2017-02-01 21:27:10 +00:00
|
|
|
class AwsIamUser < Inspec.resource(1)
|
|
|
|
name 'aws_iam_user'
|
|
|
|
desc 'Verifies settings for AWS IAM user'
|
2019-03-19 14:17:32 +00:00
|
|
|
example <<~EXAMPLE
|
2017-12-08 18:34:09 +00:00
|
|
|
describe aws_iam_user(username: 'test_user') do
|
2017-10-27 15:06:49 +00:00
|
|
|
it { should have_mfa_enabled }
|
2017-10-27 20:31:36 +00:00
|
|
|
it { should_not have_console_password }
|
2018-04-17 17:22:28 +00:00
|
|
|
it { should_not have_inline_user_policies }
|
|
|
|
it { should_not have_attached_user_policies }
|
2017-02-01 21:27:10 +00:00
|
|
|
end
|
2019-03-19 14:17:32 +00:00
|
|
|
EXAMPLE
|
2018-02-08 04:26:37 +00:00
|
|
|
supports platform: 'aws'
|
2017-02-01 21:27:10 +00:00
|
|
|
|
2018-02-08 04:26:37 +00:00
|
|
|
include AwsSingularResourceMixin
|
2018-04-17 17:22:28 +00:00
|
|
|
attr_reader :access_keys, :attached_policy_names, :attached_policy_arns, \
|
|
|
|
:has_console_password, :has_mfa_enabled, :inline_policy_names, :username
|
2017-12-08 18:34:09 +00:00
|
|
|
alias has_mfa_enabled? has_mfa_enabled
|
|
|
|
alias has_console_password? has_console_password
|
2017-11-22 13:30:18 +00:00
|
|
|
|
2017-12-08 18:34:09 +00:00
|
|
|
def name
|
2019-04-12 14:55:36 +00:00
|
|
|
Inspec.deprecate(:properties_aws_iam_user, 'The aws_iam_user `name` property is deprecated. Please use `username` instead')
|
2017-12-08 18:34:09 +00:00
|
|
|
username
|
2017-02-01 21:27:10 +00:00
|
|
|
end
|
|
|
|
|
2017-12-08 18:34:09 +00:00
|
|
|
def to_s
|
|
|
|
"IAM User #{username}"
|
2017-02-01 21:27:10 +00:00
|
|
|
end
|
2017-06-13 05:36:43 +00:00
|
|
|
|
2018-04-17 17:22:28 +00:00
|
|
|
def has_attached_policies?
|
|
|
|
return nil unless exists?
|
|
|
|
!attached_policy_names.empty?
|
|
|
|
end
|
|
|
|
|
|
|
|
def has_inline_policies?
|
|
|
|
return nil unless exists?
|
|
|
|
!inline_policy_names.empty?
|
|
|
|
end
|
|
|
|
|
2017-12-08 18:34:09 +00:00
|
|
|
private
|
2017-06-13 05:36:43 +00:00
|
|
|
|
2017-12-08 18:34:09 +00:00
|
|
|
def validate_params(raw_params)
|
|
|
|
validated_params = check_resource_param_names(
|
|
|
|
raw_params: raw_params,
|
|
|
|
allowed_params: [:username, :aws_user_struct, :name, :user],
|
|
|
|
allowed_scalar_name: :username,
|
|
|
|
allowed_scalar_type: String,
|
|
|
|
)
|
|
|
|
# If someone passed :name, rename it to :username
|
|
|
|
if validated_params.key?(:name)
|
2019-02-21 17:24:19 +00:00
|
|
|
Inspec.deprecate(:properties_aws_iam_user, 'The aws_iam_users `name` property is deprecated. Please use `username` instead')
|
2017-12-08 18:34:09 +00:00
|
|
|
validated_params[:username] = validated_params.delete(:name)
|
|
|
|
end
|
|
|
|
|
|
|
|
# If someone passed :user, rename it to :aws_user_struct
|
|
|
|
if validated_params.key?(:user)
|
2019-02-21 17:24:19 +00:00
|
|
|
Inspec.deprecate(:properties_aws_iam_user, 'The aws_iam_users `user` property is deprecated. Please use `aws_user_struct` instead')
|
2017-12-08 18:34:09 +00:00
|
|
|
validated_params[:aws_user_struct] = validated_params.delete(:user)
|
|
|
|
end
|
|
|
|
|
|
|
|
if validated_params.empty?
|
|
|
|
raise ArgumentError, 'You must provide a username to aws_iam_user.'
