// handleRecommendation handles a captured IAM Zero event and looks up advisories for it,
// saving results to the storage
handleRecommendation handles a captured IAM Zero event and looks up advisories for it,
saving results to the storage
// handleRecommendation handles a captured IAM Zero event and looks up advisories for it // saving results to the storage
func (c *Collector) handleRecommendation(args handleRecommendationArgs) (*recommendations.AWSAction, error) {
	e := args.Event
	advisor := args.Advisor
	token := args.Token
	iamRole, err := recommendations.ExtractRoleARNFromSession(e.Identity.Role)
	if err != nil {
		return nil, err
	}
	if iamRole != nil {
		e.Identity.Role = *iamRole
	}
	if c.demo {
		e.Identity.User = "iamzero-test-user"
		e.Identity.Role = "arn:aws:iam::123456789012:role/iamzero-test-role"
		e.Identity.Account = "123456789012"
	}
	policy := c.policyStorage.FindByRoleAndToken(storage.FindPolicyQuery{
		Role:   e.Identity.Role,
		Token:  token,
		Status: recommendations.PolicyStatusActive,
	})
	if policy == nil {
		policy = &recommendations.Policy{
			ID:          uuid.NewString(),
			Identity:    e.Identity,
			LastUpdated: time.Now(),
			Token:       token,
			EventCount:  0,
			Status:      "active",
			Document: recommendations.AWSIAMPolicy{
				Version:   "2012-10-17",
				Statement: []recommendations.AWSIAMStatement{},
			},
		}
	}
	advice, err := advisor.Advise(e)
	if err != nil {
		return nil, err
	} else {
		c.log.With("advice", advice).Info("matched advisor recommendation")
	}
	action := recommendations.AWSAction{
		ID:                 uuid.NewString(),
		PolicyID:           policy.ID,
		Event:              e,
		Status:             recommendations.AlertActive,
		Time:               time.Now(),
		HasRecommendations: false,
		Resources:          []recommendations.Resource{},
		Recommendations:    []recommendations.Advice{},
		Enabled:            true,
		SelectedAdvisoryID: "",
	}
	if len(advice) > 0 {
		action.HasRecommendations = true
		action.Recommendations = advice
		action.Resources = advice[0].Details().Resources 
		action.SelectedAdvisoryID = advice[0].GetID()
	}
	c.log.With("action", action).Info("adding action")
	c.actionStorage.Add(action)
	actions := c.actionStorage.ListForPolicy(policy.ID)
	policy.RecalculateDocument(actions)
	err = c.policyStorage.CreateOrUpdate(*policy)
	if err != nil {
		return nil, err
	}
	return &action, nil
}
func ( c * Collector ) handleRecommendation ( args handleRecommendationArgs ) ( * recommendations . AWSAction , error ) { e := args . Event advisor := args . Advisor token := args . Token iamRole , err := recommendations . ExtractRoleARNFromSession ( e . Identity . Role ) if err != nil { return nil , err } if iamRole != nil { e . Identity . Role = * iamRole } if c . demo { e . Identity . User = " " e . Identity . Role = " " e . Identity . Account = " " } policy := c . policyStorage . FindByRoleAndToken ( storage . FindPolicyQuery { Role : e . Identity . Role , Token : token , Status : recommendations . PolicyStatusActive , } ) if policy == nil { policy = & recommendations . Policy { ID : uuid . NewString ( ) , Identity : e . Identity , LastUpdated : time . Now ( ) , Token : token , EventCount : 0 , Status : " " , Document : recommendations . AWSIAMPolicy { Version : " " , Statement : [ ] recommendations . AWSIAMStatement { } , } , } } advice , err := advisor . Advise ( e ) if err != nil { return nil , err } else { c . log . With ( " " , advice ) . Info ( " " ) } action := recommendations . AWSAction { ID : uuid . NewString ( ) , PolicyID : policy . ID , Event : e , Status : recommendations . AlertActive , Time : time . Now ( ) , HasRecommendations : false , Resources : [ ] recommendations . Resource { } , Recommendations : [ ] recommendations . Advice { } , Enabled : true , SelectedAdvisoryID : " " , } if len ( advice ) > 0 { action . HasRecommendations = true action . Recommendations = advice action . Resources = advice [ 0 ] . Details ( ) . Resources action . SelectedAdvisoryID = advice [ 0 ] . GetID ( ) } c . log . With ( " " , action ) . Info ( " " ) c . actionStorage . Add ( action ) actions := c . actionStorage . ListForPolicy ( policy . ID ) policy . RecalculateDocument ( actions ) err = c . policyStorage . CreateOrUpdate ( * policy ) if err != nil { return nil , err } return & action , nil }
handleRecommendation handles a captured IAM Zero event and looks up advisories for it,
saving results to the storage
handleRecommendation handles a captured IAM Zero event and looks up advisories for it saving results to the storage
// if the event was captured from an assumed role, replace it with the IAM role ARN // TODO: we should store both the session ARN and the role ARN in this case // censor info if in demo mode // try and find an existing policy // create a new policy for the token and role if it doesn't exist // TODO: we should aggregate resources across different advisories