sraverify 0.1.0__py3-none-any.whl

sraverify/checks/cloudtrail/SRA-CT-1.py

@@ -0,0 +1,220 @@
+from typing import Dict, List, Any
+from sraverify.checks import SecurityCheck
+from botocore.exceptions import ClientError
+
+class SRACT1(SecurityCheck):
+    """SRA-CT-1: Organization CloudTrail Configuration"""
+    
+    def __init__(self, check_type="organization"):
+        super().__init__(check_type=check_type)
+        self.check_id = "SRA-CT-1"
+        self.check_name = "Organization CloudTrail Configuration"
+        self.severity = "HIGH"
+        self.description = ('This check verifies that an organization trail is configured for your AWS Organization. '
+                          'It is important to have uniform logging strategy for your AWS environment. Organization '
+                          'trail logs all events for all AWS accounts in that organization and delivers logs to a '
+                          'single S3 bucket, CloudWatch Logs and Event Bridge. Organization trails are automatically '
+                          'applied to all member accounts in the organization. Member accounts can see the '
+                          'organization trail, but can\'t modify or delete it. Organization trail should be '
+                          'configured for all AWS regions even if you are not operating out of any region.')
+        self.check_logic = ('1. Verify execution from Organization Management account | '  # Step 1: Check account permissions
+                          '2. List CloudTrail trails in current region | '  # Step 2: Get all trails
+                          '3. Check for organization trail with IsOrganizationTrail=true and IsMultiRegionTrail=true | '  # Step 3: Verify organization trail exists
+                          '4. Verify trail configuration (S3 bucket, CloudWatch Logs, EventBridge) | '  # Step 4: Check trail settings
+                          '5. Check passes if organization trail is properly configured')  # Step 5: All checks must pass
+        self.service = 'CloudTrail'
+
+    def get_findings(self):
+        """Return the findings"""
+        return self.findings
+
+    def run(self, session):
+        """Run the security check"""
+        try:
+            region = session.region_name
+            account_id = session.client('sts').get_caller_identity()['Account']
+            
+            # Initialize clients
+            org_client = session.client('organizations')
+            cloudtrail_client = session.client('cloudtrail')
+
+             # Step 1: Verify we're in management account using org_mgmt_checker
+            is_management, error_message = self.org_checker.verify_org_management()
+            if not is_management:
+                finding = {
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::Organizations::Account',
+                    'AccountId': account_id,
+                    'CheckedValue': 'Management Account Access',
+                    'ActualValue': error_message if error_message else 'Not running from management account',
+                    'Remediation': 'Run this check from the Organization Management Account',
+                    'Service': self.service,
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                }
+                self.findings.append(finding)
+                return self.findings
+
+            # Steps 2 & 3: Check for organization trail
+            try:
+                trails = cloudtrail_client.list_trails()['Trails']
+                org_trail = None
+                non_org_trails = []
+
+                for trail in trails:
+                    trail_info = cloudtrail_client.get_trail(Name=trail['Name'])['Trail']
+                    if (trail_info.get('IsOrganizationTrail', False) and 
+                        trail_info.get('IsMultiRegionTrail', False)):
+                        org_trail = trail_info
+                        break
+                    else:
+                        non_org_trails.append(trail['Name'])
+
+                if not org_trail:
+                    failure_details = []
+                    if not trails:
+                        failure_details.append("No trails found")
+                    if non_org_trails:
+                        failure_details.append(f"Found non-organization trails: {', '.join(non_org_trails)}")
+                    
+                    self.findings.append({
+                        'CheckId': self.check_id,
+                        'Status': 'FAIL',
+                        'Region': region,
+                        "Severity": self.severity,
+                        'Title': f"{self.check_id} {self.check_name}",
+                        'Description': self.description,
+                        'ResourceId': account_id,
+                        'ResourceType': 'AWS::CloudTrail::Trail',
+                        'AccountId': account_id,
+                        'CheckedValue': 'Organization Trail Configuration',
+                        'ActualValue': ' | '.join(failure_details) if failure_details else 'No organization-wide trail found',
+                        'Remediation': 'Create an organization trail that logs all regions',
+                        'Service': 'CloudTrail',
+                        'CheckLogic': self.check_logic,
+                        'CheckType': self.check_type
+                    })
+                    return self.findings
+
+                # Step 4: Verify trail configuration
+                try:
+                    trail_status = cloudtrail_client.get_trail_status(Name=org_trail['Name'])
+                    
+                    config_issues = []
+                    
+                    if not org_trail.get('CloudWatchLogsLogGroupArn'):
+                        config_issues.append("CloudWatch Logs integration not configured")
+                    
+                    if not org_trail.get('S3BucketName'):
+                        config_issues.append("S3 bucket not configured")
+                    
+                    if not trail_status.get('IsLogging', False):
+                        config_issues.append("Trail logging is not enabled")
