Merge pull request #2124 from AkhtarAmir/update-access-analyzer-active-finding-v2

alphadev4 · web-flow · commit 3d9db6fe9dfe · 2025-01-27T19:39:38.000+05:00
Update access analyzer active findings v2
diff --git a/collectors/aws/accessanalyzer/listFindingsV2.js b/collectors/aws/accessanalyzer/listFindingsV2.js
@@ -0,0 +1,49 @@
+var AWS = require('aws-sdk');
+var async = require('async');
+var helpers = require(__dirname + '/../../../helpers/aws');
+
+module.exports = function(AWSConfig, collection, retries, callback) {
+    var accessanalyzer = new AWS.AccessAnalyzer(AWSConfig);
+    async.eachLimit(collection.accessanalyzer.listAnalyzers[AWSConfig.region].data, 15, function(analyzer, cb) {
+        collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn] = {};
+        var params = {
+            analyzerArn: analyzer.arn
+        };
+
+        var paginating = false;
+        var paginateCb = function(err, data) {
+            if (err) collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn].err = err;
+
+            if (!data) return cb();
+
+            if (paginating && data.findings && data.findings.length &&
+                collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn].data.findings &&
+                collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn].data.findings.length) {
+                collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn].data.findings = collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data.findings.concat(data.findings);
+            } else {
+                collection.accessanalyzer.listFindingsV2[AWSConfig.region][analyzer.arn].data = data;
+            }
+
+            if (data.nextToken && data.nextToken.length) {
+                paginating = true;
+                return execute(data.nextToken);
+            }
+
+            cb();
+        };
+
+        function execute(nextToken) { // eslint-disable-line no-inner-declarations
+            var localParams = JSON.parse(JSON.stringify(params || {}));
+            if (nextToken) localParams['nextToken'] = nextToken;
+            if (nextToken) {
+                helpers.makeCustomCollectorCall(accessanalyzer, 'listFindingsV2', localParams, retries, null, null, null, paginateCb);
+            } else {
+                helpers.makeCustomCollectorCall(accessanalyzer, 'listFindingsV2', params, retries, null, null, null, paginateCb);
+            }
+        }
+
+        execute();
+    }, function(){
+        callback();
+    });
+};
diff --git a/helpers/aws/api.js b/helpers/aws/api.js
@@ -1833,8 +1833,14 @@ var postcalls = [
                 reliesOnCall: 'listAnalyzers',
                 override: true
             },
+            listFindingsV2: {
+                reliesOnService: 'accessanalyzer',
+                reliesOnCall: 'listAnalyzers',
+                override: true
+            },
             sendIntegration: serviceMap['IAM'][0]
         },
+        
         APIGateway: {
             getStages: {
                 reliesOnService: 'apigateway',
@@ -2684,7 +2690,7 @@ var postcalls = [
                 reliesOnCall: 'listFunctions',
                 filterKey: 'FunctionName',
                 filterValue: 'FunctionName',
-                rateLimit: 100, // it's not documented but experimentially 10/second works.
+                rateLimit: 100, // it's not documented but experimental 10/second works.
             },
             getFunction: {
                 reliesOnService: 'lambda',
diff --git a/plugins/aws/accessanalyzer/accessAnalyzerActiveFindings.js b/plugins/aws/accessanalyzer/accessAnalyzerActiveFindings.js
@@ -11,7 +11,7 @@ module.exports = {
         'You can view IAM Access Analyzer findings at any time. Work through all of the findings in your account until you have zero active findings.',
     link: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-work-with-findings.html',
     recommended_action: 'Investigate into active findings in your account and do the needful until you have zero active findings.',
-    apis: ['AccessAnalyzer:listAnalyzers', 'AccessAnalyzer:listFindings'],
+    apis: ['AccessAnalyzer:listAnalyzers', 'AccessAnalyzer:listFindings', 'AccessAnalyzer:listFindingsV2'],
     realtime_triggers: ['accessanalyzer:CreateAnalyzer','accessanalyzer:DeleteAnalyzer','accessanalyzer:CreateArchiveRule','accessanalyzer:StartResourceScan'],
 
     run: function(cache, settings, callback) {
@@ -40,19 +40,32 @@ module.exports = {
                 if (!analyzer.arn) continue;
 
                 let resource = analyzer.arn;
+                let totalFiltered = [];
 
                 var listFindings = helpers.addSource(cache, source,
                     ['accessanalyzer', 'listFindings', region, analyzer.arn]);
 
