AnalysisType: policy
Filename: aws_acm_certificate_valid.py
PolicyID: "AWS.ACM.Certificate.Valid"
DisplayName: "AWS ACM Certificate Status"
Enabled: true
ResourceTypes:
- AWS.ACM.Certificate
Reports:
MITRE ATT&CK:
- TA0042:T1588
Tags:
- AWS
- Operations
- Panther
- Resource Development:Obtain Capabilities
Severity: High
Description: >
This policy checks if an ACM certificate renewal is pending or has failed and is in use
by any other resources within the account.
Runbook: >
From the ACM panel in the AWS console, check and resolve the certificate status.
Reference: https://docs.aws.amazon.com/acm/latest/userguide/check-certificate-renewal-status.html
Tests:
- Name: Certificate renewal pending validation
ExpectedResult: false
Resource:
{
"Arn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateAuthorityArn": null,
"CreatedAt": "2019-05-23T19:20:52Z",
"Domain": "test.domain.io",
"DomainName": "test.domain.io",
"DomainValidationOptions":
[
{
"DomainName": "test.domain.io",
"ResourceRecord":
{
"Name": "_cc1fccccc11111111c286666111ee999.test.domain.io.",
"Type": "CNAME",
"Value": "_cc1fccccc11111111c286666111ee999.ltfvzjuylp.acm-validations.aws.",
},
"ValidationDomain": "test.domain.io",
"ValidationEmails": null,
"ValidationMethod": "DNS",
"ValidationStatus": "SUCCESS",
},
],
"ExtendedKeyUsages":
[
{
"Name": "TLS_WEB_CLIENT_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.2",
},
{
"Name": "TLS_WEB_SERVER_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.1",
},
],
"FailureReason": "No Available Contacts",
"ImportedAt": null,
"InUseBy":
["arn:aws:cloudfront::123456789012:distribution/E12KXPQHVLSYVC"],
"IssuedAt": "2019-05-23T19:21:48Z",
"Issuer": "Amazon",
"KeyAlgorithm": "RSA-2048",
"KeyUsages":
[{ "Name": "DIGITAL_SIGNATURE" }, { "Name": "KEY_ENCIPHERMENT" }],
"NotAfter": "3020-06-23T12:00:00Z",
"NotBefore": "2019-05-23T00:00:00Z",
"Options": { "CertificateTransparencyLoggingPreference": "ENABLED" },
"RenewalEligibility": "INELIGIBLE",
"RenewalSummary": null,
"RevocationReason": null,
"RevokedAt": null,
"Serial": "00:bb:cc:aa:66:11:22:00:dd:88:f8:48:3e:92:6e:0d",
"SignatureAlgorithm": "SHA256WITHRSA",
"Status": "PENDING_VALIDATION",
"Subject": "CN=test.domain.io",
"SubjectAlternativeNames": ["test.domain.io"],
"Type": "AMAZON_ISSUED",
}
- Name: Certificate renewal failed
ExpectedResult: false
Resource:
{
"Arn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateAuthorityArn": null,
"CreatedAt": "2019-05-23T19:20:52Z",
"Domain": "test.domain.io",
"DomainName": "test.domain.io",
"DomainValidationOptions":
[
{
"DomainName": "test.domain.io",
"ResourceRecord":
{
"Name": "_cc1fccccc11111111c286666111ee999.test.domain.io.",
"Type": "CNAME",
"Value": "_cc1fccccc11111111c286666111ee999.ltfvzjuylp.acm-validations.aws.",
},
"ValidationDomain": "test.domain.io",
"ValidationEmails": null,
"ValidationMethod": "DNS",
"ValidationStatus": "SUCCESS",
},
],
"ExtendedKeyUsages":
[
{
"Name": "TLS_WEB_CLIENT_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.2",
},
{
"Name": "TLS_WEB_SERVER_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.1",
},
],
"FailureReason": "No Available Contacts",
"ImportedAt": null,
"InUseBy":
["arn:aws:cloudfront::123456789012:distribution/E12KXPQHVLSYVC"],
"IssuedAt": "2019-05-23T19:21:48Z",
"Issuer": "Amazon",
"KeyAlgorithm": "RSA-2048",
"KeyUsages":
[{ "Name": "DIGITAL_SIGNATURE" }, { "Name": "KEY_ENCIPHERMENT" }],
"NotAfter": "3020-06-23T12:00:00Z",
"NotBefore": "2019-05-23T00:00:00Z",
"Options": { "CertificateTransparencyLoggingPreference": "ENABLED" },
"RenewalEligibility": "INELIGIBLE",
"RenewalSummary": null,
"RevocationReason": null,
"RevokedAt": null,
"Serial": "00:bb:cc:aa:66:11:22:00:dd:88:f8:48:3e:92:6e:0d",
