aws-cis-controls-assessment 1.0.6__tar.gz → 1.0.7__tar.gz

{aws_cis_controls_assessment-1.0.6/aws_cis_controls_assessment.egg-info → aws_cis_controls_assessment-1.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-cis-controls-assessment
-Version: 1.0.6
+Version: 1.0.7
 Summary: Production-ready AWS CIS Controls compliance assessment framework with 145 comprehensive rules
 Author-email: AWS CIS Assessment Team <security@example.com>
 Maintainer-email: AWS CIS Assessment Team <security@example.com>

{aws_cis_controls_assessment-1.0.6 → aws_cis_controls_assessment-1.0.7}/aws_cis_assessment/__init__.py

@@ -6,6 +6,6 @@ CIS Controls Implementation Groups (IG1, IG2, IG3). Implements 145 comprehensive
 across all implementation groups for complete security compliance assessment.
 """
 
-__version__ = "1.0.6"
+__version__ = "1.0.7"
 __author__ = "AWS CIS Assessment Team"
 __description__ = "Production-ready AWS CIS Controls Compliance Assessment Framework"

{aws_cis_controls_assessment-1.0.6 → aws_cis_controls_assessment-1.0.7}/aws_cis_assessment/controls/ig1/control_critical_security.py

@@ -32,24 +32,31 @@ class RootAccountHardwareMFAEnabledAssessment(BaseConfigRuleAssessment):
         try:
             iam_client = aws_factory.get_client('iam', region)
             
-            # Get account summary which includes MFA device count
+            # Get account summary which includes MFA device count for root
             account_summary = iam_client.get_account_summary()
+            summary_map = account_summary.get('SummaryMap', {})
             
-            # List MFA devices for root account (empty user name for root)
-            mfa_devices = iam_client.list_mfa_devices()
-            
-            # Get virtual MFA devices to differentiate from hardware
-            virtual_mfa_devices = iam_client.list_virtual_mfa_devices()
+            # Get virtual MFA devices to check if root has hardware MFA
+            # Virtual MFA devices can be listed without specifying a user
+            try:
+                virtual_mfa_devices = iam_client.list_virtual_mfa_devices()
+                virtual_mfa_list = virtual_mfa_devices.get('VirtualMFADevices', [])
+            except ClientError as e:
+                logger.warning(f"Could not list virtual MFA devices: {e}")
+                virtual_mfa_list = []
             
             return [{
                 'account_id': aws_factory.account_id,
-                'account_summary': account_summary.get('SummaryMap', {}),
-                'mfa_devices': mfa_devices.get('MFADevices', []),
-                'virtual_mfa_devices': virtual_mfa_devices.get('VirtualMFADevices', [])
+                'account_summary': summary_map,
+                'virtual_mfa_devices': virtual_mfa_list
             }]
             
         except ClientError as e:
-            logger.error(f"Error getting root account MFA configuration: {e}")
+            error_code = e.response.get('Error', {}).get('Code', '')
+            if error_code in ['AccessDenied', 'UnauthorizedOperation']:
+                logger.warning(f"Insufficient permissions to check root account MFA: {e}")
+            else:
+                logger.error(f"Error getting root account MFA configuration: {e}")
             return []
         except Exception as e:
             logger.error(f"Unexpected error in root account MFA check: {e}")
@@ -59,15 +66,15 @@ class RootAccountHardwareMFAEnabledAssessment(BaseConfigRuleAssessment):
         """Evaluate root account hardware MFA compliance."""
         try:
             account_summary = resource.get('account_summary', {})
-            mfa_devices = resource.get('mfa_devices', [])
             virtual_mfa_devices = resource.get('virtual_mfa_devices', [])
+            account_id = resource.get('account_id', 'unknown')
             
             # Check if root account has any MFA devices
             account_mfa_enabled = account_summary.get('AccountMFAEnabled', 0)
             
             if account_mfa_enabled == 0:
                 return ComplianceResult(
-                    resource_id=resource['account_id'],
+                    resource_id=account_id,
                     resource_type="AWS::IAM::Root",
                     compliance_status=ComplianceStatus.NON_COMPLIANT,
                     evaluation_reason="Root account does not have MFA enabled",
@@ -75,42 +82,32 @@ class RootAccountHardwareMFAEnabledAssessment(BaseConfigRuleAssessment):
                     region=region
                 )
             
-            # Check if there are any MFA devices for root (empty UserName indicates root)
-            root_mfa_devices = [device for device in mfa_devices if not device.get('UserName')]
-            
-            if not root_mfa_devices:
-                return ComplianceResult(
-                    resource_id=resource['account_id'],
-                    resource_type="AWS::IAM::Root",
-                    compliance_status=ComplianceStatus.NON_COMPLIANT,
-                    evaluation_reason="Root account MFA is enabled but no MFA devices found",
-                    config_rule_name=self.rule_name,
-                    region=region
-                )
-            
-            # Check if any of the root MFA devices are hardware (not virtual)
-            virtual_mfa_serial_numbers = {device.get('SerialNumber') for device in virtual_mfa_devices}
-            
-            hardware_mfa_devices = [
-                device for device in root_mfa_devices 
-                if device.get('SerialNumber') not in virtual_mfa_serial_numbers
+            # Check if root has a virtual MFA device
+            # Virtual MFA devices for root have SerialNumber like: arn:aws:iam::ACCOUNT_ID:mfa/root-account-mfa-device
+            root_virtual_mfa = [
+                device for device in virtual_mfa_devices 
+                if 'root-account-mfa-device' in device.get('SerialNumber', '').lower()
+                or device.get('User', {}).get('Arn', '').endswith(':root')
             ]
             
-            if not hardware_mfa_devices:
+            if root_virtual_mfa:
                 return ComplianceResult(
-                    resource_id=resource['account_id'],
+                    resource_id=account_id,
                     resource_type="AWS::IAM::Root",
                     compliance_status=ComplianceStatus.NON_COMPLIANT,
-                    evaluation_reason="Root account only has virtual MFA devices, hardware MFA required",
+                    evaluation_reason="Root account has virtual MFA enabled, hardware MFA required for enhanced security",
                     config_rule_name=self.rule_name,
                     region=region
                 )
             
+            # If MFA is enabled but no virtual MFA found, assume hardware MFA
+            # Note: We cannot definitively verify hardware MFA without root credentials,
+            # but if AccountMFAEnabled=1 and no virtual MFA exists, it's likely hardware
             return ComplianceResult(
-                resource_id=resource['account_id'],
+                resource_id=account_id,
                 resource_type="AWS::IAM::Root",
                 compliance_status=ComplianceStatus.COMPLIANT,
-                evaluation_reason=f"Root account has {len(hardware_mfa_devices)} hardware MFA device(s) enabled",
+                evaluation_reason="Root account has MFA enabled (likely hardware MFA - no virtual MFA detected)",
                 config_rule_name=self.rule_name,
                 region=region
             )

{aws_cis_controls_assessment-1.0.6 → aws_cis_controls_assessment-1.0.7/aws_cis_controls_assessment.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-cis-controls-assessment
-Version: 1.0.6
+Version: 1.0.7
 Summary: Production-ready AWS CIS Controls compliance assessment framework with 145 comprehensive rules
 Author-email: AWS CIS Assessment Team <security@example.com>
 Maintainer-email: AWS CIS Assessment Team <security@example.com>