From 263926a53b5698e53d69321c1d2d6939801840cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:44:23 +0700 Subject: [PATCH 1/6] Improve check21 - Add ISLOGGING_STATUS, INCLUDEMANAGEMENTEVENTS_STATUS, READWRITETYPE_STATUS to check - Remove ` --no-include-shadow-trails ` from CLI 2.1 Ensure CloudTrail is enabled in all regions (Scored): Via CLI 1. ` aws cloudtrail describe-trails ` Ensure `IsMultiRegionTrail` is set to true 2. `aws cloudtrail get-trail-status --name ` Ensure `IsLogging` is set to true 3. `aws cloudtrail get-event-selectors --trail-name ` Ensure there is at least one Event Selector for a Trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` --- checks/check21 | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/checks/check21 b/checks/check21 index 383578e3..2d8bc952 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" @@ -17,23 +17,32 @@ CHECK_ALTERNATE_check201="check21" check21(){ trail_count=0 # "Ensure CloudTrail is enabled in all regions (Scored)" + REGIONS=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].HomeRegion' --output text) + result='False' for regx in $REGIONS; do - LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text --no-include-shadow-trails) + LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text) if [[ $LIST_OF_TRAILS ]];then for trail in $LIST_OF_TRAILS;do - trail_count=$((trail_count + 1)) - MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - if [[ "$MULTIREGION_TRAIL_STATUS" == 'False' ]];then - textFail "$trail trail in $regx is not enabled in multi region mode" - else - textPass "$trail trail in $regx is enabled for all regions" - fi + trail_count=$((trail_count + 1)) + MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) + ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status --region $regx --name $trail --query ['IsLogging'] --output text) + INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) + READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) + + echo $MULTIREGION_TRAIL_STATUS $ISLOGGING_STATUS $INCLUDEMANAGEMENTEVENTS_STATUS $READWRITETYPE_STATUS [ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ] + if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then + textPass "$trail trail in $regx is enabled for all regions" + result='True' + break + fi done fi done - + if [[ $result == 'False' ]]; then + textFail "trail exist but it is not enabled in multi region mode" + fi if [[ $trail_count == 0 ]]; then - textFail "No CloudTrail trails were found in the account" - fi + textFail "No CloudTrail trails were found in the account" + fi } From 3116adf86e10c902879d9d310ba93318e8455bb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:46:16 +0700 Subject: [PATCH 2/6] Update check21 --- checks/check21 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check21 b/checks/check21 index 2d8bc952..762d927f 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" From 53ee538e0fbf3c470bdb7b5963e8da4dec4ce680 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:57:00 +0700 Subject: [PATCH 3/6] add $PROFILE_OPT to the CLI --- checks/check21 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/checks/check21 b/checks/check21 index 762d927f..02da72b2 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" @@ -17,7 +17,7 @@ CHECK_ALTERNATE_check201="check21" check21(){ trail_count=0 # "Ensure CloudTrail is enabled in all regions (Scored)" - REGIONS=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].HomeRegion' --output text) + REGIONS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --query 'trailList[*].HomeRegion' --output text) result='False' for regx in $REGIONS; do LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text) @@ -25,9 +25,9 @@ check21(){ for trail in $LIST_OF_TRAILS;do trail_count=$((trail_count + 1)) MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status --region $regx --name $trail --query ['IsLogging'] --output text) - INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) - READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) + ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status $PROFILE_OPT --region $regx --name $trail --query ['IsLogging'] --output text) + INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) + READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) echo $MULTIREGION_TRAIL_STATUS $ISLOGGING_STATUS $INCLUDEMANAGEMENTEVENTS_STATUS $READWRITETYPE_STATUS [ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ] if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then From ba13f25c9e903710a90f2c57be51fc64eb53dd48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:57:49 +0700 Subject: [PATCH 4/6] Update check21 --- checks/check21 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check21 b/checks/check21 index 02da72b2..5ec4eff5 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" From 89514a1fa88f4213f47c0f78954d21be057a84ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 12:59:47 +0700 Subject: [PATCH 5/6] Update check21 --- checks/check21 | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/checks/check21 b/checks/check21 index 5ec4eff5..42b43dbd 100644 --- a/checks/check21 +++ b/checks/check21 @@ -22,20 +22,18 @@ check21(){ for regx in $REGIONS; do LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text) if [[ $LIST_OF_TRAILS ]];then - for trail in $LIST_OF_TRAILS;do - trail_count=$((trail_count + 1)) - MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status $PROFILE_OPT --region $regx --name $trail --query ['IsLogging'] --output text) - INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) - READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) - - echo $MULTIREGION_TRAIL_STATUS $ISLOGGING_STATUS $INCLUDEMANAGEMENTEVENTS_STATUS $READWRITETYPE_STATUS [ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ] - if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then - textPass "$trail trail in $regx is enabled for all regions" - result='True' - break - fi - done + for trail in $LIST_OF_TRAILS;do + trail_count=$((trail_count + 1)) + MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) + ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status $PROFILE_OPT --region $regx --name $trail --query ['IsLogging'] --output text) + INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) + READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors $PROFILE_OPT --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) + if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then + textPass "$trail trail in $regx is enabled for all regions" + result='True' + break + fi + done fi done if [[ $result == 'False' ]]; then From 0979f421c3048e0fd5779e2e496d4143ea8a3ef6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=E1=BB=8D=20Anh=20=C4=90=E1=BB=A9c?= Date: Mon, 9 Mar 2020 13:00:43 +0700 Subject: [PATCH 6/6] Update check21 --- checks/check21 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check21 b/checks/check21 index 42b43dbd..591b911c 100644 --- a/checks/check21 +++ b/checks/check21 @@ -39,7 +39,7 @@ check21(){ if [[ $result == 'False' ]]; then textFail "trail exist but it is not enabled in multi region mode" fi - if [[ $trail_count == 0 ]]; then + if [[ $trail_count == 0 ]]; then textFail "No CloudTrail trails were found in the account" fi }