@Test public void test()throws Exception{ AccessKeyMetadata accessKeyMetadata = new AccessKeyMetadata(); accessKeyMetadata.setAccessKeyId("123"); List<AccessKeyMetadata> accessKeyMetadatas = new ArrayList<>(); accessKeyMetadatas.add(accessKeyMetadata); ListAccessKeysResult keysResult = new ListAccessKeysResult(); keysResult.setAccessKeyMetadata(accessKeyMetadatas); List<AccessKeyMetadata> emptyAccessKeyMetadatas = new ArrayList<>(); ListAccessKeysResult emptyKeysResult = new ListAccessKeysResult(); mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( true); Map<String,Object>map=new HashMap<String, Object>(); map.put("client", identityManagementClient); AwsIamAccountWithPermanentAccessKeysRule spy = Mockito.spy(new AwsIamAccountWithPermanentAccessKeysRule()); Mockito.doReturn(map).when((BaseRule)spy).getClientFor(anyObject(), anyString(), anyObject()); mockStatic(IAMUtils.class); when(IAMUtils.getAccessKeyInformationForUser(anyString(),anyObject())).thenReturn(accessKeyMetadatas); when(identityManagementClient.listAccessKeys(anyObject())).thenReturn(keysResult); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(IAMUtils.getAccessKeyInformationForUser(anyString(),anyObject())).thenReturn(emptyAccessKeyMetadatas); when(identityManagementClient.listAccessKeys(anyObject())).thenReturn(emptyKeysResult); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); spy.execute(CommonTestUtils.getMapString("svc_123 "),CommonTestUtils.getMapString("svc_123 ")); when(identityManagementClient.listAccessKeys(anyObject())).thenThrow(new RuleExecutionFailedExeption()); assertThatThrownBy( () -> awsIamAccountWithPermanentAccessKeysRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> awsIamAccountWithPermanentAccessKeysRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
@Override public RuleResult execute(Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AwsIamAccountWithPermanentAccessKeysRule started========="); Map<String, String> ruleParamIam = new HashMap<>(); ruleParamIam.putAll(ruleParam); ruleParamIam.put("region", "us-west-2"); Map<String, Object> map = null; Annotation annotation = null; AmazonIdentityManagementClient identityManagementClient = null; String roleIdentifyingString = ruleParam .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity, category, roleIdentifyingString)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException( PacmanRuleConstants.MISSING_CONFIGURATION); } try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamIam); identityManagementClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); logger.debug("No AWS IAM accounts except service accounts should have permanent access keys rule starts"); if (!userId.startsWith(PacmanRuleConstants.SERVICE_ACCOUNTS)) { List<AccessKeyMetadata> accessKeyMetadatas = IAMUtils .getAccessKeyInformationForUser(userId, identityManagementClient); if (!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)) { Map<String, String> accessMap = getAccessMap( accessKeyMetadatas, userId); if (!accessMap.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "IAM user has access keys"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); annotation.put(PacmanRuleConstants.ACCOUNT_DETAILS, accessMap.toString()); issue.put(PacmanRuleConstants.VIOLATION_REASON, "IAM user which are non service account has access keys"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug( "========AwsIamAccountWithPermanentAccessKeysRule ended with annotation {} :=========", annotation); return new RuleResult( PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info(userId, "This userId,AWS IAM Account has no permanent access keys"); } } else { logger.info(userId, "Access key metadata is empty for username "); } } else { logger.info(userId, " : is a service account"); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AwsIamAccountWithPermanentAccessKeysRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }
AwsIamAccountWithPermanentAccessKeysRule extends BaseRule { @Override public RuleResult execute(Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AwsIamAccountWithPermanentAccessKeysRule started========="); Map<String, String> ruleParamIam = new HashMap<>(); ruleParamIam.putAll(ruleParam); ruleParamIam.put("region", "us-west-2"); Map<String, Object> map = null; Annotation annotation = null; AmazonIdentityManagementClient identityManagementClient = null; String roleIdentifyingString = ruleParam .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity, category, roleIdentifyingString)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException( PacmanRuleConstants.MISSING_CONFIGURATION); } try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamIam); identityManagementClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); logger.debug("No AWS IAM accounts except service accounts should have permanent access keys rule starts"); if (!userId.startsWith(PacmanRuleConstants.SERVICE_ACCOUNTS)) { List<AccessKeyMetadata> accessKeyMetadatas = IAMUtils .getAccessKeyInformationForUser(userId, identityManagementClient); if (!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)) { Map<String, String> accessMap = getAccessMap( accessKeyMetadatas, userId); if (!accessMap.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "IAM user has access keys"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); annotation.put(PacmanRuleConstants.ACCOUNT_DETAILS, accessMap.toString()); issue.put(PacmanRuleConstants.VIOLATION_REASON, "IAM user which are non service account has access keys"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug( "========AwsIamAccountWithPermanentAccessKeysRule ended with annotation {} :=========", annotation); return new RuleResult( PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info(userId, "This userId,AWS IAM Account has no permanent access keys"); } } else { logger.info(userId, "Access key metadata is empty for username "); } } else { logger.info(userId, " : is a service account"); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AwsIamAccountWithPermanentAccessKeysRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); } }
