diff --git a/checks/check_extra7154 b/checks/check_extra7154 index 47206432..eb571303 100644 --- a/checks/check_extra7154 +++ b/checks/check_extra7154 @@ -32,4 +32,22 @@ CHECK_REMEDIATION_extra7154='Ensure termination protection is enabled for the cl CHECK_DOC_extra7154='https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html' CHECK_CAF_EPIC_extra7154='Infrastructure Protection' - +extra7154() { + for regx in $REGIONS; do + CFN_STACKS=$($AWSCLI cloudformation describe-stacks $PROFILE_OPT --region $regx --output json) + LIST_OF_CFN_STACKS=$(echo $CFN_STACKS | jq -r '.Stacks[].StackName') + if [[ $LIST_OF_CFN_STACKS ]];then + for stack in $LIST_OF_CFN_STACKS; do + CFN_STACK_DETAILS=$($AWSCLI cloudformation describe-stacks $PROFILE_OPT --region $regx --stack-name $stack --output json) + TERMINATION_ENABLED=echo $CFN_STACK_DETAILS | jq -r '.Stacks[] | select( .EnableTerminationProtection == true )' + if [[ $TERMINATION_ENABLED ]]; then + textPass "$regx: Cloudformation stack $stack has termination protection enabled" "$regx" "$stack" + else + textFail "$regx: Cloudformation stack $stack has termination protection disabled" "$regx" "$stack" + fi + done + else + textInfo "$regx: No Cloudformation stacks found" "$regx" + fi + done +}