prowler 5.16.0__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.metadata.json

@@ -1,30 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "iam_role_cross_account_readonlyaccess_policy",
-  "CheckTitle": "Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts",
-  "CheckType": [],
+  "CheckTitle": "IAM role does not grant ReadOnlyAccess to external AWS accounts",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Initial Access/Unauthorized Access",
+    "Effects/Data Exposure"
+  ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsIamRole",
-  "Description": "Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts",
-  "Risk": "The AWS-managed ReadOnlyAccess policy is highly potent and exposes the customer to a significant data leakage threat. It should be granted very conservatively. For granting access to 3rd party vendors, consider using alternative managed policies, such as ViewOnlyAccess or SecurityAudit.",
-  "RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#awsmp_readonlyaccess",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM roles** are assessed for the AWS-managed **ReadOnlyAccess** policy combined with a trust policy that allows **external AWS principals** or `*`. This identifies roles that expose broad read permissions to other accounts.",
+  "Risk": "Granting **cross-account read access** can expose sensitive data and metadata, impacting **confidentiality**. External principals can read S3/DynamoDB contents and enumerate resources, policies, and logs, enabling targeted recon and easier **privilege escalation** paths.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#awsmp_readonlyaccess",
+    "https://support.icompaas.com/support/solutions/articles/62000233802-ensure-iam-roles-do-not-have-readonlyaccess-access-for-external-aws-accounts"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws iam detach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess",
+      "NativeIaC": "```yaml\n# CloudFormation snippet to prevent cross-account access on a role\nResources:\n  <example_resource_name>:\n    Type: AWS::IAM::Role\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              AWS: arn:aws:iam::<example_account_id>:root  # Critical: restrict trust to this account only to avoid cross-account access\n            Action: sts:AssumeRole\n```",
+      "Other": "1. Open the AWS Management Console > IAM > Roles\n2. Select the role granting external access\n3. On the Permissions tab, locate the policy ReadOnlyAccess\n4. Click Detach policy and confirm\n5. Verify the role no longer lists ReadOnlyAccess",
+      "Terraform": "```hcl\n# Terraform snippet to prevent cross-account access on a role\nresource \"aws_iam_role\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  assume_role_policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Effect = \"Allow\"\n      Principal = {\n        AWS = \"arn:aws:iam::<example_account_id>:root\" # Critical: trust only the same account to avoid cross-account access\n      }\n      Action = \"sts:AssumeRole\"\n    }]\n  })\n}\n```"
     },
     "Recommendation": {
-      "Text": "Remove the AWS-managed ReadOnlyAccess policy from all roles that have a trust policy, including third-party cloud accounts, or remove third-party cloud accounts from the trust policy of all roles that need the ReadOnlyAccess policy.",
-      "Url": "https://docs.securestate.vmware.com/rule-docs/aws-iam-role-cross-account-readonlyaccess-policy"
+      "Text": "Avoid attaching `ReadOnlyAccess` to roles trusted by other accounts. Apply **least privilege** with custom, tightly scoped policies. Restrict trust to explicit principals, avoid `*`, and use conditions like `aws:PrincipalOrgID` and `sts:ExternalId` for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/iam_role_cross_account_readonlyaccess_policy"
     }
   },
   "Categories": [
-    "trust-boundaries"
+    "trust-boundaries",
+    "identity-access"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "iam_role_cross_service_confused_deputy_prevention",
-  "CheckTitle": "Ensure IAM Service Roles prevents against a cross-service confused deputy attack",
-  "CheckType": [],
+  "CheckTitle": "IAM service role prevents cross-service confused deputy attack",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "TTPs/Privilege Escalation"
+  ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsIamRole",
-  "Description": "Ensure IAM Service Roles prevents against a cross-service confused deputy attack",
-  "Risk": "Allow attackers to gain unauthorized access to resources",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM service role** trust policies restrict **AWS service principals** to expected sources using global condition keys like `aws:SourceArn` or `aws:SourceAccount`, avoiding overly broad `sts:AssumeRole` trust relationships.",