AwsIamAccountWithPermanentAccessKeysRule extends BaseRule { @Override public RuleResult execute(Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AwsIamAccountWithPermanentAccessKeysRule started========="); Map<String, String> ruleParamIam = new HashMap<>(); ruleParamIam.putAll(ruleParam); ruleParamIam.put("region", "us-west-2"); Map<String, Object> map = null; Annotation annotation = null; AmazonIdentityManagementClient identityManagementClient = null; String roleIdentifyingString = ruleParam .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity, category, roleIdentifyingString)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException( PacmanRuleConstants.MISSING_CONFIGURATION); } try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamIam); identityManagementClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); logger.debug("No AWS IAM accounts except service accounts should have permanent access keys rule starts"); if (!userId.startsWith(PacmanRuleConstants.SERVICE_ACCOUNTS)) { List<AccessKeyMetadata> accessKeyMetadatas = IAMUtils .getAccessKeyInformationForUser(userId, identityManagementClient); if (!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)) { Map<String, String> accessMap = getAccessMap( accessKeyMetadatas, userId); if (!accessMap.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "IAM user has access keys"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); annotation.put(PacmanRuleConstants.ACCOUNT_DETAILS, accessMap.toString()); issue.put(PacmanRuleConstants.VIOLATION_REASON, "IAM user which are non service account has access keys"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug( "========AwsIamAccountWithPermanentAccessKeysRule ended with annotation {} :=========", annotation); return new RuleResult( PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info(userId, "This userId,AWS IAM Account has no permanent access keys"); } } else { logger.info(userId, "Access key metadata is empty for username "); } } else { logger.info(userId, " : is a service account"); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AwsIamAccountWithPermanentAccessKeysRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  }
AwsIamAccountWithPermanentAccessKeysRule extends BaseRule { @Override public RuleResult execute(Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AwsIamAccountWithPermanentAccessKeysRule started========="); Map<String, String> ruleParamIam = new HashMap<>(); ruleParamIam.putAll(ruleParam); ruleParamIam.put("region", "us-west-2"); Map<String, Object> map = null; Annotation annotation = null; AmazonIdentityManagementClient identityManagementClient = null; String roleIdentifyingString = ruleParam .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity, category, roleIdentifyingString)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException( PacmanRuleConstants.MISSING_CONFIGURATION); } try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamIam); identityManagementClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); logger.debug("No AWS IAM accounts except service accounts should have permanent access keys rule starts"); if (!userId.startsWith(PacmanRuleConstants.SERVICE_ACCOUNTS)) { List<AccessKeyMetadata> accessKeyMetadatas = IAMUtils .getAccessKeyInformationForUser(userId, identityManagementClient); if (!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)) { Map<String, String> accessMap = getAccessMap( accessKeyMetadatas, userId); if (!accessMap.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "IAM user has access keys"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); annotation.put(PacmanRuleConstants.ACCOUNT_DETAILS, accessMap.toString()); issue.put(PacmanRuleConstants.VIOLATION_REASON, "IAM user which are non service account has access keys"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug( "========AwsIamAccountWithPermanentAccessKeysRule ended with annotation {} :=========", annotation); return new RuleResult( PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info(userId, "This userId,AWS IAM Account has no permanent access keys"); } } else { logger.info(userId, "Access key metadata is empty for username "); } } else { logger.info(userId, " : is a service account"); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AwsIamAccountWithPermanentAccessKeysRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  @Override RuleResult execute(Map<String, String> ruleParam,
            Map<String, String> resourceAttributes); @Override String getHelpText(); }
AwsIamAccountWithPermanentAccessKeysRule extends BaseRule { @Override public RuleResult execute(Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AwsIamAccountWithPermanentAccessKeysRule started========="); Map<String, String> ruleParamIam = new HashMap<>(); ruleParamIam.putAll(ruleParam); ruleParamIam.put("region", "us-west-2"); Map<String, Object> map = null; Annotation annotation = null; AmazonIdentityManagementClient identityManagementClient = null; String roleIdentifyingString = ruleParam .get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userId = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String, Object>> issueList = new ArrayList<>(); LinkedHashMap<String, Object> issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity, category, roleIdentifyingString)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException( PacmanRuleConstants.MISSING_CONFIGURATION); } try { map = getClientFor(AWSService.IAM, roleIdentifyingString, ruleParamIam); identityManagementClient = (AmazonIdentityManagementClient) map .get(PacmanSdkConstants.CLIENT); logger.debug("No AWS IAM accounts except service accounts should have permanent access keys rule starts"); if (!userId.startsWith(PacmanRuleConstants.SERVICE_ACCOUNTS)) { List<AccessKeyMetadata> accessKeyMetadatas = IAMUtils .getAccessKeyInformationForUser(userId, identityManagementClient); if (!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)) { Map<String, String> accessMap = getAccessMap( accessKeyMetadatas, userId); if (!accessMap.isEmpty()) { annotation = Annotation.buildAnnotation(ruleParam, Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION, "IAM user has access keys"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); annotation.put(PacmanRuleConstants.ACCOUNT_DETAILS, accessMap.toString()); issue.put(PacmanRuleConstants.VIOLATION_REASON, "IAM user which are non service account has access keys"); issueList.add(issue); annotation.put("issueDetails", issueList.toString()); logger.debug( "========AwsIamAccountWithPermanentAccessKeysRule ended with annotation {} :=========", annotation); return new RuleResult( PacmanSdkConstants.STATUS_FAILURE, PacmanRuleConstants.FAILURE_MESSAGE, annotation); } else { logger.info(userId, "This userId,AWS IAM Account has no permanent access keys"); } } else { logger.info(userId, "Access key metadata is empty for username "); } } else { logger.info(userId, " : is a service account"); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AwsIamAccountWithPermanentAccessKeysRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS, PacmanRuleConstants.SUCCESS_MESSAGE); }  @Override RuleResult execute(Map<String, String> ruleParam,
            Map<String, String> resourceAttributes); @Override String getHelpText();  }