Skip to content
This repository was archived by the owner on Jul 22, 2021. It is now read-only.

Fix false positives #56

Merged
barnesrobert merged 2 commits into from
Apr 6, 2018
Merged

Fix false positives #56

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bce18d8
We are compliant if we 'do' have a serial number.
jimrazmus Sep 29, 2017
23001c2
Fix failures resulting from an empty annotation when we are compliant.
jimrazmus Sep 29, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions architecture/create-benchmark-rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@
# Determine whether the root account uses hardware-based MFA.
mfa_devices = client.list_virtual_mfa_devices()['VirtualMFADevices']
for mfa_device in mfa_devices:
if not 'SerialNumber' in mfa_device:
if 'SerialNumber' in mfa_device:
is_compliant = is_compliant and True
else:
is_compliant = is_compliant and False
Expand All @@ -288,19 +288,20 @@
annotation = annotation + ' The root account has active access keys associated with it.'
break

config = boto3.client('config')
config.put_evaluations(
Evaluations=[
{
'ComplianceResourceType': 'AWS::::Account',
'ComplianceResourceId': 'Root',
'ComplianceType': 'COMPLIANT' if is_compliant else 'NON_COMPLIANT',
'Annotation': annotation,
'OrderingTimestamp': datetime.datetime.now(),
},
],
ResultToken=result_token
)
evaluations = [
{
'ComplianceResourceType': 'AWS::::Account',
'ComplianceResourceId': 'Root',
'ComplianceType': 'COMPLIANT' if is_compliant else 'NON_COMPLIANT',
'OrderingTimestamp': datetime.datetime.now(),
}
]

if annotation: evaluations[0]['Annotation'] = annotation

response = boto3.client('config').put_evaluations(
Evaluations = evaluations,
ResultToken = result_token)

Description: Evaluates the security properties of the root account
Handler: index.lambda_handler
Expand Down