def check_ibp_item_02_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] # IAMユーザの一覧を取得する。 try: list_users = IAMUtils.get_list_users(trace_id, session, aws_account) except PmError as e: pm_logger.error("[%s] IAMユーザー一覧情報取得に失敗しました。", aws_account) return CheckResult.Error try: # 取得したユーザ一覧をS3に保存する(リソース情報ファイル)。 s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "IBP/IAM_ListUsers.json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", list_users, s3_file_name) except PmError as e: pm_logger.error("[%s] IAMユーザー一覧情報のS3保存に失敗しました。", aws_account) return CheckResult.Error # チェックルール # Check-1. IAMユーザが存在するか try: if (len(list_users) == 0): result = { 'Region': 'Global', 'Level': CommonConst.LEVEL_CODE_21, 'DetectionItem': { 'NoIAMUser': True } } check_results.append(result) except Exception as e: pm_logger.error("[%s] チェック処理中にエラーが発生しました。", aws_account) return CheckResult.Error # Export File CHECK_IBP_ITEM_02_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_ibp_item_02_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", check_ibp_item_02_01, result_json_path) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_ibp_item_07_08(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] # チェック結果 try: account_password_policy = ibp_item_common_logic.get_account_password_policy( trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path) if (common_utils.check_key("AllowUsersToChangePassword", account_password_policy) is False or account_password_policy['AllowUsersToChangePassword'] is False): check_results.append(get_check_ibp_item_07_08_result()) except PmError as e: if e.cause_error.response['Error'][ 'Code'] == CommonConst.NO_SUCH_ENTITY: check_results.append(get_check_ibp_item_07_08_result()) else: pm_logger.error("[%s] チェック処理中にエラーが発生しました。", aws_account) return CheckResult.Error # Export File CHECK_IBP_ITEM_07_08.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_password_policy = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_password_policy, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if len(check_results) == 0: return CheckResult.Normal return CheckResult.CriticalDefect
def check_asc_item_13_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): cw_logger = common_utils.begin_cw_logger(trace_id, __name__, inspect.currentframe()) check_results = [] is_authorized = True s3_client = S3Utils.get_s3_client(trace_id, session, aws_account, is_cw_logger=True) try: list_buckets = asc_item_common_logic.get_list_buckets( trace_id, check_history_id, organization_id, project_id, s3_client, aws_account) except PmError as e: return CheckResult.Error # 取得したS3バケットのアクセスコントロールリスト情報をS3に保存する(リソース情報ファイル)。 for bucket in list_buckets['Buckets']: bucket_name = bucket['Name'] region_name = None try: region_name = S3Utils.get_bucket_location( trace_id, s3_client, bucket_name, aws_account) if region_name is None: region_name = CommonConst.US_EAST_REGION bucket_encryption_rules = S3Utils.get_bucket_encryption( trace_id, s3_client, bucket_name, aws_account, region_name, is_cw_logger=True) except PmError as e: if e.cause_error.response['Error'][ 'Code'] in CommonConst.SERVER_SIDE_ENCRYPTION_CONFIGURATION_NOT_FOUND_ERROR: check_results.append(get_check_asc_item_13_01_result( region_name, bucket_name)) continue elif e.cause_error.response['Error'][ 'Code'] in CommonConst.S3_SKIP_EXCEPTION: error_operation = e.cause_error.operation_name, error_code = e.cause_error.response['Error']['Code'], error_message = e.cause_error.response['Error']['Message'] if region_name is None: region_name = CommonConst.ERROR check_results.append( asc_item_common_logic.get_error_authorized_result( region_name, bucket_name, error_operation, error_code, error_message)) is_authorized = False continue else: return CheckResult.Error if len(bucket_encryption_rules) == 0: continue try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/S3_Encryption_" + region_name + "_" + bucket_name + ".json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", bucket_encryption_rules, s3_file_name, is_cw_logger=True) except