From 263926a53b5698e53d69321c1d2d6939801840cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:44:23 +0700 Subject: [PATCH] Improve check21 - Add ISLOGGING_STATUS, INCLUDEMANAGEMENTEVENTS_STATUS, READWRITETYPE_STATUS to check - Remove ` --no-include-shadow-trails ` from CLI 2.1 Ensure CloudTrail is enabled in all regions (Scored): Via CLI 1. ` aws cloudtrail describe-trails ` Ensure `IsMultiRegionTrail` is set to true 2. `aws cloudtrail get-trail-status --name ` Ensure `IsLogging` is set to true 3. `aws cloudtrail get-event-selectors --trail-name ` Ensure there is at least one Event Selector for a Trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` --- checks/check21 | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/checks/check21 b/checks/check21 index 383578e3..2d8bc952 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" @@ -17,23 +17,32 @@ CHECK_ALTERNATE_check201="check21" check21(){ trail_count=0 # "Ensure CloudTrail is enabled in all regions (Scored)" + REGIONS=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].HomeRegion' --output text) + result='False' for regx in $REGIONS; do - LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text --no-include-shadow-trails) + LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text) if [[ $LIST_OF_TRAILS ]];then for trail in $LIST_OF_TRAILS;do - trail_count=$((trail_count + 1)) - MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - if [[ "$MULTIREGION_TRAIL_STATUS" == 'False' ]];then - textFail "$trail trail in $regx is not enabled in multi region mode" - else - textPass "$trail trail in $regx is enabled for all regions" - fi + trail_count=$((trail_count + 1)) + MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) + ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status --region $regx --name $trail --query ['IsLogging'] --output text) + INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) + READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) + + echo $MULTIREGION_TRAIL_STATUS $ISLOGGING_STATUS $INCLUDEMANAGEMENTEVENTS_STATUS $READWRITETYPE_STATUS [ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ] + if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then + textPass "$trail trail in $regx is enabled for all regions" + result='True' + break + fi done fi done - + if [[ $result == 'False' ]]; then + textFail "trail exist but it is not enabled in multi region mode" + fi if [[ $trail_count == 0 ]]; then - textFail "No CloudTrail trails were found in the account" - fi + textFail "No CloudTrail trails were found in the account" + fi }