sraverify 0.1.0__py3-none-any.whl

sraverify/services/config/checks/sra_config_06.py

@@ -0,0 +1,194 @@
+"""
+SRA-CONFIG-06: AWS Config Conformance Packs.
+"""
+from typing import List, Dict, Any
+import json
+from sraverify.services.config.base import ConfigCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CONFIG_06(ConfigCheck):
+    """Check if AWS Config delivery channel S3 bucket is centralized in Log Archive account."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CONFIG-06"
+        self.check_name = "AWS Config delivery channel S3 bucket is centralized in Log Archive account"
+        self.account_type = "application"  # This check applies to management account
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies that the AWS Config delivery channel S3 bucket is centralized in "
+            "Log Archive account. Security Tooling provides central visibility and monitoring of AWS "
+            "Organization wide resource configuration."
+        )
+        self.check_logic = (
+            "Checks if AWS Config delivery channel S3 bucket is owned by the Log Archive account."
+        )
+        self.resource_type = "AWS::Config::DeliveryChannel"
+        # Initialize log archive account attribute
+        self._log_archive_accounts = None
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Check if Log Archive account ID is provided
+        if not hasattr(self, '_log_archive_accounts') or not self._log_archive_accounts:
+            findings.append(
+                self.create_finding(
+                    status="ERROR",
+                    region="global",
+                    resource_id="config:global",
+                    checked_value="S3 bucket owned by Log Archive account",
+                    actual_value="Log Archive Account ID not provided",
+                    remediation="Provide the Log Archive account ID using the --log-archive-account parameter"
+                )
+            )
+            return findings
+        
+        # Use the first log archive account if multiple are provided
+        log_archive_account = self._log_archive_accounts[0]
+        logger.debug(f"Using Log Archive account: {log_archive_account}")
+        
+        if not self.regions:
+            findings.append(
+                self.create_finding(
+                    status="ERROR",
+                    region="global",
+                    resource_id="config:global",
+                    checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                    actual_value="No regions specified for check",
+                    remediation="Specify at least one region when running the check"
+                )
+            )
+            return findings
+        
+        # Check each region for delivery channels
+        for region in self.regions:
+            # Get delivery channels for the region
+            channels = self.get_delivery_channels(region)
+            
+            if not channels:
+                # No delivery channel found in this region
+                findings.append(
+                    self.create_finding(
+                        status="FAIL",
+                        region=region,
+                        resource_id=f"arn:aws:config:{region}:{self.account_id}:deliveryChannel/default",
+                        checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                        actual_value="No delivery channel found in this region",
+                        remediation=(
+                            f"Create a delivery channel in {region} using: aws configservice put-delivery-channel "
+                            f"--delivery-channel name=default,s3BucketName=aws-controltower-logs-{log_archive_account}-{region} "
+                            f"--region {region}"
+                        )
+                    )
+                )
+                continue
+            
+            # Check each delivery channel
+            for channel in channels:
+                channel_name = channel.get('name', 'default')
+                bucket_name = channel.get('s3BucketName', '')
+                
+                if not bucket_name:
+                    # No S3 bucket configured
+                    findings.append(
+                        self.create_finding(
+                            status="FAIL",
+                            region=region,
+                            resource_id=f"arn:aws:config:{region}:{self.account_id}:deliveryChannel/{channel_name}",
+                            checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                            actual_value="No S3 bucket configured for delivery channel",
+                            remediation=(
+                                f"Update the delivery channel in {region} to use an S3 bucket in the Log Archive account: "
+                                f"aws configservice put-delivery-channel --delivery-channel name={channel_name},"
+                                f"s3BucketName=aws-controltower-logs-{log_archive_account}-{region} --region {region}"
+                            )
+                        )
+                    )
+                    continue
+                
+                # Check if the bucket name contains the Log Archive account ID
+                # This is a common pattern for AWS Control Tower and other AWS managed solutions
+                bucket_owner_found = False
+                
+                # Check for common bucket naming patterns
