sraverify 0.1.0__py3-none-any.whl

sraverify/checks/cloudtrail/SRA-CT-13.py

@@ -0,0 +1,279 @@
+from typing import Dict, List, Any
+from sraverify.checks import SecurityCheck
+from botocore.exceptions import ClientError
+import logging
+
+class SRACT13(SecurityCheck):
+    """SRA-CT-13: Security Tooling Account CloudTrail Delegated Administrator"""
+    
+    def __init__(self, check_type="organization", security_ou_name=None):
+        """Initialize the check with organization type and optional security OU name"""
+        super().__init__(check_type=check_type)
+        self.check_id = "SRA-CT-13"
+        self.check_name = "The Security Tooling Account is the Delegated Administrator set for CloudTrail"
+        self.description = ('This check verifies whether CloudTrail delegated admin account is the security tooling account '
+                          'of your AWS organization. Security Tooling account is dedicated to operating security services, '
+                          'monitoring AWS accounts, and automating security alerting and response. CloudTrail helps monitor '
+                          'API activities across all your AWS accounts and regions.')
+        self.service = "CloudTrail"
+        self.severity = "HIGH"
+        self.check_type = check_type
+        self.check_logic = ('1. Verify execution from Organization Management Account | '
+                          '2. List all Organization Units and find specified OU (via flag --security-ou-name) or OU containing "security" | '
+                          '3. List accounts in Security OU | '
+                          '4. List CloudTrail delegated administrators | '
+                          '5. Verify delegated admin account exists in Security OU')
+        self.logger = logging.getLogger(self.__class__.__name__)
+        self.findings = []
+        self.security_ou_name = security_ou_name.lower() if security_ou_name else None
+
+    def get_findings(self) -> List[Dict[str, Any]]:
+        """Return the findings"""
+        return self.findings
+
+    def find_security_ou(self, org_client, root_id):
+        """Find the security OU based on name parameter or default search"""
+        paginator = org_client.get_paginator('list_organizational_units_for_parent')
+        search_term = self.security_ou_name if self.security_ou_name else 'security'
+        
+        for page in paginator.paginate(ParentId=root_id):
+            for ou in page['OrganizationalUnits']:
+                # If security_ou_name is provided, use exact match
+                if self.security_ou_name and self.security_ou_name == ou['Name'].lower():
+                    return ou['Id'], ou['Name'], search_term
+                # If no security_ou_name provided, look for 'security' in name
+                elif not self.security_ou_name and 'security' in ou['Name'].lower():
+                    return ou['Id'], ou['Name'], search_term
+        
+        return None, None, search_term
+
+    def get_accounts_in_ou(self, organizations_client, ou_id: str) -> List[str]:
+        """Get list of account IDs in the specified OU"""
+        try:
+            account_ids = []
+            paginator = organizations_client.get_paginator('list_accounts_for_parent')
+            
+            for page in paginator.paginate(ParentId=ou_id):
+                for account in page['Accounts']:
+                    account_ids.append(account['Id'])
+            
+            return account_ids
+            
+        except ClientError as e:
+            self.logger.error(f"Error listing accounts in OU: {str(e)}")
+            return []
+
+    def run(self, session) -> None:
+        """Run the security check"""
+        try:
+            # Get account information
+            sts_client = session.client('sts')
+            account_id = sts_client.get_caller_identity()['Account']
+            region = session.region_name
+            self.logger.debug(f"Running check for account: {account_id} in region: {region}")
+            
+            # Step 1: Verify execution from Organization Management Account
+            is_management, error_message = self.org_checker.verify_org_management()
+            if not is_management:
+                self.findings.append({
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::Organizations::Account',
+                    'AccountId': account_id,
+                    'CheckedValue': 'Management Account Access',
+                    'ActualValue': error_message if error_message else 'Not running from management account',
+                    'Remediation': 'Run this check from the Organization Management Account',
+                    'Service': self.service,
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                })
+                return self.findings
+            
+            try:
+                # Initialize Organizations client
+                organizations_client = session.client('organizations')
+                
+                # Step 2: List all Organization Units and find Security OU
+                root_id = organizations_client.list_roots()['Roots'][0]['Id']
+                security_ou_id, security_ou_name, search_term = self.find_security_ou(organizations_client, root_id)
+                
+                if not security_ou_id:
+                    self.findings.append({
+                        "CheckId": self.check_id,
+                        "Status": "ERROR",