+  "Risk": "Unrestricted service-principal trust lets outsiders trigger a **cross-service confused deputy**, causing unintended `sts:AssumeRole`.\nThis can enable data exfiltration, unauthorized changes, and lateral movement, impacting **confidentiality** and **integrity**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html",
+    "https://aws.amazon.com/blogs/security/how-to-set-up-least-privilege-access-to-your-encrypted-amazon-sqs-queue/",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html#cross-service-confused-deputy-prevention",
+    "https://docs.aws.amazon.com/textract/latest/dg/cross-service-confused-deputy-prevention.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws iam update-assume-role-policy --role-name <example_resource_name> --policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"<service>.amazonaws.com\"},\"Action\":\"sts:AssumeRole\",\"Condition\":{\"StringEquals\":{\"aws:SourceAccount\":\"<ACCOUNT_ID>\"}}}]}'",
+      "NativeIaC": "```yaml\n# CloudFormation: IAM role trust policy with confused deputy protection\nResources:\n  <example_resource_name>:\n    Type: AWS::IAM::Role\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: <service>.amazonaws.com\n            Action: sts:AssumeRole\n            Condition:\n              StringEquals:\n                aws:SourceAccount: <ACCOUNT_ID>  # CRITICAL: restricts the service to calls from this account to prevent cross-service confused deputy\n```",
+      "Other": "1. In the AWS console, go to IAM > Roles\n2. Open <example_resource_name> and select the Trust relationships tab\n3. Click Edit trust policy\n4. In the statement for Principal Service \"<service>.amazonaws.com\", add a Condition block:\n   - StringEquals: aws:SourceAccount = <ACCOUNT_ID>\n5. Save changes\n6. Re-run the check to confirm the role now prevents cross-service confused deputy attacks",
+      "Terraform": "```hcl\n# IAM role trust policy with confused deputy protection\nresource \"aws_iam_role\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  # CRITICAL: Condition restricts service to this account to prevent cross-service confused deputy\n  assume_role_policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [\n      {\n        Effect    = \"Allow\"\n        Principal = { Service = \"<service>.amazonaws.com\" }\n        Action    = \"sts:AssumeRole\"\n        Condition = {\n          StringEquals = { \"aws:SourceAccount\" = \"<ACCOUNT_ID>\" }\n        }\n      }\n    ]\n  })\n}\n```"
     },
     "Recommendation": {
-      "Text": "To mitigate cross-service confused deputy attacks, it's recommended to use the aws:SourceArn and aws:SourceAccount global condition context keys in your IAM role trust policies. If the role doesn't support these fields, consider implementing alternative security measures, such as defining more restrictive resource-based policies or using service-specific trust policies, to limit the role's permissions and exposure. For detailed guidance, refer to AWS's documentation on preventing cross-service confused deputy issues.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html#cross-service-confused-deputy-prevention"
+      "Text": "Constrain service-role trust to expected callers using `aws:SourceArn`/`aws:SourceAccount` to bind service principals to specific resources or accounts. If unsupported, apply equivalent limits in resource-based policies or org-level controls. Apply **least privilege** and review trust relationships regularly.",
+      "Url": "https://hub.prowler.com/check/iam_role_cross_service_confused_deputy_prevention"
     }
   },
   "Categories": [
+    "identity-access",
     "trust-boundaries"
   ],
   "DependsOn": [],

prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.metadata.json

@@ -1,34 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "iam_root_credentials_management_enabled",
-  "CheckTitle": "Ensure centralized root credentials management is enabled",
-  "CheckType": [],
+  "CheckTitle": "AWS Organization has centralized root credentials management enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "Other",
-  "Description": "Checks if centralized management of root credentials for member accounts in AWS Organizations is enabled. This ensures that root credentials are managed centrally, reducing the risk of unauthorized access or mismanagement.",
-  "Risk": "Without centralized root credentials management, member accounts retain full control over their root user credentials, increasing the risk of credential misuse, mismanagement, or compromise.",
-  "RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user-access-management",
+  "ResourceGroup": "IAM",
+  "Description": "**AWS Organizations** uses **centralized root credentials management** to control root user credentials across member accounts.\n\nThis finding evaluates whether the organization has enabled the `RootCredentialsManagement` feature to centrally govern presence and recovery of root passwords, access keys, signing certificates, and MFA.",
