diff --git a/include/outputs b/include/outputs index fd64fd8c..97f8c29b 100644 --- a/include/outputs +++ b/include/outputs @@ -27,13 +27,13 @@ TIMESTAMP=$(get_iso8601_timestamp) PROWLER_PARAMETERS=$@ # Ensure that output directory always exists when -M is used -if [[ $MODE ]];then +if [[ $MODE ]];then mkdir -p "${OUTPUT_DIR}" if [[ "${MODES[@]}" =~ "html" ]]; then addHtmlHeader > ${OUTPUT_FILE_NAME}.$EXTENSION_HTML HTML_REPORT_INIT="1" fi -fi +fi if [[ $PROFILE == "" ]];then PROFILE="ENV" @@ -60,7 +60,7 @@ textPass(){ JSON_ASFF_OUTPUT=$(generateJsonAsffOutput "$1" "PASSED" "INFORMATIONAL") echo "${JSON_ASFF_OUTPUT}" | tee -a $OUTPUT_FILE_NAME.$EXTENSION_ASFF if [[ "${SEND_TO_SECURITY_HUB}" -eq 1 ]]; then - sendToSecurityHub "${JSON_ASFF_OUTPUT}" + sendToSecurityHub "${JSON_ASFF_OUTPUT}" "${REPREGION}" fi fi if is_junit_output_enabled; then @@ -147,7 +147,7 @@ textFail(){ JSON_ASFF_OUTPUT=$(generateJsonAsffOutput "$1" "${level}" "HIGH") echo "${JSON_ASFF_OUTPUT}" | tee -a ${OUTPUT_FILE_NAME}.${EXTENSION_ASFF} if [[ "${SEND_TO_SECURITY_HUB}" -eq 1 ]]; then - sendToSecurityHub "${JSON_ASFF_OUTPUT}" + sendToSecurityHub "${JSON_ASFF_OUTPUT}" "${REPREGION}" fi fi if is_junit_output_enabled; then @@ -318,7 +318,7 @@ generateHtmlOutput(){ echo ''$TITLE_TEXT'' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML echo ''$message'' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML echo '' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML - fi + fi if [[ $status == "PASS" ]];then echo '' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML echo '' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML diff --git a/include/securityhub_integration b/include/securityhub_integration index b08f5277..9c36264b 100644 --- a/include/securityhub_integration +++ b/include/securityhub_integration @@ -14,21 +14,26 @@ # Checks that the correct mode (json-asff) has been specified if wanting to send check output to AWS Security Hub # and that Security Hub is enabled in the chosen region checkSecurityHubCompatibility(){ + local regx if [[ "${MODE}" != "json-asff" ]]; then echo -e "\n$RED ERROR!$NORMAL Output can only be sent to Security Hub when the output mode is json-asff, i.e. -M json-asff -S\n" EXITCODE=1 exit $EXITCODE fi - SECURITY_HUB_ENABLED=$($AWSCLI securityhub --region $REGION $PROFILE_OPT describe-hub) - if [[ -z "${SECURITY_HUB_ENABLED}" ]]; then - echo -e "\n$RED ERROR!$NORMAL Security Hub is not enabled in $REGION. Enable it by calling '$AWSCLI securityhub --region $REGION $PROFILE_OPT enable-security-hub'\n" - EXITCODE=1 - exit $EXITCODE - fi + for regx in $REGIONS; do + SECURITY_HUB_ENABLED=$($AWSCLI securityhub --region "$regx" $PROFILE_OPT describe-hub) + if [[ -z "${SECURITY_HUB_ENABLED}" ]]; then + echo -e "\n$RED ERROR!$NORMAL Security Hub is not enabled in $regx. Enable it by calling '$AWSCLI securityhub --region $regx $PROFILE_OPT enable-security-hub'\n" + EXITCODE=1 + exit $EXITCODE + fi + done } sendToSecurityHub(){ - BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region $REGION $PROFILE_OPT batch-import-findings --findings "$1") + local findings="$1" + local region="$2" + BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region "$region" $PROFILE_OPT batch-import-findings --findings "${findings}") # A successful CLI response is: {"SuccessCount": 1,"FailedFindings": [],"FailedCount": 0} # Therefore, check that SuccessCount is indeed 1 if [[ -z "${BATCH_IMPORT_RESULT}" ]] || ! jq -e '.SuccessCount == 1' <<< "${BATCH_IMPORT_RESULT}" > /dev/null 2>&1; then