+                    
+                    if config_issues:
+                        self.findings.append({
+                            'CheckId': self.check_id,
+                            'Status': 'FAIL',
+                            'Region': region,
+                            "Severity": self.severity,
+                            'Title': f"{self.check_id} {self.check_name}",
+                            'Description': self.description,
+                            'ResourceId': org_trail['TrailARN'],
+                            'ResourceType': 'AWS::CloudTrail::Trail',
+                            'AccountId': account_id,
+                            'CheckedValue': 'Trail Configuration Details',
+                            'ActualValue': f"Configuration issues found: {' | '.join(config_issues)}",
+                            'Remediation': 'Configure CloudWatch Logs, S3 bucket, and enable logging for the organization trail',
+                            'Service': 'CloudTrail',
+                            'CheckLogic': self.check_logic,
+                            'CheckType': self.check_type
+                        })
+                        return self.findings
+
+                    # All checks passed
+                    self.findings.append({
+                        'CheckId': self.check_id,
+                        'Status': 'PASS',
+                        'Region': region,
+                        "Severity": self.severity,
+                        'Title': f"{self.check_id} {self.check_name}",
+                        'Description': self.description,
+                        'ResourceId': org_trail['TrailARN'],
+                        'ResourceType': 'AWS::CloudTrail::Trail',
+                        'AccountId': account_id,
+                        'CheckedValue': 'Organization Trail Configuration',
+                        'ActualValue': (f"Organization trail: {org_trail['Name']} | "
+                                      f"Multi-region: {org_trail['IsMultiRegionTrail']} | "
+                                      f"Logging Enabled: {trail_status['IsLogging']} | "
+                                      f"S3 Bucket: {org_trail['S3BucketName']} | "
+                                      f"CloudWatch Logs Configured: {'Yes' if org_trail.get('CloudWatchLogsLogGroupArn') else 'No'}"),
+                        'Remediation': 'None required',
+                        'Service': 'CloudTrail',
+                        'CheckLogic': self.check_logic,
+                        'CheckType': self.check_type
+                    })
+
+                except ClientError as e:
+                    self.findings.append({
+                        'CheckId': self.check_id,
+                        'Status': 'ERROR',
+                        'Region': region,
+                        "Severity": self.severity,
+                        'Title': f"{self.check_id} {self.check_name}",
+                        'Description': self.description,
+                        'ResourceId': org_trail['TrailARN'],
+                        'ResourceType': 'AWS::CloudTrail::Trail',
+                        'AccountId': account_id,
+                        'CheckedValue': 'Trail Status',
+                        'ActualValue': f'Error checking trail status: {str(e)} | Error Code: {e.response["Error"]["Code"]}',
+                        'Remediation': 'Verify CloudTrail permissions and trail configuration',
+                        'Service': 'CloudTrail',
+                        'CheckLogic': self.check_logic,
+                        'CheckType': self.check_type
+                    })
+
+            except ClientError as e:
+                self.findings.append({
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::CloudTrail::Trail',
+                    'AccountId': account_id,
+                    'CheckedValue': 'CloudTrail Access',
+                    'ActualValue': f'Error accessing CloudTrail: {str(e)} | Error Code: {e.response["Error"]["Code"]}',
+                    'Remediation': 'Verify CloudTrail permissions and service availability',
+                    'Service': 'CloudTrail',
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                })
+
+        except Exception as e:
+            self.findings.append({
+                'CheckId': self.check_id,
+                'Status': 'ERROR',
+                'Region': region,
+                "Severity": self.severity,
+                'Title': f"{self.check_id} {self.check_name}",
+                'Description': self.description,
+                'ResourceId': account_id,
+                'ResourceType': 'AWS::CloudTrail::Trail',
+                'AccountId': account_id,
+                'CheckedValue': 'Check Execution',
+                'ActualValue': f'Unexpected error during check execution: {str(e)}',
+                'Remediation': 'Review error logs and verify AWS credentials and permissions',
+                'Service': 'CloudTrail',
+                'CheckLogic': self.check_logic,
+                'CheckType': self.check_type
+            })
+
+        return self.findings

sraverify/checks/cloudtrail/SRA-CT-10.py

@@ -0,0 +1,229 @@
+from typing import Dict, List, Any
+from sraverify.checks import SecurityCheck
+from botocore.exceptions import ClientError
+import logging
+from datetime import datetime, timezone
+
+class SRACT10(SecurityCheck):
+    """SRA-CT-10: Organization Trail Log File Validation Status"""
+    
+    def __init__(self, check_type="organization"):
+        """Initialize the check with organization type"""
+        super().__init__(check_type=check_type)
+        self.check_id = "SRA-CT-10"
+        self.check_name = "Organization trail is configured to deliver Log file validation digest files to destination bucket"
+        self.description = ('This check verifies that log file validation digest files are being successfully delivered to a S3 bucket. '
+                          'Log file validation helps ensure the integrity and authenticity of CloudTrail logs by creating digitally '
+                          'signed digest files containing hashes of log files.')