+                patterns_to_check = [
+                    f"aws-controltower-logs-{log_archive_account}",  # AWS Control Tower pattern
+                    f"config-bucket-{log_archive_account}",          # Common custom pattern
+                    f"aws-config-{log_archive_account}",             # Another common pattern
+                    f"config-{log_archive_account}",                 # Simple pattern
+                    f"-{log_archive_account}-"                       # Generic pattern (account ID in the middle)
+                ]
+                
+                for pattern in patterns_to_check:
+                    if pattern in bucket_name:
+                        bucket_owner_found = True
+                        break
+                
+                if bucket_owner_found:
+                    # Bucket name contains the Log Archive account ID, assume it's owned by the Log Archive account
+                    findings.append(
+                        self.create_finding(
+                            status="PASS",
+                            region=region,
+                            resource_id=f"arn:aws:config:{region}:{self.account_id}:deliveryChannel/{channel_name}",
+                            checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                            actual_value=f"Delivery channel S3 bucket '{bucket_name}' is owned by the Log Archive account {log_archive_account}",
+                            remediation="No remediation needed"
+                        )
+                    )
+                else:
+                    # Try to check if the bucket is in another region but still owned by Log Archive
+                    # For example, a bucket in us-east-1 might be used by a delivery channel in us-east-2
+                    cross_region_match = False
+                    
+                    for other_region in self.regions:
+                        if other_region != region and f"-{other_region}" in bucket_name:
+                            # The bucket name contains another region, check if it also contains the Log Archive account ID
+                            for pattern in patterns_to_check:
+                                if pattern in bucket_name:
+                                    cross_region_match = True
+                                    break
+                            
+                            if cross_region_match:
+                                break
+                    
+                    if cross_region_match:
+                        # Bucket is in another region but still owned by Log Archive
+                        findings.append(
+                            self.create_finding(
+                                status="PASS",
+                                region=region,
+                                resource_id=f"arn:aws:config:{region}:{self.account_id}:deliveryChannel/{channel_name}",
+                                checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                                actual_value=f"Delivery channel S3 bucket '{bucket_name}' is owned by the Log Archive account {log_archive_account} (cross-region bucket)",
+                                remediation="No remediation needed"
+                            )
+                        )
+                    else:
+                        # Bucket name doesn't contain the Log Archive account ID
+                        findings.append(
+                            self.create_finding(
+                                status="FAIL",
+                                region=region,
+                                resource_id=f"arn:aws:config:{region}:{self.account_id}:deliveryChannel/{channel_name}",
+                                checked_value=f"S3 bucket owned by Log Archive account {log_archive_account}",
+                                actual_value=f"Delivery channel S3 bucket '{bucket_name}' does not appear to be owned by the Log Archive account {log_archive_account} based on the bucket name",
+                                remediation=(
+                                    f"1. Create an S3 bucket in the Log Archive account {log_archive_account}. "
+                                    f"2. Update the delivery channel in {region} to use the new S3 bucket: "
+                                    f"aws configservice put-delivery-channel --delivery-channel name={channel_name},"
+                                    f"s3BucketName=aws-controltower-logs-{log_archive_account}-{region} --region {region}"
+                                )
+                            )
+                        )
+        
+        return findings

sraverify/services/config/checks/sra_config_07.py

@@ -0,0 +1,162 @@
+"""
+SRA-CONFIG-07: AWS Config Aggregator.
+"""
+from typing import List, Dict, Any
+from sraverify.services.config.base import ConfigCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CONFIG_07(ConfigCheck):
+    """Check if Config administration for the AWS Organization has a delegated administrator."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CONFIG-07"
+        self.check_name = "Config administration for the AWS Organization has a delegated administrator"
+        self.account_type = "management"  # This check applies to management account
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies whether Config service administration for your AWS Organization "
+            "is delegated out of the AWS Organization management account."
