aws - account access-analyzer filter

c7n/resources/account.py

@@ -367,6 +367,51 @@ def process(self, resources, event=None):
         return []
 
 
+@filters.register('access-analyzer')
+class AccessAnalyzer(Filter):
+    """Check for access analyzers in an account
+
+    :example:
+
+    .. code-block:: yaml
+
+            policies:
+              - name: account-access-analyzer
+                resource: account
+                region: us-east-1
+                filters:
+                  - type: access-analyzer
+                    status: active
+                    trust: organization
+    """
+
+    schema = type_schema('access-analyzer',
+                        status={'oneOf': [{'enum': ['active', 'creating', 'disabled', 'failed']}]},
+                        trust={'oneOf': [{'enum': ['account', 'organization']}]})
+    schema_alias = False
+    permissions = ('access-analyzer:ListAnalyzers',)
+
+    def process(self, resources, event=None):
+        account = resources[0]
+        status = self.data.get('status', 'active')
+        trust = self.data.get('trust', 'account')
+
+        client = local_session(self.manager.session_factory).client('accessanalyzer')
+
+        try:
+            analyzers = self.manager.retry(client.list_analyzers)['analyzers']
+            for analyzer in analyzers:
+                if analyzer['status'].lower() == status and analyzer['type'].lower() == trust:
+                    account['c7n:AccessAnalyzer'] = analyzer
+                    return resources
+        except Exception as e:
+            self.log.warning(
+                "Exception trying to list analyzers in account: %s error: %s",
+                self.manager.config.account_id, e)
+            raise e
+        return []
+
+
 @filters.register('password-policy')
 class AccountPasswordPolicy(ValueFilter):
     """Check an account's password policy.

tests/data/placebo/test_account_access_analyzer_filter/access-analyzer.ListAnalyzers_1.json

@@ -0,0 +1,15 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "analyzers": [
+            {
+                "arn": "arn:aws:access-analyzer:us-east-1:0123456789012:analyzer/ConsoleAnalyzer-d534345f-499c-43bd-bbcc-dd637ab352d2",
+                "name": "ConsoleAnalyzer-d534345f-499c-43bd-bbcc-dd637ab352d2",
+                "status": "ACTIVE",
+                "tags": {},
+                "type": "ACCOUNT"
+            }
+        ]
+    }
+}

tests/data/placebo/test_account_access_analyzer_filter/iam.ListAccountAliases_1.json

@@ -0,0 +1,10 @@
+{
+    "status_code": 200,
+    "data": {
+        "AccountAliases": [
+            "test-account"
+        ],
+        "IsTruncated": false,
+        "ResponseMetadata": {}
+    }
+}

tests/test_account.py

@@ -13,6 +13,7 @@
 from dateutil import parser
 import json
 import mock
+from unittest.mock import MagicMock
 import time
 
 from .common import functional
@@ -859,6 +860,46 @@ def test_enable_trail(self):
         status = client.get_trail_status(Name=arn)
         self.assertTrue(status["IsLogging"])
 
+    def test_account_access_analyzer_filter(self):
+        session_factory = self.replay_flight_data("test_account_access_analyzer_filter")
+        p = self.load_policy(
+            {
+                "name": "account-access-analyzer",
+                "resource": "account",
+                "filters": ["access-analyzer"],
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+
+    def test_account_access_analyzer_filter_error(self):
+        session_factory = self.replay_flight_data("test_account_access_analyzer_filter")
+        client = session_factory().client("accessanalyzer")
+        mock_factory = MagicMock()
+        mock_factory.region = 'us-east-1'
+        mock_factory().client(
+            'accessanalyzer').exceptions.InternalServerException = (
+                client.exceptions.InternalServerException)
+
+        mock_factory().client('accessanalyzer').list_analyzers.side_effect = (
+            client.exceptions.InternalServerException(
+                {'Error': {'Code': 'InternalServerException'}},
+                operation_name='list_analyzers'))
+
+        p = self.load_policy(
+            {
+                "name": "account-access-analyzer",
+                "resource": "account",
+                "filters": ["access-analyzer"],
+            },
+            session_factory=mock_factory,
+        )
+        try:
+            p.run()
+        except client.exceptions.InternalServerException:
+            mock_factory().client('accessanalyzer').list_analyzers.assert_called_once()
+
     def test_account_shield_filter(self):
         session_factory = self.replay_flight_data("test_account_shield_advanced_filter")
         p = self.load_policy(