PmError as e: cw_logger.error("[%s] S3バケット暗号化情報のS3保存に失敗しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # チェック処理 try: for bucket_encryption_rule in bucket_encryption_rules: if (common_utils.check_key( "SSEAlgorithm", bucket_encryption_rule['ApplyServerSideEncryptionByDefault'] ) is False): check_results.append(get_check_asc_item_13_01_result( region_name, bucket_name)) break except Exception as e: cw_logger.error("[%s] チェック処理中にエラーが発生しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # Export File json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_asc_item_13_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_asc_item_13_01, result_json_path, format_json=True, is_cw_logger=True) except Exception as e: cw_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if is_authorized is False: return CheckResult.Error if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_asc_item_12_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): cw_logger = common_utils.begin_cw_logger(trace_id, __name__, inspect.currentframe()) check_results = [] is_authorized = True # 取得したクレデンシャル情報を使用して、S3クライアントを作成します。 try: s3_client = S3Utils.get_s3_client(trace_id, session, aws_account, is_cw_logger=True) except PmError as e: raise common_utils.write_log_pm_error(e, cw_logger) # S3バケット一覧を取得します。 try: list_buckets = S3Utils.list_buckets(trace_id, s3_client, aws_account, is_cw_logger=True) except PmError as e: return CheckResult.Error # S3バケット一覧情報をS3に保存します。 try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/S3_ListBuckets.json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", list_buckets, s3_file_name, is_cw_logger=True) except PmError as e: cw_logger.error("[%s] S3バケット一覧情報のS3保存に失敗しました。", aws_account) return CheckResult.Error for bucket in list_buckets["Buckets"]: bucket_name = bucket['Name'] region_name = None try: # 取得したS3バケット一覧情報ファイルをもとに、各バケットのリージョンを取得する。 region_name = S3Utils.get_bucket_location(trace_id, s3_client, bucket_name, aws_account, is_cw_logger=True) if region_name is None: region_name = CommonConst.US_EAST_REGION # 取得したS3バケット一覧情報ファイルをもとに、該当のS3バケットのアクセスコントロールリストを取得する。 bucket_acl = S3Utils.get_bucket_acl(trace_id, s3_client, bucket_name, aws_account, region_name) # 取得したS3バケット情報ファイルをもとに、該当のS3バケットのバケットポリシーを取得する。 bucket_policy = S3Utils.get_bucket_policy(trace_id, s3_client, bucket_name, aws_account, region_name, is_cw_logger=True) if bucket_policy is None: continue except PmError as e: if e.cause_error.response['Error'][ 'Code'] in CommonConst.S3_SKIP_EXCEPTION: error_operation = e.cause_error.operation_name, error_code = e.cause_error.response['Error']['Code'], error_message = e.cause_error.response['Error']['Message'] if region_name is None: region_name = CommonConst.ERROR check_results.append( asc_item_common_logic.get_error_authorized_result( region_name, bucket_name, error_operation, error_code, error_message)) is_authorized = False continue else: return CheckResult.Error # 取得したS3バケットのアクセスコントロールリスト情報をS3に保存する。(アクセスコントロールリスト情報) try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/S3_ACL_" + region_name + "_" + bucket_name + ".json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", bucket_acl, s3_file_name, is_cw_logger=True) except PmError as e: cw_logger.error("[%s] S3バケットACL情報のS3保存に失敗しました。(%s)/(%s)", aws_account, region_name, bucket_name) return CheckResult.Error # 取得したS3バケットのバケットポリシー情報をS3に保存する。(バケットポリシー情報) try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/S3_Bucketpolicy_" + region_name + "_" + bucket_name + ".json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", bucket_policy, s3_file_name, is_cw_logger=True) except PmError as e: cw_logger.error("[%s] S3バケットポリシー情報のS3保存に失敗しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # チェック処理 bucket_acl_abnormity = False bucket_policy_abnormity = False try: # Check-1. ACLによりAllUsersに操作権限が与えられたS3バケットが存在するか # Check-2. ACLによりAuthenticatedUsersに操作権限が与えられたS3バケットが存在するか for grant in bucket_acl["Grants"]: if (common_utils.check_key("URI", grant['Grantee'])): if grant['Grantee']["URI"] in