect Audit Logs
+    AWS Config Rule: cloudtrail-enabled
+    
+    Ensures CloudTrail is enabled to record AWS Management Console actions and API calls.
+    """
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="cloudtrail-enabled",
+            control_id="8.2",
+            resource_types=["AWS::::Account"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get CloudTrail configuration for the account."""
+        if resource_type != "AWS::::Account":
+            return []
+        
+        try:
+            cloudtrail_client = aws_factory.get_client('cloudtrail', region)
+            
+            # Get all trails in this region
+            response = cloudtrail_client.describe_trails()
+            trails = response.get('trailList', [])
+            
+            # Get trail status for each trail
+            trail_statuses = []
+            for trail in trails:
+                trail_name = trail.get('Name', '')
+                trail_arn = trail.get('TrailARN', '')
+                
+                try:
+                    # Get trail status
+                    status_response = cloudtrail_client.get_trail_status(Name=trail_name)
+                    is_logging = status_response.get('IsLogging', False)
+                    
+                    # Get event selectors to check what's being logged
+                    try:
+                        selectors_response = cloudtrail_client.get_event_selectors(TrailName=trail_name)
+                        event_selectors = selectors_response.get('EventSelectors', [])
+                    except ClientError:
+                        event_selectors = []
+                    
+                    trail_statuses.append({
+                        'TrailName': trail_name,
+                        'TrailARN': trail_arn,
+                        'IsLogging': is_logging,
+                        'IsMultiRegionTrail': trail.get('IsMultiRegionTrail', False),
+                        'IncludeGlobalServiceEvents': trail.get('IncludeGlobalServiceEvents', False),
+                        'S3BucketName': trail.get('S3BucketName', ''),
+                        'EventSelectors': event_selectors,
+                        'Region': region
+                    })
+                    
+                except ClientError as e:
+                    logger.warning(f"Error getting status for trail {trail_name}: {e}")
+                    continue
+            
+            # Return account-level resource with trail information
+            return [{
+                'AccountId': aws_factory.get_account_info().get('account_id', 'unknown'),
+                'Region': region,
+                'Trails': trail_statuses,
+                'HasActiveTrails': any(trail['IsLogging'] for trail in trail_statuses)
+            }]
+            
+        except ClientError as e:
+            logger.error(f"Error retrieving CloudTrail information from {region}: {e}")
+            raise
+        except Exception as e:
+            logger.error(f"Unexpected error retrieving CloudTrail information from {region}: {e}")
+            raise
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
+        """Evaluate if CloudTrail is enabled and logging."""
+        account_id = resource.get('AccountId', 'unknown')
+        trails = resource.get('Trails', [])
+        has_active_trails = resource.get('HasActiveTrails', False)
+        
+        if has_active_trails:
+            # Check for at least one properly configured trail
+            active_trails = [trail for trail in trails if trail['IsLogging']]
+            trail_names = [trail['TrailName'] for trail in active_trails]
+            
+            return ComplianceResult(
+                resource_id=account_id,
+                resource_type="AWS::::Account",
+                compliance_status=ComplianceStatus.COMPLIANT,
+                evaluation_reason=f"CloudTrail is enabled with {len(active_trails)} active trail(s): {', '.join(trail_names)}",
+                config_rule_name=self.rule_name,
+                region=region
+            )
+        else:
+            return ComplianceResult(
+                resource_id=account_id,
+                resource_type="AWS::::Account",
+                compliance_status=ComplianceStatus.NON_COMPLIANT,
+                evaluation_reason="CloudTrail is not enabled or no trails are actively logging",
+                config_rule_name=self.rule_name,
+                region=region
+            )
+
+
+class CloudWatchLogGroupEncryptedAssessment(BaseConfigRuleAssessment):
+    """
+    CIS Control 3.11 - Encrypt Sensitive Data at Rest
+    AWS Config Rule: cloudwatch-log-group-encrypted
+    
+    Ensures CloudWatch Log Groups are encrypted with KMS keys.
+    """
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="cloudwatch-log-group-encrypted",
+            control_id="3.11",
+            resource_types=["AWS::Logs::LogGroup"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get all CloudWatch Log Groups in the region."""
