Cloud Credentials Rotation - AWS

## **AWS Credentials Rotation Playbook** ### **Identity Remediation** Secure compromised accounts by taking swift action: - **Reset Password**: Resets the user password to halt any unauthorized access. - **Access Key Deactivation**: Deactivate any suspicious or known-compromised access keys. - **Combo Action**: In some cases, you may want to reset both the password and deactivate the access key for absolute security. ### **Role Remediation** If a role is suspected to be compromised: - **Deny Policy Implementation**: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions. - **Role Cloning**: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.

AWS Enrichment and Remediation · 36 tasks · 9 inputs · 4 outputs

Details

IDCloud Credentials Rotation - AWS
From Version6.9.0
Tasks36

README

AWS Credentials Rotation Playbook

Identity Remediation

Secure compromised accounts by taking swift action:

  • Reset Password: Resets the user password to halt any unauthorized access.

  • Access Key Deactivation: Deactivate any suspicious or known-compromised access keys.

  • Combo Action: In some cases, you may want to reset both the password and deactivate the access key for absolute security.

Role Remediation

If a role is suspected to be compromised:

  • Deny Policy Implementation: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions.

  • Role Cloning: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • Set
  • GeneratePassword

Commands

  • aws-ec2-describe-iam-instance-profile-associations
  • aws-iam-list-attached-role-policies
  • aws-iam-list-role-policies
  • aws-iam-list-policy-versions
  • aws-iam-create-instance-profile
  • aws-iam-get-policy-version
  • aws-iam-create-role
  • aws-iam-attach-policy
  • aws-iam-put-role-policy
  • aws-iam-update-login-profile
  • aws-iam-update-access-key
  • aws-iam-get-instance-profile
  • aws-ec2-describe-instances
  • aws-iam-get-role-policy
  • aws-ec2-describe-regions

Playbook Inputs

Name Description Default Value Required
IAMRemediationType The response playbook provides the following remediation actions for IAM users:

Reset - By entering “Reset” in the input, the playbook will execute password reset.

Deactivate - By entering “Deactivate” in the input, the playbook will execute access key deactivation.

ALL - By entering “ALL” in the input, the playbook will execute both password reset and access key deactivation.		   Optional
shouldCloneSA Whether to clone the compromised SA before putting a deny policy to it.
True/False		   Optional
identityType The type of identity involved. Usually mapped to the incident field named ‘cloudidentitytype’.
e.g.
USER,SERVICE_ACCOUNT,APPLICATION		   Optional
newRoleName The new role name to assign in the clone service account flow. tempNewRoleName Optional
newInstanceProfileName The new instance profile name to assign in the clone service account flow. tempNewInstanceProfileName Optional
accessKeyID The access key ID.   Optional
username The user name.   Optional
instanceID The instance ID.   Optional
roleNameToRestrict If provided, the role will be attached with a deny policy without the compute instance analysis flow.   Optional

Playbook Outputs

Path Description Type
AWS.EC2.Instances AWS EC2 instance information. unknown
AWS.IAM.InstanceProfiles AWS IAM instance profile information. unknown
AWS.IAM.Roles.AttachedPolicies.Policies A list of managed policy names. unknown
AWS.IAM.Roles.RoleName.Policies A list of policy names. unknown

Playbook Image

Cloud Credentials Rotation - AWS

Inputs

  • IAMRemediationType — The response playbook provides the following remediation actions for IAM users: Reset - By entering "Reset" in the input, the playbook will execute password reset. Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation. ALL - By entering "ALL" in the input, the playbook will execute both password reset and access key deactivation.
  • shouldCloneSA — Whether to clone the compromised SA before putting a deny policy to it. True/False
  • identityType — The type of identity involved. Usually mapped to the incident field named 'cloudidentitytype'. e.g. USER,SERVICE_ACCOUNT,APPLICATION
  • newRoleName — The new role name to assign in the clone service account flow.
  • newInstanceProfileName — The new instance profile name to assign in the clone service account flow.
  • accessKeyID — The access key ID.
  • username — The user name.
  • instanceID — The instance ID.
  • roleNameToRestrict — If provided, the role will be attached with a deny policy without the compute instance analysis flow.

