sraverify 0.1.0__py3-none-any.whl

sraverify/services/cloudtrail/checks/sra_cloudtrail_02.py

@@ -0,0 +1,99 @@
+"""
+SRA-CLOUDTRAIL-02: Organization CloudTrail KMS Encryption.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_02(CloudTrailCheck):
+    """Check if organization trails are encrypted with KMS."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-02"
+        self.check_name = "Organization trail is encrypted with KMS"
+        self.account_type = "management"
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies that your organization trail is encrypted with a KMS key. "
+            "Log files delivered by CloudTrail to your bucket should be encrypted by using SSE-KMS. "
+            "This is selected by default in the console but can be altered by users. With SSE-KMS "
+            "you create and manage the KMS key yourself with the ability to manage permissions on "
+            "who can use the key. For a user to read log files they must have read permissions to "
+            "the bucket and have permissions that allows decrypt permission on the key applied by "
+            "the KMS key policy."
+        )
+        self.check_logic = (
+            "Check if organization trails have KmsKeyId configured."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get organization trails
+        org_trails = self.get_organization_trails()
+        
+        if not org_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"organization/{self.account_id}",
+                    checked_value="KmsKeyId: not empty",
+                    actual_value="No organization trails found",
+                    remediation=(
+                        "Create an organization trail with KMS encryption in the management account using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name org-trail --is-organization-trail --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--kms-key-id arn:aws:kms:{self.regions[0] if self.regions else 'us-east-1'}:{self.account_id}:key/YOUR_KMS_KEY_ID "
+                        f"--is-multi-region-trail --region {self.regions[0] if self.regions else 'us-east-1'}"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each organization trail for KMS encryption
+        for trail in org_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            kms_key_id = trail.get('KmsKeyId', '')
+            home_region = trail.get('HomeRegion', 'Unknown')
+            
+            if kms_key_id:
+                # Trail is encrypted with KMS
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="KmsKeyId: not empty",
+                        actual_value=f"Organization trail '{trail_name}' is encrypted with KMS key: {kms_key_id}",
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail is not encrypted with KMS
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="KmsKeyId: not empty",
+                        actual_value=f"Organization trail '{trail_name}' is not encrypted with KMS",
+                        remediation=(
+                            f"Update the organization trail '{trail_name}' to use KMS encryption using the AWS CLI command: "
+                            f"aws cloudtrail update-trail --name {trail_name} "
+                            f"--kms-key-id arn:aws:kms:{home_region}:{self.account_id}:key/YOUR_KMS_KEY_ID "
+                            f"--region {home_region}"
+                        )
+                    )
+                )
+        
+        return findings

sraverify/services/cloudtrail/checks/sra_cloudtrail_03.py

@@ -0,0 +1,94 @@
+"""
+SRA-CLOUDTRAIL-03: Organization CloudTrail Log File Validation.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_03(CloudTrailCheck):
+    """Check if organization trails have log file validation enabled."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-03"
+        self.check_name = "Organization trail has Log File validation enabled"
+        self.account_type = "management"
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies that your organization trail has log file validation enabled. "
+            "Validated log files are especially valuable in security and forensic investigations. "
+            "CloudTrail log file integrity validation uses industry standard algorithms: SHA-256 for "
+            "hashing and SHA-256 with RSA for digital signing. This makes it computationally unfeasible "
+            "to modify, delete or forge CloudTrail log files without detection."
+        )
+        self.check_logic = (
+            "Check if organization trails have LogFileValidationEnabled set to true."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get organization trails
+        org_trails = self.get_organization_trails()
+        
+        if not org_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"organization/{self.account_id}",
+                    checked_value="LogFileValidationEnabled: true",
+                    actual_value="No organization trails found",
+                    remediation=(
+                        "Create an organization trail with log file validation in the management account using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name org-trail --is-organization-trail --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--enable-log-file-validation --is-multi-region-trail --region {self.regions[0] if self.regions else 'us-east-1'}"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each organization trail for log file validation
+        for trail in org_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            log_file_validation_enabled = trail.get('LogFileValidationEnabled', False)
+            home_region = trail.get('HomeRegion', 'Unknown')
+            
+            if log_file_validation_enabled:
+                # Trail has log file validation enabled
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="LogFileValidationEnabled: true",
+                        actual_value=f"Organization trail '{trail_name}' has log file validation enabled",
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail does not have log file validation enabled
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="LogFileValidationEnabled: true",
+                        actual_value=f"Organization trail '{trail_name}' does not have log file validation enabled",
+                        remediation=(
+                            f"Update the organization trail '{trail_name}' to enable log file validation using the AWS CLI command: "
+                            f"aws cloudtrail update-trail --name {trail_name} --enable-log-file-validation --region {home_region}"
+                        )
+                    )
+                )
+        
+        return findings