+        self.service = "CloudTrail"
+        self.severity = "HIGH"
+        self.check_type = check_type
+        self.check_logic = ('1. Verify execution from Organization Management Account | '
+                          '2. List CloudTrail trails in current region | '
+                          '3. Check for organization trail with IsOrganizationTrail=true | '
+                          '4. Verify log file validation configuration and successful delivery by checking: '
+                          'a) EnableLogFileValidation is true, b) S3 bucket is configured, '
+                          'c) No digest delivery errors exist, d) Latest digest delivery was successful within 24 hours')
+        self.logger = logging.getLogger(self.__class__.__name__)
+        self.findings = []
+
+    def get_findings(self) -> List[Dict[str, Any]]:
+        """Return the findings"""
+        return self.findings
+
+    def check_digest_delivery_status(self, cloudtrail_client, trail_name: str) -> tuple:
+        """Check digest file delivery status and return status details"""
+        try:
+            status = cloudtrail_client.get_trail_status(Name=trail_name)
+            latest_delivery_time = status.get('LatestDigestDeliveryTime')
+            latest_delivery_error = status.get('LatestDigestDeliveryError', '')
+            is_logging = status.get('IsLogging', False)
+            
+
+             # Step 1: Verify we're in management account using org_mgmt_checker
+            is_management, error_message = self.org_checker.verify_org_management()
+            if not is_management:
+                finding = {
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::Organizations::Account',
+                    'AccountId': account_id,
+                    'CheckedValue': 'Management Account Access',
+                    'ActualValue': error_message if error_message else 'Not running from management account',
+                    'Remediation': 'Run this check from the Organization Management Account',
+                    'Service': self.service,
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                }
+                self.findings.append(finding)
+                return self.findings
+
+
+            # Check if delivery is recent (within 24 hours)
+            current_time = datetime.now(timezone.utc)
+            is_recent = False
+            if latest_delivery_time:
+                time_difference = current_time - latest_delivery_time
+                is_recent = time_difference.total_seconds() < 86400  # 24 hours
+            
+            return is_logging, is_recent, latest_delivery_error
+            
+        except ClientError as e:
+            self.logger.error(f"Error getting trail status for {trail_name}: {str(e)}")
+            return False, False, str(e)
+
+    def run(self, session) -> None:
+        """Run the security check"""
+        try:
+            # Get account information
+            sts_client = session.client('sts')
+            account_id = sts_client.get_caller_identity()['Account']
+            region = session.region_name
+            self.logger.debug(f"Running check for account: {account_id} in region: {region}")
+            
+            # Initialize CloudTrail client
+            cloudtrail_client = session.client('cloudtrail')
+            
+            try:
+                # List trails and find organization trails
+                trails = cloudtrail_client.describe_trails(includeShadowTrails=True)
+                org_trails = [t for t in trails['trailList'] if t.get('IsOrganizationTrail')]
+                self.logger.debug(f"Found {len(org_trails)} organization trails")
+
+                if not org_trails:
+                    self.findings.append({
+                        "CheckId": self.check_id,
+                        "Status": "FAIL",
+                        "Region": region,
+                        "Severity": self.severity,
+                        "Title": f"{self.check_id} {self.check_name}",
+                        "Description": self.description,
+                        "ResourceId": "organization-trail",
+                        "ResourceType": "AWS::CloudTrail::Trail",
+                        "AccountId": account_id,
+                        "CheckedValue": "Organization Trail Configuration",
+                        "ActualValue": "No organization trail found",
+                        "Remediation": "Create an organization trail with log file validation enabled",
+                        "Service": self.service,
+                        "CheckLogic": self.check_logic,
+                        "CheckType": self.check_type
+                    })
+                    return
+
+                # Check each organization trail for log file validation and digest delivery
+                valid_trail = None
+                for trail in org_trails:
+                    trail_name = trail['Name']
+                    log_validation_enabled = trail.get('LogFileValidationEnabled', False)
+                    s3_bucket = trail.get('S3BucketName')
+                    
+                    # Skip if log validation is not enabled or S3 bucket is not configured
+                    if not (log_validation_enabled and s3_bucket):
+                        continue
+                    
+                    is_logging, is_recent, delivery_error = self.check_digest_delivery_status(cloudtrail_client, trail_name)
+                    
+                    if is_logging and is_recent and not delivery_error:
