refactor(checks): migrate AWS accessanalyzer, athena, cloudfront to Rego

Signed-off-by: Nikita Pivkin <[email protected]>

avd_docs/aws/accessanalyzer/AVD-AWS-0175/docs.md

@@ -1,5 +1,4 @@
 
-
 AWS IAM Access Analyzer helps you identify the resources in your organization and
 accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity.
 This lets you identify unintended access to your resources and data. Access Analyzer

avd_docs/aws/athena/AVD-AWS-0006/docs.md

@@ -1,6 +1,7 @@
 
 Athena databases and workspace result sets should be encrypted at rests. These databases and query sets are generally derived from data in S3 buckets and should have the same level of at rest protection.
 
+
 ### Impact
 Data can be read if the Athena Database is compromised
 

avd_docs/aws/athena/AVD-AWS-0007/docs.md

@@ -1,6 +1,7 @@
 
 Athena workgroup configuration should be enforced to prevent client side changes to disable encryption settings.
 
+
 ### Impact
 Clients can ignore encryption requirements
 

avd_docs/aws/cloudtrail/AVD-AWS-0014/docs.md

@@ -1,6 +1,7 @@
 
 When creating Cloudtrail in the AWS Management Console the trail is configured by default to be multi-region, this isn't the case with the Terraform resource. Cloudtrail should cover the full AWS account to ensure you can track changes in regions you are not actively operting in.
 
+
 ### Impact
 Activity could be happening in your account in a different region
 

avd_docs/aws/cloudtrail/AVD-AWS-0015/docs.md

@@ -1,6 +1,7 @@
 
 Using Customer managed keys provides comprehensive control over cryptographic keys, enabling management of policies, permissions, and rotation, thus enhancing security and compliance measures for sensitive data and systems.
 
+
 ### Impact
 Using AWS managed keys does not allow for fine grained control
 

avd_docs/aws/cloudtrail/AVD-AWS-0016/docs.md

@@ -1,6 +1,7 @@
 
 Log validation should be activated on Cloudtrail logs to prevent the tampering of the underlying data in the S3 bucket. It is feasible that a rogue actor compromising an AWS account might want to modify the log data to remove trace of their actions.
 
+
 ### Impact
 Illicit activity could be removed from the logs
 

avd_docs/aws/cloudtrail/AVD-AWS-0161/docs.md

@@ -1,5 +1,4 @@
 
-
 CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. CIS recommends that the S3 bucket policy, or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs. Allowing public access to CloudTrail log content might aid an adversary in identifying weaknesses in the affected account's use or configuration.
 
 

avd_docs/aws/cloudtrail/AVD-AWS-0162/docs.md

@@ -1,5 +1,4 @@
 
-
 CloudTrail is a web service that records AWS API calls made in a given account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.
 
 CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs in a specified Amazon S3 bucket for long-term analysis, you can perform real-time analysis by configuring CloudTrail to send logs to CloudWatch Logs.

avd_docs/aws/cloudtrail/AVD-AWS-0163/docs.md

@@ -1,8 +1,6 @@
 
 Amazon S3 bucket access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed.
-
 CIS recommends that you enable bucket access logging on the CloudTrail S3 bucket.
-
 By enabling S3 bucket logging on target S3 buckets, you can capture all events that might affect objects in a target bucket. Configuring logs to be placed in a separate bucket enables access to log information, which can be useful in security and incident response workflows.
 
 

checks/cloud/aws/accessanalyzer/enable_access_analyzer.go

@@ -34,7 +34,8 @@ keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.
 		Links: []string{
 			"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
 		},
-		Severity: severity.Low,
+		Severity:   severity.Low,
+		Deprecated: true,
 	},
 	func(s *state.State) (results scan.Results) {
 		var enabled bool

checks/cloud/aws/accessanalyzer/enable_access_analyzer.rego

@@ -0,0 +1,46 @@
+# METADATA
+# title: Enable IAM Access analyzer for IAM policies about all resources in each region.
+# description: |
+#   AWS IAM Access Analyzer helps you identify the resources in your organization and
+#   accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity.
+#   This lets you identify unintended access to your resources and data. Access Analyzer
+#   identifies resources that are shared with external principals by using logic-based reasoning
+#   to analyze the resource-based policies in your AWS environment. IAM Access Analyzer
+#   continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service)
+#   keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.
+# scope: package
+# schemas:
+#   - input: schema["cloud"]
+# related_resources:
+#   - https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
+# custom:
+#   id: AVD-AWS-0175
+#   avd_id: AVD-AWS-0175
+#   provider: aws
+#   service: accessanalyzer
+#   severity: LOW
+#   short_code: enable-access-analyzer
+#   recommended_action: Enable IAM Access analyzer across all regions.
+#   impact: Reduced visibility of externally shared resources.
+#   frameworks:
+#     cis-aws-1.4:
+#       - "1.20"
+#   input:
+#     selector:
+#       - type: cloud
+#         subtypes:
+#           - service: accessanalyzer
+#             provider: aws
+package builtin.aws.accessanalyzer.aws0175
+
+import rego.v1
+
+deny contains res if {
+	not has_active_analyzer
+	res := result.new("Access Analyzer is not enabled.", {})
+}
+
+has_active_analyzer if {
+	some analyzer in input.aws.accessanalyzer.analyzers
+	analyzer.active.value
+}

