ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 23:05:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(extra736): Recover Customer Managed KMS keys (#1036)

Browse Source
This commit is contained in:
Pepe Fagoaga
2022-02-09 10:05:57 +01:00
committed by GitHub
parent c6f0351e9c
commit 6c12a3e1e0
1 changed files with 30 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
checks/check_extra736
View File

@@ -26,18 +26,39 @@ CHECK_CAF_EPIC_extra736='Data Protection'
extra736(){
for regx in $REGIONS; do
LIST_OF_CUSTOMER_KMS_KEYS=$($AWSCLI kms list-aliases $PROFILE_OPT --region $regx --query "Aliases[].[AliasName,TargetKeyId]" --output text |grep -v ^alias/aws/ |awk '{ print $2 }')
if [[ $LIST_OF_CUSTOMER_KMS_KEYS ]];then
for key in $LIST_OF_CUSTOMER_KMS_KEYS; do
CHECK_POLICY=$($AWSCLI kms get-key-policy --key-id $key --policy-name default $PROFILE_OPT --region $regx --output text| jq '.Statement[]|select(.Effect=="Allow" and (((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Condition == null)')
if [[ $CHECK_POLICY ]]; then
textFail "$regx: KMS key $key may be publicly accessible!" "$regx" "$key"
else
textPass "$regx: KMS key $key is not exposed to Public" "$regx" "$key"
local CUSTOMER_MANAGED_KMS_KEYS=()
# First, we need to recover every KMS key
LIST_OF_KMS_KEYS=$($AWSCLI kms list-keys $PROFILE_OPT --region "${regx}" --query "Keys[].[KeyArn]" --output text)
if [[ $LIST_OF_KMS_KEYS ]]
then
# Second, we need to check for Customer Managed KMS keys, with or without a configured alias
for keyID in ${LIST_OF_KMS_KEYS}
do
KMS_KEY_MANAGER=$($AWSCLI kms describe-key --region "${regx}" --key-id "${keyID}" --query "KeyMetadata.KeyManager" --output text)
if [[ "${KMS_KEY_MANAGER}" == "CUSTOMER" ]]
then
CUSTOMER_MANAGED_KMS_KEYS+=( "${keyID}" )
fi
done
else
textInfo "$regx: No KMS keys found" "$regx"
textInfo "${regx}: No KMS keys found" "${regx}"
continue
fi
# Third, we need to check the policy included in every Customer Managed KMS key
if [[ "${CUSTOMER_MANAGED_KMS_KEYS[*]}" ]]
then
for keyID in "${CUSTOMER_MANAGED_KMS_KEYS[@]}"
do
CHECK_POLICY=$($AWSCLI kms get-key-policy --key-id "${keyID}" --policy-name default $PROFILE_OPT --region "${regx}" --output text | jq '.Statement[]|select(.Effect=="Allow" and (((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Condition == null)')
if [[ $CHECK_POLICY ]]; then
textFail "${regx}: KMS key ${keyID} may be publicly accessible!" "${regx}" "${keyID}"
else
textPass "${regx}: KMS key ${keyID} is not exposed to Public" "${regx}" "${keyID}"
fi
done
else
textInfo "${regx}: No Customer Managed KMS keys found" "${regx}"
fi
done
}