-
Notifications
You must be signed in to change notification settings - Fork 116
/
enable_audit_logging.go
executable file
·51 lines (49 loc) · 1.89 KB
/
enable_audit_logging.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
package mq
import (
"github.com/aquasecurity/defsec/internal/rules"
"github.com/aquasecurity/defsec/pkg/providers"
"github.com/aquasecurity/defsec/pkg/scan"
"github.com/aquasecurity/defsec/pkg/severity"
"github.com/aquasecurity/defsec/pkg/state"
)
var CheckEnableAuditLogging = rules.Register(
scan.Rule{
AVDID: "AVD-AWS-0070",
Provider: providers.AWSProvider,
Service: "mq",
ShortCode: "enable-audit-logging",
Summary: "MQ Broker should have audit logging enabled",
Impact: "Without audit logging it is difficult to trace activity in the MQ broker",
Resolution: "Enable audit logging",
Explanation: `Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation`,
Links: []string{
"https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/configure-logging-monitoring-activemq.html",
},
Terraform: &scan.EngineMetadata{
GoodExamples: terraformEnableAuditLoggingGoodExamples,
BadExamples: terraformEnableAuditLoggingBadExamples,
Links: terraformEnableAuditLoggingLinks,
RemediationMarkdown: terraformEnableAuditLoggingRemediationMarkdown,
},
CloudFormation: &scan.EngineMetadata{
GoodExamples: cloudFormationEnableAuditLoggingGoodExamples,
BadExamples: cloudFormationEnableAuditLoggingBadExamples,
Links: cloudFormationEnableAuditLoggingLinks,
RemediationMarkdown: cloudFormationEnableAuditLoggingRemediationMarkdown,
},
Severity: severity.Medium,
},
func(s *state.State) (results scan.Results) {
for _, broker := range s.AWS.MQ.Brokers {
if broker.Logging.Audit.IsFalse() {
results.Add(
"Broker does not have audit logging enabled.",
broker.Logging.Audit,
)
} else {
results.AddPassed(&broker)
}
}
return
},
)