<s> """<STR_LIT>""" <EOL> import datetime <EOL> from dateutil import parser <EOL> from dateutil import tz <EOL> from security_monkey . watchers . iam . iam_user import IAMUser <EOL> from security_monkey . auditors . iam . iam_policy import IAMPolicyAuditor <EOL> class IAMUserAuditor ( IAMPolicyAuditor ) : <EOL> index = IAMUser . index <EOL> i_am_singular = IAMUser . i_am_singular <EOL> i_am_plural = IAMUser . i_am_plural <EOL> def __init__ ( self , accounts = None , debug = False ) : <EOL> super ( IAMUserAuditor , self ) . __init__ ( accounts = accounts , debug = debug ) <EOL> def prep_for_audit ( self ) : <EOL> """<STR_LIT>""" <EOL> now = datetime . datetime . now ( ) <EOL> then = now - datetime . timedelta ( days = <NUM_LIT> ) <EOL> self . ninety_days_ago = then . replace ( tzinfo = tz . gettz ( '<STR_LIT>' ) ) <EOL> def check_access_keys ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> akeys = iamuser_item . config . get ( '<STR_LIT>' , { } ) <EOL> for akey in akeys . keys ( ) : <EOL> if u'<STR_LIT:status>' in akeys [ akey ] : <EOL> if akeys [ akey ] [ u'<STR_LIT:status>' ] == u'<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , iamuser_item , notes = akey ) <EOL> else : <EOL> self . add_issue ( <NUM_LIT:0> , '<STR_LIT>' , iamuser_item , notes = akey ) <EOL> def check_access_key_rotation ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> akeys = iamuser_item . config . get ( '<STR_LIT>' , { } ) <EOL> for akey in akeys . keys ( ) : <EOL> if u'<STR_LIT:status>' in akeys [ akey ] : <EOL> if akeys [ akey ] [ u'<STR_LIT:status>' ] == u'<STR_LIT>' : <EOL> create_date = akeys [ akey ] [ u'<STR_LIT>' ] <EOL> create_date = parser . parse ( create_date ) <EOL> if create_date < self . ninety_days_ago : <EOL> notes = "<STR_LIT>" <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , iamuser_item , notes = notes ) <EOL> def check_star_privileges ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_star_privileges ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_iam_star_privileges ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_iam_star_privileges ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_iam_privileges ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_iam_privileges ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_iam_passrole ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_iam_passrole ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_notaction ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_notaction ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_security_group_permissions ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> self . library_check_iamobj_has_security_group_permissions ( iamuser_item , policies_key = '<STR_LIT>' ) <EOL> def check_no_mfa ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> mfas = iamuser_item . config . get ( '<STR_LIT>' , { } ) <EOL> loginprof = iamuser_item . config . get ( '<STR_LIT>' , { } ) <EOL> has_active_mfas = False <EOL> has_login_profile = False <EOL> if mfas : <EOL> has_active_mfas = True <EOL> if loginprof != { } : <EOL> has_login_profile = True <EOL> if has_login_profile and not has_active_mfas : <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , iamuser_item ) <EOL> def check_loginprofile_plus_akeys ( self , iamuser_item ) : <EOL> """<STR_LIT>""" <EOL> if not iamuser_item . config . get ( '<STR_LIT>' , None ) : <EOL> return <EOL> akeys = iamuser_item . config . get ( '<STR_LIT>' , { } ) <EOL> for akey in akeys . keys ( ) : <EOL> if u'<STR_LIT:status>' in akeys [ akey ] and akeys [ akey ] [ u'<STR_LIT:status>' ] == u'<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , iamuser_item ) <EOL> return </s>