+        if resource_type != "AWS::Logs::LogGroup":
+            return []
+        
+        try:
+            logs_client = aws_factory.get_client('logs', region)
+            
+            log_groups = []
+            paginator = logs_client.get_paginator('describe_log_groups')
+            
+            for page in paginator.paginate():
+                for log_group in page.get('logGroups', []):
+                    log_group_name = log_group.get('logGroupName', '')
+                    kms_key_id = log_group.get('kmsKeyId', '')
+                    
+                    log_groups.append({
+                        'LogGroupName': log_group_name,
+                        'KmsKeyId': kms_key_id,
+                        'IsEncrypted': bool(kms_key_id),
+                        'CreationTime': log_group.get('creationTime', 0),
+                        'RetentionInDays': log_group.get('retentionInDays'),
+                        'StoredBytes': log_group.get('storedBytes', 0)
+                    })
+            
+            logger.debug(f"Found {len(log_groups)} CloudWatch Log Groups in {region}")
+            return log_groups
+            
+        except ClientError as e:
+            logger.error(f"Error retrieving CloudWatch Log Groups from {region}: {e}")
+            raise
+        except Exception as e:
+            logger.error(f"Unexpected error retrieving CloudWatch Log Groups from {region}: {e}")
+            raise
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], aws_factory: AWSClientFactory, region: str) -> ComplianceResult:
+        """Evaluate if CloudWatch Log Group is encrypted."""
+        log_group_name = resource.get('LogGroupName', 'unknown')
+        is_encrypted = resource.get('IsEncrypted', False)
+        kms_key_id = resource.get('KmsKeyId', '')
+        
+        if is_encrypted:
+            return ComplianceResult(
+                resource_id=log_group_name,
+                resource_type="AWS::Logs::LogGroup",
+                compliance_status=ComplianceStatus.COMPLIANT,
+                evaluation_reason=f"CloudWatch Log Group is encrypted with KMS key: {kms_key_id}",
+                config_rule_name=self.rule_name,
+                region=region
+            )
+        else:
+            return ComplianceResult(
+                resource_id=log_group_name,
+                resource_type="AWS::Logs::LogGroup",
+                compliance_status=ComplianceStatus.NON_COMPLIANT,
+                evaluation_reason="CloudWatch Log Group is not encrypted with KMS",
+                config_rule_name=self.rule_name,
+                region=region
+            )

aws_cis_assessment/controls/ig1/control_critical_security.py

@@ -0,0 +1,422 @@
+"""
+Critical Security Foundation Controls for CIS Assessment.
+Implements the most critical security controls that should be prioritized.
+"""
+
+from typing import List, Dict, Any, Optional
+import logging
+from botocore.exceptions import ClientError, NoCredentialsError
+
+from aws_cis_assessment.controls.base_control import BaseConfigRuleAssessment
+from aws_cis_assessment.core.models import ComplianceResult, ComplianceStatus
+from aws_cis_assessment.core.aws_client_factory import AWSClientFactory
+
+logger = logging.getLogger(__name__)
+
+
+class RootAccountHardwareMFAEnabledAssessment(BaseConfigRuleAssessment):
+    """Assessment for root-account-hardware-mfa-enabled AWS Config rule."""
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="root-account-hardware-mfa-enabled",
+            control_id="1.5",
+            resource_types=["AWS::IAM::Root"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get root account MFA configuration."""
+        if resource_type != "AWS::IAM::Root":
+            return []
+            
+        try:
+            iam_client = aws_factory.get_client('iam', region)
+            
+            # Get account summary which includes MFA device count
+            account_summary = iam_client.get_account_summary()
+            
+            # List MFA devices for root account (empty user name for root)
+            mfa_devices = iam_client.list_mfa_devices()
+            
+            # Get virtual MFA devices to differentiate from hardware
+            virtual_mfa_devices = iam_client.list_virtual_mfa_devices()
+            
+            return [{
+                'account_id': aws_factory.account_id,
+                'account_summary': account_summary.get('SummaryMap', {}),
+                'mfa_devices': mfa_devices.get('MFADevices', []),
+                'virtual_mfa_devices': virtual_mfa_devices.get('VirtualMFADevices', [])
+            }]
+            
+        except ClientError as e:
+            logger.error(f"Error getting root account MFA configuration: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Unexpected error in root account MFA check: {e}")
+            return []
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], **kwargs) -> ComplianceResult:
+        """Evaluate root account hardware MFA compliance."""