+  "Risk": "Without central control, member accounts can retain or recover long-term root credentials, weakening **confidentiality** and **integrity**.\n\nThreats include:\n- Account takeover via root email recovery\n- Persistent access through root keys\n- Unfixable lockouts from misconfigured policies\n- Bypass of **separation of duties**",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user-access-management",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws iam enable-organizations-root-credentials-management",
       "NativeIaC": "",
-      "Other": "",
+      "Other": "1. Sign in to the AWS Management Console with the management account and open IAM\n2. In the left pane, select \"Root access management\" and click \"Enable\"\n3. In \"Capabilities to enable\", select only \"Root credentials management\"\n4. Click \"Enable\" to apply\n5. If prompted, enable trusted access for IAM in AWS Organizations and retry step 3",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Enable centralized management of root access for member accounts using the CLI or IAM console.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html"
+      "Text": "Enable centralized root access with **root credentials management** and assign a **delegated administrator**.\n\nApply **least privilege** and **separation of duties** by deleting long-term root credentials in members, limiting privileged tasks to short-lived sessions, enforcing **MFA**, and auditing root-related activity for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/iam_root_credentials_management_enabled"
     }
   },
-  "Categories": [],
-  "DependsOn": [],
-  "RelatedTo": [
-    "iam_root_hardware_mfa_enabled",
-    "iam_root_mfa_enabled",
-    "iam_no_root_access_key"
+  "Categories": [
+    "identity-access",
+    "secrets"
   ],
+  "DependsOn": [],
+  "RelatedTo": [],
   "Notes": "This check skips findings for member accounts as they cannot execute the ListOrganizationsFeatures API call, which is restricted to the management account or delegated administrators."
 }

prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.metadata.json

@@ -1,33 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "iam_root_hardware_mfa_enabled",
-  "CheckTitle": "Ensure only hardware MFA is enabled for the root account",
+  "CheckTitle": "Root account has a hardware MFA device enabled",
   "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS AWS Foundations Benchmark"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "AwsIamUser",
-  "Description": "Ensure only hardware MFA is enabled for the root account",
-  "Risk": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled when a user signs in to an AWS website they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2 it is recommended that the root account be protected with only a hardware MFA.",
+  "ResourceGroup": "IAM",
+  "Description": "**AWS root user** credentials are assessed for **MFA status** and device type. The check detects whether MFA is absent or implemented with a **virtual device** instead of **hardware MFA** on the root user, and notes when centralized root credential management is in effect.",
+  "Risk": "Without **hardware MFA** on the root user:\n- No MFA: stolen password/keys enable full account takeover.\n- Virtual MFA: device compromise or backup restoration weakens second-factor assurance.\nAn attacker could delete resources, change policies, and disable logging, harming **confidentiality**, **integrity**, and **availability**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/root-hardware-mfa.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
       "NativeIaC": "",
-      "Other": "",
+      "Other": "1. Sign in to the AWS Management Console as the root user\n2. Open My Security Credentials: https://console.aws.amazon.com/iam/home?#/security_credentials\n3. In the Multi-factor authentication (MFA) section, choose Activate/Assign MFA\n4. Select a hardware option (Security key or Hardware TOTP token) and complete the prompts (for TOTP: enter the device serial and two consecutive codes)\n5. After the hardware MFA is added, locate any Virtual MFA device listed for root and Deactivate/Remove it\n6. Confirm only the hardware MFA remains assigned",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Using IAM console navigate to Dashboard and expand Activate MFA on your root account. If using AWS Organizations, consider enabling Centralized Root Management and removing individual root credentials.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa"
+      "Text": "Require a **hardware MFA token** for the root user and remove any virtual MFA. Apply **least privilege**: avoid using root, disable access keys, and eliminate long-term credentials. In organizations, **centralize root management**. Keep a controlled break-glass process with strict recovery checks and continuous monitoring.",
+      "Url": "https://hub.prowler.com/check/iam_root_hardware_mfa_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.metadata.json