ACL_URI: bucket_acl_abnormity = True break # Check-3. バケットポリシーのプリンシパルにて全てのユーザに操作権限が与えられたS3バケットが存在するか bucket_policy = ast.literal_eval(bucket_policy['Policy']) for statement in bucket_policy["Statement"]: if (statement["Effect"] == CommonConst.ALLOW and statement["Principal"] == CommonConst.ALL): bucket_policy_abnormity = True break if bucket_acl_abnormity is True or bucket_policy_abnormity is True: check_results.append( get_check_accessible_result(region_name, bucket_acl_abnormity, bucket_policy_abnormity, bucket_name)) except Exception as e: cw_logger.error("[%s] チェック処理中にエラーが発生しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # Export File CHECK_ASC_ITEM_12_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_bucket = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_bucket, result_json_path, format_json=True, is_cw_logger=True) except Exception as e: cw_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if is_authorized is False: return CheckResult.Error if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_asc_item_07_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): cw_logger = common_utils.begin_cw_logger(trace_id, __name__, inspect.currentframe()) check_results = [] try: regions = aws_common.get_regions(trace_id, session, is_cw_logger=True) except PmError as e: cw_logger.error("Regionの情報の取得に失敗しました。") raise common_utils.write_log_pm_error(e, cw_logger) for region in regions: region_name = region["RegionName"] if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, aws_account, is_cw_logger=True) try: # EBS情報を取得する。 ebs_volumes = Ec2Utils.describe_volumes(trace_id, aws_account, ec2_client, region_name, is_cw_logger=True) except PmError as e: return CheckResult.Error # 取得件数が0件の場合、ログを出力し、次のリージョンの処理に進みます。 if (len(ebs_volumes) == 0): cw_logger.info("[%s/%s] EBSボリューム情報の取得件数が0でした。", aws_account, region_name) continue try: # 取得したEBS情報をS3に保存する(EBS情報ファイル)。 s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/EBS_Volumes_" + region_name + ".json") FileUtils.upload_s3(trace_id, ebs_volumes, s3_file_name, True, is_cw_logger=True) except PmError as e: cw_logger.error("[%s/%s] EBSボリューム情報情報のS3保存に失敗しました。", aws_account, region_name) return CheckResult.Error # チェックルール try: for ebs_volume in ebs_volumes: if (ebs_volume['Encrypted'] is False): check_result = get_check_asc_item_07_01_result( ebs_volume, region_name) check_results.append(check_result) except PmError as e: cw_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", aws_account, region_name) return CheckResult.Error # Export File ASC/CHECK_ ASC_ITEM_07_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_acs_item_7_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_acs_item_7_01, result_json_path, format_json=True, is_cw_logger=True) except Exception as e: cw_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_cis_metric(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, check_item_code, level_code, check_result): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] is_all_region_enable = False is_check5_successful = False # Get all region try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: try: region_name = region["RegionName"] if region_name in REGION_IGNORE: continue # Default value check is_region_error = True try: cloud_trails = cis_item_common_logic.get_cloud_trails( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, session) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) logs_client = LogsUtils.get_logs_client(trace_id, session, region_name, awsaccount) cloudwatch_client = CloudWatchlUtils.get_cloudwatch_client( trace_id, session, region_name, awsaccount) sns_client = SNSUtils.get_sns_client(trace_id, session, region_name, awsaccount) trail_client = CloudTrailUtils.get_trail_client( trace_id, session, region_name, awsaccount) for cloud_trail in cloud_trails: try: # Check-0. マルチリージョン設定されたCloudTrailが存在するか。 