How are errors counted when the AWS credential report is not available?

[e-gineer]

Here is my scan output:

CIS v2.0.0 .................................................................................................................................................................. 1,069 / 2,239 [==========]
| 
+ 1 Identity and Access Management ..........................................................................................................................................   140 /   681 [====      ]
| | 
| + 1.1 Maintain current contact details ....................................................................................................................................     0 /     2 [=         ]
| | | 
| | INFO : Manual verification required. .................................................................................................................................................. XXXXXXXX1623
| | INFO : Manual verification required. .................................................................................................................................................. XXXXXXXX8155
| | 
| + 1.2 Ensure security contact information is registered ...................................................................................................................     1 /     2 [==        ]
| | | 
| | ALARM: morales-aaa security contact not registered. ................................................................................................................................... XXXXXXXX8155
| | OK   : daredevil-aaa has security contact Security Test registered. ................................................................................................................... XXXXXXXX1623
| | 
| + 1.3 Ensure security questions are registered in the AWS account .........................................................................................................     0 /     2 [=         ]
| | | 
| | INFO : Manual verification required. .................................................................................................................................................. XXXXXXXX1623
| | INFO : Manual verification required. .................................................................................................................................................. XXXXXXXX8155
| | 
| + 1.4 Ensure no 'root' user account access key exists .....................................................................................................................     0 /     2 [=         ]
| | | 
| | OK   : No root user access keys exist. ................................................................................................................................................ XXXXXXXX8155
| | OK   : No root user access keys exist. ................................................................................................................................................ XXXXXXXX1623
| | 
| + 1.5 Ensure MFA is enabled for the 'root' user account ...................................................................................................................     1 /     2 [==        ]
| | | 
| | ALARM: MFA not enabled for root account. .............................................................................................................................................. XXXXXXXX1623
| | OK   : MFA enabled for root account. .................................................................................................................................................. XXXXXXXX8155
| | 
| + 1.6 Ensure hardware MFA is enabled for the 'root' user account ..........................................................................................................     2 /     2 [=         ]
| | | 
| | ALARM: MFA not enabled for root account. .............................................................................................................................................. XXXXXXXX1623
| | ALARM: MFA enabled for root account, but the MFA associated is a virtual device. ...................................................................................................... XXXXXXXX8155
| | 
| + 1.7 Eliminate use of the 'root' user for administrative and daily tasks .................................................................................................     2 /     2 [=         ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.8 Ensure IAM password policy requires minimum length of 14 or greater .................................................................................................     1 /     2 [==        ]
| | | 
| | ALARM: Minimum password length set to 8. .............................................................................................................................................. XXXXXXXX1623
| | OK   : Minimum password length set to 14. ............................................................................................................................................. XXXXXXXX8155
| | 
| + 1.9 Ensure IAM password policy prevents password reuse ..................................................................................................................     0 /     2 [=         ]
| | | 
| | OK   : Password reuse prevention set to 24. ........................................................................................................................................... XXXXXXXX1623
| | OK   : Password reuse prevention set to 24. ........................................................................................................................................... XXXXXXXX8155
| | 
| + 1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password .................................................................     7 /    17 [==        ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password ..................................................................     3 /    17 [==        ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.12 Ensure credentials unused for 45 days or greater are disabled ......................................................................................................     9 /    17 [==        ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)

Here is the output summary at the bottom:

Summary

OK .................................................................................................................................................................................. 1,099 [=====     ]
SKIP ................................................................................................................................................................................... 58 [=         ]
INFO ................................................................................................................................................................................... 13 [=         ]
ALARM ............................................................................................................................................................................... 1,065 [=====     ]
ERROR ................................................................................................................................................................................... 4 [=         ]

TOTAL ....................................................................................................................................................................... 1,069 / 2,239 [==========]

Issues I see:

• Each error control only lists one of the two accounts in my aggregator with a "hard" error, should it list more?
• There seems to be 21 errors in the counts for those controls, but only 4 in the ERROR total?

[e-gineer]

Noting that a different later run showed different error messages for this?

| + 1.7 Eliminate use of the 'root' user for administrative and daily tasks .................................................................................................     1 /     1 [=         ]
| | 
| | ERROR: aws_daredevil: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again.
	aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.8 Ensure IAM password policy requires minimum length of 14 or greater .................................................................................................     1 /     2 [==        ]
| | | 
| | ALARM: Minimum password length set to 8. .............................................................................................................................................. 828685001623
| | OK   : Minimum password length set to 14. ............................................................................................................................................. 876515858155
| | 
| + 1.9 Ensure IAM password policy prevents password reuse ..................................................................................................................     0 /     2 [=         ]
| | | 
| | OK   : Password reuse prevention set to 24. ........................................................................................................................................... 828685001623
| | OK   : Password reuse prevention set to 24. ........................................................................................................................................... 876515858155
| | 
| + 1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password .................................................................     1 /     1 [=         ]
| | 
| | ERROR: aws_daredevil: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again.
	aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.11 Do not setup access keys during initial user setup for all IAM users that have a console password ..................................................................     1 /     1 [=         ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again.
	aws_daredevil: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)
| | 
| + 1.12 Ensure credentials unused for 45 days or greater are disabled ......................................................................................................     1 /     1 [=         ]
| | 
| | ERROR: aws_morales: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again.
	aws_daredevil: Credential report not available. Please run 'aws iam generate-credential-report' to generate it and try again. (SQLSTATE HV000)

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.