@@ -1,33 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "iam_root_mfa_enabled",
-  "CheckTitle": "Ensure MFA is enabled for the root account",
+  "CheckTitle": "Root account has MFA enabled",
   "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS AWS Foundations Benchmark"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "AwsIamUser",
-  "Description": "Ensure MFA is enabled for the root account",
-  "Risk": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled when a user signs in to an AWS website they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. When virtual MFA is used for root accounts it is recommended that the device used is NOT a personal device but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (non-personal virtual MFA) This lessens the risks of losing access to the MFA due to device loss / trade-in or if the individual owning the device is no longer employed at the company.",
+  "ResourceGroup": "IAM",
+  "Description": "**AWS root user** with active credentials is assessed for **MFA activation**. The evaluation considers whether the root identity has a password or access keys and whether **MFA is enabled**.\n\n*If centralized root access is enabled in Organizations, the presence of individual root credentials is also noted.*",
+  "Risk": "Without **MFA**, compromise of the root password or access keys can lead to full **account takeover**. An attacker with root can disable protections, steal or delete data, change billing, and create persistent admins, undermining confidentiality, integrity, and availability.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
       "NativeIaC": "",
-      "Other": "",
+      "Other": "1. Sign in to the AWS Management Console as the root user (choose \"Sign in as root user\" and enter the account email)\n2. Open the account menu (top right) and click \"Security credentials\"\n3. In \"Multi-factor authentication (MFA)\", choose \"Assign MFA device\" (or \"Activate MFA\")\n4. Select \"Authenticator app\" and click \"Next\"\n5. Scan the QR code with your authenticator app and enter two consecutive MFA codes\n6. Click \"Add MFA\" (or \"Assign MFA\") to complete",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Using IAM console navigate to Dashboard and expand Activate MFA on your root account. If using AWS Organizations, consider enabling Centralized Root Management and removing individual root credentials.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa"
+      "Text": "Enable **MFA** for the root user, preferably **hardware-based** or a dedicated, managed device. Remove root access keys and avoid using root for daily tasks. Apply **least privilege** with IAM Identity Center for admins, and use Organizations to **centralize root access** and eliminate long-lived root credentials.",
+      "Url": "https://hub.prowler.com/check/iam_root_mfa_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.metadata.json

@@ -1,33 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "iam_rotate_access_key_90_days",
-  "CheckTitle": "Ensure access keys are rotated every 90 days or less",
+  "CheckTitle": "IAM user does not have active access keys older than 90 days",
   "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS AWS Foundations Benchmark"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "AwsIamAccessKey",
-  "Description": "Ensure access keys are rotated every 90 days or less",
-  "Risk": "Access keys consist of an access key ID and secret access key which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI)- Tools for Windows PowerShell- the AWS SDKs- or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.",
+  "ResourceType": "AwsIamUser",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM user access keys** are assessed via the credential report. For each active key, the `last_rotated` timestamp is compared to `90 days`; keys exceeding this age are identified. Users without keys or with only recent rotations are noted.",
+  "Risk": "Long-lived access keys widen the attack window. If a key is leaked in code, logs, or tooling, lack of rotation keeps it valid for abuse, enabling unauthorized API calls, data exfiltration, and tampering. This degrades **confidentiality** and **integrity** and can impact **availability** and cost through destructive or excessive operations.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/access-keys-rotated-90-days.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
+      "CLI": "aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive",
       "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "Other": "1. Open the IAM console and go to Users\n2. Select the affected user\n3. Open the Security credentials tab\n4. Under Access keys, find any key older than 90 days\n5. Click Actions > Deactivate (or Delete) for that key\n6. Repeat for any other active keys older than 90 days",