"SignatureAlgorithm": "SHA256WITHRSA",
"Status": "FAILED",
"Subject": "CN=test.domain.io",
"SubjectAlternativeNames": ["test.domain.io"],
"Type": "AMAZON_ISSUED",
}
- Name: Certificate has been issued
ExpectedResult: true
Resource:
{
"Arn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/33333333-5555-4444-aaaa-04206915b869",
"CertificateAuthorityArn": null,
"CreatedAt": "2019-05-23T19:20:52Z",
"Domain": "test.domain.io",
"DomainName": "test.domain.io",
"DomainValidationOptions":
[
{
"DomainName": "test.domain.io",
"ResourceRecord":
{
"Name": "_cc1fccccc11111111c286666111ee999.test.domain.io.",
"Type": "CNAME",
"Value": "_cc1fccccc11111111c286666111ee999.ltfvzjuylp.acm-validations.aws.",
},
"ValidationDomain": "test.domain.io",
"ValidationEmails": null,
"ValidationMethod": "DNS",
"ValidationStatus": "SUCCESS",
},
],
"ExtendedKeyUsages":
[
{
"Name": "TLS_WEB_CLIENT_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.2",
},
{
"Name": "TLS_WEB_SERVER_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.1",
},
],
"FailureReason": null,
"ImportedAt": null,
"InUseBy":
["arn:aws:cloudfront::123456789012:distribution/E12KXPQHVLSYVC"],
"IssuedAt": "2019-05-23T19:21:48Z",
"Issuer": "Amazon",
"KeyAlgorithm": "RSA-2048",
"KeyUsages":
[{ "Name": "DIGITAL_SIGNATURE" }, { "Name": "KEY_ENCIPHERMENT" }],
"NotAfter": "2000-06-23T12:00:00Z",
"NotBefore": "2019-05-23T00:00:00Z",
"Options": { "CertificateTransparencyLoggingPreference": "ENABLED" },
"RenewalEligibility": "ELIGIBLE",
"RenewalSummary": null,
"RevocationReason": null,
"RevokedAt": null,
"Serial": "00:bb:cc:aa:66:11:22:00:dd:88:f8:48:3e:92:6e:0d",
"SignatureAlgorithm": "SHA256WITHRSA",
"Status": "ISSUED",
"Subject": "CN=test.domain.io",
"SubjectAlternativeNames": ["test.domain.io"],
"Type": "AMAZON_ISSUED",
}
- Name: Certificate is INELIGIBLE but not in use
ExpectedResult: true
Resource:
{
"Status": "ISSUED",
"KeyUsages":
[{ "Name": "DIGITAL_SIGNATURE" }, { "Name": "KEY_ENCIPHERMENT" }],
"Type": "AMAZON_ISSUED",
"NotAfter": "2020-06-09T12:00:00Z",
"Options": { "CertificateTransparencyLoggingPreference": "ENABLED" },
"KeyAlgorithm": "RSA-2048",
"ResourceId": "arn:aws:acm:us-east-1:123456789012:certificate/fe9dceea-121d-4a04-bda1-de35a68a846e",
"FailureReason": null,
"Serial": "08:57:00:ff:aa:11:ff:99:ee:44:33:77:99:bb:00:dd",
"Region": "us-east-1",
"DomainValidationOptions":
[
{
"DomainName": "staging.productionenv.io",
"ResourceRecord":
{
"Value": "_0b741cda9f99a8df89813rjj1lkrj.ltfvzjuylp.acm-validations.aws.",
"Type": "CNAME",
"Name": "_sad9f087asdfujejkwf09wa8.staging.productionenv.io.",
},
"ValidationDomain": "staging.productionenv.io",
"ValidationMethod": "DNS",
"ValidationStatus": "SUCCESS",
"ValidationEmails": null,
},
],
"RenewalEligibility": "INELIGIBLE",
"IssuedAt": "2019-05-09T19:49:06Z",
"AccountId": "123456789012",
"DomainName": "staging.productionenv.io",
"RevokedAt": null,
"Arn": "arn:aws:acm:us-east-1:123456789012:certificate/fe9dceea-121d-4a04-bda1-de35a68a846e",
"ResourceType": "AWS.ACM.Certificate",
"TimeCreated": null,
"RenewalSummary": null,
"ExtendedKeyUsages":
[
{
"Name": "TLS_WEB_CLIENT_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.2",
},
{
"Name": "TLS_WEB_SERVER_AUTHENTICATION",
"OID": "1.3.6.1.5.5.7.3.1",
},
],
"NotBefore": "2019-05-09T00:00:00Z",
"RevocationReason": null,
"InUseBy": null,
"SubjectAlternativeNames": ["staging.productionenv.io"],
"Tags": null,
"Subject": "CN=staging.productionenv.io",
"SignatureAlgorithm": "SHA256WITHRSA",
"Issuer": "Amazon",
"Name": "staging.productionenv.io",
"CertificateAuthorityArn": null,
}
# ------ paired body: aws_acm_certificate_valid.py ------
def policy(resource):
if not bool(resource["InUseBy"]):
return True
return resource["Status"] == "ISSUED"