Redis ACL User Audit

id: redis-acl-user-audit
namespace: company.team

description: |
  Audit Redis ACL users: enabled users with no password, users allowed every command or
  dangerous commands (FLUSHALL, CONFIG, KEYS, DEBUG...), users allowed every key, and users not
  in the list of known accounts. Alert Slack, and optionally disable passwordless users and
  remove dangerous commands with ACL SETUSER, then read ACL LIST again to verify. Password
  hashes are stripped before anything is logged.

inputs:
  - id: host
    type: STRING
    displayName: Redis host
    defaults: "localhost"

  - id: port
    type: INT
    displayName: Redis port
    defaults: 6379

  - id: known_users
    type: ARRAY
    itemType: STRING
    displayName: Known application users
    defaults:
      - app
      - cache-worker

  - id: admin_users
    type: ARRAY
    itemType: STRING
    displayName: Admin users
    description: Users allowed every command and every key.
    defaults:
      - ops-admin

  - id: network
    type: STRING
    displayName: Docker network for redis-cli
    description: Network of the redis-cli containers. Leave empty for Docker's
      default bridge.
    defaults: ""

  - id: auto_remediate
    type: BOOL
    displayName: Auto remediate
    description: Disable passwordless users (never default) and remove dangerous
      commands. Medium findings are only reported.
    defaults: false

  - id: dry_run
    type: BOOL
    displayName: Dry run
    description: Must be false, together with auto_remediate, for ACL SETUSER to run.
    defaults: true

variables:
  dangerous: '["+@all", "+@dangerous", "+@admin", "+flushall", "+flushdb",
    "+config", "+keys", "+debug", "+shutdown", "+save", "+bgsave", "+replicaof",
    "+slaveof", "+acl", "+module", "+script"]'
  rules: >-
    .known as $known | .admins as $admins | .dangerous as $danger | [.list |
    split("\\n")[] | select(startswith("user ")) | split(" ") | {user: .[1],
    tokens: (.[2:] | map(select(startswith("#") or startswith(">") | not)))}
       | select(.tokens | index("on")) | . as $u | ($admins | index($u.user) != null) as $admin
       | ([.tokens[] | select(. as $t | $danger | index($t)) | select(. != "+@all" or ($u.tokens | index("-@dangerous") | not))]) as $bad
       | [ (if (.tokens | index("nopass")) then {code: "NOPASS", severity: "HIGH", why: "any client can authenticate as this user without a password",
              fix: (if .user == "default" then null else ["ACL", "SETUSER", .user, "off"] end)} else empty end),
           (if ($bad | length) > 0 and ($admin | not) then {code: "DANGEROUS_COMMANDS", severity: "HIGH", why: "allowed \($bad | join(" "))",
              fix: (if .user == "default" then null else ["ACL", "SETUSER", .user] + (if ($bad | index("+@all")) then ["-@dangerous"] else ($bad | map("-" + .[1:])) end) end)} else empty end),
           (if (.tokens | index("~*")) and ($admin | not) then {code: "ALL_KEYS", severity: "MEDIUM", why: "can read or write every key", fix: null} else empty end),
           (if ($known | index($u.user)) == null and ($admin | not) and .user != "default" then {code: "UNKNOWN_USER", severity: "MEDIUM", why: "not a known application user", fix: null} else empty end) ]
       | .[] | . + {user: $u.user, acl: ($u.tokens | join(" "))}]

tasks:
  - id: acl_list
    type: io.kestra.plugin.redis.cli.RedisCLI
    description: Read-only.
    host: "{{ inputs.host }}"
    port: "{{ inputs.port }}"
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      networkMode: "{{ inputs.network }}"
    commands:
      - ACL LIST

  - id: readable
    type: io.kestra.plugin.core.flow.If
    description: A user without ACL LIST permission gets a NOPERM reply, not an
      error exit code. No user line means the audit saw nothing, which must not
      read as clean.
    condition: "{{ {'s': outputs.acl_list.vars.command_1 ?? ''} | jq('.s |
      ltrimstr(\"\\n\") | startswith(\"user \") | not') | first }}"
    then:
      - id: unreadable
        type: io.kestra.plugin.core.execution.Fail
        errorMessage: "ACL LIST did not return any user: {{
          outputs.acl_list.vars.command_1 ?? 'no output' }}. The connecting user
          needs the acl|list command."

