Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration

This playbook remediates the following Prisma Cloud AWS IAM password policy alerts. Prisma Cloud policies remediated: - AWS IAM password policy allows password reuse - AWS IAM password policy does not expire in 90 days - AWS IAM password policy does not have a lowercase character - AWS IAM password policy does not have a minimum of 14 characters - AWS IAM password policy does not have a number - AWS IAM password policy does not have a symbol - AWS IAM password policy does not have a uppercase character - AWS IAM password policy does not have password expiration period - AWS IAM Password policy is insecure

Prisma Cloud by Palo Alto Networks · 13 tasks · 1 input · 0 outputs

Details

ID	`Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration`
From Version	5.0.0
Tasks	13

README

Remediates the following Prisma Cloud AWS IAM password policy alerts.

Prisma Cloud policies remediated:

AWS IAM password policy allows password reuse
AWS IAM password policy does not expire in 90 days
AWS IAM password policy does not have a lowercase character
AWS IAM password policy does not have a minimum of 14 characters
AWS IAM password policy does not have a number
AWS IAM password policy does not have a symbol
AWS IAM password policy does not have a uppercase character
AWS IAM password policy does not have password expiration period
AWS IAM Password policy is insecure

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

aws-iam-update-account-password-policy

Playbook Inputs

Name	Description	Required
policyId	Returns the Prisma Cloud policy ID.	Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PCR_AWS_IAM_Password_Policy_Misconfig

Inputs

policyId — Get the Prisma Cloud policy ID.

Commands used

aws-iam-update-account-password-policy

Flowchart

Source

playbook-PCR_-_AWS_IAM_Password_Policy_Misconfig.yml

Download History Raw

id: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
description: |-
  This playbook remediates the following Prisma Cloud AWS IAM password policy alerts.