sraverify/services/cloudtrail/checks/sra_cloudtrail_04.py

@@ -0,0 +1,92 @@
+"""
+SRA-CLOUDTRAIL-04: Organization CloudTrail Multi-Region Configuration.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_04(CloudTrailCheck):
+    """Check if organization trails are configured as multi-region trails."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-04"
+        self.check_name = "Organization Trail is a multi-region trail"
+        self.account_type = "management"
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies whether the Organization trail is configured as a multi-region trail. "
+            "This helps with visibility across your entire AWS environment, even for AWS Regions where "
+            "you are not operating to ensure you detect any malicious and/or unauthorized activities."
+        )
+        self.check_logic = (
+            "Check if organization trails have IsMultiRegionTrail set to true."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get organization trails
+        org_trails = self.get_organization_trails()
+        
+        if not org_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"organization/{self.account_id}",
+                    checked_value="IsMultiRegionTrail: true",
+                    actual_value="No organization trails found",
+                    remediation=(
+                        "Create a multi-region organization trail in the management account using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name org-trail --is-organization-trail --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--is-multi-region-trail --region {self.regions[0] if self.regions else 'us-east-1'}"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each organization trail for multi-region configuration
+        for trail in org_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            is_multi_region_trail = trail.get('IsMultiRegionTrail', False)
+            home_region = trail.get('HomeRegion', 'Unknown')
+            
+            if is_multi_region_trail:
+                # Trail is a multi-region trail
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IsMultiRegionTrail: true",
+                        actual_value=f"Organization trail '{trail_name}' is configured as a multi-region trail",
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail is not a multi-region trail
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IsMultiRegionTrail: true",
+                        actual_value=f"Organization trail '{trail_name}' is not configured as a multi-region trail",
+                        remediation=(
+                            f"Update the organization trail '{trail_name}' to be a multi-region trail using the AWS CLI command: "
+                            f"aws cloudtrail update-trail --name {trail_name} --is-multi-region-trail --region {home_region}"
+                        )
+                    )
+                )
+        
+        return findings