+                        "Region": region,
+                        "Severity": self.severity,
+                        "Title": f"{self.check_id} {self.check_name}",
+                        "Description": self.description,
+                        "ResourceId": "security-ou",
+                        "ResourceType": "AWS::Organizations::OrganizationalUnit",
+                        "AccountId": account_id,
+                        "CheckedValue": "Security OU Existence",
+                        "ActualValue": f"No OU found matching search term: {search_term}",
+                        "Remediation": "Verify Security OU name or existence of OU containing 'security'",
+                        "Service": self.service,
+                        "CheckLogic": self.check_logic,
+                        "CheckType": self.check_type
+                    })
+                    return
+
+                # Step 3: List accounts in Security OU
+                security_accounts = self.get_accounts_in_ou(organizations_client, security_ou_id)
+                if not security_accounts:
+                    self.findings.append({
+                        "CheckId": self.check_id,
+                        "Status": "FAIL",
+                        "Region": region,
+                        "Severity": self.severity,
+                        "Title": f"{self.check_id} {self.check_name}",
+                        "Description": self.description,
+                        "ResourceId": security_ou_id,
+                        "ResourceType": "AWS::Organizations::OrganizationalUnit",
+                        "AccountId": account_id,
+                        "CheckedValue": "Security OU Accounts",
+                        "ActualValue": f"No accounts found in Security OU: {security_ou_name}",
+                        "Remediation": "Verify Security OU configuration and account assignments",
+                        "Service": self.service,
+                        "CheckLogic": self.check_logic,
+                        "CheckType": self.check_type
+                    })
+                    return
+
+                # Step 4: List CloudTrail delegated administrators
+                try:
+                    delegated_admins = organizations_client.list_delegated_administrators(
+                        ServicePrincipal='cloudtrail.amazonaws.com'
+                    )
+                    admin_accounts = delegated_admins.get('DelegatedAdministrators', [])
+                    
+                    if not admin_accounts:
+                        self.findings.append({
+                            "CheckId": self.check_id,
+                            "Status": "FAIL",
+                            "Region": region,
+                            "Severity": self.severity,
+                            "Title": f"{self.check_id} {self.check_name}",
+                            "Description": self.description,
+                            "ResourceId": "cloudtrail-delegated-admin",
+                            "ResourceType": "AWS::Organizations::Account",
+                            "AccountId": account_id,
+                            "CheckedValue": "Delegated Administrator Configuration",
+                            "ActualValue": "No CloudTrail delegated administrators configured",
+                            "Remediation": "Configure a Security Tooling account as CloudTrail delegated administrator",
+                            "Service": self.service,
+                            "CheckLogic": self.check_logic,
+                            "CheckType": self.check_type
+                        })
+                        return
+
+                    # Step 5: Verify delegated admin account exists in Security OU
+                    valid_admin = None
+                    for admin in admin_accounts:
+                        if admin['Id'] in security_accounts:
+                            valid_admin = admin
+                            break
+
+                    if valid_admin:
+                        self.findings.append({
+                            "CheckId": self.check_id,
+                            "Status": "PASS",
+                            "Region": region,
+                            "Severity": self.severity,
+                            "Title": f"{self.check_id} {self.check_name}",
+                            "Description": self.description,
+                            "ResourceId": valid_admin['Id'],
+                            "ResourceType": "AWS::Organizations::Account",
+                            "AccountId": account_id,
+                            "CheckedValue": "CloudTrail Delegated Administrator",
+                            "ActualValue": f"CloudTrail delegated administrator {valid_admin['Id']} is in Security OU {security_ou_name}",
+                            "Remediation": "None required",
+                            "Service": self.service,
+                            "CheckLogic": self.check_logic,
+                            "CheckType": self.check_type
+                        })
+                    else:
+                        admin_list = ', '.join([admin['Id'] for admin in admin_accounts])
+                        self.findings.append({
+                            "CheckId": self.check_id,
+                            "Status": "FAIL",
+                            "Region": region,