trail_status = cis_item_common_logic.get_trails_status( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, trail_client, cloud_trail) if (len(trail_status) == 0): continue event_selectors = cis_item_common_logic.get_trail_event_selectors( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, trail_client, cloud_trail) # 全リージョンに対し有効なCloudTrailが存在するか # ロギングが有効か if (is_all_region_enable is False and cloud_trail['IsMultiRegionTrail'] is True and trail_status['IsLogging'] is True): # すべての管理操作の書き込みが有効か for event_selector in event_selectors: if (event_selector['IncludeManagementEvents'] is True and event_selector['ReadWriteType'] == CommonConst.EVENT_SELECTOR_READ_WRITE_TYPE_ALL): is_all_region_enable = True break if (is_all_region_enable is False): continue # Check-1. CloudTrailのロググループに対してメトリクスは設定されているか。 if common_utils.check_key( 'CloudWatchLogsLogGroupArn', cloud_trail ) is False or not cloud_trail['CloudWatchLogsLogGroupArn']: continue # Check-2. 許可されていないAPIコールに対するメトリクスは設定されているか。 metric_filters = describe_metric_filters( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, logs_client, cloud_trail['CloudWatchLogsLogGroupArn'].split(":")[6]) list_filter_pattern_result = get_list_filter_pattern_match_result( trace_id, check_item_code, metric_filters) if (not list_filter_pattern_result): continue # Check-3. メトリクスに対しアラームは設定されているか。 metric_alarms = describe_alarms( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, cloudwatch_client) metric_names = [] for filter_pattern_result in list_filter_pattern_result: metric_names.extend( jmespath.search( 'metricTransformations[*].metricName', filter_pattern_result)) metric_alarms_matching = [] for metric_alarm in metric_alarms: pm_logger.info( "アラーム名=%s", common_utils.get_value("AlarmName", metric_alarm)) if (common_utils.check_key('MetricName', metric_alarm) is True and metric_alarm['MetricName'] in metric_names): metric_alarms_matching.append(metric_alarm) if not metric_alarms_matching: continue # Check-4. アラームからキックされたSNSに対し通知先は設定されているか。 for metric_alarm in metric_alarms_matching: for alarm_action in metric_alarm['AlarmActions']: if alarm_action.startswith(CommonConst.ARN_SNS): subscriptions = list_subscriptions_by_topic( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, sns_client, alarm_action) if len(subscriptions) > 0: is_region_error = False break # Check-5. 設定されたCloudTrailは全Region有効なTrailか。 if (is_region_error is False and is_all_region_enable is True): is_check5_successful = True break except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_exception(e, pm_logger) if is_check5_successful is True: check_results = [] break if (is_region_error is True): result = {'Region': region_name, 'Level': level_code} check_results.append(result) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) if not pm_error.pm_notification_error: pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) else: pm_error.pm_notification_error.check_item_code = check_item_code pm_error.pm_notification_error.aws_account = awsaccount pm_error.pm_notification_error.region = region_name raise common_utils.write_log_pm_error(pm_error, pm_logger) # 検出結果を1つのチェック結果JSONファイルに保存する。 try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_cis_item_3 = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_cis_item_3, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) if len(check_results) > 0: return check_result return CheckResult.Normal
def check_asc_item_16_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] is_authorized = True # 取得したクレデンシャル情報を使用して、S3クライアントを作成します。 try: s3_client = S3Utils.get_s3_client(trace_id, session, aws_account) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) # S3バケット一覧を取得します。 try: list_buckets = asc_item_common_logic.get_list_buckets( trace_id, check_history_id, organization_id, project_id, s3_client, aws_account) except PmError as e: return CheckResult.Error for bucket in list_buckets["Buckets"]: bucket_name = bucket['Name'] region_name = None try: # 取得したS3バケット一覧情報ファイルをもとに、各バケットのリージョンを取得する。 region_name = S3Utils.get_bucket_location(trace_id, s3_client, bucket_name, aws_account) if region_name is None: region_name = CommonConst.US_EAST_REGION # 取得したS3バケット情報ファイルをもとに、該当のS3バケットのアクセスコントロールリストを取得する。 