ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-12 15:55:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #419 from zfLQ2qx2/prowler-extra719

Browse Source 
Filter out private zones in check extra719
This commit is contained in:
Toni de la Fuente
2019-11-22 00:12:36 +01:00
committed by GitHub
parent 5c8b0aa942 687686c929
commit 2e1cead3a2
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
checks/check_extra719
View File

@@ -11,21 +11,21 @@
# CONDITIONS OF ANY KIND, either express or implied. See the License for the # CONDITIONS OF ANY KIND, either express or implied. See the License for the
# specific language governing permissions and limitations under the License. # specific language governing permissions and limitations under the License.
CHECK_ID_extra719="7.19" CHECK_ID_extra719="7.19"
CHECK_TITLE_extra719="[extra719] Check if Route53 hosted zones are logging queries to CloudWatch Logs (Not Scored) (Not part of CIS benchmark)" CHECK_TITLE_extra719="[extra719] Check if Route53 public hosted zones are logging queries to CloudWatch Logs (Not Scored) (Not part of CIS benchmark)"
CHECK_SCORED_extra719="NOT_SCORED" CHECK_SCORED_extra719="NOT_SCORED"
CHECK_TYPE_extra719="EXTRA" CHECK_TYPE_extra719="EXTRA"
CHECK_ALTERNATE_check719="extra719" CHECK_ALTERNATE_check719="extra719"
extra719(){ extra719(){
# "Check if Route53 hosted zones are logging queries to CloudWatch Logs (Not Scored) (Not part of CIS benchmark)" # You can't create a query logging config for a private hosted zone.
LIST_OF_HOSTED_ZONES=$($AWSCLI route53 list-hosted-zones $PROFILE_OPT --query HostedZones[*].Id --output text|xargs -n1) LIST_OF_HOSTED_ZONES=$($AWSCLI route53 list-hosted-zones $PROFILE_OPT | jq -r ".HostedZones[] | select(.Config.PrivateZone == false) | .Id")
if [[ $LIST_OF_HOSTED_ZONES ]]; then if [[ $LIST_OF_HOSTED_ZONES ]]; then
for hostedzoneid in $LIST_OF_HOSTED_ZONES;do for hostedzoneid in $LIST_OF_HOSTED_ZONES;do
HOSTED_ZONE_QUERY_LOG_ENABLED=$($AWSCLI route53 list-query-logging-configs --hosted-zone-id $hostedzoneid $PROFILE_OPT --query QueryLoggingConfigs[*].CloudWatchLogsLogGroupArn --output text|cut -d: -f7) HOSTED_ZONE_QUERY_LOG_ENABLED=$($AWSCLI route53 list-query-logging-configs --hosted-zone-id $hostedzoneid $PROFILE_OPT --query QueryLoggingConfigs[*].CloudWatchLogsLogGroupArn --output text|cut -d: -f7)
if [[ $HOSTED_ZONE_QUERY_LOG_ENABLED ]];then if [[ $HOSTED_ZONE_QUERY_LOG_ENABLED ]];then
textPass "Route53 hosted zone Id $hostedzoneid has query logging enabled in Log Group $HOSTED_ZONE_QUERY_LOG_ENABLED" textPass "Route53 public hosted zone Id $hostedzoneid has query logging enabled in Log Group $HOSTED_ZONE_QUERY_LOG_ENABLED"
else else
textFail "Route53 hosted zone Id $hostedzoneid has query logging disabled!" textFail "Route53 public hosted zone Id $hostedzoneid has query logging disabled!"
fi fi
done done
else else