  Prisma Cloud policies remediated:
  - AWS IAM password policy allows password reuse
  - AWS IAM password policy does not expire in 90 days
  - AWS IAM password policy does not have a lowercase character
  - AWS IAM password policy does not have a minimum of 14 characters
  - AWS IAM password policy does not have a number
  - AWS IAM password policy does not have a symbol
  - AWS IAM password policy does not have a uppercase character
  - AWS IAM password policy does not have password expiration period
  - AWS IAM Password policy is insecure
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
    type: start
    task:
      id: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 1541a3a0-b8c0-460e-893a-96c8fc75ecc6
    type: regular
    task:
      id: 1541a3a0-b8c0-460e-893a-96c8fc75ecc6
      version: -1
      name: Remediate IAM password policy allows password reuse
      description: Create or update a password policy to prevent password reuse.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength: {}
      passwordReusePrevention:
        simple: "5"
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: 68839924-ec0e-4ed5-8810-420713a772ba
    type: condition
    task:
      id: 68839924-ec0e-4ed5-8810-420713a772ba
      version: -1
      name: Get Prisma Cloud policy id
      description: Based on the Prisma Cloud policy ID, determine which IAM password policy attribute to remediate.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      expiration period:
      - "17"
      expire in 90 days:
      - "11"
      minimum length:
      - "13"
      password reuse:
      - "4"
      policy insecure:
      - "18"
      require lowercase:
      - "12"
      require numbers:
      - "14"
      require symbol:
      - "15"
      require uppercase:
      - "16"
    separatecontext: false
    conditions:
    - label: password reuse
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: a2107824-6ed5-4c67-9450-8b154bb1fd2b
    - label: expire in 90 days
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: f53107a2-00b2-46fb-98a9-1f12262c7d44
    - label: require lowercase
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: ef7c537b-72eb-42a7-bab7-cb2d22c76a0d
    - label: minimum length
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 168bfaa0-8c1d-427e-bfa8-4d96d82e3d83
    - label: require numbers
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 9a5813af-17a3-4058-be13-588ea00b4bfa
    - label: require symbol
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: fd4dae57-509e-4374-96d3-e136821fc3f3
    - label: require uppercase
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 31626ca9-f659-4d25-9d88-fa32262bbba7
    - label: expiration period
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: a8dcc272-0b02-4534-8627-cf70ddd264c5
    - label: policy insecure
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b1acdeff-4959-4c14-8a5e-2adc1016a3d5
    view: |-
      {
        "position": {
          "x": 690,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: c2fa1f1a-a03e-4e1c-8a09-6945b6724261
    type: regular
    task:
      id: c2fa1f1a-a03e-4e1c-8a09-6945b6724261
      version: -1
      name: Remediate IAM password policy does not expire in 90 days
      description: Create or update a password policy to ensure that passwords expire after 90 days.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge:
        simple: "90"
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 120,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: ad4c2820-7478-4c35-8d42-d0e7d3b15e36
    type: regular
    task:
      id: ad4c2820-7478-4c35-8d42-d0e7d3b15e36
      version: -1
      name: Remediate AWS IAM password policy does not have a lowercase character
      description: Create or update a password policy to ensure that the password must contain at least one lowercase character.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters:
        simple: "True"
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -70,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 0068d356-a8c1-44bc-8374-493ae525bfcd
    type: regular
    task:
      id: 0068d356-a8c1-44bc-8374-493ae525bfcd
      version: -1
      name: Remediate AWS IAM password policy does not have a minimum of 14 characters
      description: Create or update a password policy to verify that the password contains at least 14 characters.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength:
        simple: "14"
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -260,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 96fb3a21-c45b-46aa-8583-b47fbff4c7dd
    type: regular
    task:
      id: 96fb3a21-c45b-46aa-8583-b47fbff4c7dd
      version: -1
      name: Remediate AWS IAM password policy does not have a number
      description: Create or update a password policy to ensure that the password includes at least one number.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers:
        simple: "True"
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: dc3dde5a-d558-4377-8287-beb786e40d47
    type: regular
    task:
      id: dc3dde5a-d558-4377-8287-beb786e40d47
      version: -1
      name: Remediate AWS IAM password policy does not have a symbol
      description: Create or update a password policy to ensure that the password contains at least one special character.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols:
        simple: "True"
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1070,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 94b6b908-ee21-465c-8497-ba8b6d33735e
    type: regular
    task:
      id: 94b6b908-ee21-465c-8497-ba8b6d33735e
      version: -1
      name: Remediate AWS IAM password policy does not have a uppercase character
      description: Create or update a password policy to ensure that the password contains at least one uppercase character.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge: {}
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters:
        simple: "True"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1260,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 6655d3a8-af50-4d86-839e-308aaa458346
    type: regular
    task:
      id: 6655d3a8-af50-4d86-839e-308aaa458346
      version: -1
      name: Remediate AWS IAM password policy does not have password expiration period
      description: Create or update a password policy to ensure that the password includes an expiration date.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword: {}
      hardExpiry: {}
      maxPasswordAge:
        simple: "90"
      minimumPasswordLength: {}
      passwordReusePrevention: {}
      requireLowercaseCharacters: {}
      requireNumbers: {}
      requireSymbols: {}
      requireUppercaseCharacters: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: 466538d1-57bc-4aec-872e-2192b24de9df
    type: regular
    task:
      id: 466538d1-57bc-4aec-872e-2192b24de9df
      version: -1
      name: Remediate AWS IAM Password policy is insecure
      description: Create or update a password policy to ensure that there are no insecure passwords.
      script: '|||aws-iam-update-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      allowUsersToChangePassword:
        simple: "True"
      hardExpiry:
        simple: "True"
      maxPasswordAge:
        simple: "90"
      minimumPasswordLength:
        simple: "14"
      passwordReusePrevention:
        simple: "4"
      requireLowercaseCharacters:
        simple: "True"
      requireNumbers:
        simple: "True"
      requireSymbols:
        simple: "True"
      requireUppercaseCharacters:
        simple: "True"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1640,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: f688c628-328d-4db0-870f-2012cdb397b4
    type: title
    task:
      id: f688c628-328d-4db0-870f-2012cdb397b4
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: b07b1cad-2b0d-4e2b-8eb2-cfc08eaba1f8
    type: condition
    task:
      id: b07b1cad-2b0d-4e2b-8eb2-cfc08eaba1f8
      version: -1
      name: Is AWS - IAM integration enabled?
      description: "Is AWS - IAM integration enabled?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - IAM
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 690,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_11_expire in 90 days": 0.84,
      "10_12_require lowercase": 0.87,
      "10_13_minimum length": 0.9,
      "10_14_require numbers": 0.9,
      "10_16_require uppercase": 0.82,
      "10_17_expiration period": 0.87,
      "10_18_policy insecure": 0.9,
      "10_4_password reuse": 0.74
    },
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 2280,
        "x": -260,
        "y": -370
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Get the Prisma Cloud policy ID.
outputs: []
tests:
- No Test