@Test public void test()throws Exception{ Date date = new Date(); Date daysAgo = new DateTime(date).minusDays(300).toDate(); AccessKeyMetadata accessKeyMetadata = new AccessKeyMetadata(); accessKeyMetadata.setAccessKeyId("123"); accessKeyMetadata.setCreateDate(daysAgo); accessKeyMetadata.setStatus("Active"); List<AccessKeyMetadata> accessKeyMetadatas = new ArrayList<>(); accessKeyMetadatas.add(accessKeyMetadata); AccessKeyMetadata accessKeyMetadataTest = new AccessKeyMetadata(); accessKeyMetadataTest.setAccessKeyId("123"); accessKeyMetadataTest.setCreateDate(new Date()); accessKeyMetadataTest.setStatus("Inactive"); List<AccessKeyMetadata> accessKeyMetadatasTest = new ArrayList<>(); accessKeyMetadatasTest.add(accessKeyMetadataTest); List<AccessKeyMetadata> emptyAccessKeyMetadatas = new ArrayList<>(); mockStatic(PacmanUtils.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString())).thenReturn( true); Map<String,Object>map=new HashMap<String, Object>(); map.put("client", identityManagementClient); AccessKeyRotatedRule spy = Mockito.spy(new AccessKeyRotatedRule()); Mockito.doReturn(map).when((BaseRule)spy).getClientFor(anyObject(), anyString(), anyObject()); mockStatic(IAMUtils.class); when(IAMUtils.getAccessKeyInformationForUser(anyString(),anyObject())).thenReturn(accessKeyMetadatas); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(IAMUtils.getAccessKeyInformationForUser(anyString(),anyObject())).thenReturn(accessKeyMetadatasTest); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); when(IAMUtils.getAccessKeyInformationForUser(anyString(),anyObject())).thenReturn(emptyAccessKeyMetadatas); spy.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 ")); assertThatThrownBy( () -> accessKeyRotatedRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); when(PacmanUtils.doesAllHaveValue(anyString(),anyString())).thenReturn( false); assertThatThrownBy( () -> accessKeyRotatedRule.execute(CommonTestUtils.getMapString("r_123 "),CommonTestUtils.getMapString("r_123 "))).isInstanceOf(InvalidInputException.class); }
public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AccessKeyRotatedRule started========="); Map<String, String> temp = new HashMap<>(); temp.putAll(ruleParam); temp.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParam.get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userName = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AccessKeyMetadata> accessKeyMetadatas; String message = null; try { map = getClientFor(AWSService.IAM, roleIdentifyingString, temp); iamClient = (AmazonIdentityManagementClient) map.get(PacmanSdkConstants.CLIENT); accessKeyMetadatas = IAMUtils.getAccessKeyInformationForUser(userName, iamClient); if(!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)){ if(anyAccessKeysNotRotatedForLong(accessKeyMetadatas)){ message = "Iam access keys for " + userName + " are NOT ROTATED for more than "+PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days"; logger.info(message); annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========AccessKeyRotatedRule ended with annotation {} :=========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); }else{ logger.info(userName,"Access key is already rotated for username "); } } else{ logger.info(userName,"Access key metadata is empty for username "); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AccessKeyRotatedRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }
AccessKeyRotatedRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AccessKeyRotatedRule started========="); Map<String, String> temp = new HashMap<>(); temp.putAll(ruleParam); temp.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParam.get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userName = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AccessKeyMetadata> accessKeyMetadatas; String message = null; try { map = getClientFor(AWSService.IAM, roleIdentifyingString, temp); iamClient = (AmazonIdentityManagementClient) map.get(PacmanSdkConstants.CLIENT); accessKeyMetadatas = IAMUtils.getAccessKeyInformationForUser(userName, iamClient); if(!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)){ if(anyAccessKeysNotRotatedForLong(accessKeyMetadatas)){ message = "Iam access keys for " + userName + " are NOT ROTATED for more than "+PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days"; logger.info(message); annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========AccessKeyRotatedRule ended with annotation {} :=========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); }else{ logger.info(userName,"Access key is already rotated for username "); } } else{ logger.info(userName,"Access key metadata is empty for username "); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AccessKeyRotatedRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); } }
AccessKeyRotatedRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AccessKeyRotatedRule started========="); Map<String, String> temp = new HashMap<>(); temp.putAll(ruleParam); temp.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParam.get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userName = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AccessKeyMetadata> accessKeyMetadatas; String message = null; try { map = getClientFor(AWSService.IAM, roleIdentifyingString, temp); iamClient = (AmazonIdentityManagementClient) map.get(PacmanSdkConstants.CLIENT); accessKeyMetadatas = IAMUtils.getAccessKeyInformationForUser(userName, iamClient); if(!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)){ if(anyAccessKeysNotRotatedForLong(accessKeyMetadatas)){ message = "Iam access keys for " + userName + " are NOT ROTATED for more than "+PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days"; logger.info(message); annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========AccessKeyRotatedRule ended with annotation {} :=========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); }else{ logger.info(userName,"Access key is already rotated for username "); } } else{ logger.info(userName,"Access key metadata is empty for username "); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AccessKeyRotatedRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  }
AccessKeyRotatedRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AccessKeyRotatedRule started========="); Map<String, String> temp = new HashMap<>(); temp.putAll(ruleParam); temp.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParam.get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userName = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AccessKeyMetadata> accessKeyMetadatas; String message = null; try { map = getClientFor(AWSService.IAM, roleIdentifyingString, temp); iamClient = (AmazonIdentityManagementClient) map.get(PacmanSdkConstants.CLIENT); accessKeyMetadatas = IAMUtils.getAccessKeyInformationForUser(userName, iamClient); if(!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)){ if(anyAccessKeysNotRotatedForLong(accessKeyMetadatas)){ message = "Iam access keys for " + userName + " are NOT ROTATED for more than "+PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days"; logger.info(message); annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========AccessKeyRotatedRule ended with annotation {} :=========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); }else{ logger.info(userName,"Access key is already rotated for username "); } } else{ logger.info(userName,"Access key metadata is empty for username "); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AccessKeyRotatedRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); @Override String getHelpText(); }
AccessKeyRotatedRule extends BaseRule { public RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes) { logger.debug("========AccessKeyRotatedRule started========="); Map<String, String> temp = new HashMap<>(); temp.putAll(ruleParam); temp.put("region", "us-west-2"); Map<String, Object> map = null; AmazonIdentityManagementClient iamClient = null; String roleIdentifyingString = ruleParam.get(PacmanSdkConstants.Role_IDENTIFYING_STRING); String userName = ruleParam.get(PacmanSdkConstants.RESOURCE_ID); String severity = ruleParam.get(PacmanRuleConstants.SEVERITY); String category = ruleParam.get(PacmanRuleConstants.CATEGORY); MDC.put("executionId", ruleParam.get("executionId")); MDC.put("ruleId", ruleParam.get(PacmanSdkConstants.RULE_ID)); List<LinkedHashMap<String,Object>>issueList = new ArrayList<>(); LinkedHashMap<String,Object>issue = new LinkedHashMap<>(); if (!PacmanUtils.doesAllHaveValue(severity,category)) { logger.info(PacmanRuleConstants.MISSING_CONFIGURATION); throw new InvalidInputException(PacmanRuleConstants.MISSING_CONFIGURATION); } Annotation annotation = null; List<AccessKeyMetadata> accessKeyMetadatas; String message = null; try { map = getClientFor(AWSService.IAM, roleIdentifyingString, temp); iamClient = (AmazonIdentityManagementClient) map.get(PacmanSdkConstants.CLIENT); accessKeyMetadatas = IAMUtils.getAccessKeyInformationForUser(userName, iamClient); if(!CollectionUtils.isNullOrEmpty(accessKeyMetadatas)){ if(anyAccessKeysNotRotatedForLong(accessKeyMetadatas)){ message = "Iam access keys for " + userName + " are NOT ROTATED for more than "+PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days"; logger.info(message); annotation = Annotation.buildAnnotation(ruleParam,Annotation.Type.ISSUE); annotation.put(PacmanSdkConstants.DESCRIPTION,"access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); annotation.put(PacmanRuleConstants.SEVERITY, severity); annotation.put(PacmanRuleConstants.CATEGORY, category); issue.put(PacmanRuleConstants.VIOLATION_REASON, "access keys not rotated for more than " +PacmanRuleConstants.ACCESSKEY_ROTATION_DURATION+" days found"); issueList.add(issue); annotation.put("issueDetails",issueList.toString()); logger.debug("========AccessKeyRotatedRule ended with annotation {} :=========",annotation); return new RuleResult(PacmanSdkConstants.STATUS_FAILURE,PacmanRuleConstants.FAILURE_MESSAGE,annotation); }else{ logger.info(userName,"Access key is already rotated for username "); } } else{ logger.info(userName,"Access key metadata is empty for username "); } } catch (UnableToCreateClientException e) { logger.error("unable to get client for following input", e); throw new InvalidInputException(e.toString()); } logger.debug("========AccessKeyRotatedRule ended========="); return new RuleResult(PacmanSdkConstants.STATUS_SUCCESS,PacmanRuleConstants.SUCCESS_MESSAGE); }  RuleResult execute(final Map<String, String> ruleParam, Map<String, String> resourceAttributes); @Override String getHelpText();  }