Project: KICS (Provisioning / Security & Compliance)
File: 6685d912-d81f-4cfa-95ad-e316ea31c989.md

title: Directory Service Simple AD Password Exposed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6685d912-d81f-4cfa-95ad-e316ea31c989 Query name: Directory Service Simple AD Password Exposed Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Secret Management URL: DirectoryService SimpleAD password must not be a plaintext string or a Ref to a Parameter with a Default value.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="18" Parameters: ParentMasterPassword: Description: 'Password' Type: String Default: '' ParentMasterUsername: Description: 'username' Type: String Default: 'username!' Resources: NewAmpApp4: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: 'asDjskjs73!!' ShortName: String Size: String ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="9" Resources: NewAmpApp5: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: 'asDjskjs73!!' ShortName: String Size: String ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="5" Parameters: ParentMasterPassword: Description: 'Password' Type: String Default: 'asDjskjs73!' ParentMasterUsername: Description: 'username' Type: String Default: 'username!' Resources: NewAmpApp6: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: !Ref ParentMasterPassword ShortName: String Size: String ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="20" { "Parameters": { "ParentMasterUsername": { "Description": "username", "Type": "String", "Default": "username!" }, "ParentMasterPassword": { "Description": "Password", "Type": "String", "Default": "" } }, "Resources": { "NewAmpApp4": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "EnableSso": true, "Name": "String", "Password": "asDjskjs73!!", "ShortName": "String", "Size": "String", "CreateAlias": true, "Description": "String" } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="12" { "Resources": { "NewAmpApp5": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "ShortName": "String", "Size": "String", "CreateAlias": true, "Description": "String", "EnableSso": true, "Name": "String", "Password": "asDjskjs73!!" } } } } ``` </details> <details><summary>Positive test

6 - json file</summary> ```json hl_lines="6" { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String", "Default": "asDjskjs73!" }, "ParentMasterUsername": { "Description": "username", "Type": "String", "Default": "username!" } }, "Resources": { "NewAmpApp6": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "Size": "String", "CreateAlias": true, "Description": "String", "EnableSso": true, "Name": "String", "Password": "ParentMasterPassword", "ShortName": "String" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Parameters: ParentMasterPassword: Description: 'Password' Type: String Default: '' ParentMasterUsername: Description: 'username' Type: String Default: 'username!' Resources: NewAmpApp1: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: !Ref ParentMasterPassword ShortName: String Size: String ``` ```yaml title="Negative test num. 2 - yaml file" Parameters: ParentMasterPassword: Description: 'Password' Type: String ParentMasterUsername: Description: 'username' Type: String Default: 'username' Resources: NewAmpApp2: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: !Ref ParentMasterPassword ShortName: String Size: String ``` ```yaml title="Negative test num. 3 - yaml file" Resources: NewAmpApp3: Type: AWS::DirectoryService::SimpleAD Properties: CreateAlias: true Description: String EnableSso: true Name: String Password: !Sub '{{resolve:secretsmanager:${MyAmpAppSecretManagerRotater}::password}}' ShortName: String Size: String MyAmpAppSecretManagerRotater: Type: AWS::SecretsManager::Secret Properties: Description: 'This is my amp app instance secret' GenerateSecretString: SecretStringTemplate: '{"username": "admin"}' GenerateStringKey: 'password' PasswordLength: 16 ExcludeCharacters: '"@/\' ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String", "Default": "" }, "ParentMasterUsername": { "Description": "username", "Type": "String", "Default": "username!" } }, "Resources": { "NewAmpApp1": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "Description": "String", "EnableSso": true, "Name": "String", "Password": "ParentMasterPassword", "ShortName": "String", "Size": "String", "CreateAlias": true } } } } ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "Parameters": { "ParentMasterPassword": { "Description": "Password", "Type": "String" }, "ParentMasterUsername": { "Description": "username", "Type": "String", "Default": "username" } }, "Resources": { "NewAmpApp2": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "Size": "String", "CreateAlias": true, "Description": "String", "EnableSso": true, "Name": "String", "Password": "ParentMasterPassword", "ShortName": "String" } } } } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "Resources": { "NewAmpApp3": { "Type": "AWS::DirectoryService::SimpleAD", "Properties": { "Password": "{{resolve:secretsmanager:${MyAmpAppSecretManagerRotater}::password}}", "ShortName": "String", "Size": "String", "CreateAlias": true, "Description": "String", "EnableSso": true, "Name": "String" } }, "MyAmpAppSecretManagerRotater": { "Type": "AWS::SecretsManager::Secret", "Properties": { "Description": "This is my amp app instance secret", "GenerateSecretString": { "GenerateStringKey": "password", "PasswordLength": 16, "ExcludeCharacters": "\"@/\\", "SecretStringTemplate": "{\"username\": \"admin\"}" } } } } } ``` </details>