+      "Terraform": "```hcl\nresource \"aws_iam_access_key\" \"<example_resource_name>\" {\n  user   = \"<example_resource_name>\"\n  status = \"Inactive\" # Critical: disables the access key to ensure no active key is older than 90 days\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use the credential report to  ensure  access_key_X_last_rotated  is less than 90 days ago.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html"
+      "Text": "Apply **least privilege** and limit static credentials:\n- Rotate active access keys at or before `90 days`\n- Prefer **IAM roles** with short-lived tokens\n- Maintain only one active key during rotation; delete the old one\n- Monitor `last_used` and remove dormant keys\n- Automate alerts and periodic reviews of key age",
+      "Url": "https://hub.prowler.com/check/iam_rotate_access_key_90_days"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "secrets"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.metadata.json

@@ -1,33 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "iam_securityaudit_role_created",
-  "CheckTitle": "Ensure a Security Audit role has been created to conduct security audits",
+  "CheckTitle": "At least one IAM role has the SecurityAudit AWS managed policy attached",
   "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS AWS Foundations Benchmark"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "low",
-  "ResourceType": "AwsIamRole",
-  "Description": "Ensure a Security Audit role has been created to conduct security audits",
-  "Risk": "Creating an IAM role with a security audit policy provides a clear separation of duties between the security team and other teams within the organization. This helps to ensure that security-related activities are performed by authorized individuals with the appropriate expertise and access permissions.",
+  "ResourceType": "AwsIamPolicy",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM roles** with the AWS managed `SecurityAudit` policy (`arn:aws:iam::aws:policy/SecurityAudit`) are identified. The focus is on whether a role exists that grants read-only visibility into security-relevant configuration across AWS services.",
+  "Risk": "Without a dedicated **read-only audit role**, security teams lack safe visibility into configs and logs, enabling **undetected misconfigurations**, slower incident triage, and reliance on over-privileged access. This erodes **confidentiality** and **integrity** by letting exposure persist unnoticed.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/iam_example_iam_AttachRolePolicy_section.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws iam attach-role-policy --role-name <example_resource_name> --policy-arn arn:aws:iam::aws:policy/SecurityAudit",
+      "NativeIaC": "```yaml\n# CloudFormation: create a minimal IAM role with SecurityAudit attached\nResources:\n  <example_resource_name>:\n    Type: AWS::IAM::Role\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              AWS: arn:aws:iam::<example_account_id>:root\n            Action: sts:AssumeRole\n      ManagedPolicyArns:\n        - arn:aws:iam::aws:policy/SecurityAudit  # CRITICAL: attaches the AWS managed SecurityAudit policy to this role, satisfying the check\n```",
+      "Other": "1. In the AWS Console, go to IAM > Roles\n2. Open any existing role that is appropriate for read-only security auditing\n3. Click \"Add permissions\" > \"Attach policies\"\n4. Search for \"SecurityAudit\", check the box for the AWS managed policy named SecurityAudit\n5. Click \"Add permissions\" to attach the policy (the account now has at least one role with SecurityAudit attached)",
+      "Terraform": "```hcl\n# Minimal IAM role plus attachment of the AWS managed SecurityAudit policy\nresource \"aws_iam_role\" \"example\" {\n  name               = \"<example_resource_name>\"\n  assume_role_policy = <<POLICY\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": { \"AWS\": \"arn:aws:iam::<example_account_id>:root\" },\n      \"Action\": \"sts:AssumeRole\"\n    }\n  ]\n}\nPOLICY\n}\n\nresource \"aws_iam_role_policy_attachment\" \"security_audit\" {\n  role       = aws_iam_role.example.name\n  policy_arn = \"arn:aws:iam::aws:policy/SecurityAudit\" # CRITICAL: attaches SecurityAudit to the role to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Create an IAM role for conduct security audits with AWS.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor"
+      "Text": "Establish a dedicated **audit role** and attach the AWS managed `SecurityAudit` policy. Enforce **least privilege** and **separation of duties**: restrict who can assume it, require **MFA**, monitor usage, and avoid write permissions. Prefer **federated access** and regularly review and rotate access.",
+      "Url": "https://hub.prowler.com/check/iam_securityaudit_role_created"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.metadata.json

@@ -1,33 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "iam_support_role_created",