sraverify/services/cloudtrail/checks/sra_cloudtrail_05.py

@@ -0,0 +1,106 @@
+"""
+SRA-CLOUDTRAIL-05: CloudTrail CloudWatch Logs Configuration.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_05(CloudTrailCheck):
+    """Check if trails have CloudWatch Logs configuration."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-05"
+        self.check_name = "CloudTrail has CloudWatch Logs configuration"
+        self.account_type = "management"
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies that CloudTrail has CloudWatch Logs configuration. "
+            "CloudWatch Logs enables you to centralize the CloudTrail logs from all your AWS accounts and "
+            "regions in the AWS Organization, to a single, highly scalable service. You can then easily "
+            "view them, search them for specific error codes or patterns, filter them based on specific "
+            "fields, or archive them securely for future analysis."
+        )
+        self.check_logic = (
+            "Check if trails have CloudWatchLogsLogGroupArn and CloudWatchLogsRoleArn configured."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get all trails
+        all_trails = self.describe_trails()
+        
+        if not all_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id="cloudtrail:global",
+                    checked_value="CloudWatchLogsLogGroupArn and CloudWatchLogsRoleArn: configured",
+                    actual_value="No CloudTrail trails found",
+                    remediation=(
+                        "Create a CloudTrail trail with CloudWatch Logs configuration using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name trail-with-cloudwatch --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--cloud-watch-logs-log-group-arn arn:aws:logs:{self.regions[0] if self.regions else 'us-east-1'}:{self.account_id}:log-group:CloudTrail/Logs:* "
+                        f"--cloud-watch-logs-role-arn arn:aws:iam::{self.account_id}:role/CloudTrail_CloudWatchLogs_Role"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each trail for CloudWatch Logs configuration
+        for trail in all_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            cloudwatch_logs_group_arn = trail.get('CloudWatchLogsLogGroupArn', '')
+            cloudwatch_logs_role_arn = trail.get('CloudWatchLogsRoleArn', '')
+            
+            # Get the home region from the trail
+            home_region = trail.get('HomeRegion', self.regions[0] if self.regions else 'us-east-1')
+            
+            if cloudwatch_logs_group_arn and cloudwatch_logs_role_arn:
+                # Trail has CloudWatch Logs configuration
+                resource_id = f"{cloudwatch_logs_group_arn},{cloudwatch_logs_role_arn}"
+                
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=resource_id,
+                        checked_value="CloudWatchLogsLogGroupArn and CloudWatchLogsRoleArn: configured",
+                        actual_value=(
+                            f"CloudTrail '{trail_name}' has CloudWatch Logs configuration: "
+                            f"CloudWatch Logs Group ARN: {cloudwatch_logs_group_arn}, "
+                            f"CloudWatch Logs Role ARN: {cloudwatch_logs_role_arn}"
+                        ),
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail does not have CloudWatch Logs configuration
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="CloudWatchLogsLogGroupArn and CloudWatchLogsRoleArn: configured",
+                        actual_value=f"CloudTrail '{trail_name}' does not have CloudWatch Logs configuration",
+                        remediation=(
+                            f"Configure CloudTrail '{trail_name}' to use CloudWatch Logs using the AWS CLI command: "
+                            f"aws cloudtrail update-trail --name {trail_name} "
+                            f"--cloud-watch-logs-log-group-arn arn:aws:logs:{home_region}:{self.account_id}:log-group:CloudTrail/Logs:* "
+                            f"--cloud-watch-logs-role-arn arn:aws:iam::{self.account_id}:role/CloudTrail_CloudWatchLogs_Role"
+                        )
+                    )
+                )
+        
+        return findings

sraverify/services/cloudtrail/checks/sra_cloudtrail_06.py

@@ -0,0 +1,93 @@
+"""
+SRA-CLOUDTRAIL-06: Organization CloudTrail Global Service Events.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_06(CloudTrailCheck):
+    """Check if organization trails are configured to publish events from global services."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-06"
+        self.check_name = "Organization trail is configured to publish events from global services"
+        self.account_type = "management"
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies that your organization trail is configured to publish event from AWS global services. "
+            "The organization trail should capture events from global services such as AWS IAM, AWS STS and Amazon CloudFront. "
+            "Trails created using CloudTrail console by default have global service event configured but if you are creating "
+            "trail with AWS CLI, AWS SDKs, or CloudTrail API you have to specify to included global services events."
+        )
+        self.check_logic = (
+            "Check if organization trails have IncludeGlobalServiceEvents set to true."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get organization trails
+        org_trails = self.get_organization_trails()
+        
+        if not org_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"organization/{self.account_id}",
+                    checked_value="IncludeGlobalServiceEvents: true",
+                    actual_value="No organization trails found",
+                    remediation=(
+                        "Create an organization trail with global service events in the management account using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name org-trail --is-organization-trail --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--include-global-service-events --is-multi-region-trail --region {self.regions[0] if self.regions else 'us-east-1'}"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each organization trail for global service events
+        for trail in org_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            include_global_service_events = trail.get('IncludeGlobalServiceEvents', False)
+            home_region = trail.get('HomeRegion', 'Unknown')
+            
+            if include_global_service_events:
+                # Trail includes global service events
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IncludeGlobalServiceEvents: true",
+                        actual_value=f"Organization trail '{trail_name}' is configured to publish events from global services",
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail does not include global service events
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IncludeGlobalServiceEvents: true",
+                        actual_value=f"Organization trail '{trail_name}' is not configured to publish events from global services",
+                        remediation=(
+                            f"Update the organization trail '{trail_name}' to include global service events using the AWS CLI command: "
+                            f"aws cloudtrail update-trail --name {trail_name} --include-global-service-events --region {home_region}"
+                        )
+                    )
+                )
+        
+        return findings