bucket_acl = get_bucket_acl( trace_id, check_history_id, organization_id, project_id, aws_account, region_name, bucket_name, s3_client) # 取得したS3バケット情報をもとに、S3のロギング情報を取得する。 bucket_logging = S3Utils.get_bucket_logging( trace_id, aws_account, s3_client, bucket_name, region_name) except PmError as e: if e.cause_error.response['Error'][ 'Code'] in CommonConst.S3_SKIP_EXCEPTION: error_operation = e.cause_error.operation_name, error_code = e.cause_error.response['Error']['Code'], error_message = e.cause_error.response['Error']['Message'] if region_name is None: region_name = CommonConst.ERROR check_results.append( asc_item_common_logic.get_error_authorized_result( region_name, bucket_name, error_operation, error_code, error_message)) is_authorized = False continue else: return CheckResult.Error # 取得したS3ロギング情報をS3に保存する(リソース情報ファイル)。 try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/S3_ClientLogging_" + region_name + "_" + bucket_name + ".json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", bucket_logging, s3_file_name) except PmError as e: pm_logger.error("[%s] S3バケットロギング情報の取得に失敗しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # チェック処理 bucket_abnormity = True try: # Check-1. ACLによりLogDeliveryに操作権限が与えられたS3バケットが存在するか for grant in bucket_acl["Grants"]: if (common_utils.check_key("URI", grant['Grantee']) and grant['Grantee']["URI"] == LOG_DELIVERY_URI): bucket_abnormity = False break # Check-2. S3バケットでログ記録が有効になっていないものは存在するか if bucket_abnormity is True and len(bucket_logging) == 0: result = { 'Region': region_name, 'Level': CommonConst.LEVEL_CODE_21, 'DetectionItem': { 'BucketName': bucket_name } } check_results.append(result) except Exception as e: pm_logger.error("[%s] チェック処理中にエラーが発生しました。(%s/%s)", aws_account, region_name, bucket_name) return CheckResult.Error # Export File CHECK_ASC_ITEM_16_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_asc_item_16_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_asc_item_16_01, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if is_authorized is False: return CheckResult.Error if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_ibp_item_14_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] cloud_front_client = CloudFrontUtils.get_cloud_front_client( trace_id, session, aws_account) # CloudFrontディストリビューションの一覧を取得する try: distribution_list = CloudFrontUtils.get_list_distributions( trace_id, cloud_front_client, aws_account) except PmError as e: return CheckResult.Error # 取得したディストリビューション一覧情報をS3に保存する(ディストリビューション一覧ファイル)。 try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "IBP/CloudFront_list_distributions.json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", distribution_list, s3_file_name) except PmError as e: pm_logger.error("[%s] ディストリビューション一覧情報のS3保存に失敗しました。", aws_account) return CheckResult.Error # Check-1. CloudFrontディストリビューションが存在するか is_exist_distribution_cloudFront = False try: if len(distribution_list) > 0: is_exist_distribution_cloudFront = True except Exception as e: pm_logger.error("[%s] チェック処理中にエラーが発生しました。", aws_account) return CheckResult.Error if is_exist_distribution_cloudFront is True: for distribution in distribution_list: distribution_id = distribution['Id'] # ディストリビューション一覧をもとに、各ディストリビューションの情報を取得します。 try: info_distribution = CloudFrontUtils.get_distribution( trace_id, cloud_front_client, distribution_id, aws_account) except PmError as e: return CheckResult.Error # ディストリビューション情報をS3に保管します。 try: s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "IBP/CloudFront_" + distribution_id + ".json") FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", info_distribution, s3_file_name) except PmError as e: pm_logger.error("[%s] ディストリビューション情報のS3保存に失敗しました。(%s)", aws_account, distribution_id) return CheckResult.Error # Check-2. CloudFrontのログ設定が無効なディストリビューションが存在するか try: if info_distribution['DistributionConfig']['Logging'][ 'Enabled'] is False: check_results.append( get_check_ibp_item_14_01_result(distribution_id)) except Exception as e: pm_logger.error("[%s] チェック処理中にエラーが発生しました。