ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhancement: extra712 improved with Macie API call instead of IAM @eko0126

Browse Source 
using api commands to check if macie is enabled instead of looking ia…
This commit is contained in:
Toni de la Fuente
2020-04-20 19:20:13 +02:00
committed by GitHub
parent 3feac6f75b 86ea46d77c
commit 0c7805356e
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
checks/check_extra712
View File

@@ -18,12 +18,16 @@ CHECK_ALTERNATE_check712="extra712"
extra712(){
# "Check if Amazon Macie is enabled (Not Scored) (Not part of CIS benchmark)"
textInfo "No API commands available to check if Macie is enabled,"
textInfo "just looking if IAM Macie related permissions exist. "
MACIE_IAM_ROLES_CREATED=$($AWSCLI iam list-roles $PROFILE_OPT --query 'Roles[*].Arn'|grep AWSMacieServiceCustomer|wc -l)
if [[ $MACIE_IAM_ROLES_CREATED -eq 2 ]];then
textPass "Macie related IAM roles exist so it might be enabled. Check it out manually"
else
textFail "No Macie related IAM roles found. It is most likely not to be enabled"
fi
}
MACIE_NOT_SUPPORTED="Could not connect to the endpoint URL"
MACIE_NOT_ENABLED="Macie is not enabled for this AWS account"
for regx in $REGIONS; do
MACIE_MEMBER_ACCOUNTS=$($AWSCLI macie list-member-accounts $PROFILE_OPT --region $regx --output text --query 'memberAccounts[*]' 2>&1)
if [[ ${MACIE_MEMBER_ACCOUNTS} == *${MACIE_NOT_SUPPORTED}* ]];then
textInfo "Macie is not supported in the $regx AWS Regions"
elif [[ ${MACIE_MEMBER_ACCOUNTS} == *${MACIE_NOT_ENABLED}* ]];then
textFail "$regx: Amazon Macie is not enabled!" "$regx"
else
textPass "$regx: Amazon Macie is enabled!" "$regx"
fi
done
}