@Test public void executeTest() throws Exception { mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( true); when(PacmanUtils.formatUrl(anyObject(),anyString())).thenReturn("host"); when(PacmanUtils.checkResourceIdForRuleInES(anyString(),anyString(),anyString(),anyString())).thenReturn(true); assertThat(checkLambdaFunWithAdminOrIamPrivileges.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.checkResourceIdForRuleInES(anyString(),anyString(),anyString(),anyString())).thenReturn(false); assertThat(checkLambdaFunWithAdminOrIamPrivileges.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")), is(notNullValue())); when(PacmanUtils.checkResourceIdForRuleInES(anyString(),anyString(),anyString(),anyString())).thenThrow(new Exception()); assertThatThrownBy( () -> checkLambdaFunWithAdminOrIamPrivileges.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(RuleExecutionFailedExeption.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> checkLambdaFunWithAdminOrIamPrivileges.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
public RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes) { logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges started========="); Annotation annotation = null; String lambdaRole = null; boolean isRoleExists = false; String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String accountid = resourceAttributes.get(PacmanSdkConstants.ACCOUNT_ID); String nonAdminAccntsWithIAMFullAccessEsUrl = null; String nonAdminAccntsWithIAMFullAccessRuleId = ruleParam.get(PacmanRuleConstants.NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_RULE_ID); String formattedUrl = PacmanUtils.formatUrl(ruleParam, PacmanRuleConstants.ES_NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_URL); if (!StringUtils.isEmpty(formattedUrl)) { nonAdminAccntsWithIAMFullAccessEsUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category,nonAdminAccntsWithIAMFullAccessEsUrl)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (resourceAttributes.containsKey(PacmanRuleConstants.LAMBDA_ROLE)) { lambdaRole = resourceAttributes.get(PacmanRuleConstants.LAMBDA_ROLE); String role = StringUtils.substringAfterLast(lambdaRole, "/"); try { isRoleExists = PacmanUtils.checkResourceIdForRuleInES(role,nonAdminAccntsWithIAMFullAccessEsUrl,nonAdminAccntsWithIAMFullAccessRuleId,accountid); if (isRoleExists) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"Lambda function with admin or IAM privileges found!"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Lambda function with AdministratorAccess/IAMFullAccess privileges found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended with annotation {} : =========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } catch (Exception e) { logger.error("error", e); throw new RuleExecutionFailedExeption(e.getMessage()); } } logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }
CheckLambdaFunWithAdminOrIamPrivileges extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes) { logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges started========="); Annotation annotation = null; String lambdaRole = null; boolean isRoleExists = false; String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String accountid = resourceAttributes.get(PacmanSdkConstants.ACCOUNT_ID); String nonAdminAccntsWithIAMFullAccessEsUrl = null; String nonAdminAccntsWithIAMFullAccessRuleId = ruleParam.get(PacmanRuleConstants.NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_RULE_ID); String formattedUrl = PacmanUtils.formatUrl(ruleParam, PacmanRuleConstants.ES_NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_URL); if (!StringUtils.isEmpty(formattedUrl)) { nonAdminAccntsWithIAMFullAccessEsUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category,nonAdminAccntsWithIAMFullAccessEsUrl)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (resourceAttributes.containsKey(PacmanRuleConstants.LAMBDA_ROLE)) { lambdaRole = resourceAttributes.get(PacmanRuleConstants.LAMBDA_ROLE); String role = StringUtils.substringAfterLast(lambdaRole, "/"); try { isRoleExists = PacmanUtils.checkResourceIdForRuleInES(role,nonAdminAccntsWithIAMFullAccessEsUrl,nonAdminAccntsWithIAMFullAccessRuleId,accountid); if (isRoleExists) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"Lambda function with admin or IAM privileges found!"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Lambda function with AdministratorAccess/IAMFullAccess privileges found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended with annotation {} : =========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } catch (Exception e) { logger.error("error", e); throw new RuleExecutionFailedExeption(e.getMessage()); } } logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } }
CheckLambdaFunWithAdminOrIamPrivileges extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes) { logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges started========="); Annotation annotation = null; String lambdaRole = null; boolean isRoleExists = false; String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String accountid = resourceAttributes.get(PacmanSdkConstants.ACCOUNT_ID); String nonAdminAccntsWithIAMFullAccessEsUrl = null; String nonAdminAccntsWithIAMFullAccessRuleId = ruleParam.get(PacmanRuleConstants.NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_RULE_ID); String formattedUrl = PacmanUtils.formatUrl(ruleParam, PacmanRuleConstants.ES_NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_URL); if (!StringUtils.isEmpty(formattedUrl)) { nonAdminAccntsWithIAMFullAccessEsUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category,nonAdminAccntsWithIAMFullAccessEsUrl)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (resourceAttributes.containsKey(PacmanRuleConstants.LAMBDA_ROLE)) { lambdaRole = resourceAttributes.get(PacmanRuleConstants.LAMBDA_ROLE); String role = StringUtils.substringAfterLast(lambdaRole, "/"); try { isRoleExists = PacmanUtils.checkResourceIdForRuleInES(role,nonAdminAccntsWithIAMFullAccessEsUrl,nonAdminAccntsWithIAMFullAccessRuleId,accountid); if (isRoleExists) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"Lambda function with admin or IAM privileges found!"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Lambda function with AdministratorAccess/IAMFullAccess privileges found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended with annotation {} : =========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } catch (Exception e) { logger.error("error", e); throw new RuleExecutionFailedExeption(e.getMessage()); } } logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  }
CheckLambdaFunWithAdminOrIamPrivileges extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes) { logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges started========="); Annotation annotation = null; String lambdaRole = null; boolean isRoleExists = false; String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String accountid = resourceAttributes.get(PacmanSdkConstants.ACCOUNT_ID); String nonAdminAccntsWithIAMFullAccessEsUrl = null; String nonAdminAccntsWithIAMFullAccessRuleId = ruleParam.get(PacmanRuleConstants.NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_RULE_ID); String formattedUrl = PacmanUtils.formatUrl(ruleParam, PacmanRuleConstants.ES_NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_URL); if (!StringUtils.isEmpty(formattedUrl)) { nonAdminAccntsWithIAMFullAccessEsUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category,nonAdminAccntsWithIAMFullAccessEsUrl)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (resourceAttributes.containsKey(PacmanRuleConstants.LAMBDA_ROLE)) { lambdaRole = resourceAttributes.get(PacmanRuleConstants.LAMBDA_ROLE); String role = StringUtils.substringAfterLast(lambdaRole, "/"); try { isRoleExists = PacmanUtils.checkResourceIdForRuleInES(role,nonAdminAccntsWithIAMFullAccessEsUrl,nonAdminAccntsWithIAMFullAccessRuleId,accountid); if (isRoleExists) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"Lambda function with admin or IAM privileges found!"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Lambda function with AdministratorAccess/IAMFullAccess privileges found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended with annotation {} : =========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } catch (Exception e) { logger.error("error", e); throw new RuleExecutionFailedExeption(e.getMessage()); } } logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes); String getHelpText(); }
CheckLambdaFunWithAdminOrIamPrivileges extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes) { logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges started========="); Annotation annotation = null; String lambdaRole = null; boolean isRoleExists = false; String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); String accountid = resourceAttributes.get(PacmanSdkConstants.ACCOUNT_ID); String nonAdminAccntsWithIAMFullAccessEsUrl = null; String nonAdminAccntsWithIAMFullAccessRuleId = ruleParam.get(PacmanRuleConstants.NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_RULE_ID); String formattedUrl = PacmanUtils.formatUrl(ruleParam, PacmanRuleConstants.ES_NON_ADMIN_ACCNT_WITH_IAM_FULL_ACC_URL); if (!StringUtils.isEmpty(formattedUrl)) { nonAdminAccntsWithIAMFullAccessEsUrl = formattedUrl; } MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category,nonAdminAccntsWithIAMFullAccessEsUrl)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } if (resourceAttributes.containsKey(PacmanRuleConstants.LAMBDA_ROLE)) { lambdaRole = resourceAttributes.get(PacmanRuleConstants.LAMBDA_ROLE); String role = StringUtils.substringAfterLast(lambdaRole, "/"); try { isRoleExists = PacmanUtils.checkResourceIdForRuleInES(role,nonAdminAccntsWithIAMFullAccessEsUrl,nonAdminAccntsWithIAMFullAccessRuleId,accountid); if (isRoleExists) { annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"Lambda function with admin or IAM privileges found!"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "Lambda function with AdministratorAccess/IAMFullAccess privileges found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended with annotation {} : =========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE, annotation); } } catch (Exception e) { logger.error("error", e); throw new RuleExecutionFailedExeption(e.getMessage()); } } logger.debug("========CheckLambdaFunWithAdminOrIAMPrivileges ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam,Map<String, String> resourceAttributes); String getHelpText();  }