(%s)", aws_account, distribution_id) return CheckResult.Error # Export File CHECK_IBP_ITEM_14_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_ibp_item_14_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", check_ibp_item_14_01, result_json_path) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def execute_delete_invalid_user(trace_id): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) # Get Cognito UserPools status UNCONFIRMED try: list_user_unconfirmed = aws_common.get_cognito_user_pools( trace_id, CommonConst.COGNITO_STATUS_UNCONFIRMED, attribute_filter=CommonConst.ATTRIBUTE_FILTER_USER_STATUS) except PmError as e: pm_logger.error("[%s]Cognitoユーザー一覧情報取得に失敗しました。", CommonConst.COGNITO_STATUS_UNCONFIRMED) raise common_utils.write_log_pm_error(e, pm_logger) # get current date current_date_time = date_utils.toDate( date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS), date_utils.UTC) # loop user cognito UserPools status UNCONFIRMED for user_unconfirmed in list_user_unconfirmed: user_create_date = date_utils.toDate( date_utils.toString(user_unconfirmed['UserCreateDate'], date_utils.PATTERN_YYYYMMDDHHMM), date_utils.UTC) if date_utils.difference_days( user_create_date, current_date_time) > CommonConst.TERM_USER_UNCONFIRMED_DAY: # delete Cognito UserPools status UNCONFIRMED update period greater than 1 days try: aws_common.delete_cognito_user_by_user_name( trace_id, user_unconfirmed['Username']) except PmError as e: pm_logger.warning("CognitoでUserName = %sのユーザー削除に失敗しました。", user_unconfirmed['Username']) raise common_utils.write_log_pm_error(e, pm_logger) # Get Cognito UserPools status FORCE_CHANGE_PASSWORD try: list_user_force_change_password = aws_common.get_cognito_user_pools( trace_id, CommonConst.COGNITO_STATUS_FORCE_CHANGE_PASSWORD, attribute_filter=CommonConst.ATTRIBUTE_FILTER_USER_STATUS) except PmError as e: pm_logger.error("[%s]Cognitoユーザー一覧情報取得に失敗しました。", CommonConst.COGNITO_STATUS_FORCE_CHANGE_PASSWORD) raise common_utils.write_log_pm_error(e, pm_logger) current_date = date_utils.toDate( date_utils.toString(current_date_time, date_utils.PATTERN_YYYYMMDD_SLASH), date_utils.UTC) # loop user cognito UserPools status FORCE_CHANGE_PASSWORD for user_force_change_password in list_user_force_change_password: user_create_date = date_utils.toDate( date_utils.toString(user_force_change_password['UserCreateDate'], date_utils.PATTERN_YYYYMMDD_SLASH), date_utils.UTC) if date_utils.difference_days( user_create_date, current_date ) > CommonConst.TERM_USER_FORCE_CHANGE_PASSWORD_DAY: # get list affiliations try: affiliations = pm_affiliation.query_userid_key( trace_id, user_force_change_password['Username']) except PmError as e: pm_logger.warning( "PM_Affiliationテーブルにて、UserID = %sのレコード取得に失敗しました。", user_force_change_password['Username']) raise common_utils.write_log_pm_error(e, pm_logger) # delete affiliations user status FORCE_CHANGE_PASSWORD update period greater than 6 days for affiliation in affiliations: try: pm_affiliation.delete_affiliation( affiliation['UserID'], affiliation['OrganizationID']) except PmError as e: pm_logger.warning( "PM_Affiliationテーブルのレコード削除に失敗しました。UserID : %s / OrganizationID : %s", affiliation['UserID'], affiliation['OrganizationID']) raise common_utils.write_log_pm_error(e, pm_logger) # delete Cognito UserPools status FORCE_CHANGE_PASSWORD update period greater than 6 days try: aws_common.delete_cognito_user_by_user_name( trace_id, user_force_change_password['Username']) except PmError as e: pm_logger.warning("CognitoでUserName = %sのユーザー削除に失敗しました。", user_force_change_password['Username']) raise common_utils.write_log_pm_error(e, pm_logger)