|
|
|
|
end
|
|
|
|
validated_params
|
2017-08-08 13:50:35 +00:00
|
|
|
end
|
|
|
|
|
2018-02-08 04:26:37 +00:00
|
|
|
def fetch_from_api
|
|
|
|
backend = BackendFactory.create(inspec_runner)
|
2017-12-08 18:34:09 +00:00
|
|
|
@aws_user_struct ||= nil # silence unitialized warning
|
|
|
|
unless @aws_user_struct
|
|
|
|
begin
|
|
|
|
@aws_user_struct = backend.get_user(user_name: username)
|
|
|
|
rescue Aws::IAM::Errors::NoSuchEntity
|
|
|
|
@exists = false
|
2018-04-17 17:22:28 +00:00
|
|
|
@access_keys = []
|
|
|
|
@inline_policy_names = []
|
|
|
|
@attached_policy_arns = []
|
|
|
|
@attached_policy_names = []
|
2017-12-08 18:34:09 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
end
|
|
|
|
# TODO: extract properties from aws_user_struct?
|
|
|
|
|
|
|
|
@exists = true
|
|
|
|
|
|
|
|
begin
|
|
|
|
_login_profile = backend.get_login_profile(user_name: username)
|
|
|
|
@has_console_password = true
|
|
|
|
# Password age also available here
|
|
|
|
rescue Aws::IAM::Errors::NoSuchEntity
|
|
|
|
@has_console_password = false
|
|
|
|
end
|
|
|
|
|
|
|
|
mfa_info = backend.list_mfa_devices(user_name: username)
|
|
|
|
@has_mfa_enabled = !mfa_info.mfa_devices.empty?
|
|
|
|
|
2018-10-15 16:09:46 +00:00
|
|
|
# TODO: consider returning InSpec AwsIamAccessKey objects
|
2017-12-08 18:34:09 +00:00
|
|
|
@access_keys = backend.list_access_keys(user_name: username).access_key_metadata
|
2018-02-14 19:15:20 +00:00
|
|
|
# If the above call fails, we get nil here; but we promise access_keys will be an array.
|
|
|
|
@access_keys ||= []
|
2018-04-17 17:22:28 +00:00
|
|
|
|
|
|
|
@inline_policy_names = backend.list_user_policies(user_name: username).policy_names
|
|
|
|
|
|
|
|
attached_policies = backend.list_attached_user_policies(user_name: username).attached_policies
|
|
|
|
@attached_policy_arns = attached_policies.map { |p| p[:policy_arn] }
|
|
|
|
@attached_policy_names = attached_policies.map { |p| p[:policy_name] }
|
2017-06-28 12:46:59 +00:00
|
|
|
end
|
|
|
|
|
2017-12-08 18:34:09 +00:00
|
|
|
class Backend
|
2018-02-08 04:26:37 +00:00
|
|
|
class AwsClientApi < AwsBackendBase
|
2017-12-08 18:34:09 +00:00
|
|
|
BackendFactory.set_default_backend(self)
|
2018-02-08 04:26:37 +00:00
|
|
|
self.aws_client_class = Aws::IAM::Client
|
2017-12-08 18:34:09 +00:00
|
|
|
|
|
|
|
def get_user(criteria)
|
2018-02-08 04:26:37 +00:00
|
|
|
aws_service_client.get_user(criteria)
|
2017-12-08 18:34:09 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def get_login_profile(criteria)
|
2018-02-08 04:26:37 +00:00
|
|
|
aws_service_client.get_login_profile(criteria)
|
2017-12-08 18:34:09 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def list_mfa_devices(criteria)
|
2018-02-08 04:26:37 +00:00
|
|
|
aws_service_client.list_mfa_devices(criteria)
|
2017-12-08 18:34:09 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def list_access_keys(criteria)
|
2018-02-08 04:26:37 +00:00
|
|
|
aws_service_client.list_access_keys(criteria)
|
2017-12-08 18:34:09 +00:00
|
|
|
end
|
2018-04-17 17:22:28 +00:00
|
|
|
|
|
|
|
def list_user_policies(criteria)
|
|
|
|
aws_service_client.list_user_policies(criteria)
|
|
|
|
end
|
|
|
|
|
|
|
|
def list_attached_user_policies(criteria)
|
|
|
|
aws_service_client.list_attached_user_policies(criteria)
|
|
|
|
end
|
2017-06-13 05:36:43 +00:00
|
|
|
end
|
|
|
|
end
|
2017-02-01 21:27:10 +00:00
|
|
|
end
|