diff --git a/include/assume_role b/include/assume_role index 9e43c0b3..462e0062 100644 --- a/include/assume_role +++ b/include/assume_role @@ -31,13 +31,13 @@ assume_role(){ # assume role command $AWSCLI $PROFILE_OPT sts assume-role --role-arn arn:${AWS_PARTITION}:iam::$ACCOUNT_TO_ASSUME:role/$ROLE_TO_ASSUME \ --role-session-name ProwlerAssessmentSession \ - --region $REGION \ + --region $REGION_FOR_STS \ --duration-seconds $SESSION_DURATION_TO_ASSUME > $TEMP_STS_ASSUMED_FILE else $AWSCLI $PROFILE_OPT sts assume-role --role-arn arn:${AWS_PARTITION}:iam::$ACCOUNT_TO_ASSUME:role/$ROLE_TO_ASSUME \ --role-session-name ProwlerAssessmentSession \ --duration-seconds $SESSION_DURATION_TO_ASSUME \ - --region $REGION \ + --region $REGION_FOR_STS \ --external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE fi diff --git a/include/whoami b/include/whoami index e23cfe59..03a40fa7 100644 --- a/include/whoami +++ b/include/whoami @@ -13,8 +13,30 @@ # Get whoami in AWS, who is the user running this shell script -GETCALLER=$($AWSCLI sts get-caller-identity $PROFILE_OPT --region $REGION) -ACCOUNT_NUM=$(echo $GETCALLER | jq -r '.Account') +# Get a list of all available AWS Regions +# sice describe-regions doesn't seem to work at me-south-1|eu-south-1|ap-east-1|af-south-1. +# Probably dased on https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html +# when invoking regions with -r, those regions with STS disabled make GETCALLER fail then +# this if will filter them out (Africa (Cape Town), Asia Pacific (Hong Kong), Europe (Milan) and Middle East (Bahrain) ): + + +case "$REGION" in + me-south-1|eu-south-1|ap-east-1|af-south-1) + REGION_FOR_STS="us-east-1" + ;; + *) + REGION_FOR_STS=$REGION + ;; +esac + +GETCALLER=$($AWSCLI sts get-caller-identity $PROFILE_OPT --region $REGION_FOR_STS) + +if [[ $ACCOUNT_TO_ASSUME ]]; then + ACCOUNT_NUM=$ACCOUNT_TO_ASSUME +else + ACCOUNT_NUM=$(echo $GETCALLER | jq -r '.Account') +fi + CALLER_ARN=$(echo $GETCALLER | jq -r '.Arn') USER_ID=$(echo $GETCALLER | jq -r '.UserId') AWS_PARTITION=$(echo $CALLER_ARN| cut -d: -f2) @@ -28,10 +50,6 @@ getWhoami(){ exit $EXITCODE fi - if [[ $ACCOUNT_TO_ASSUME ]]; then - ACCOUNT_NUM=$ACCOUNT_TO_ASSUME - fi - if [[ "$MODE" == "csv" ]]; then if [[ 255 -eq $? ]]; then # Failed to get own identity ... exit diff --git a/prowler b/prowler index 368623d6..2f3d40da 100755 --- a/prowler +++ b/prowler @@ -236,12 +236,8 @@ trap handle_ctrl_c INT . $PROWLER_DIR/include/securityhub_integration . $PROWLER_DIR/include/junit_integration -# Get a list of all available AWS Regions -REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' \ - --output text \ - $PROFILE_OPT \ - --region $REGION \ - --region-names $FILTERREGION) +# Get list of regions based on include/whoami +REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' --output text $PROFILE_OPT --region $REGION_FOR_STS --region-names $FILTERREGION) # Pre-process whitelist file if supplied if [[ -n "$WHITELIST_FILE" ]]; then