forked from aquasecurity/cloudsploit
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathunusedWorkspaces.js
More file actions
64 lines (53 loc) · 3.05 KB
/
Copy pathunusedWorkspaces.js
File metadata and controls
64 lines (53 loc) · 3.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
var async = require('async');
var helpers = require('../../../helpers/aws');
module.exports = {
title: 'Unused WorkSpaces',
category: 'WorkSpaces',
domain: 'Identity Access and Management',
description: 'Ensure that there are no unused AWS WorkSpaces instances available within your AWS account.',
more_info: 'An AWS WorkSpaces instance is considered unused if it has 0 known user connections registered within the past 30 days. Remove these instances to avoid unnecessary billing.',
link: 'https://aws.amazon.com/workspaces/pricing/',
recommended_action: 'Identify and remove unused Workspaces instance',
apis: ['WorkSpaces:describeWorkspacesConnectionStatus','STS:getCallerIdentity'],
run: function(cache, settings, callback) {
var results = [];
var source = {};
var regions = helpers.regions(settings);
var awsOrGov = helpers.defaultPartition(settings);
var acctRegion = helpers.defaultRegion(settings);
var accountId = helpers.addSource(cache, source, ['sts', 'getCallerIdentity', acctRegion , 'data']);
async.each(regions.workspaces, function(region, rcb){
var describeWorkspacesConnectionStatus = helpers.addSource(cache, source,
['workspaces', 'describeWorkspacesConnectionStatus', region]);
if (!describeWorkspacesConnectionStatus) return rcb();
if (describeWorkspacesConnectionStatus.err || !describeWorkspacesConnectionStatus.data) {
helpers.addResult(results, 3,
'Unable to query for WorkSpaces instance connection status: ' + helpers.addError(describeWorkspacesConnectionStatus), region);
return rcb();
}
if (!describeWorkspacesConnectionStatus.data.length) {
helpers.addResult(results, 0, 'No WorkSpaces instance connection status found', region);
return rcb();
}
describeWorkspacesConnectionStatus.data.forEach(workspace => {
if (!workspace.WorkspaceId) return;
let resource = `arn:${awsOrGov}:region:${region}:${accountId}:worskpace/${workspace.WorkspaceId}`;
if (!workspace.LastKnownUserConnectionTimestamp) {
helpers.addResult(results, 2,
'WorkSpace does not have any known user connection', region, resource);
} else if (workspace.LastKnownUserConnectionTimestamp &&
(helpers.daysBetween(new Date(), workspace.LastKnownUserConnectionTimestamp)) > 30) {
helpers.addResult(results, 2,
`WorkSpace is not in use for last ${helpers.daysBetween(new Date(), workspace.LastKnownUserConnectionTimestamp)}`,
region, resource);
} else {
helpers.addResult(results, 0,
'WorkSpace is in use', region, resource);
}
});
rcb();
}, function(){
callback(null, results, source);
});
}
};