-  "CheckTitle": "Ensure a support role has been created to manage incidents with AWS Support",
+  "CheckTitle": "At least one IAM role has the AWSSupportAccess managed policy attached",
   "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS AWS Foundations Benchmark"
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
   "ResourceType": "AwsIamRole",
-  "Description": "Ensure a support role has been created to manage incidents with AWS Support",
-  "Risk": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.",
+  "ResourceGroup": "IAM",
+  "Description": "Presence of an **IAM role** that has the AWS managed `AWSSupportAccess` policy attached, designating a support role for interacting with **AWS Support Center** and related tooling.",
+  "Risk": "Without a dedicated support role:\n- Case creation and escalation can be delayed, prolonging outages (**availability**)\n- Teams may use admin/root, increasing blast radius (**confidentiality/integrity**)\n- Audit trails of support actions are weaker, hindering investigations",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/awssupport/latest/user/using-service-linked-roles-sup.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/support-role.html",
+    "https://icompaas.freshdesk.com/support/solutions/articles/62000081064-ensure-a-support-role-has-been-created-to-manage-incidents-with-aws-support",
+    "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportAccess.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws iam attach-role-policy --role-name <example_resource_name> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess",
+      "NativeIaC": "```yaml\n# CloudFormation: create a role with AWS Support access\nResources:\n  ExampleRole:\n    Type: AWS::IAM::Role\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              AWS: arn:aws:iam::<example_account_id>:user/<example_resource_name>\n            Action: sts:AssumeRole\n      ManagedPolicyArns:\n        - arn:aws:iam::aws:policy/AWSSupportAccess  # Critical: attaches AWS Support access so at least one role has this policy (PASS)\n```",
+      "Other": "1. In the AWS console, go to IAM > Roles\n2. Select any existing role you can use for support access\n3. Click Add permissions (or Attach policies)\n4. Search for \"AWSSupportAccess\" and select it\n5. Click Attach policies to save\n\nThis immediately ensures at least one role has the AWSSupportAccess managed policy (PASS).",
+      "Terraform": "```hcl\n# IAM role with AWS Support access\nresource \"aws_iam_role\" \"example_resource_name\" {\n  name               = \"example_resource_name\"\n  assume_role_policy = jsonencode({\n    Version   = \"2012-10-17\",\n    Statement = [{\n      Effect    = \"Allow\",\n      Principal = { AWS = \"arn:aws:iam::<example_account_id>:user/<example_resource_name>\" },\n      Action    = \"sts:AssumeRole\"\n    }]\n  })\n\n  managed_policy_arns = [\n    \"arn:aws:iam::aws:policy/AWSSupportAccess\"  # Critical: ensures this role has AWSSupportAccess (PASS)\n  ]\n}\n```"
     },
     "Recommendation": {
-      "Text": "Create an IAM role for managing incidents with AWS.",
-      "Url": "https://docs.aws.amazon.com/awssupport/latest/user/using-service-linked-roles-sup.html"
+      "Text": "Create a dedicated IAM role for AWS Support with `AWSSupportAccess` and:\n- Restrict who can assume it; require MFA and time-bound access\n- Enforce **least privilege** and **separation of duties**\n- Monitor usage via audit logs and review assignments regularly",
+      "Url": "https://hub.prowler.com/check/iam_support_role_created"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "CAF Security Epic: IAM"

prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.metadata.json

@@ -1,31 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "iam_user_accesskey_unused",
-  "CheckTitle": "Ensure unused User Access Keys are disabled",
+  "CheckTitle": "IAM user does not have unused access keys older than 45 days",
   "CheckType": [
-    "Software and Configuration Checks"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
   ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsIamUser",
-  "Description": "Ensure unused User Access Keys are disabled",
-  "Risk": "To increase the security of your AWS account, remove IAM user credentials (that is, passwords and access keys) that are not needed. For example, when users leave your organization or no longer need AWS access.",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM users** are evaluated for **active access keys** whose `last-used` timestamp exceeds `max_unused_access_keys_days` (default `45`). Users without access keys, or whose keys were used within this window, are reported separately.",
+  "Risk": "Active yet unused keys expand the attack surface. If leaked, adversaries gain API access for data exfiltration, unauthorized changes, and resource abuse, harming **confidentiality**, **integrity**, and **availability**. Stale credentials also enable persistence and unexpected cost spikes.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html",
