prowler-cloud 5.14.2__py3-none-any.whl → 5.15.1__py3-none-any.whl

prowler/providers/alibabacloud/services/ram/ram_policy_no_administrative_privileges/ram_policy_no_administrative_privileges.metadata.json

@@ -0,0 +1,39 @@
+{
+  "Provider": "alibabacloud",
+  "CheckID": "ram_policy_no_administrative_privileges",
+  "CheckTitle": "RAM policies that allow full \"*:*\" administrative privileges are not created",
+  "CheckType": [
+    "Abnormal account",
+    "Cloud threat detection"
+  ],
+  "ServiceName": "ram",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "acs:ram::account-id:policy/{policy-name}",
+  "Severity": "critical",
+  "ResourceType": "AlibabaCloudRAMPolicy",
+  "Description": "**RAM policies** represent permissions that can be granted to users, groups, or roles. It is recommended to grant **least privilege**—that is, granting only the permissions required to perform tasks.\n\nDetermine what users need to do and then create policies with permissions that only fit those tasks, instead of allowing full administrative privileges.",
+  "Risk": "It is more secure to start with a minimum set of permissions and grant additional permissions as necessary. Providing **full administrative privileges** exposes your resources to potentially unwanted actions.\n\nRAM policies with `\"Effect\": \"Allow\"`, `\"Action\": \"*\"`, and `\"Resource\": \"*\"` should be prohibited.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.alibabacloud.com/help/doc-detail/93733.htm",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/policies-with-full-administrative-privileges.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aliyun ram DetachPolicyFromUser --PolicyName <policy_name> --PolicyType Custom --UserName <ram_user>",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Log on to the **RAM Console**\n2. Choose **Permissions** > **Policies**\n3. From the Policy Type drop-down list, select **Custom Policy**\n4. In the Policy Name column, click the name of the target policy\n5. In the Policy Document section, edit the policy to remove the statement with full administrative privileges, or remove the policy from any RAM users, user groups, or roles that have this policy attached",
+      "Url": "https://hub.prowler.com/check/ram_policy_no_administrative_privileges"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/alibabacloud/services/ram/ram_policy_no_administrative_privileges/ram_policy_no_administrative_privileges.py

@@ -0,0 +1,73 @@
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.ram.ram_client import ram_client
+
+
+def check_admin_access(policy_document: dict) -> bool:
+    """
+    Check if the policy document allows full administrative privileges.
+
+    Args:
+        policy_document: The policy document as a dictionary.
+
+    Returns:
+        bool: True if the policy allows admin access (Effect: Allow, Action: *, Resource: *), False otherwise.
+    """
+    if not policy_document:
+        return False
+
+    statements = policy_document.get("Statement", [])
+    if not isinstance(statements, list):
+        statements = [statements]
+
+    for statement in statements:
+        effect = statement.get("Effect")
+        action = statement.get("Action")
+        resource = statement.get("Resource")
+
+        # Check if statement has Effect: Allow, Action: *, Resource: *
+        if effect == "Allow":
+            # Action can be a string or a list
+            actions = action if isinstance(action, list) else [action] if action else []
+            # Resource can be a string or a list
+            resources = (
+                resource
+                if isinstance(resource, list)
+                else [resource] if resource else []
+            )
+
+            # Check if Action contains "*" and Resource contains "*"
+            if "*" in actions and "*" in resources:
+                return True
+
+    return False
+
+
+class ram_policy_no_administrative_privileges(Check):
+    """Check if RAM policies that allow full '*:*' administrative privileges are not created."""
+
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+
+        for policy in ram_client.policies.values():
+            # Check only for custom policies that are attached
+            if policy.policy_type == "Custom" and policy.attachment_count > 0:
+                report = CheckReportAlibabaCloud(
+                    metadata=self.metadata(), resource=policy
+                )
+                report.region = ram_client.region
+                report.resource_id = policy.name
+                report.resource_arn = (
+                    f"acs:ram::{ram_client.audited_account}:policy/{policy.name}"
+                )
+
+                report.status = "PASS"
+                report.status_extended = f"Custom policy {policy.name} is attached but does not allow '*:*' administrative privileges."
+
+                if policy.document:
+                    if check_admin_access(policy.document):
+                        report.status = "FAIL"
+                        report.status_extended = f"Custom policy {policy.name} is attached and allows '*:*' administrative privileges."
+
+                findings.append(report)
+
+        return findings

prowler/providers/alibabacloud/services/ram/ram_rotate_access_key_90_days/ram_rotate_access_key_90_days.metadata.json