+        )
+        self.check_logic = (
+            "Checks if a delegated administrator exists for the Config service using the "
+            "list-delegated-administrators API with service principals config.amazonaws.com "
+            "and config-multiaccountsetup.amazonaws.com."
+        )
+        self.resource_type = "AWS::Organizations::Account"
+        # Initialize parameters as an empty dict
+        self.params = {}
+    
+    def initialize(self, session, regions=None, **kwargs):
+        """
+        Initialize check with AWS session, regions, and parameters.
+        
+        Args:
+            session: AWS session to use for the check
+            regions: List of AWS regions to check
+            **kwargs: Additional parameters for the check
+        """
+        super().initialize(session, regions)
+        # Store parameters
+        self.params = kwargs
+        logger.debug(f"Initialized {self.check_id} with parameters: {self.params}")
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Get delegated administrators for both Config service principals
+        delegated_admins = self.get_delegated_administrators()
+        
+        if not delegated_admins:
+            # No delegated administrator found for either service principal
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id="delegated-admin/none",
+                    checked_value="Delegated administrator exists for Config service",
+                    actual_value="No delegated administrator found for Config service",
+                    remediation=(
+                        "Register a delegated administrator for Config using both service principals:\n"
+                        "1. aws organizations register-delegated-administrator "
+                        "--service-principal config.amazonaws.com "
+                        "--account-id <AUDIT_ACCOUNT_ID>\n"
+                        "2. aws organizations register-delegated-administrator "
+                        "--service-principal config-multiaccountsetup.amazonaws.com "
+                        "--account-id <AUDIT_ACCOUNT_ID>"
+                    )
+                )
+            )
+            return findings
+        
+        # Group delegated admins by service principal to check coverage
+        service_principals_covered = set()
+        admin_accounts = {}
+        
+        for admin in delegated_admins:
+            admin_id = admin.get('Id', 'Unknown')
+            admin_name = admin.get('Name', 'Unknown')
+            
+            # In a real implementation, we would know which service principal this admin is for
+            # For now, we'll just track unique admin accounts
+            if admin_id not in admin_accounts:
+                admin_accounts[admin_id] = {
+                    'name': admin_name,
+                    'count': 1
+                }
+            else:
+                admin_accounts[admin_id]['count'] += 1
+        
+        # Check if we have full coverage of service principals
+        if len(delegated_admins) >= 2:
+            # We have at least one delegated admin for each service principal
+            for admin_id, info in admin_accounts.items():
+                admin_name = info['name']
+                service_count = info['count']
+                
+                if service_count == 2:
+                    # This account is delegated for both service principals
+                    findings.append(
+                        self.create_finding(
+                            status="PASS",
+                            region="global",
+                            resource_id=f"delegated-admin/{admin_id}",
+                            checked_value="Delegated administrator exists for Config service",
+                            actual_value=f"Config service has delegated administrator set to account {admin_id} ({admin_name}) for both service principals",
+                            remediation="No remediation needed"
+                        )
+                    )
+                else:
+                    # This account is delegated for only one service principal
+                    findings.append(
+                        self.create_finding(
+                            status="WARN",
+                            region="global",
+                            resource_id=f"delegated-admin/{admin_id}",
+                            checked_value="Delegated administrator exists for all Config service principals",
+                            actual_value=f"Config service has delegated administrator set to account {admin_id} ({admin_name}) but not for all required service principals",
+                            remediation=(
+                                f"Ensure the same account is registered as a delegated administrator for both Config service principals:\n"
+                                f"1. aws organizations register-delegated-administrator "
+                                f"--service-principal config.amazonaws.com "
+                                f"--account-id {admin_id}\n"
+                                f"2. aws organizations register-delegated-administrator "
+                                f"--service-principal config-multiaccountsetup.amazonaws.com "
+                                f"--account-id {admin_id}"
+                            )
+                        )
+                    )
+        else:
+            # We don't have full coverage of service principals
+            admin_list = []
+            for admin_id, info in admin_accounts.items():
+                admin_list.append(f"{admin_id} ({info['name']})")
+            
+            findings.append(
+                self.create_finding(
+                    status="WARN",
+                    region="global",
+                    resource_id=f"delegated-admin/{','.join(admin_accounts.keys())}",
+                    checked_value="Delegated administrator exists for all Config service principals",
+                    actual_value=f"Config service has delegated administrators ({', '.join(admin_list)}) but not for all required service principals",
+                    remediation=(
+                        "Ensure a delegated administrator is registered for both Config service principals:\n"
+                        "1. aws organizations register-delegated-administrator "
+                        "--service-principal config.amazonaws.com "
+                        "--account-id <AUDIT_ACCOUNT_ID>\n"
+                        "2. aws organizations register-delegated-administrator "
+                        "--service-principal config-multiaccountsetup.amazonaws.com "
+                        "--account-id <AUDIT_ACCOUNT_ID>"
+                    )
+                )
+            )
+        
+        return findings

sraverify/services/config/checks/sra_config_08.py

@@ -0,0 +1,185 @@
+"""
+SRA-CONFIG-08: AWS Config Aggregator Authorization.
