diff --git a/helpers/aws/api.js b/helpers/aws/api.js index 7497e18119..12dd2b6b19 100644 --- a/helpers/aws/api.js +++ b/helpers/aws/api.js @@ -2067,7 +2067,6 @@ var postcalls = [ reliesOnCall: 'listUserPools', override: true } - }, GuardDuty: { getDetector: { diff --git a/plugins/aws/cognito/cognitoHasWafEnabled.js b/plugins/aws/cognito/cognitoHasWafEnabled.js index dc9b49b12c..eba7741dd7 100644 --- a/plugins/aws/cognito/cognitoHasWafEnabled.js +++ b/plugins/aws/cognito/cognitoHasWafEnabled.js @@ -4,11 +4,11 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Cognito User Pool Has WAF Enabled', category: 'Cognito', - domain: 'Identity Service Provider', + domain: 'Identity and Access Management', description: 'Ensure that Cognito User Pool has WAF enabled.', more_info: 'Enabling WAF allows control over unwanted requests to your hosted UI and Amazon Cognito API service endpoints, allowing or denying traffic based off rules in the Web ACL.', link: 'https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html', - recommended_action: '1. Enter the Cognito service. 2. Enter user pools and enable WAF from properties', + recommended_action: '1. Enter the Cognito service. 2. Enter user pools and enable WAF from properties.', apis: ['CognitoIdentityServiceProvider:listUserPools', 'WAFV2:getWebACLForCognitoUserPool', 'STS:getCallerIdentity'], run: function(cache, settings, callback) { @@ -30,10 +30,12 @@ module.exports = { helpers.addResult(results, 3, 'Unable to query Cognito user pools: ' + helpers.addError(userPools), region); return rcb(); } + if (!userPools.data.length){ helpers.addResult(results, 0, 'No Cognito user pools found', region); return rcb(); } + for (let userPool of userPools.data) { if (!userPool.Id) continue; @@ -48,9 +50,9 @@ module.exports = { continue; } if (webACLResource.data.WebACL){ - helpers.addResult(results, 0, 'Cognito User pool has WAFV2 enabled', region, arn); + helpers.addResult(results, 0, 'User pool has WAFV2 enabled', region, arn); } else { - helpers.addResult(results, 2, 'Cognito User pool does not have WAFV2 enabled', region, arn); + helpers.addResult(results, 2, 'User pool does not have WAFV2 enabled', region, arn); } } diff --git a/plugins/aws/cognito/cognitoHasWafEnabled.spec.js b/plugins/aws/cognito/cognitoHasWafEnabled.spec.js index c41594eeb2..50e7f79dc8 100644 --- a/plugins/aws/cognito/cognitoHasWafEnabled.spec.js +++ b/plugins/aws/cognito/cognitoHasWafEnabled.spec.js @@ -85,7 +85,7 @@ describe('cognitoHasWafEnabled', function () { expect(results.length).to.equal(1); expect(results[0].status).to.equal(0); expect(results[0].region).to.equal('us-east-1'); - expect(results[0].message).to.include('Cognito User pool has WAFV2 enabled'); + expect(results[0].message).to.include('User pool has WAFV2 enabled'); done(); }; @@ -98,7 +98,7 @@ describe('cognitoHasWafEnabled', function () { expect(results.length).to.equal(1); expect(results[0].status).to.equal(2); expect(results[0].region).to.equal('us-east-1'); - expect(results[0].message).to.include('Cognito User pool does not have WAFV2 enabled'); + expect(results[0].message).to.include('User pool does not have WAFV2 enabled'); done(); };