@@ -0,0 +1,39 @@
+{
+  "Provider": "alibabacloud",
+  "CheckID": "ram_rotate_access_key_90_days",
+  "CheckTitle": "Access keys are rotated every 90 days or less",
+  "CheckType": [
+    "Unusual logon",
+    "Cloud threat detection"
+  ],
+  "ServiceName": "ram",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "acs:ram::account-id:user/{user-name}/accesskey/{access-key-id}",
+  "Severity": "medium",
+  "ResourceType": "AlibabaCloudRAMAccessKey",
+  "Description": "An **access key** consists of an access key ID and a secret, which are used to sign programmatic requests that you make to Alibaba Cloud.\n\nRAM users need their own access keys to make programmatic calls from SDKs, CLIs, or direct API calls. It is recommended that all access keys be **regularly rotated**.",
+  "Risk": "Access keys might be compromised by leaving them in code, configuration files, on-premise and cloud storages, and then stolen by attackers.\n\n**Rotating access keys** reduces the window of opportunity for a compromised access key to be used.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.alibabacloud.com/help/doc-detail/116401.htm",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/access-keys-rotation.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aliyun ram CreateAccessKey --UserName <ram_user> && aliyun ram UpdateAccessKey --UserAccessKeyId <old_access_key_ID> --Status Inactive --UserName <ram_user> && aliyun ram DeleteAccessKey --UserAccessKeyId <old_access_key_ID> --UserName <ram_user>",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Create a new **AccessKey pair** for rotation\n2. Update all applications and systems to use the new AccessKey pair\n3. **Disable** the original AccessKey pair\n4. Confirm that your applications and systems are working\n5. **Delete** the original AccessKey pair",
+      "Url": "https://hub.prowler.com/check/ram_rotate_access_key_90_days"
+    }
+  },
+  "Categories": [
+    "secrets"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/alibabacloud/services/ram/ram_rotate_access_key_90_days/ram_rotate_access_key_90_days.py

@@ -0,0 +1,58 @@
+from datetime import datetime, timedelta, timezone
+
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.ram.ram_client import ram_client
+
+
+class ram_rotate_access_key_90_days(Check):
+    """Check if access keys are rotated every 90 days or less."""
+
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+        # Use UTC timezone-aware datetime for consistent comparison
+        now = datetime.now(timezone.utc)
+        ninety_days_ago = now - timedelta(days=90)
+
+        for user in ram_client.users:
+            if user.access_keys:
+                for access_key in user.access_keys:
+                    # Only check active access keys
+                    if access_key.status == "Active":
+                        report = CheckReportAlibabaCloud(
+                            metadata=self.metadata(), resource=user
+                        )
+                        report.region = ram_client.region
+                        report.resource_id = access_key.access_key_id
+                        report.resource_arn = f"acs:ram::{ram_client.audited_account}:user/{user.name}/accesskey/{access_key.access_key_id}"
+
+                        if access_key.create_date:
+                            # Ensure create_date is timezone-aware for comparison
+                            create_date = access_key.create_date
+                            if create_date.tzinfo is None:
+                                # If naive, assume UTC
+                                create_date = create_date.replace(tzinfo=timezone.utc)
+
+                            if create_date < ninety_days_ago:
+                                report.status = "FAIL"
+                                days_old = (now - create_date).days
+                                report.status_extended = (
+                                    f"Access key {access_key.access_key_id} for user {user.name} "
+                                    f"has not been rotated in {days_old} days (more than 90 days)."
+                                )
+                            else:
+                                report.status = "PASS"
+                                days_old = (now - create_date).days
+                                report.status_extended = (
+                                    f"Access key {access_key.access_key_id} for user {user.name} "
+                                    f"was created {days_old} days ago (within 90 days)."
+                                )
+                        else:
+                            report.status = "PASS"
+                            report.status_extended = (
+                                f"Access key {access_key.access_key_id} for user {user.name} "
+                                f"creation date is not available."
+                            )
+
+                        findings.append(report)
+
+        return findings