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/IAM/access-keys-rotated-45-days.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
+      "CLI": "aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive",
       "NativeIaC": "",
-      "Other": "",
+      "Other": "1. Sign in to the AWS console and open IAM\n2. Go to Users, select the affected user\n3. Open the Security credentials tab > Access keys\n4. For any key with Last used > 45 days, choose Deactivate (or Delete)\n5. Repeat for any additional unused keys over 45 days for the user",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Find the credentials that they were using and ensure that they are no longer operational. Ideally, you delete credentials if they are no longer needed. You can always recreate them at a later date if the need arises. At the very least, you should change the password or deactivate the access keys so that the former users no longer have access.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html"
+      "Text": "Disable or delete **unused access keys** promptly and prefer **IAM roles** with temporary credentials. Enforce **least privilege**, rotation, and time-bounded access. Monitor `last-used` metadata and automate deactivation of idle keys. Use federation/SSO to avoid long-lived user keys.",
+      "Url": "https://hub.prowler.com/check/iam_user_accesskey_unused"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "secrets"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.metadata.json

@@ -1,29 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "iam_user_administrator_access_policy",
-  "CheckTitle": "Ensure No IAM Users Have Administrator Access Policy",
-  "CheckType": [],
+  "CheckTitle": "IAM user does not have AdministratorAccess policy attached",
+  "CheckType": [
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "TTPs/Privilege Escalation"
+  ],
   "ServiceName": "iam",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "high",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
   "ResourceType": "AwsIamUser",
-  "Description": "This check ensures that no IAM users in your AWS account have the 'AdministratorAccess' policy attached. IAM users with this policy have unrestricted access to all AWS services and resources, which poses a significant security risk if misused.",
-  "Risk": "IAM users with administrator-level permissions can perform any action on any resource in your AWS environment. If these permissions are granted to users unnecessarily or to individuals without sufficient knowledge, it can lead to security vulnerabilities, data leaks, data loss, or unexpected charges.",
-  "RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html",
+  "ResourceGroup": "IAM",
+  "Description": "**IAM users** are evaluated for a direct attachment of the AWS managed policy `AdministratorAccess`. The finding identifies identities where this policy appears among the user's attached policies.",
+  "Risk": "Assigning an IAM user full admin rights concentrates power in long-lived credentials. If compromised, attackers gain:\n- **Confidentiality**: read/export all data\n- **Integrity**: change configs, policies, code\n- **Availability**: delete resources, disrupt services\nAlso enables persistence and uncontrolled spend.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/admin-permissions.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/admin-permissions.html",
+      "NativeIaC": "```yaml\n# CloudFormation: ensure IAM user does NOT have AdministratorAccess attached\nResources:\n  <example_resource_name>:\n    Type: AWS::IAM::User\n    Properties:\n      ManagedPolicyArns: []  # Critical: empty list ensures 'AdministratorAccess' is NOT attached to this user\n```",
+      "Other": "1. Sign in to the AWS Console and open IAM\n2. Go to Users and select the target user\n3. Open the Permissions tab\n4. In Attached policies (or Permissions policies), find AdministratorAccess\n5. Select it and click Detach policy (or Remove)\n6. Confirm to detach",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Replace the 'AdministratorAccess' policy with more specific permissions that follow the Principle of Least Privilege. Consider implementing IAM roles such as 'IAM Master' and 'IAM Manager' to manage permissions more securely.",
-      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
+      "Text": "Remove direct `AdministratorAccess` from users.\n- Apply **least privilege** with scoped policies\n- Use **federation** and **roles** for temporary admin access\n- Enforce **separation of duties** and approvals\n- Add guardrails (SCPs, permissions boundaries)\n- Require **MFA** and rotate any remaining long-lived credentials",
+      "Url": "https://hub.prowler.com/check/iam_user_administrator_access_policy"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""