+                            "Severity": self.severity,
+                            "Title": f"{self.check_id} {self.check_name}",
+                            "Description": self.description,
+                            "ResourceId": "cloudtrail-delegated-admin",
+                            "ResourceType": "AWS::Organizations::Account",
+                            "AccountId": account_id,
+                            "CheckedValue": "CloudTrail Delegated Administrator",
+                            "ActualValue": f"CloudTrail delegated administrators ({admin_list}) are not in Security OU {security_ou_name}",
+                            "Remediation": f"Configure a Security Tooling account from Security OU {security_ou_name} as CloudTrail delegated administrator",
+                            "Service": self.service,
+                            "CheckLogic": self.check_logic,
+                            "CheckType": self.check_type
+                        })
+
+                except ClientError as e:
+                    if 'AccessDeniedException' in str(e):
+                        self.findings.append({
+                            "CheckId": self.check_id,
+                            "Status": "ERROR",
+                            "Region": region,
+                            "Severity": self.severity,
+                            "Title": f"{self.check_id} {self.check_name}",
+                            "Description": self.description,
+                            "ResourceId": "organizations-permissions",
+                            "ResourceType": "AWS::Organizations::Account",
+                            "AccountId": account_id,
+                            "CheckedValue": "Organizations Permissions",
+                            "ActualValue": "Insufficient permissions to list delegated administrators",
+                            "Remediation": "Verify Organizations permissions in management account",
+                            "Service": self.service,
+                            "CheckLogic": self.check_logic,
+                            "CheckType": self.check_type
+                        })
+                    else:
+                        raise e
+
+            except ClientError as e:
+                self.logger.error(f"Error accessing Organizations: {str(e)}")
+                self.findings.append({
+                    "CheckId": self.check_id,
+                    "Status": "ERROR",
+                    "Region": region,
+                    "Severity": self.severity,
+                    "Title": f"{self.check_id} {self.check_name}",
+                    "Description": self.description,
+                    "ResourceId": "organizations",
+                    "ResourceType": "AWS::Organizations::Account",
+                    "AccountId": account_id,
+                    "CheckedValue": "Organizations API Access",
+                    "ActualValue": f"Error accessing Organizations: {str(e)}",
+                    "Remediation": "Verify Organizations permissions",
+                    "Service": self.service,
+                    "CheckLogic": self.check_logic,
+                    "CheckType": self.check_type
+                })
+
+        except Exception as e:
+            self.logger.error(f"Unexpected error in check: {str(e)}")
+            self.findings.append({
+                "CheckId": self.check_id,
+                "Status": "ERROR",
+                "Region": region if 'region' in locals() else session.region_name,
+                "Severity": self.severity,
+                "Title": f"{self.check_id} {self.check_name}",
+                "Description": self.description,
+                "ResourceId": "check-execution",
+                "ResourceType": "AWS::Organizations::Account",
+                "AccountId": account_id if 'account_id' in locals() else "unknown",
+                "CheckedValue": "Check Execution",
+                "ActualValue": f"Unexpected error: {str(e)}",
+                "Remediation": "Contact support team",
+                "Service": self.service,
+                "CheckLogic": self.check_logic,
+                "CheckType": self.check_type
+            })

sraverify/checks/cloudtrail/SRA-CT-2.py

@@ -0,0 +1,218 @@
+from typing import Dict, List, Any
+from sraverify.checks import SecurityCheck
+from botocore.exceptions import ClientError
+
+class SRACT2(SecurityCheck):
+    """SRA-CT-2: Organization trail is encrypted with KMS"""
+    
+    def __init__(self, check_type="organization"):
+        super().__init__(check_type=check_type)
+        self.check_id = "SRA-CT-2"
+        self.check_name = "Organization trail is encrypted with KMS"
+        self.severity = 'HIGH'
+        self.description = ('This check verifies that your organization trail is encrypted with a KMS key. '
+                          'Log files delivered by CloudTrail to your bucket should be encrypted by using SSE-KMS. '
+                          'This is selected by default in the console but can be altered by users. With SSE-KMS '
+                          'you create and manage the KMS key yourself with the ability to manage permissions on '
+                          'who can use the key. For a user to read log files they must have read permissions to '
+                          'the bucket and have permissions that allows decrypt permission on the key applied by '
+                          'the KMS key policy.')