checks/cloud/aws/accessanalyzer/enable_access_analyzer_test.rego

@@ -0,0 +1,26 @@
+package builtin.aws.accessanalyzer.aws0175_test
+
+import rego.v1
+
+import data.builtin.aws.accessanalyzer.aws0175 as check
+import data.lib.test
+
+test_disallow_no_analyzers if {
+	r := check.deny with input as {"aws": {"accessanalyzer": {"analyzers": []}}}
+	test.assert_equal_message("Access Analyzer is not enabled.", r)
+}
+
+test_disallow_analyzer_disabled if {
+	r := check.deny with input as {"aws": {"accessanalyzer": {"analyzers": [{"active": {"value": false}}]}}}
+	test.assert_equal_message("Access Analyzer is not enabled.", r)
+}
+
+test_allow_one_of_analyzer_disabled if {
+	r := check.deny with input as {"aws": {"accessanalyzer": {"analyzers": [{"active": {"value": false}}, {"active": {"value": true}}]}}}
+	test.assert_empty(r)
+}
+
+test_allow_analyzer_enabled if {
+	r := check.deny with input as {"aws": {"accessanalyzer": {"analyzers": [{"active": {"value": true}}]}}}
+	test.assert_empty(r)
+}

checks/cloud/aws/athena/enable_at_rest_encryption.go

@@ -34,7 +34,8 @@ var CheckEnableAtRestEncryption = rules.Register(
 			Links:               cloudFormationEnableAtRestEncryptionLinks,
 			RemediationMarkdown: cloudFormationEnableAtRestEncryptionRemediationMarkdown,
 		},
-		Severity: severity.High,
+		Severity:   severity.High,
+		Deprecated: true,
 	},
 	func(s *state.State) (results scan.Results) {
 		for _, workgroup := range s.AWS.Athena.Workgroups {

checks/cloud/aws/athena/enable_at_rest_encryption.rego

@@ -0,0 +1,54 @@
+# METADATA
+# title: Athena databases and workgroup configurations are created unencrypted at rest by default, they should be encrypted
+# description: |
+#   Athena databases and workspace result sets should be encrypted at rests. These databases and query sets are generally derived from data in S3 buckets and should have the same level of at rest protection.
+# scope: package
+# schemas:
+#   - input: schema["cloud"]
+# related_resources:
+#   - https://docs.aws.amazon.com/athena/latest/ug/encryption.html
+# custom:
+#   id: AVD-AWS-0006
+#   avd_id: AVD-AWS-0006
+#   provider: aws
+#   service: athena
+#   severity: HIGH
+#   short_code: enable-at-rest-encryption
+#   recommended_action: Enable encryption at rest for Athena databases and workgroup configurations
+#   impact: Data can be read if the Athena Database is compromised
+#   input:
+#     selector:
+#       - type: cloud
+#         subtypes:
+#           - service: athena
+#             provider: aws
+#   terraform:
+#     links:
+#       - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup#encryption_configuration
+#       - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_database#encryption_configuration
+#     good_examples: checks/cloud/aws/athena/enable_at_rest_encryption.tf.go
+#     bad_examples: checks/cloud/aws/athena/enable_at_rest_encryption.tf.go
+#   cloudformation:
+#     good_examples: checks/cloud/aws/athena/enable_at_rest_encryption.cf.go
+#     bad_examples: checks/cloud/aws/athena/enable_at_rest_encryption.cf.go
+package builtin.aws.athena.aws0006
+
+import rego.v1
+
+encryption_type_none := ""
+
+deny contains res if {
+	some workgroup in input.aws.athena.workgroups
+	is_encryption_type_none(workgroup.encryption)
+	res := result.new("Workgroup does not have encryption configured.", workgroup)
+}
+
+deny contains res if {
+	some database in input.aws.athena.databases
+	is_encryption_type_none(database.encryption)
+	res := result.new("Database does not have encryption configured.", database)
+}
+
+is_encryption_type_none(encryption) if {
+	encryption.type.value == encryption_type_none
+}