Outputs

  • AWS.EC2.Instances — AWS EC2 instance information.
  • AWS.IAM.InstanceProfiles — AWS IAM instance profile information.
  • AWS.IAM.Roles.AttachedPolicies.Policies — A list of managed policy names.
  • AWS.IAM.Roles.RoleName.Policies — A list of policy names.

Commands used

aws-ec2-describe-iam-instance-profile-associations aws-ec2-describe-instances aws-ec2-describe-regions aws-iam-attach-policy aws-iam-create-instance-profile aws-iam-create-role aws-iam-get-instance-profile aws-iam-get-policy-version aws-iam-get-role-policy aws-iam-list-attached-role-policies aws-iam-list-policy-versions aws-iam-list-role-policies aws-iam-put-role-policy aws-iam-update-access-key aws-iam-update-login-profile

Flowchart

Yes ALL Deactivate Access Key Reset Password yes ROLE USER yes yes yes Start Start Compute Compute Identity Identity Deactivate the user's access key - aws-iam-update-access-key Deactivate the user's acc... aws-iam-update-access-key Force password reset - aws-iam-update-login-profile Force password reset aws-iam-update-login-profile Describe regions - aws-ec2-describe-regions Describe regions aws-ec2-describe-regions Describe instances - aws-ec2-describe-instances Describe instances aws-ec2-describe-instances Describe IAM instance profile associations - aws-ec2-describe-iam-instance-profile-associations Describe IAM instance pro... aws-ec2-describe-iam-instance... Get instance profile - aws-iam-get-instance-profile Get instance profile aws-iam-get-instance-profile List attached role policies - aws-iam-list-attached-role-policies List attached role policies aws-iam-list-attached-role-po... List role inline-policies - aws-iam-list-role-policies List role inline-policies aws-iam-list-role-policies Create instance profile - aws-iam-create-instance-profile Create instance profile aws-iam-create-instance-profile Create role - aws-iam-create-role Create role aws-iam-create-role Clone Compromised Service Account Clone Compromised Service... Change Instance Profile IAM Role Change Instance Profile I... Attach role policy - aws-iam-attach-policy Attach role policy aws-iam-attach-policy Attach deny policy to a role - aws-iam-put-role-policy Attach deny policy to a role aws-iam-put-role-policy Should clone before putting a deny policy? Should clone before putti... Check remediation type Check remediation type Done Done Done Done ALL ALL Set attached policies ARN - Set Set attached policies ARN Set Set policies name - Set Set policies name Set Were role policies document retrieved? Were role policies docume... Get role policies - aws-iam-get-role-policy Get role policies aws-iam-get-role-policy List policy versions - aws-iam-list-policy-versions List policy versions aws-iam-list-policy-versions Get policy version - aws-iam-get-policy-version Get policy version aws-iam-get-policy-version Managed Policies Managed Policies Inline Policies Inline Policies Put role policy - aws-iam-put-role-policy Put role policy aws-iam-put-role-policy Generate a temporary password - GeneratePassword Generate a temporary pass... GeneratePassword Check identity type Check identity type Should investigate the compromised instance? Should investigate the co... Were role inline-policies retrieved? Were role inline-policies... Were role managed policies retrieved? Were role managed policie...

Source

playbook-Cloud_Credentials_Rotation_-_AWS.yml
Download History Raw 
id: Cloud Credentials Rotation - AWS
version: -1
name: Cloud Credentials Rotation - AWS
description: |-
  ## **AWS Credentials Rotation Playbook**

  ### **Identity Remediation**
  Secure compromised accounts by taking swift action:
  - **Reset Password**: Resets the user password to halt any unauthorized access.

  - **Access Key Deactivation**: Deactivate any suspicious or known-compromised access keys.

  - **Combo Action**: In some cases, you may want to reset both the password and deactivate the access key for absolute security.

  ### **Role Remediation**
  If a role is suspected to be compromised:
  - **Deny Policy Implementation**: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions.