+        self.check_logic = ('1. Verify execution from Organization Management account | '
+                          '2. List all CloudTrail trails in the region | '
+                          '3. Identify organization trail | '
+                          '4. Check if trail is enabled and logging | '
+                          '5. Verify KMS encryption is enabled on the trail | '
+                          '6. Validate KMS key exists and is accessible | '
+                          '7. Check passes if organization trail uses KMS encryption')
+        self.service = 'CloudTrail'
+
+    def get_findings(self) -> List[Dict[str, Any]]:
+        """Return the findings of the check"""
+        return self.findings
+
+    def run(self, session):
+        """Run the CloudTrail organization trail encryption check"""
+        try:
+            cloudtrail_client = session.client('cloudtrail')
+            account_id = session.client('sts').get_caller_identity()['Account']
+            region = session.region_name
+
+             # Step 1: Verify we're in management account using org_mgmt_checker
+            is_management, error_message = self.org_checker.verify_org_management()
+            if not is_management:
+                finding = {
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::Organizations::Account',
+                    'AccountId': account_id,
+                    'CheckedValue': 'Management Account Access',
+                    'ActualValue': error_message if error_message else 'Not running from management account',
+                    'Remediation': 'Run this check from the Organization Management Account',
+                    'Service': self.service,
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                }
+                self.findings.append(finding)
+                return self.findings
+
+            try:
+                # Step 2: List all CloudTrail trails in the region
+                trails = cloudtrail_client.list_trails()
+
+                if not trails['Trails']:
+                    self.findings.append({
+                        'CheckId': self.check_id,
+                        'Status': 'FAIL',
+                        'Region': region,
+                        "Severity": self.severity,
+                        'Title': f"{self.check_id} {self.check_name}",
+                        'Description': self.description,
+                        'ResourceId': account_id,
+                        'ResourceType': 'AWS::CloudTrail::Trail',
+                        'AccountId': account_id,
+                        'CheckedValue': 'Organization CloudTrail',
+                        'ActualValue': 'No trails found',
+                        'Remediation': 'Create an organization-level CloudTrail with KMS encryption enabled',
+                        'Service': 'CloudTrail',
+                        'CheckLogic': self.check_logic,
+                        'CheckType': self.check_type
+                    })
+                    return self.findings
+
+                org_trail_found = False
+                
+                for trail in trails['Trails']:
+                    trail_name = trail['Name']
+                    trail_arn = trail['TrailARN']
+                    
+                    # Step 3: Identify organization trail
+                    trail_info = cloudtrail_client.get_trail(Name=trail_name)['Trail']
+                    
+                    if trail_info.get('IsOrganizationTrail'):
+                        org_trail_found = True
+                        
+                        # Step 4: Check if trail is enabled and logging
+                        trail_status = cloudtrail_client.get_trail_status(Name=trail_name)
+                        if not trail_status.get('IsLogging', False):
+                            self.findings.append({
+                                'CheckId': self.check_id,
+                                'Status': 'FAIL',
+                                'Region': region,
+                                "Severity": self.severity,
+                                'Title': f"{self.check_id} {self.check_name}",
+                                'Description': self.description,
+                                'ResourceId': trail_arn,
+                                'ResourceType': 'AWS::CloudTrail::Trail',
+                                'AccountId': account_id,
+                                'CheckedValue': 'Trail Logging Status',
+                                'ActualValue': 'Organization trail is not logging',
+                                'Remediation': 'Enable logging for the organization trail',
+                                'Service': 'CloudTrail',
+                                'CheckLogic': self.check_logic,
+                                'CheckType': self.check_type
+                            })
+                            continue
+
+                        # Step 5: Verify KMS encryption is enabled on the trail
+                        # Step 6: Validate KMS key exists and is accessible