-                if (!listFindings || listFindings.err || !listFindings.data) {
+                if (listFindings && !listFindings.err && listFindings.data) {
+                    let filtered = listFindings.data.findings.filter(finding => finding.status === 'ACTIVE');
+                    totalFiltered = totalFiltered.concat(filtered);
+                }
+
+                var listFindingsV2 = helpers.addSource(cache, source,
+                    ['accessanalyzer', 'listFindingsV2', region, analyzer.arn]);
+
+                if (listFindingsV2 && !listFindingsV2.err && listFindingsV2.data) {
+                    let filteredv2 = listFindingsV2.data.findings.filter(finding => finding.status === 'ACTIVE');
+                    totalFiltered = totalFiltered.concat(filteredv2);
+                }
+                
+                if ((!listFindings || listFindings.err || !listFindings.data) && (!listFindingsV2 || listFindingsV2.err || !listFindingsV2.data)) {
                     helpers.addResult(results, 3,
-                        `Unable to IAM Access Analyzer findings: ${helpers.addError(listFindings)}`,
+                        `Unable to IAM Access Analyzer findings: ${helpers.addError(listFindings)} ${helpers.addError(listFindingsV2)}`,
                         region, resource);
                     continue;
                 } 
                 
-                let filtered = listFindings.data.findings.filter(finding => finding.status === 'ACTIVE');
-                if (!filtered.length) {
+                if (!totalFiltered.length) {
                     helpers.addResult(results, 0,
                         'Amazon IAM Access Analyzer has no active findings',
                         region, resource);
diff --git a/plugins/aws/accessanalyzer/accessAnalyzerActiveFindings.spec.js b/plugins/aws/accessanalyzer/accessAnalyzerActiveFindings.spec.js
@@ -138,6 +138,83 @@ const listFindings = [
         
 ];
 
+const listFindingsV2 = [
+{
+    "findings": [
+            {
+                "analyzedAt": "2025-01-23T13:06:24+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "1a234567-bc6d-7yui-h5j7-4f5f9j8987y0",
+                "resource": "arn:aws:iam::123456789123:role/abcd-abcd-adfitoui-abcdefg-p1-AsdfghTfjdudnjkDkjg-Z9JgMyMzcxOZ",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "ACTIVE",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedIAMRole"
+            },
+            {
+                "analyzedAt": "2025-01-23T13:06:24+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "938r4848-4h4j-8449-76d8-8768dh5dhh4u",
+                "resource": "arn:aws:iam::123456789123:role/abcd-abcd-adfitoui-abcdefg-AsdfghTfjdudnjkDkjg-6vzrTVSqTaNe",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "ACTIVE",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedIAMRole"
+            },
+            {
+                "analyzedAt": "2025-01-23T13:06:55+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "7484f848-984j-498l-784s-yryh74748f45",
+                "resource": "arn:aws:iam::123456789123:role/service-role/sdfghyFj-FGH-njkkjg-plgd-6uhjn9ok",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "ACTIVE",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedPermission"
+            },
+        ]
+},
+{
+    "findings": [
+            {
+                "analyzedAt": "2025-01-23T13:06:24+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "1a234567-bc6d-7yui-h5j7-4f5f9j8987y0",
+                "resource": "arn:aws:iam::123456789123:role/abcd-abcd-adfitoui-abcdefg-p1-AsdfghTfjdudnjkDkjg-Z9JgMyMzcxOZ",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "ARCHIVED",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedIAMRole"
+            },
+            {
+                "analyzedAt": "2025-01-23T13:06:24+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "938r4848-4h4j-8449-76d8-8768dh5dhh4u",
+                "resource": "arn:aws:iam::123456789123:role/abcd-abcd-adfitoui-abcdefg-AsdfghTfjdudnjkDkjg-6vzrTVSqTaNe",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "ARCHIVED",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedIAMRole"
+            },
+            {
+                "analyzedAt": "2025-01-23T13:06:55+00:00",
+                "createdAt": "2025-01-23T13:06:56+00:00",
+                "id": "7484f848-984j-498l-784s-yryh74748f45",
+                "resource": "arn:aws:iam::123456789123:role/service-role/sdfghyFj-FGH-njkkjg-plgd-6uhjn9ok",
+                "resourceType": "AWS::IAM::Role",
+                "resourceOwnerAccount": "123456789123",
+                "status": "RESOLVED",
+                "updatedAt": "2025-01-23T13:06:56+00:00",
+                "findingType": "UnusedPermission"
+            },
+        ]
+}
+
+]
 