sraverify/services/cloudtrail/checks/sra_cloudtrail_07.py

@@ -0,0 +1,96 @@
+"""
+SRA-CLOUDTRAIL-07: Organization CloudTrail Active Logging.
+"""
+from typing import List, Dict, Any
+from sraverify.services.cloudtrail.base import CloudTrailCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CLOUDTRAIL_07(CloudTrailCheck):
+    """Check if organization trails are actively publishing events."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CLOUDTRAIL-07"
+        self.check_name = "Organization trail is actively publishing events"
+        self.account_type = "management"
+        self.severity = "HIGH"
+        self.description = (
+            "This check verifies that your organization trail is running and actively logging events. "
+            "If a trail is modified to stop logging, accidently or by malicious user, you will not have "
+            "visibility into any API activity across your AWS environment."
+        )
+        self.check_logic = (
+            "Check if organization trails have IsLogging set to true in their status."
+        )
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get organization trails
+        org_trails = self.get_organization_trails()
+        
+        if not org_trails:
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"organization/{self.account_id}",
+                    checked_value="IsLogging: true",
+                    actual_value="No organization trails found",
+                    remediation=(
+                        "Create an organization trail in the management account using the AWS CLI command: "
+                        f"aws cloudtrail create-trail --name org-trail --is-organization-trail --s3-bucket-name cloudtrail-logs-{self.account_id} "
+                        f"--is-multi-region-trail --region {self.regions[0] if self.regions else 'us-east-1'} && "
+                        f"aws cloudtrail start-logging --name org-trail --region {self.regions[0] if self.regions else 'us-east-1'}"
+                    )
+                )
+            )
+            return findings
+        
+        # Check each organization trail for active logging
+        for trail in org_trails:
+            trail_name = trail.get('Name', 'Unknown')
+            trail_arn = trail.get('TrailARN', 'Unknown')
+            home_region = trail.get('HomeRegion', 'Unknown')
+            
+            # Get trail status to check if logging is enabled
+            trail_status = self.get_trail_status(home_region, trail_arn)
+            is_logging = trail_status.get('IsLogging', False)
+            
+            if is_logging:
+                # Trail is actively logging
+                findings.append(
+                    self.create_finding(
+                        status="PASS",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IsLogging: true",
+                        actual_value=f"Organization trail '{trail_name}' is actively logging events",
+                        remediation="No remediation needed"
+                    )
+                )
+            else:
+                # Trail is not actively logging
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region="global",
+                        resource_id=trail_arn,
+                        checked_value="IsLogging: true",
+                        actual_value=f"Organization trail '{trail_name}' is not actively logging events",
+                        remediation=(
+                            f"Start logging for the organization trail '{trail_name}' using the AWS CLI command: "
+                            f"aws cloudtrail start-logging --name {trail_name} --region {home_region}"
+                        )
+                    )
+                )
+        
+        return findings