+"""
+from typing import List, Dict, Any
+from sraverify.services.config.base import ConfigCheck
+from sraverify.core.logging import logger
+
+
+class SRA_CONFIG_08(ConfigCheck):
+    """Check if Config delegated admin account is the Security Tooling (Audit) account."""
+    
+    def __init__(self):
+        """Initialize the check."""
+        super().__init__()
+        self.check_id = "SRA-CONFIG-08"
+        self.check_name = "Config delegated admin account is the Security Tooling (Audit) account"
+        self.account_type = "management"  # This check applies to management account
+        self.severity = "MEDIUM"
+        self.description = (
+            "This check verifies whether Config delegated admin account is the audit account of your "
+            "AWS organization. The audit account is dedicated to operating security services, monitoring "
+            "AWS accounts, and automating security alerting and response."
+        )
+        self.check_logic = (
+            "Compares the delegated admin account ID with the provided audit account ID."
+        )
+        self.resource_type = "AWS::Organizations::Account"
+        # Initialize audit account attribute
+        self._audit_accounts = []
+    
+    def initialize(self, session, regions=None, **kwargs):
+        """
+        Initialize check with AWS session, regions, and parameters.
+        
+        Args:
+            session: AWS session to use for the check
+            regions: List of AWS regions to check
+            **kwargs: Additional parameters for the check
+        """
+        super().initialize(session, regions)
+        
+        # Extract audit-account from kwargs
+        if 'audit-account' in kwargs:
+            # Handle both single value and list
+            audit_account = kwargs['audit-account']
+            if isinstance(audit_account, list):
+                self._audit_accounts = audit_account
+            else:
+                self._audit_accounts = [audit_account]
+            logger.debug(f"Audit account IDs set to: {self._audit_accounts}")
+        else:
+            logger.debug("No Audit account ID provided in parameters")
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+        
+        Returns:
+            List of findings
+        """
+        findings = []
+        
+        # Check if Audit account ID is provided
+        if not self._audit_accounts:
+            findings.append(
+                self.create_finding(
+                    status="ERROR",
+                    region="global",
+                    resource_id="delegated-admin/none",
+                    checked_value="Delegated administrator is audit account",
+                    actual_value="No audit account ID provided",
+                    remediation="Provide the audit account ID using the --audit-account parameter"
+                )
+            )
+            return findings
+        
+        # Get delegated administrators for both Config service principals
+        delegated_admins = self.get_delegated_administrators()
+        
+        if not delegated_admins:
+            # No delegated administrator found for either service principal
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"delegated-admin/none",
+                    checked_value=f"Delegated administrator is audit account {', '.join(self._audit_accounts)}",
+                    actual_value=f"No delegated administrator found for Config service",
+                    remediation=(
+                        f"Register the audit account as a delegated administrator for Config using both service principals:\n"
+                        f"1. aws organizations register-delegated-administrator "
+                        f"--service-principal config.amazonaws.com "
+                        f"--account-id {self._audit_accounts[0]}\n"
+                        f"2. aws organizations register-delegated-administrator "
+                        f"--service-principal config-multiaccountsetup.amazonaws.com "
+                        f"--account-id {self._audit_accounts[0]}"
+                    )
+                )
+            )
+            return findings
+        
+        # Group delegated admins by account ID to check if the same account is used for both service principals
+        admin_accounts = {}
+        for admin in delegated_admins:
+            admin_id = admin.get('Id', 'Unknown')
+            admin_name = admin.get('Name', 'Unknown')
+            