+        try:
+            account_summary = resource.get('account_summary', {})
+            mfa_devices = resource.get('mfa_devices', [])
+            virtual_mfa_devices = resource.get('virtual_mfa_devices', [])
+            
+            # Check if root account has any MFA devices
+            account_mfa_enabled = account_summary.get('AccountMFAEnabled', 0)
+            
+            if account_mfa_enabled == 0:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="Root account does not have MFA enabled",
+                    resource_id=resource['account_id'],
+                    resource_type="AWS::IAM::Root"
+                )
+            
+            # Check if there are any MFA devices for root (empty UserName indicates root)
+            root_mfa_devices = [device for device in mfa_devices if not device.get('UserName')]
+            
+            if not root_mfa_devices:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="Root account MFA is enabled but no MFA devices found",
+                    resource_id=resource['account_id'],
+                    resource_type="AWS::IAM::Root"
+                )
+            
+            # Check if any of the root MFA devices are hardware (not virtual)
+            virtual_mfa_serial_numbers = {device.get('SerialNumber') for device in virtual_mfa_devices}
+            
+            hardware_mfa_devices = [
+                device for device in root_mfa_devices 
+                if device.get('SerialNumber') not in virtual_mfa_serial_numbers
+            ]
+            
+            if not hardware_mfa_devices:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="Root account only has virtual MFA devices, hardware MFA required",
+                    resource_id=resource['account_id'],
+                    resource_type="AWS::IAM::Root"
+                )
+            
+            return ComplianceResult(
+                status=ComplianceStatus.COMPLIANT,
+                reason=f"Root account has {len(hardware_mfa_devices)} hardware MFA device(s) enabled",
+                resource_id=resource['account_id'],
+                resource_type="AWS::IAM::Root"
+            )
+            
+        except Exception as e:
+            logger.error(f"Error evaluating root account hardware MFA compliance: {e}")
+            return ComplianceResult(
+                status=ComplianceStatus.NOT_APPLICABLE,
+                reason=f"Error evaluating compliance: {str(e)}",
+                resource_id=resource.get('account_id', 'unknown'),
+                resource_type="AWS::IAM::Root"
+            )
+
+
+class OpenSearchInVPCOnlyAssessment(BaseConfigRuleAssessment):
+    """Assessment for opensearch-in-vpc-only AWS Config rule."""
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="opensearch-in-vpc-only",
+            control_id="2.2.1",
+            resource_types=["AWS::OpenSearch::Domain"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get OpenSearch domains to evaluate."""
+        if resource_type != "AWS::OpenSearch::Domain":
+            return []
+            
+        try:
+            opensearch_client = aws_factory.get_client('opensearch', region)
+            
+            # List all OpenSearch domain names
+            domain_names_response = opensearch_client.list_domain_names()
+            domain_names = [domain['DomainName'] for domain in domain_names_response.get('DomainNames', [])]
+            
+            if not domain_names:
+                return []
+            
+            # Get detailed information for each domain
+            domains_response = opensearch_client.describe_domains(DomainNames=domain_names)
+            domains = domains_response.get('DomainStatusList', [])
+            
+            return domains
+            
+        except ClientError as e:
+            if e.response['Error']['Code'] in ['UnauthorizedOperation', 'AccessDenied']:
+                logger.warning("Insufficient permissions to list OpenSearch domains")
+                return []
+            logger.error(f"Error listing OpenSearch domains: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Unexpected error listing OpenSearch domains: {e}")
+            return []
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], **kwargs) -> ComplianceResult:
+        """Evaluate OpenSearch domain VPC compliance."""
