Commit `a70cee9b1e`

a70cee9b1e475ff61f5ca97183969f16bf931fa8

parent: 5ea48c117a

Unsigned

cmc <hello@cleberg.net> · 2026-08-05 20:44 UTC

fix: correct password-policy evaluator bugs and harden collector

evaluate_policy.py:
- Fix MaxPasswordAge scoring: it is a maximum (lower is stricter), so
  score actual <= expected. Previously scored as a minimum, which passed
  overly long expiry windows that should fail.
- Stop crashing on absent numeric fields. AWS omits MaxPasswordAge when
  expiry is off (and PasswordReusePrevention when reuse prevention is
  off); comparing the "(missing)" sentinel to an int raised TypeError.
  A required-but-absent item is now reported as FAIL.
- Fix utc_now(): it referenced datetime.datetime (the class has no such
  attribute) and only worked via a module re-import buried in __main__.
  Use datetime.now(timezone.utc) and drop the shadowing import.
- Compare booleans with == and reject cross-type matches (a bool no
  longer satisfies a numeric rule and vice versa).

gather_policy.sh:
- Build the metadata block with `jq --arg/--argjson` so hostnames or
  working directories containing quotes or backslashes cannot produce
  malformed JSON.

Layout: unified · split

applications/aws/aws_password_policy/evaluate_policy.py +29 −13

 Features
 * Interactive prompts – press <Enter> to mark a rule as N/A.
-* Numeric items are treated as **minimums** (actual >= expected → PASS).
+* Most numeric items are treated as **minimums** (actual >= expected → PASS).
+* Maximum password age is treated as a **maximum** (actual <= expected → PASS),
+  because a lower ceiling is the stricter/more‑secure setting.
 * Boolean items are treated as **exact matches** (actual == expected → PASS).
+* A required item that is absent from the policy is reported as FAIL rather
+  than crashing (AWS omits e.g. MaxPasswordAge when password expiry is off).
 * The CSV begins with a small metadata block (same data that the Bash script
   captured) so the audit trail is self‑contained.
 * Usage:
 # Mapping of the 10 password‑policy fields we care about
 # (rule_no, json_key, friendly_name, datatype)
 # ----------------------------------------------------------------------
+# Numeric datatypes carry a direction:
+#   "int_min" – actual must be >= expected (higher is stricter)
+#   "int_max" – actual must be <= expected (lower is stricter)
 POLICY_FIELDS = [
-    (1, "MinimumPasswordLength", "Minimum password length", "int"),
+    (1, "MinimumPasswordLength", "Minimum password length", "int_min"),
     (2, "RequireSymbols", "Require symbols (!@#$…)", "bool"),
     (3, "RequireNumbers", "Require numbers (0‑9)", "bool"),
     (4, "RequireUppercaseCharacters", "Require uppercase letters (A‑Z)", "bool"),
     (5, "RequireLowercaseCharacters", "Require lowercase letters (a‑z)", "bool"),
     (6, "AllowUsersToChangePassword", "Allow users to change password", "bool"),
     (7, "ExpirePasswords", "Expire passwords (enable aging)", "bool"),
-    (8, "MaxPasswordAge", "Maximum password age (days)", "int"),
+    (8, "MaxPasswordAge", "Maximum password age (days)", "int_max"),
-    (9, "PasswordReusePrevention", "Prevent password reuse (last N)", "int"),
+    (9, "PasswordReusePrevention", "Prevent password reuse (last N)", "int_min"),
     (10, "HardExpiry", "Hard expiry (no grace period)", "bool"),
 ]
 # Helper functions
 # ----------------------------------------------------------------------
 def utc_now() -> datetime:
-    """Return a timezone‑aware UTC datetime (compatible with all Python 3.x)."""
+    """Return a timezone‑aware UTC datetime."""
-    return datetime.datetime.now(timezone.utc)
+    return datetime.now(timezone.utc)
 def prompt_expected(field_type: str, description: str) -> Any | None:
         ).strip()
         if raw == "":
             return None  # N/A
-        if field_type == "int":
+        if field_type.startswith("int"):
             if raw.isdigit():
                 return int(raw)
             print("Please enter a whole number (or leave blank).")
 def evaluate(expect: Any | None, actual: Any, field_type: str) -> str:
-    """Return PASS / FAIL / N/A."""
+    """Return PASS / FAIL / N/A.
+    A required item (expectation set) that is absent or of the wrong type in
+    the policy is a FAIL, never a crash.
+    """
     if expect is None:
         return "N/A"
-    if field_type == "int":
-        return "PASS" if actual >= expect else "FAIL"
     if field_type == "bool":
-        return "PASS" if actual is expect else "FAIL"
+        # bool is a subclass of int, so guard against ints sneaking through.
+        return "PASS" if isinstance(actual, bool) and actual == expect else "FAIL"
+    if field_type.startswith("int"):
+        # Reject non‑numbers (e.g. a missing field rendered as a string) and
+        # booleans (a subclass of int that must not satisfy a numeric rule).
+        if isinstance(actual, bool) or not isinstance(actual, (int, float)):
+            return "FAIL"
+        if field_type == "int_max":
+            return "PASS" if actual <= expect else "FAIL"
+        return "PASS" if actual >= expect else "FAIL"
     return "FAIL"
 if __name__ == "__main__":
-    import datetime  # imported here to keep the top of file tidy
     main()

applications/aws/aws_password_policy/gather_policy.sh +20 −14

	@@ -60,20 +60,26 @@ fi
60	# * current working directory (useful for traceability)	60	# * current working directory (useful for traceability)
61	# * AWS profile & region (if set)	61	# * AWS profile & region (if set)
62	# * AWS caller identity (ARN, account id, user id) – proves who ran the command	62	# * AWS caller identity (ARN, account id, user id) – proves who ran the command
63	METADATA=$(cat <<EOF	63	# Build with `jq --arg` so values containing quotes/backslashes (e.g. an odd
64	{	64	# hostname or working directory) can never produce malformed JSON.
65	"metadata": {	65	CALLER_IDENTITY=$(aws sts get-caller-identity 2>/dev/null \|\| echo "null")
66	"report_timestamp_utc": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")",	66	METADATA=$(jq -n \
67	"os_user": "$(id -un)",	67	--arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
68	"hostname": "$(hostname)",	68	--arg user "$(id -un)" \
69	"working_directory": "$(pwd)",	69	--arg host "$(hostname)" \
70	"aws_profile": "${AWS_PROFILE:-default}",	70	--arg cwd "$(pwd)" \
71	"aws_region": "${AWS_DEFAULT_REGION:-unknown}",	71	--arg profile "${AWS_PROFILE:-default}" \
72	"aws_caller_identity": $(aws sts get-caller-identity 2>/dev/null \|\| echo "null")	72	--arg region "${AWS_DEFAULT_REGION:-unknown}" \
73	}	73	--argjson caller "$CALLER_IDENTITY" \
74	}	74	'{metadata: {
75	EOF	75	report_timestamp_utc: $ts,
76	)	76	os_user: $user,
		77	hostname: $host,
		78	working_directory: $cwd,
		79	aws_profile: $profile,
		80	aws_region: $region,
		81	aws_caller_identity: $caller
		82	}}')
77		83
78	# ---------- 3. Merge policy + metadata ----------	84	# ---------- 3. Merge policy + metadata ----------
79	# The final JSON will have two top‑level keys: "metadata" and "PasswordPolicy"	85	# The final JSON will have two top‑level keys: "metadata" and "PasswordPolicy"

Commit a70cee9b1e

Commit `a70cee9b1e`