nccgroup / ScoutSuite

Multi-Cloud Security Auditing Tool

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

AWS Credential Report detail view incorrectly flags disabled credentials

rieck-srlabs opened this issue · comments

Describe the bug

AWS's credential report rule ("Credentials Unused for 90 Days or Greater Are Not Disabled") correctly flags users that have credentials which have been unused for at least 90 days and which are enabled.

However, the detail overview highlights not just the affected credentials in red, but all credentials, even disabled ones or credentials that are newer than 90 days:

Screenshot 2024-04-12 at 14 19 37

In the screenshot above:

  1. Password is highlighted despite being disabled
  2. Access Key 2 is highlighted despite not being active
  3. (Active access keys that have recently been used are also highlighted in red, as long as there is another access key that has not been used recently. Note that this problem is not highlighted in the screenshot above)

To Reproduce

Run ScoutSuite with no parameter against an account that has a user with an access key that has not been used for at least 90 days:

$ scout aws

Additional context

n/a

Closing issue, as the fix was merged and is included in the latest release.