+            if admin_id not in admin_accounts:
+                admin_accounts[admin_id] = {
+                    'name': admin_name,
+                    'count': 1
+                }
+            else:
+                admin_accounts[admin_id]['count'] += 1
+        
+        # Check if any of the audit accounts is a delegated administrator
+        audit_account_found = False
+        for audit_account_id in self._audit_accounts:
+            if audit_account_id in admin_accounts:
+                admin_info = admin_accounts[audit_account_id]
+                admin_name = admin_info['name']
+                service_count = admin_info['count']
+                
+                # Check if the audit account is delegated for both service principals
+                if service_count == 2:
+                    audit_account_found = True
+                    findings.append(
+                        self.create_finding(
+                            status="PASS",
+                            region="global",
+                            resource_id=f"delegated-admin/{audit_account_id}",
+                            checked_value=f"Delegated administrator is audit account {audit_account_id}",
+                            actual_value=f"Config delegated administrator is the audit account {audit_account_id} ({admin_name}) for both service principals",
+                            remediation="No remediation needed"
+                        )
+                    )
+                else:
+                    audit_account_found = True
+                    findings.append(
+                        self.create_finding(
+                            status="WARN",
+                            region="global",
+                            resource_id=f"delegated-admin/{audit_account_id}",
+                            checked_value=f"Delegated administrator is audit account {audit_account_id} for both service principals",
+                            actual_value=f"Config delegated administrator is the audit account {audit_account_id} ({admin_name}) but not for all required service principals",
+                            remediation=(
+                                f"Ensure the audit account is registered as a delegated administrator for both Config service principals:\n"
+                                f"1. aws organizations register-delegated-administrator "
+                                f"--service-principal config.amazonaws.com "
+                                f"--account-id {audit_account_id}\n"
+                                f"2. aws organizations register-delegated-administrator "
+                                f"--service-principal config-multiaccountsetup.amazonaws.com "
+                                f"--account-id {audit_account_id}"
+                            )
+                        )
+                    )
+        
+        # If no audit account is a delegated administrator
+        if not audit_account_found:
+            # List all accounts that are delegated administrators
+            other_admins = []
+            for admin_id, info in admin_accounts.items():
+                other_admins.append(f"{admin_id} ({info['name']})")
+            
+            findings.append(
+                self.create_finding(
+                    status="FAIL",
+                    region="global",
+                    resource_id=f"delegated-admin/none",
+                    checked_value=f"Delegated administrator is audit account {', '.join(self._audit_accounts)}",
+                    actual_value=f"Config delegated administrator(s) {', '.join(other_admins)} are not the audit account {', '.join(self._audit_accounts)}",
+                    remediation=(
+                        f"1. Deregister the current delegated administrator(s).\n"
+                        f"2. Register the audit account as a delegated administrator for both Config service principals:\n"
+                        f"   aws organizations register-delegated-administrator "
+                        f"--service-principal config.amazonaws.com "
+                        f"--account-id {self._audit_accounts[0]}\n"
+                        f"   aws organizations register-delegated-administrator "
+                        f"--service-principal config-multiaccountsetup.amazonaws.com "
+                        f"--account-id {self._audit_accounts[0]}"
+                    )
+                )
+            )
+        
+        return findings