Write output files to a directory relative to Prowler

Write output files (CSV, JSON, etc.) to an `output` directory that is relative to prowler itself, no matter where prowler is invoked from.
Simplify Dockerfile by specifying a WORKDIR
Replace ADD command with the more recommended COPY command
Update README to cover how to run in Docker and access saved reports
Add a .dockerignore file to ignore .git and output directories

This partially addresses #570 - previously, within Docker, Prowler was attempting to write
reports to the root `/` directory in the container, which it did not have permission to do.
Instead, reports are now written to a path relative to Prowler
This commit is contained in:
Marc Jay
2020-05-08 11:46:53 +01:00
parent 2a9f6c67a8
commit 802d1151c2
5 changed files with 24 additions and 7 deletions

5
.dockerignore Normal file
View File

@@ -0,0 +1,5 @@
.git/
# Ignore output directories
output/
junit-reports/

2
.gitignore vendored
View File

@@ -21,7 +21,7 @@ tags
*.DS_Store *.DS_Store
# Prowler output # Prowler output
prowler-output-* output/
# JUnit Reports # JUnit Reports
junit-reports/ junit-reports/

View File

@@ -188,7 +188,7 @@ This script has been written in bash using AWS-CLI and it works in Linux and OSX
./prowler -g gdpr -M csv,json,json-asff ./prowler -g gdpr -M csv,json,json-asff
``` ```
Now `-M` creates a file inside the prowler root directory named `prowler-output-AWSACCOUNTID-YYYYMMDDHHMMSS.format`. You don't have to specify anything else, no pipes, no redirects. Now `-M` creates a file inside the prowler `output` directory named `prowler-output-AWSACCOUNTID-YYYYMMDDHHMMSS.format`. You don't have to specify anything else, no pipes, no redirects.
or just saving the output to a file like below: or just saving the output to a file like below:
@@ -211,12 +211,18 @@ This script has been written in bash using AWS-CLI and it works in Linux and OSX
>Note about output formats to use with `-M`: "text" is the default one with colors, "mono" is like default one but monochrome, "csv" is comma separated values, "json" plain basic json (without comma between lines) and "json-asff" is also json with Amazon Security Finding Format that you can ship to Security Hub using `-S`. >Note about output formats to use with `-M`: "text" is the default one with colors, "mono" is like default one but monochrome, "csv" is comma separated values, "json" plain basic json (without comma between lines) and "json-asff" is also json with Amazon Security Finding Format that you can ship to Security Hub using `-S`.
or save your report in a S3 bucket (this only works for text or mono, for csv, json or json-asff it has to be copied afterwards): or save your report in an S3 bucket (this only works for text or mono. For csv, json or json-asff it has to be copied afterwards):
```sh ```sh
./prowler -M mono | aws s3 cp - s3://bucket-name/prowler-report.txt ./prowler -M mono | aws s3 cp - s3://bucket-name/prowler-report.txt
``` ```
When generating multiple formats and running using Docker, to retrieve the reports, bind a local directory to the container, e.g.:
```sh
docker run -ti --rm --name prowler --volume "$(pwd)":/prowler/output --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY --env AWS_SESSION_TOKEN toniblyx/prowler:latest -M csv,json
```
1. To perform an assessment based on CIS Profile Definitions you can use cislevel1 or cislevel2 with `-g` flag, more information about this [here, page 8](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf): 1. To perform an assessment based on CIS Profile Definitions you can use cislevel1 or cislevel2 with `-g` flag, more information about this [here, page 8](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf):
```sh ```sh

View File

@@ -19,7 +19,11 @@ EXTENSION_ASFF="asff-json"
EXTENSION_TEXT="txt" EXTENSION_TEXT="txt"
EXTENSION_HTML="html" # not implemented yet, use ansi2html as in documentation EXTENSION_HTML="html" # not implemented yet, use ansi2html as in documentation
OUTPUT_DATE=$(date -u +"%Y%m%d%H%M%S") OUTPUT_DATE=$(date -u +"%Y%m%d%H%M%S")
OUTPUT_FILE_NAME="prowler-output-${ACCOUNT_NUM}-${OUTPUT_DATE}" OUTPUT_DIR="${PROWLER_DIR}/output"
OUTPUT_FILE_NAME="${OUTPUT_DIR}/prowler-output-${ACCOUNT_NUM}-${OUTPUT_DATE}"
# Ensure that output directory always exists
mkdir -p "${OUTPUT_DIR}"
textPass(){ textPass(){
if [[ "$QUIET" == 1 ]]; then if [[ "$QUIET" == 1 ]]; then

View File

@@ -9,10 +9,12 @@ RUN addgroup -g ${USERID} ${USERNAME} && \
pip3 install --upgrade pip && \ pip3 install --upgrade pip && \
pip install awscli ansi2html boto3 detect-secrets pip install awscli ansi2html boto3 detect-secrets
ADD . /prowler WORKDIR /prowler
RUN chown -R prowler /prowler/ COPY . ./
RUN chown -R prowler .
USER ${USERNAME} USER ${USERNAME}
ENTRYPOINT ["/prowler/prowler"] ENTRYPOINT ["./prowler"]