+        try:
+            domain_name = resource.get('DomainName', 'unknown')
+            vpc_options = resource.get('VPCOptions', {})
+            
+            # Check if domain is deployed in VPC
+            vpc_id = vpc_options.get('VPCId')
+            
+            if not vpc_id:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="OpenSearch domain is not deployed within a VPC",
+                    resource_id=domain_name,
+                    resource_type="AWS::OpenSearch::Domain"
+                )
+            
+            # Additional checks for VPC configuration
+            subnet_ids = vpc_options.get('SubnetIds', [])
+            security_group_ids = vpc_options.get('SecurityGroupIds', [])
+            
+            if not subnet_ids:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="OpenSearch domain VPC configuration is incomplete - no subnets specified",
+                    resource_id=domain_name,
+                    resource_type="AWS::OpenSearch::Domain"
+                )
+            
+            if not security_group_ids:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="OpenSearch domain VPC configuration is incomplete - no security groups specified",
+                    resource_id=domain_name,
+                    resource_type="AWS::OpenSearch::Domain"
+                )
+            
+            return ComplianceResult(
+                status=ComplianceStatus.COMPLIANT,
+                reason=f"OpenSearch domain is properly deployed in VPC {vpc_id} with {len(subnet_ids)} subnets",
+                resource_id=domain_name,
+                resource_type="AWS::OpenSearch::Domain"
+            )
+            
+        except Exception as e:
+            logger.error(f"Error evaluating OpenSearch domain VPC compliance: {e}")
+            return ComplianceResult(
+                status=ComplianceStatus.NOT_APPLICABLE,
+                reason=f"Error evaluating compliance: {str(e)}",
+                resource_id=resource.get('DomainName', 'unknown'),
+                resource_type="AWS::OpenSearch::Domain"
+            )
+
+
+class ECSTaskDefinitionNonRootUserAssessment(BaseConfigRuleAssessment):
+    """Assessment for ecs-task-definition-nonroot-user AWS Config rule."""
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="ecs-task-definition-nonroot-user",
+            control_id="4.1",
+            resource_types=["AWS::ECS::TaskDefinition"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get ECS task definitions to evaluate."""
+        if resource_type != "AWS::ECS::TaskDefinition":
+            return []
+            
+        try:
+            ecs_client = aws_factory.get_client('ecs', region)
+            
+            # List all task definition families
+            families_response = ecs_client.list_task_definition_families(status='ACTIVE')
+            families = families_response.get('families', [])
+            
+            task_definitions = []
+            
+            for family in families:
+                try:
+                    # Get the latest active revision for each family
+                    task_def_response = ecs_client.describe_task_definition(
+                        taskDefinition=family,
+                        include=['TAGS']
+                    )
+                    task_definitions.append(task_def_response.get('taskDefinition', {}))
+                except ClientError as e:
+                    logger.warning(f"Error describing task definition {family}: {e}")
+                    continue
+            
+            return task_definitions
+            
+        except ClientError as e:
+            if e.response['Error']['Code'] in ['UnauthorizedOperation', 'AccessDenied']:
+                logger.warning("Insufficient permissions to list ECS task definitions")
+                return []
+            logger.error(f"Error listing ECS task definitions: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Unexpected error listing ECS task definitions: {e}")
+            return []
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], **kwargs) -> ComplianceResult:
+        """Evaluate ECS task definition non-root user compliance."""
+        try:
+            task_def_arn = resource.get('taskDefinitionArn', 'unknown')
+            family = resource.get('family', 'unknown')
+            revision = resource.get('revision', 'unknown')
+            container_definitions = resource.get('containerDefinitions', [])
+            
+            if not container_definitions:
+                return ComplianceResult(
+                    status=ComplianceStatus.NOT_APPLICABLE,
+                    reason="Task definition has no container definitions",
+                    resource_id=f"{family}:{revision}",
+                    resource_type="AWS::ECS::TaskDefinition"
+                )
+            
+            non_compliant_containers = []
+            
+            for container in container_definitions:
+                container_name = container.get('name', 'unknown')
+                user = container.get('user')
+                
+                # Check if user is specified and is not root
+                if user is None:
+                    # No user specified - defaults to root in most images
+                    non_compliant_containers.append(f"{container_name} (no user specified)")
+                elif user == 'root' or user == '0':
+                    # Explicitly set to root
+                    non_compliant_containers.append(f"{container_name} (user: {user})")
+                # If user is specified and not root, it's compliant
+            
+            if non_compliant_containers:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason=f"Containers running as root: {', '.join(non_compliant_containers)}",
+                    resource_id=f"{family}:{revision}",
+                    resource_type="AWS::ECS::TaskDefinition"
+                )
+            
+            return ComplianceResult(
+                status=ComplianceStatus.COMPLIANT,
+                reason=f"All {len(container_definitions)} containers specify non-root users",
+                resource_id=f"{family}:{revision}",
+                resource_type="AWS::ECS::TaskDefinition"
+            )
+            
+        except Exception as e:
+            logger.error(f"Error evaluating ECS task definition compliance: {e}")
+            return ComplianceResult(
+                status=ComplianceStatus.NOT_APPLICABLE,
+                reason=f"Error evaluating compliance: {str(e)}",
+                resource_id=resource.get('family', 'unknown'),
+                resource_type="AWS::ECS::TaskDefinition"
+            )
+
+
+class SecurityHubEnabledAssessment(BaseConfigRuleAssessment):
+    """Assessment for securityhub-enabled AWS Config rule."""