def execute_security_group_port(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, port, check_item_code, excluded_resources): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] # Export File VPC_SecurityGroups_{region}.json try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: region_name = region["RegionName"] try: if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, awsaccount) s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SecurityGroups_" + region_name + ".json") if (aws_common.check_exists_file_s3(trace_id, "S3_CHECK_BUCKET", s3_file_name)) is True: try: security_groups = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: security_groups = Ec2Utils.describe_security_groups( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(security_groups) == 0): pm_logger.info("[%s/%s] セキュリティグループ情報の取得件数が0でした。", awsaccount, region_name) continue try: FileUtils.upload_s3(trace_id, security_groups, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] セキュリティグループ情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) try: for security_group in security_groups: # check excluded resources resource_name = security_group['GroupId'] if common_utils.check_excluded_resources( check_item_code, region_name, ResourceType.GroupId, resource_name, excluded_resources): continue for ip_permission in security_group['IpPermissions']: if ip_permission['IpProtocol'] != '-1': if ip_permission['IpProtocol'] != CommonConst.TCP: continue if common_utils.check_key( 'FromPort', ip_permission ) is False or ip_permission['FromPort'] > port: continue if common_utils.check_key( 'ToPort', ip_permission ) is False or ip_permission['ToPort'] < port: continue for ip_range in ip_permission['IpRanges']: if common_utils.check_key('CidrIp', ip_range): if (CommonConst.CIDR_IP_NOT_SECURITY == ip_range['CidrIp']): check_result = get_check_result( security_group, ip_permission, ip_range, region_name) check_results.append(check_result) break except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) result_security_group = CheckResult.Normal if (len(check_results) > 0): result_security_group = CheckResult.CriticalDefect # 検出結果を1つのチェック結果JSONファイルに保存する。 try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_rule_security_group = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_rule_security_group, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) return result_security_group
def check_cis_item_4_03(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, check_item_code, excluded_resources): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: region_name = region["RegionName"] try: if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, awsaccount) # 対象のAWSアカウントのリージョンごと(GovCloud、北京を除く)にセキュリティグループ情報を取得する。 s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SecurityGroups_" + region_name + ".json") if (aws_common.check_exists_file_s3(trace_id, "S3_CHECK_BUCKET", s3_file_name)) is True: try: security_groups = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: security_groups = Ec2Utils.describe_security_groups( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(security_groups) == 0): pm_logger.info("[%s/%s] セキュリティグループ情報の取得件数が0でした。", awsaccount, region_name) try: if (len(security_groups) > 0): FileUtils.upload_s3(trace_id, security_groups, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] セキュリティグループ情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) # 対象のAWSアカウントのリージョンごと(GovCloud、北京を除く)にEC2インスタンス情報を取得する。 s3_file_name_iam_instances = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "IAM_Instances_" + region_name + ".json") if (aws_common.check_exists_file_s3( trace_id, "S3_CHECK_BUCKET", s3_file_name_iam_instances)) is True: try: reservation_instances = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name_iam_instances) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: reservation_instances = Ec2Utils.describe_instances( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(reservation_instances) == 0): pm_logger.info("[%s/%s] EC2インスタンス情報の取得件数が0でした。", awsaccount, region_name) try: if (len(reservation_instances) > 0): s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SG_Instances_" + region_name + ".json") FileUtils.upload_s3(trace_id, reservation_instances, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] EC2インスタンス情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) check1 = [] check2 = [] try: # リソース情報ファイルのセキュリティグループ情報から、インバウンドルール、アウトバウンドルールを設定しているdefaultセキュリティグループを検出する。 