  - **Role Cloning**: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e31893d6-5dc6-4f63-8bea-7e87a3626950
    type: start
    task:
      id: e31893d6-5dc6-4f63-8bea-7e87a3626950
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 7184e6ea-8ff8-4956-8c4f-7e7d49e44f43
    type: title
    task:
      id: 7184e6ea-8ff8-4956-8c4f-7e7d49e44f43
      version: -1
      name: Compute
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 474544c9-043c-4cfb-8f23-804aadb9ea6f
    type: title
    task:
      id: 474544c9-043c-4cfb-8f23-804aadb9ea6f
      version: -1
      name: Identity
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": -165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 50995c28-10ca-4f42-8c2a-4d7635c60b1f
    type: regular
    task:
      id: 50995c28-10ca-4f42-8c2a-4d7635c60b1f
      version: -1
      name: Deactivate the user's access key
      description: Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow.
      script: '|||aws-iam-update-access-key'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      accessKeyId:
        complex:
          root: inputs.accessKeyID
      status:
        simple: Inactive
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 346dec85-0477-4f49-819b-701179050d19
    type: regular
    task:
      id: 346dec85-0477-4f49-819b-701179050d19
      version: -1
      name: Force password reset
      description: Changes the password for the specified IAM user.
      script: '|||aws-iam-update-login-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      newPassword:
        complex:
          root: NEW_PASSWORD
      passwordResetRequired:
        simple: "True"
      userName:
        complex:
          root: inputs.username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1660,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 1f824e1c-2bcf-4204-8806-e89b4d144f97
    type: regular
    task:
      id: 1f824e1c-2bcf-4204-8806-e89b4d144f97
      version: -1
      name: Describe regions
      description: Describes one or more regions that are currently available to you.
      script: '|||aws-ec2-describe-regions'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 33ef6c53-9f17-426e-82b3-756ed55a185e
    type: regular
    task:
      id: 33ef6c53-9f17-426e-82b3-756ed55a185e
      version: -1
      name: Describe instances
      description: Describes one or more of your instances.
      script: '|||aws-ec2-describe-instances'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      filters:
        simple: Name=iam-instance-profile.arn,Values=${AWS.EC2.IamInstanceProfileAssociations.IamInstanceProfile.Arn}
      region:
        complex:
          root: AWS.Regions
          accessor: RegionName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 29547081-1a2e-4a6d-8576-51caf121a64d
    type: regular
    task:
      id: 29547081-1a2e-4a6d-8576-51caf121a64d
      version: -1
      name: Describe IAM instance profile associations
      description: Describes your IAM instance profile associations.
      script: '|||aws-ec2-describe-iam-instance-profile-associations'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      filters:
        simple: Name=instance-id,Values=${inputs.instanceID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 155
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 78bbcd2c-6182-4122-8a92-0c94bf784f58
    type: regular
    task:
      id: 78bbcd2c-6182-4122-8a92-0c94bf784f58
      version: -1
      name: Get instance profile
      description: Retrieves information about the specified instance profile.
      script: '|||aws-iam-get-instance-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      instanceProfileName:
        complex:
          root: AWS.EC2.Instances.IamInstanceProfile
          accessor: Arn
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 675
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: b4cca9fe-a91c-44fd-86a6-1d8cf0237267
    type: regular
    task:
      id: b4cca9fe-a91c-44fd-86a6-1d8cf0237267
      version: -1
      name: List attached role policies
      description: List all managed policies that are attached to the specified IAM role.
      script: '|||aws-iam-list-attached-role-policies'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      roleName:
        complex:
          root: AWS.IAM.InstanceProfiles.Roles
          accessor: RoleName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: c6a5ddee-9189-4e0e-8ca9-3724362c5632
    type: regular
    task:
      id: c6a5ddee-9189-4e0e-8ca9-3724362c5632
      version: -1
      name: List role inline-policies
      description: Lists the names of the inline policies that are embedded in the specified IAM role.
      script: '|||aws-iam-list-role-policies'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      roleName:
        complex:
          root: AWS.IAM.InstanceProfiles.Roles
          accessor: RoleName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: d01a4182-b82b-4372-8f46-292de9d16868
    type: regular
    task:
      id: d01a4182-b82b-4372-8f46-292de9d16868
      version: -1
      name: Create instance profile
      description: Creates a new instance profile.
      script: '|||aws-iam-create-instance-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      instanceProfileName:
        complex:
          root: inputs.newInstanceProfileName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 397cd3fc-0559-4e90-85dd-17dcc0f0611f
    type: regular
    task:
      id: 397cd3fc-0559-4e90-85dd-17dcc0f0611f
      version: -1
      name: Create role
      description: Creates a new role for your AWS account.
      script: '|||aws-iam-create-role'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      assumeRolePolicyDocument:
        complex:
          root: AWS.IAM.InstanceProfiles.Roles
          accessor: AssumeRolePolicyDocument
          transformers:
          - operator: Stringify
      roleName:
        complex:
          root: inputs.newRoleName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 08733be8-8938-4261-8ca4-3634944d8d4e
    type: title
    task:
      id: 08733be8-8938-4261-8ca4-3634944d8d4e
      version: -1