 const createCache = (analyzer, listFindings, analyzerErr, listFindingsErr) => {
     var analyzerArn = (analyzer && analyzer.length) ? analyzer[0].arn: null;
@@ -163,7 +240,7 @@ const createCache = (analyzer, listFindings, analyzerErr, listFindingsErr) => {
 
 describe('accessAnalyzerActiveFindings', function () {
     describe('run', function () {
-        it('should FAIL if Amazon IAM access analyzer has active findings.', function (done) {
+        it('should FAIL if Amazon IAM access analyzer V1 has active findings.', function (done) {
             const cache = createCache(listAnalyzers, listFindings[0]);
             accessAnalyzerActiveFindings.run(cache, {}, (err, results) => {
                 expect(results.length).to.equal(1);
@@ -174,7 +251,18 @@ describe('accessAnalyzerActiveFindings', function () {
             });
         });
 
-        it('should PASS if Amazon IAM access analyzer have no active findings.', function (done) {
+        it('should FAIL if Amazon IAM access analyzer v2 has active findings.', function (done) {
+            const cache = createCache(listAnalyzers, listFindingsV2[0]);
+            accessAnalyzerActiveFindings.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].region).to.equal('us-east-1');
+                expect(results[0].message).to.include('Amazon IAM Access Analyzer has active findings');
+                done();
+            });
+        });
+
+        it('should PASS if Amazon IAM access analyzer V1 have no active findings.', function (done) {
             const cache = createCache(listAnalyzers, listFindings[1]);
             accessAnalyzerActiveFindings.run(cache, {}, (err, results) => {
                 expect(results.length).to.equal(1);
@@ -186,6 +274,19 @@ describe('accessAnalyzerActiveFindings', function () {
             });
         });
 
+
+        it('should PASS if Amazon IAM access analyzer V2 have no active findings.', function (done) {
+            const cache = createCache(listAnalyzers, listFindingsV2[1]);
+            accessAnalyzerActiveFindings.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].region).to.equal('us-east-1');
+                expect(results[0].message).to.include('Amazon IAM Access Analyzer has no active findings');
+                
+                done();
+            });
+        });
+
         it('should PASS if no analyzers found', function (done) {
             const cache = createCache([]);
             accessAnalyzerActiveFindings.run(cache, {}, (err, results) => {
diff --git a/plugins/azure/advisor/checkAdvisorRecommendations.js b/plugins/azure/advisor/checkAdvisorRecommendations.js
@@ -8,7 +8,7 @@ module.exports = {
     severity: 'Medium',
     description: 'Ensure that all Microsoft Azure Advisor recommendations found are implemented to optimize your cloud deployments, increase security, and reduce costs.',
     more_info: 'Advisor service analyzes your Azure cloud configurations and resource usage telemetry to provide personalized and actionable recommendations that can help you optimize your cloud resources for security, reliability and high availability, operational excellence, performance efficiency, and cost.',
-    recommended_action: 'Implement all Microsoft Azurer Adivsor recommendations.',
+    recommended_action: 'Implement all Microsoft Azurer Advisor recommendations.',
     link: 'https://learn.microsoft.com/en-us/azure/advisor/advisor-get-started',
     apis: ['advisor:recommendationsList'],
 
diff --git a/plugins/azure/automationAccounts/automationAcctExpiredWebhooks.spec.js b/plugins/azure/automationAccounts/automationAcctExpiredWebhooks.spec.js
@@ -1,5 +1,7 @@
 var expect = require('chai').expect;
 var automationAcctExpiredWebhooks = require('./automationAcctExpiredWebhooks');
+var nextMonthExpiry = new Date();
+nextMonthExpiry.setMonth(nextMonthExpiry.getMonth() + 1);
 
 const automationAccounts = [
     {
@@ -31,7 +33,7 @@ const webhooks = [
         "id": "/subscriptions/12345/resourceGroups/test-rg/providers/Microsoft.Automation/automationAccounts/test-automationacct/webhooks/test1",
         "name": "test1",
         "creationTime": "2024-01-22T13:33:52.1066667+00:00",
-        "expiryTime": "2025-01-22T13:33:52.1066667+00:00",
+        "expiryTime": nextMonthExpiry,
     },
     {
         "id": "/subscriptions/12345/resourceGroups/test-rg/providers/Microsoft.Automation/automationAccounts/test-automationacct/webhooks/test2",
