Panther critical experimental python

AWS Root Account Access Keys

Validates that no programmatic access keys exist for the AWS root account. Root access keys provide unrestricted access to all AWS resources and cannot have permissions limited. If compromised, these keys grant attackers complete account control including resource modification, data access, and billing changes.

View Source

Detection Logic

from panther_base_helpers import deep_get


def policy(resource):
    return not deep_get(resource, "CredentialReport", "AccessKey1Active") and not deep_get(
        resource, "CredentialReport", "AccessKey2Active"
    )

Field Validations

Loading…

Comments (0)

Loading comments...