+                        valid_trail = trail
+                        self.logger.debug(f"Found valid trail with successful digest delivery: {trail_name}")
+                        break
+
+                # Create finding based on log validation and digest delivery status
+                if valid_trail:
+                    self.findings.append({
+                        "CheckId": self.check_id,
+                        "Status": "PASS",
+                        "Region": region,
+                        "Severity": self.severity,
+                        "Title": f"{self.check_id} {self.check_name}",
+                        "Description": self.description,
+                        "ResourceId": valid_trail['TrailARN'],
+                        "ResourceType": "AWS::CloudTrail::Trail",
+                        "AccountId": account_id,
+                        "CheckedValue": "Log File Validation Status",
+                        "ActualValue": f"Organization trail {valid_trail['Name']} is successfully delivering digest files to S3 bucket {valid_trail['S3BucketName']}",
+                        "Remediation": "None required",
+                        "Service": self.service,
+                        "CheckLogic": self.check_logic,
+                        "CheckType": self.check_type
+                    })
+                else:
+                    actual_value = "No organization trail found with successful recent digest file delivery"
+                    remediation = "Verify log file validation configuration and S3 permissions"
+                    if org_trails:
+                        trail = org_trails[0]
+                        if not trail.get('LogFileValidationEnabled'):
+                            actual_value = f"Trail {trail['Name']} does not have log file validation enabled"
+                            remediation = "Enable log file validation for the organization trail"
+                        elif not trail.get('S3BucketName'):
+                            actual_value = f"Trail {trail['Name']} has no S3 bucket configured"
+                            remediation = "Configure S3 bucket for the organization trail"
+                        elif delivery_error:
+                            actual_value = f"Trail {trail['Name']} has digest delivery error: {delivery_error}"
+                            remediation = "Resolve digest delivery errors (check S3 bucket permissions)"
+                        elif not is_recent:
+                            actual_value = f"Trail {trail['Name']} has no recent digest file delivery"
+                            remediation = "Verify trail logging is enabled and check CloudWatch logs for errors"
+
+                    self.findings.append({
+                        "CheckId": self.check_id,
+                        "Status": "FAIL",
+                        "Region": region,
+                        "Severity": self.severity,
+                        "Title": f"{self.check_id} {self.check_name}",
+                        "Description": self.description,
+                        "ResourceId": (valid_trail or org_trails[0])['TrailARN'],
+                        "ResourceType": "AWS::CloudTrail::Trail",
+                        "AccountId": account_id,
+                        "CheckedValue": "Log File Validation Status",
+                        "ActualValue": actual_value,
+                        "Remediation": remediation,
+                        "Service": self.service,
+                        "CheckLogic": self.check_logic,
+                        "CheckType": self.check_type
+                    })
+
+            except ClientError as e:
+                self.logger.error(f"Error accessing CloudTrail: {str(e)}")
+                self.findings.append({
+                    "CheckId": self.check_id,
+                    "Status": "ERROR",
+                    "Region": region,
+                    "Severity": self.severity,
+                    "Title": f"{self.check_id} {self.check_name}",
+                    "Description": self.description,
+                    "ResourceId": "cloudtrail",
+                    "ResourceType": "AWS::CloudTrail::Trail",
+                    "AccountId": account_id,
+                    "CheckedValue": "CloudTrail API Access",
+                    "ActualValue": f"Error accessing CloudTrail: {str(e)}",
+                    "Remediation": "Verify CloudTrail permissions",
+                    "Service": self.service,
+                    "CheckLogic": self.check_logic,
+                    "CheckType": self.check_type
+                })
+
+        except Exception as e:
+            self.logger.error(f"Unexpected error in check: {str(e)}")
+            self.findings.append({
+                "CheckId": self.check_id,
+                "Status": "ERROR",
+                "Region": region if 'region' in locals() else session.region_name,
+                "Severity": self.severity,
+                "Title": f"{self.check_id} {self.check_name}",
+                "Description": self.description,
+                "ResourceId": "check-execution",
+                "ResourceType": "AWS::CloudTrail::Trail",
+                "AccountId": account_id if 'account_id' in locals() else "unknown",
+                "CheckedValue": "Check Execution",
+                "ActualValue": f"Unexpected error: {str(e)}",
+                "Remediation": "Contact support team",
+                "Service": self.service,
+                "CheckLogic": self.check_logic,
+                "CheckType": self.check_type
+            })