#!/usr/bin/env bash

# Prowler - the handy cloud security tool (copyright 2020) by Toni de la Fuente
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy
# of the License at http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
# specific language governing permissions and limitations under the License.

GROUP_ID[17]='internet-exposed'
GROUP_NUMBER[17]='17.0'
GROUP_TITLE[17]='Find resources exposed to the internet - [internet-exposed] ***'
GROUP_RUN_BY_DEFAULT[17]='N' # run it when execute_all is called
GROUP_CHECKS[17]='check41,check42,check45,check46,extra72,extra73,extra74,extra76,extra77,extra78,extra79,extra710,extra711,extra716,extra723,extra727,extra731,extra736,extra738,extra745,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra770,extra771,extra778,extra779,extra787,extra788,extra795,extra796,extra798,extra7102,extra7134,extra7135,extra7136,extra7137,extra7138'

# 4.1 [check41] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 22 (Scored)  [group4, cislevel1, cislevel2]
# 4.2 [check42] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389 (Scored)  [group4, cislevel1, cislevel2]
# 7.2 [extra72] Ensure there are no EBS Snapshots set as Public    [extras, forensics-ready, gdpr, hipaa, apigateway, rds]
# 7.3 [extra73] Ensure there are no S3 buckets open to the Everyone or Any AWS user    [extras, gdpr, hipaa, rds]
# 7.4 [extra74] Ensure there are no Security Groups without ingress filtering being used    [extras, gdpr, hipaa, secrets, apigateway, rds]
# 7.6 [extra76] Ensure there are no EC2 AMIs set as Public    [extras, gdpr, secrets]
# 7.7 [extra77] Ensure there are no ECR repositories set as Public    [group1, extras, secrets, elasticsearch]
# 7.8 [extra78] Ensure there are no Public Accessible RDS instances    [extras, rds, elasticsearch, trustboundaries]
# 7.9 [extra79] Check for internet facing Elastic Load Balancers    [extras, trustboundaries]
# 7.10 [extra710] Check for internet facing EC2 Instances    [extras]
# 7.11 [extra711] Check for Publicly Accessible Redshift Clusters    [extras]
# 7.16 [extra716] Check if Amazon Elasticsearch Service (ES) domains are set as Public or if it has open policy access   [extras, elasticsearch]
# 7.23 [extra723] Check if RDS Snapshots and Cluster Snapshots are public    [extras, rds]
# 7.27 [extra727] Check if SQS queues have policy set as Public    [extras, gdpr]
# 7.31 [extra731] Check if SNS topics have policy set as Public    [extras, gdpr]
# 7.38 [extra738] Check if CloudFront distributions are set to HTTPS    [extras, gdpr]
# 7.45 [extra745] Check if API Gateway endpoint is public or private    [extras, apigateway]
# 7.48 [extra748] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port    [extras]
# 7.49 [extra749] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483    [extras]
# 7.50 [extra750] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306    [extras]
# 7.51 [extra751] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432    [extras]
# 7.52 [extra752] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379    [extras]
# 7.53 [extra753] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018    [extras]
# 7.54 [extra754] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888    [extras]
# 7.55 [extra755] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached port 11211    [extras]
# 7.70 [extra770] Check for internet facing EC2 instances with Instance Profiles attached    [extras]
# 7.78 [extra778] Find VPC security groups with wide-open public IPv4 CIDR ranges (non-RFC1918)    [extras]
# 7.79 [extra779] Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports   [extras, elasticsearch]
# 7.87 [extra787] Check connection and authentication for Internet exposed Elasticsearch/Kibana ports   [extras, elasticsearch]
# 7.88 [extra788] Check connection and authentication for Internet exposed Amazon Elasticsearch Service (ES) domains   [extras, elasticsearch]
# 7.71 [extra771] Check if S3 buckets have policies which allow WRITE access    [extras]