for security_group in security_groups: # check excluded resources resource_name = security_group['GroupId'] if common_utils.check_excluded_resources( check_item_code, region_name, ResourceType.GroupId, resource_name, excluded_resources): continue if (security_group['GroupName'] == CommonConst.DEFAULT and len(security_group['IpPermissions']) > 0 and len(security_group['IpPermissionsEgress']) > 0): check1.append(security_group['GroupId']) # リソース情報ファイルのEC2インスタンス情報から、defaultセキュリティグループをアタッチしたEC2インスタンスを検出する、。 for reservation_instance in reservation_instances: for instance in reservation_instance['Instances']: for security_group in instance['SecurityGroups']: if security_group[ 'GroupName'] == CommonConst.DEFAULT: if common_utils.check_key('Tags', instance) is True: name_tag = next( filter( lambda tag: tag['Key'] == 'Name', instance['Tags']), None) instance[ 'InstanceName'] = None if name_tag is None else name_tag[ 'Value'] check2.append(instance) if (len(check1) > 0 or len(check2) > 0): check_results.append( get_check_cis_item_4_03_result(check1, check2, region_name)) except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) # Export File CHECK_CIS12_ITEM_4_03.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_cis_item_4_03 = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_cis_item_4_03, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) # チェック結果 if len(check_results) > 0: return CheckResult.MinorInadequacies return CheckResult.Normal
def execute_check_results_assessment(trace_id, check_item_code, check_history_id, organization_id, project_id, aws_account, result_json_path, level): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) s3_file_name = CommonConst.PATH_CHECK_RAW.format(check_history_id, organization_id, project_id, aws_account, "Assessment_Result.json") try: # リソース情報取得 if (aws_common.check_exists_file_s3(trace_id, "S3_CHECK_BUCKET", s3_file_name)) is True: try: assessment_items = FileUtils.read_json(trace_id, "S3_CHECK_BUCKET", s3_file_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: assessment_items = pm_assessmentItems.query_organization_index_filter_awsaccount( trace_id, organization_id, project_id, aws_account) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) # 取得したクエリ結果をS3に保存します。(リソース情報ファイル) try: FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", assessment_items, s3_file_name) except PmError as e: pm_logger.error("[%s] リソース情報ファイのS3保存に失敗しました。", aws_account) # チェック処理 try: check_results = [] assessment_result = None for assessment_item in assessment_items: if (assessment_item['CheckItemCode'] == check_item_code): assessment_result = { 'AssessmentComment': common_utils.get_value('AssessmentComment', assessment_item), 'UserID': common_utils.get_value('UserID', assessment_item), 'MailAddress': common_utils.get_value('MailAddress', assessment_item), 'CreatedAt': assessment_item['CreatedAt'] } break if (assessment_result is None): LEVEL_DIVISION = { "1": CommonConst.LEVEL_CODE_21, # 重大な不備 "2": CommonConst.LEVEL_CODE_11 # 軽微な不備 } result = { 'Region': 'Global', 'Level': LEVEL_DIVISION[level], 'DetectionItem': { 'NoEvaluation': True } } check_results.append(result) except Exception as e: pm_logger.error("[%s] チェック処理中にエラーが発生しました。", aws_account) raise common_utils.write_log_exception(e, pm_logger) # チェック結果JSONファイル try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_result_json = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } if assessment_result is not None: check_result_json['AssessmentResult'] = assessment_result FileUtils.upload_json(trace_id, "S3_CHECK_BUCKET", check_result_json, result_json_path) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) raise common_utils.write_log_exception(e, pm_logger) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) # チェック結果 if len(check_results) == 0: return CheckResult.Normal elif (level == CommonConst.LEVEL_CODE_1): return CheckResult.CriticalDefect return CheckResult.MinorInadequacies