+    
+    def __init__(self):
+        super().__init__(
+            rule_name="securityhub-enabled",
+            control_id="8.8",
+            resource_types=["AWS::SecurityHub::Hub"]
+        )
+    
+    def _get_resources(self, aws_factory: AWSClientFactory, resource_type: str, region: str) -> List[Dict[str, Any]]:
+        """Get Security Hub configuration for current region."""
+        if resource_type != "AWS::SecurityHub::Hub":
+            return []
+            
+        try:
+            securityhub_client = aws_factory.get_client('securityhub', region)
+            
+            # Check if Security Hub is enabled
+            try:
+                hub_response = securityhub_client.describe_hub()
+                
+                # Get enabled standards
+                standards_response = securityhub_client.get_enabled_standards()
+                
+                return [{
+                    'region': region,
+                    'hub_arn': hub_response.get('HubArn'),
+                    'subscribed_at': hub_response.get('SubscribedAt'),
+                    'auto_enable_controls': hub_response.get('AutoEnableControls'),
+                    'enabled_standards': standards_response.get('StandardsSubscriptions', [])
+                }]
+                
+            except ClientError as e:
+                if e.response['Error']['Code'] == 'InvalidAccessException':
+                    # Security Hub is not enabled
+                    return [{
+                        'region': region,
+                        'enabled': False,
+                        'error': 'Security Hub is not enabled'
+                    }]
+                else:
+                    raise
+            
+        except ClientError as e:
+            if e.response['Error']['Code'] in ['UnauthorizedOperation', 'AccessDenied']:
+                logger.warning("Insufficient permissions to check Security Hub status")
+                return []
+            logger.error(f"Error checking Security Hub status: {e}")
+            return []
+        except Exception as e:
+            logger.error(f"Unexpected error checking Security Hub: {e}")
+            return []
+    
+    def _evaluate_resource_compliance(self, resource: Dict[str, Any], **kwargs) -> ComplianceResult:
+        """Evaluate Security Hub enabled compliance."""
+        try:
+            region = resource.get('region', 'unknown')
+            
+            # Check if Security Hub is enabled
+            if resource.get('enabled') is False:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="AWS Security Hub is not enabled in this region",
+                    resource_id=region,
+                    resource_type="AWS::SecurityHub::Hub"
+                )
+            
+            hub_arn = resource.get('hub_arn')
+            if not hub_arn:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="Security Hub configuration is incomplete",
+                    resource_id=region,
+                    resource_type="AWS::SecurityHub::Hub"
+                )
+            
+            # Check if any security standards are enabled
+            enabled_standards = resource.get('enabled_standards', [])
+            active_standards = [std for std in enabled_standards if std.get('StandardsStatus') == 'READY']
+            
+            if not active_standards:
+                return ComplianceResult(
+                    status=ComplianceStatus.NON_COMPLIANT,
+                    reason="Security Hub is enabled but no security standards are active",
+                    resource_id=region,
+                    resource_type="AWS::SecurityHub::Hub"
+                )
+            
+            return ComplianceResult(
+                status=ComplianceStatus.COMPLIANT,
+                reason=f"Security Hub is enabled with {len(active_standards)} active security standards",
+                resource_id=region,
+                resource_type="AWS::SecurityHub::Hub"
+            )
+            
+        except Exception as e:
+            logger.error(f"Error evaluating Security Hub compliance: {e}")
+            return ComplianceResult(
+                status=ComplianceStatus.NOT_APPLICABLE,
+                reason=f"Error evaluating compliance: {str(e)}",
+                resource_id=resource.get('region', 'unknown'),
+                resource_type="AWS::SecurityHub::Hub"
+            )