      name: Clone Compromised Service Account
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
      - "47"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 1025
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: a6106476-d3ca-4263-8ea6-7909e43e53eb
    type: title
    task:
      id: a6106476-d3ca-4263-8ea6-7909e43e53eb
      version: -1
      name: Change Instance Profile IAM Role
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -560,
          "y": 3105
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 6539d1ad-9593-49b5-804a-13aff5eba217
    type: regular
    task:
      id: 6539d1ad-9593-49b5-804a-13aff5eba217
      version: -1
      name: Attach role policy
      description: Attaches the specified managed policy to the specified IAM resource.
      script: '|||aws-iam-attach-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    scriptarguments:
      entityName:
        complex:
          root: inputs.newRoleName
      policyArn:
        complex:
          root: AWS.IAM.Roles.AttachedPolicies.Policies
          accessor: PolicyArn
      type:
        simple: Role
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 8d96c531-4f68-4e75-8264-066143a2d0c1
    type: regular
    task:
      id: 8d96c531-4f68-4e75-8264-066143a2d0c1
      version: -1
      name: Attach deny policy to a role
      description: Adds or updates an inline policy document that is embedded in the specified IAM role.
      script: '|||aws-iam-put-role-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      policyDocument:
        simple: |-
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Deny",
                "Action": "*",
                "Resource": "*"
              }
            ]
          }
      policyName:
        simple: XSIAM-DenyPolicy-Alert-${alert.id}
      roleName:
        complex:
          root: AWS.IAM.InstanceProfiles.Roles
          accessor: RoleName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.roleNameToRestrict
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -560,
          "y": 3240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: da40f794-fe96-4266-852b-65cfe91deb2e
    type: condition
    task:
      id: da40f794-fe96-4266-852b-65cfe91deb2e
      version: -1
      name: Should clone before putting a deny policy?
      description: Checks whether to clone the service account before putting a deny policy to it.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "Yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.shouldCloneSA
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: d072f064-19a3-44cc-8a3c-b69d6cf02efd
    type: condition
    task:
      id: d072f064-19a3-44cc-8a3c-b69d6cf02efd
      version: -1
      name: Check remediation type
      description: Checks the remediation type provided by the user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      ALL:
      - "39"
      Deactivate Access Key:
      - "16"
      Reset Password:
      - "51"
    separatecontext: false
    conditions:
    - label: Deactivate Access Key
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: Deactivate
          ignorecase: true
    - label: Reset Password
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: Reset
          ignorecase: true
    - label: ALL
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: ALL
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 818b1edc-5cab-4940-88fc-4a3a25c547fd
    type: title
    task:
      id: 818b1edc-5cab-4940-88fc-4a3a25c547fd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 5c0c9617-db02-446a-820c-f43fd368debd
    type: title
    task:
      id: 5c0c9617-db02-446a-820c-f43fd368debd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 625
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 1015b828-1cf9-45d3-8aca-b2585e0dbd3d
    type: title
    task:
      id: 1015b828-1cf9-45d3-8aca-b2585e0dbd3d
      version: -1
      name: ALL
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 368e0611-9297-4445-8a8c-89529dcfc92d
    type: regular
    task:
      id: 368e0611-9297-4445-8a8c-89529dcfc92d
      version: -1
      name: Set attached policies ARN
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      key:
        simple: attachedPoliciesARN
      value:
        complex:
          root: AWS.IAM.Roles.AttachedPolicies.Policies
          accessor: PolicyArn
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 10287654-3015-469a-8a34-df6a48c0504d
    type: regular
    task:
      id: 10287654-3015-469a-8a34-df6a48c0504d
      version: -1
      name: Set policies name
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      key:
        simple: policyNames
      value:
        complex:
          root: AWS.IAM.Roles
          accessor: Policies
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 37908070-3c4c-4d1e-8203-be5a0d33db00
    type: condition
    task:
      id: 37908070-3c4c-4d1e-8203-be5a0d33db00
      version: -1
      name: Were role policies document retrieved?
      description: Checks whether managed or inline policies are available.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: AWS.IAM.Policies.Versions.Document
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: AWS.IAM.Roles.PolicyDocument
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 63fb652e-4520-43c8-8d43-2623e816b1c8
    type: regular
    task:
      id: 63fb652e-4520-43c8-8d43-2623e816b1c8
      version: -1
      name: Get role policies
      description: Retrieves the specified inline policy document that is embedded with the specified IAM role.
      script: '|||aws-iam-get-role-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      policyName:
        complex:
          root: policyNames
      roleName:
        complex:
          root: AWS.IAM.InstanceProfiles.Roles
          accessor: RoleName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 0d3bb8ba-03e1-4a39-8dae-4878f0c16ae8
    type: regular
    task:
      id: 0d3bb8ba-03e1-4a39-8dae-4878f0c16ae8
      version: -1
      name: List policy versions
      description: Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.
      script: '|||aws-iam-list-policy-versions'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      policyArn:
        complex:
          root: attachedPoliciesARN
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: cfc564cd-cc7a-4706-88f5-16c70d6ca1a3
    type: regular
    task:
      id: cfc564cd-cc7a-4706-88f5-16c70d6ca1a3
      version: -1
      name: Get policy version
      description: Retrieves information about the specified version of the specified managed policy, including the policy document.
      script: '|||aws-iam-get-policy-version'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      policyArn:
        complex:
          root: AWS.IAM.Policies.Versions
          accessor: PolicyArn
      versionId:
        complex:
          root: AWS.IAM.Policies.Versions
          accessor: VersionId
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Policy Details
      output:
        complex:
          root: AWS.IAM.Policies.Versions.Document
          accessor: Version
          transformers:
          - operator: toUpperCase
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 30ba96a4-3837-4635-8375-8a48796db293
    type: title
    task:
      id: 30ba96a4-3837-4635-8375-8a48796db293
      version: -1
      name: Managed Policies
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 89b9042f-b670-4972-8f0a-c739171e1789
    type: title
    task:
      id: 89b9042f-b670-4972-8f0a-c739171e1789
      version: -1
      name: Inline Policies
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 16340052-4dba-49d8-8078-7d20e460351e
    type: regular
    task:
      id: 16340052-4dba-49d8-8078-7d20e460351e
      version: -1
      name: Put role policy
      description: Adds or updates an inline policy document that is embedded in the specified IAM role.
      script: '|||aws-iam-put-role-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      policyDocument:
        complex:
          root: AWS.IAM.Policies.Versions
          accessor: Document
          transformers:
          - operator: Stringify
      policyName:
        complex:
          root: policyNames
      roleName:
        complex:
          root: inputs.newRoleName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: c1b5e014-a3fc-4564-88b8-519a2903a86c
    type: regular
    task:
      id: c1b5e014-a3fc-4564-88b8-519a2903a86c
      version: -1
      name: Generate a temporary password
      description: "This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements).  The default behavior is to generate a password of  *random length* including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. \n\nThe min_* values all default to 0. This means that if the command is executed in this way:\n!GeneratePassword max_lcase=10\nIt is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. \n\nThe debug parameter will print certain properties of the command into the WarRoom for easy diagnostics."
      scriptName: GeneratePassword
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      min_digits:
        simple: "5"
      min_lcase:
        simple: "5"
      min_symbols:
        simple: "2"
      min_ucase:
        simple: "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1660,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 0cb9aa20-b9be-490b-871d-0f42d13d6641
    type: condition
    task:
      id: 0cb9aa20-b9be-490b-871d-0f42d13d6641
      version: -1
      name: Check identity type
      description: Checks the identity type that was part of the alert.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      ROLE:
      - "1"
      USER:
      - "10"
    separatecontext: false
    conditions:
    - label: ROLE
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: Compute
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.instanceID
            iscontext: true
    - label: USER
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: User
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.username
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.accessKeyID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 9b78a8bb-3900-4e8c-8276-a0c02edf0f24
    type: condition
    task:
      id: 9b78a8bb-3900-4e8c-8276-a0c02edf0f24
      version: -1
      name: Should investigate the compromised instance?
      description: Checks if the user provided a role name to put a deny policy to.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEmpty
          left:
            value:
              complex:
                root: inputs.roleNameToRestrict
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: efee05cd-487f-4c72-87ef-21356f33de71
    type: condition
    task:
      id: efee05cd-487f-4c72-87ef-21356f33de71
      version: -1
      name: 'Were role inline-policies retrieved? '
      description: Checks if inline policies were found for the role.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "42"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: AWS.IAM.Roles
                accessor: Policies
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 4ac0c6ae-8fee-4c34-8bac-c53528d788ef
    type: condition
    task:
      id: 4ac0c6ae-8fee-4c34-8bac-c53528d788ef
      version: -1
      name: 'Were role managed policies retrieved? '
      description: Checks if managed policies were found for the role.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: AWS.IAM.Roles.AttachedPolicies.Policies
                accessor: PolicyArn
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "34_29_Yes": 0.39,
      "34_30_#default#": 0.17,
      "35_16_Deactivate Access Key": 0.58,
      "35_37_#default#": 0.35,
      "35_39_ALL": 0.7,
      "35_51_Reset Password": 0.83,
      "43_25_yes": 0.44,
      "43_36_#default#": 0.26,
      "52_10_USER": 0.49,
      "52_1_ROLE": 0.7,
      "52_36_#default#": 0.1,
      "53_21_yes": 0.46,
      "53_30_#default#": 0.12,
      "54_42_yes": 0.36,
      "54_43_#default#": 0.66,
      "55_41_yes": 0.4,
      "55_43_#default#": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 3975,
        "width": 2980,
        "x": -560,
        "y": -490
      }
    }
  }
inputs:
- key: IAMRemediationType
  value: {}
  required: false
  description: |-
    The response playbook provides the following remediation actions for IAM users:

    Reset - By entering "Reset" in the input, the playbook will execute password reset.

    Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation.

    ALL - By entering "ALL" in the input, the playbook will execute both password reset and access key deactivation.
  playbookInputQuery:
- key: shouldCloneSA
  value: {}
  required: false
  description: |-
    Whether to clone the compromised SA before putting a deny policy to it.
    True/False
  playbookInputQuery:
- key: identityType
  value: {}
  required: false
  description: |-
    The type of identity involved. Usually mapped to the incident field named 'cloudidentitytype'.
    e.g.
    USER,SERVICE_ACCOUNT,APPLICATION
  playbookInputQuery:
- key: newRoleName
  value:
    simple: tempNewRoleName
  required: false
  description: The new role name to assign in the clone service account flow.
  playbookInputQuery:
- key: newInstanceProfileName
  value:
    simple: tempNewInstanceProfileName
  required: false
  description: The new instance profile name to assign in the clone service account flow.
  playbookInputQuery:
- key: accessKeyID
  value: {}
  required: false
  description: The access key ID.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: The user name.
  playbookInputQuery:
- key: instanceID
  value: {}
  required: false
  description: The instance ID.
  playbookInputQuery:
- key: roleNameToRestrict
  value: {}
  required: false
  description: If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  playbookInputQuery:
outputs:
- contextPath: AWS.EC2.Instances
  description: AWS EC2 instance information.
  type: unknown
- contextPath: AWS.IAM.InstanceProfiles
  description: AWS IAM instance profile information.
  type: unknown
- contextPath: AWS.IAM.Roles.AttachedPolicies.Policies
  description: A list of managed policy names.
  type: unknown
- contextPath: AWS.IAM.Roles.RoleName.Policies
  description: A list of policy names.
tests:
- No tests (auto formatted)
fromversion: 6.9.0