From 4fddb7fa637511d296e13eee9ef94875a10fb099 Mon Sep 17 00:00:00 2001 From: mikeurbanski1 Date: Sun, 22 Nov 2020 10:13:42 -0600 Subject: [PATCH] Fix log metric filter checks (#33) * debug statements for issue demonstration * use separate array elements * add debug and comments * clean up debug statements --- include/check3x | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/include/check3x b/include/check3x index cabe626a..bfbba6b3 100644 --- a/include/check3x +++ b/include/check3x @@ -17,16 +17,19 @@ check3x(){ # In order to make all these checks work properly logs and alarms have to # be based only on CloudTrail tail with CloudWatchLog configuration. DESCRIBE_TRAILS_CACHE=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[?CloudWatchLogsLogGroupArn != `null`]') - TRAIL_LIST=$(echo $DESCRIBE_TRAILS_CACHE | jq -r '. |@base64') + TRAIL_LIST=$(echo $DESCRIBE_TRAILS_CACHE | jq -r -c '.[] |@base64') # this treats each array element as its own line CURRENT_ACCOUNT_ID=$($AWSCLI sts $PROFILE_OPT get-caller-identity --region "$REGION" --query Account --output text) CLOUDWATCH_LOGGROUP=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text| tr '\011' '\012' | awk -F: '{print $7}') if [[ $CLOUDWATCH_LOGGROUP != "" ]]; then for group_obj_enc in $TRAIL_LIST; do + group_obj_raw=$(echo $group_obj_enc | decode_report) - CLOUDWATCH_LOGGROUP_NAME=$(echo $group_obj_raw | jq -r '.[] | .CloudWatchLogsLogGroupArn|split(":")[6]') - CLOUDWATCH_LOGGROUP_REGION=$(echo $group_obj_raw | jq -r '.[] | .CloudWatchLogsLogGroupArn|split(":")[3]') - CLOUDWATCH_LOGGROUP_ACCOUNT=$(echo $group_obj_raw | jq -r '.[] | .CloudWatchLogsLogGroupArn|split(":")[4]') + + CLOUDWATCH_LOGGROUP_NAME=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[6]') + CLOUDWATCH_LOGGROUP_REGION=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[3]') + CLOUDWATCH_LOGGROUP_ACCOUNT=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[4]') + if [ "$CLOUDWATCH_LOGGROUP_ACCOUNT" == "$CURRENT_ACCOUNT_ID" ];then # Filter control and whitespace from .metricFilters[*].filterPattern for easier matching later METRICFILTER_CACHE=$($AWSCLI logs describe-metric-filters --log-group-name "$CLOUDWATCH_LOGGROUP_NAME" $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION"|jq '.metricFilters|=map(.filterPattern|=gsub("[[:space:]]+"; " "))') @@ -69,7 +72,7 @@ check3x(){ fi if [[ $CHECK_CROSS_ACCOUNT_WARN ]]; then for group in $CHECK_CROSS_ACCOUNT_WARN; do - textInfo "CloudWatch group $group is not in this account" + textInfo "CloudWatch group $group is not in this account" done fi else