+                        if not trail_info.get('KmsKeyId'):
+                            self.findings.append({
+                                'CheckId': self.check_id,
+                                'Status': 'FAIL',
+                                'Region': region,
+                                "Severity": self.severity,
+                                'Title': f"{self.check_id} {self.check_name}",
+                                'Description': self.description,
+                                'ResourceId': trail_arn,
+                                'ResourceType': 'AWS::CloudTrail::Trail',
+                                'AccountId': account_id,
+                                'CheckedValue': 'KMS Encryption',
+                                'ActualValue': 'Organization trail is not KMS encrypted',
+                                'Remediation': 'Enable KMS encryption for the organization trail',
+                                'Service': 'CloudTrail',
+                                'CheckLogic': self.check_logic,
+                                'CheckType': self.check_type
+                            })
+                        else:
+                            # Step 7: Check passes if organization trail uses KMS encryption
+                            self.findings.append({
+                                'CheckId': self.check_id,
+                                'Status': 'PASS',
+                                'Region': region,
+                                "Severity": self.severity,
+                                'Title': f"{self.check_id} {self.check_name}",
+                                'Description': self.description,
+                                'ResourceId': trail_arn,
+                                'ResourceType': 'AWS::CloudTrail::Trail',
+                                'AccountId': account_id,
+                                'CheckedValue': 'KMS Encryption',
+                                'ActualValue': f"Organization trail is encrypted with key: {trail_info['KmsKeyId']}",
+                                'Remediation': 'None required',
+                                'Service': 'CloudTrail',
+                                'CheckLogic': self.check_logic,
+                                'CheckType': self.check_type
+                            })
+
+                if not org_trail_found:
+                    self.findings.append({
+                        'CheckId': self.check_id,
+                        'Status': 'FAIL',
+                        'Region': region,
+                        "Severity": self.severity,
+                        'Title': f"{self.check_id} {self.check_name}",
+                        'Description': self.description,
+                        'ResourceId': account_id,
+                        'ResourceType': 'AWS::CloudTrail::Trail',
+                        'AccountId': account_id,
+                        'CheckedValue': 'Organization Trail',
+                        'ActualValue': 'No organization trail found',
+                        'Remediation': 'Create an organization-level CloudTrail with KMS encryption enabled',
+                        'Service': 'CloudTrail',
+                        'CheckLogic': self.check_logic,
+                        'CheckType': self.check_type
+                    })
+
+            except ClientError as e:
+                self.findings.append({
+                    'CheckId': self.check_id,
+                    'Status': 'ERROR',
+                    'Region': region,
+                    "Severity": self.severity,
+                    'Title': f"{self.check_id} {self.check_name}",
+                    'Description': self.description,
+                    'ResourceId': account_id,
+                    'ResourceType': 'AWS::CloudTrail::Trail',
+                    'AccountId': account_id,
+                    'CheckedValue': 'CloudTrail Access',
+                    'ActualValue': f"Error: {str(e)}",
+                    'Remediation': 'Check CloudTrail permissions and try again',
+                    'Service': 'CloudTrail',
+                    'CheckLogic': self.check_logic,
+                    'CheckType': self.check_type
+                })
+
+        except Exception as e:
+            self.findings.append({
+                'CheckId': self.check_id,
+                'Status': 'ERROR',
+                'Region': region,
+                "Severity": self.severity,
+                'Title': f"{self.check_id} {self.check_name}",
+                'Description': self.description,
+                'ResourceId': account_id,
+                'ResourceType': 'AWS::CloudTrail::Trail',
+                'AccountId': account_id,
+                'CheckedValue': 'Check Execution',
+                'ActualValue': f"Error: {str(e)}",
+                'Remediation': 'Check permissions and try again',
+                'Service': 'CloudTrail',
+                'CheckLogic': self.check_logic,
+                'CheckType': self.check_type
+            })
+            
+        return self.findings