  - id: findings
    type: io.kestra.plugin.core.output.OutputValues
    values:
      items: "{{ {'list': outputs.acl_list.vars.command_1, 'known':
        inputs.known_users, 'admins': inputs.admin_users, 'dangerous':
        fromJson(vars.dangerous)} | jq(vars.rules) | first | toJson }}"

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: >-
      Redis ACL audit on {{ inputs.host }}:{{ inputs.port }}: {{
      fromJson(outputs.findings.values.items) | length }} findings. {{
      fromJson(outputs.findings.values.items) | jq('map("\(.severity) \(.code)
      \(.user): \(.why)") | join("; ")') | first }}

  - id: route
    type: io.kestra.plugin.core.flow.If
    condition: "{{ fromJson(outputs.findings.values.items) | length > 0 }}"
    then:
      - id: alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {{ {'text': 'Redis ACL audit on ' ~ inputs.host ~ ':' ~ inputs.port ~ ': ' ~ (fromJson(outputs.findings.values.items) | jq('map("\(.severity) \(.code) \(.user)") | join(", ")') | first) ~ '.' ~ (inputs.auto_remediate and not inputs.dry_run ? ' Applying the fixes now.' : ' No change applied (auto_remediate=' ~ inputs.auto_remediate ~ ', dry_run=' ~ inputs.dry_run ~ ').')} | toJson }}

      - id: remediate_gate
        type: io.kestra.plugin.core.flow.If
        condition: "{{ inputs.auto_remediate and not inputs.dry_run and
          fromJson(outputs.findings.values.items) | jq('map(select(.fix !=
          null)) | length') | first > 0 }}"
        then:
          - id: remediate
            type: io.kestra.plugin.core.flow.Loop
            concurrencyLimit: 1
            description: One ACL SETUSER per fix. Each one only adds rules, so the rest of
              the user's ACL is kept.
            values: "{{ fromJson(outputs.findings.values.items) | jq('map(select(.fix !=
              null) | .fix | join(\" \"))') | first | toJson }}"
            tasks:
              - id: setuser
                type: io.kestra.plugin.redis.cli.RedisCLI
                host: "{{ inputs.host }}"
                port: "{{ inputs.port }}"
                taskRunner:
                  type: io.kestra.plugin.scripts.runner.docker.Docker
                  networkMode: "{{ inputs.network }}"
                commands:
                  - "{{ item.value }}"

          - id: acl_relist
            type: io.kestra.plugin.redis.cli.RedisCLI
            host: "{{ inputs.host }}"
            port: "{{ inputs.port }}"
            taskRunner:
              type: io.kestra.plugin.scripts.runner.docker.Docker
              networkMode: "{{ inputs.network }}"
            commands:
              - ACL LIST

          - id: after
            type: io.kestra.plugin.core.output.OutputValues
            values:
              items: "{{ {'list': outputs.acl_relist.vars.command_1, 'known':
                inputs.known_users, 'admins': inputs.admin_users, 'dangerous':
                fromJson(vars.dangerous)} | jq(vars.rules) | first | toJson }}"

          - id: verify_result
            type: io.kestra.plugin.core.flow.If
            description: Every finding that had a fix must be gone from the second ACL LIST.
            condition: >-
              {{ {'b': fromJson(outputs.findings.values.items), 'a':
              fromJson(outputs.after.values.items)} | jq('([.a[] | .user + "|" +
              .code]) as $a
                 | [.b[] | select(.fix != null) | .user + "|" + .code | select(. as $x | $a | index($x))] | length') | first > 0 }}
            then:
              - id: remediation_failed
                type: io.kestra.plugin.core.execution.Fail
                errorMessage: "ACL SETUSER ran, but some findings are still there: {{
                  fromJson(outputs.after.values.items) | jq('map(\"\\(.code)
                  \\(.user)\") | join(\", \")') | first }}."
            else:
              - id: remediated
                type: io.kestra.plugin.core.log.Log
                message: >-
                  Fixed and verified: {{ fromJson(outputs.findings.values.items)
                  | jq('map(select(.fix != null) | .fix | join(" ")) | join(";
                  ")') | first }}. Left for review: {{
                  fromJson(outputs.after.values.items) | jq('if length == 0 then
                  "none" else map("\(.code) \(.user)") | join(", ") end') |
                  first }}. ACL changes live in memory: run ACL SAVE if the
                  server uses an aclfile, or update users.acl or redis.conf.
    else:
      - id: clean
        type: io.kestra.plugin.core.log.Log
        message: "No ACL finding."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Redis ACL audit failed on ' ~ inputs.host ~ ':' ~ inputs.port ~ ' (execution ' ~ execution.id ~ '). Treat the ACLs as unaudited.'} | toJson }}

triggers:
  - id: daily
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled, and always in safe mode.
    cron: "0 7 * * *"
    disabled: true
    inputs:
      auto_remediate: false
      dry_run: true