From 056190cfc92354cc82945111713936e8fbf7e8cd Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Sat, 24 Apr 2021 13:23:14 +0200 Subject: [PATCH] feat(network-acls): change textFail to textInfo because NACLs are stateless --- checks/check45 | 2 +- checks/check46 | 2 +- checks/check_extra7138 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/checks/check45 b/checks/check45 index 7471e1ae..f0e1d898 100644 --- a/checks/check45 +++ b/checks/check45 @@ -29,7 +29,7 @@ check45(){ NACL_LIST=$($AWSCLI ec2 describe-network-acls --query 'NetworkAcls[?Entries[?(((!PortRange) || (PortRange.From<=`22` && PortRange.To>=`22`)) && ((CidrBlock == `0.0.0.0/0`) && (Egress == `false`) && (RuleAction == `allow`)))]].{NetworkAclId:NetworkAclId}' $PROFILE_OPT --region $regx --output text) if [[ $NACL_LIST ]];then for NACL in $NACL_LIST;do - textFail "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for SSH port 22" "$regx" + textInfo "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for SSH port 22" "$regx" done else textPass "$regx: No Network ACL found with SSH port 22 open to 0.0.0.0/0" "$regx" diff --git a/checks/check46 b/checks/check46 index 81225920..97252df1 100644 --- a/checks/check46 +++ b/checks/check46 @@ -29,7 +29,7 @@ check46(){ NACL_LIST=$($AWSCLI ec2 describe-network-acls --query 'NetworkAcls[?Entries[?(((!PortRange) || (PortRange.From<=`3389` && PortRange.To>=`3389`)) && ((CidrBlock == `0.0.0.0/0`) && (Egress == `false`) && (RuleAction == `allow`)))]].{NetworkAclId:NetworkAclId}' $PROFILE_OPT --region $regx --output text) if [[ $NACL_LIST ]];then for NACL in $NACL_LIST;do - textFail "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for Microsoft RDP port 3389" "$regx" + textInfo "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for Microsoft RDP port 3389" "$regx" done else textPass "$regx: No Network ACL found with Microsoft RDP port 3389 open to 0.0.0.0/0" "$regx" diff --git a/checks/check_extra7138 b/checks/check_extra7138 index 21ec01f8..90c57f13 100644 --- a/checks/check_extra7138 +++ b/checks/check_extra7138 @@ -30,7 +30,7 @@ extra7138(){ NACL_LIST=$($AWSCLI ec2 describe-network-acls --query 'NetworkAcls[?Entries[?((!PortRange) && (CidrBlock == `0.0.0.0/0`) && (Egress == `false`) && (RuleAction == `allow`))]].{NetworkAclId:NetworkAclId}' $PROFILE_OPT --region $regx --output text) if [[ $NACL_LIST ]];then for NACL in $NACL_LIST;do - textFail "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for any port" "$regx" + textInfo "$regx: Found Network ACL: $NACL open to 0.0.0.0/0 for any port" "$regx" done else textPass "$regx: No Network ACL found with any port open to 0.0.0.0/0" "$regx"