From 8e1aa17a800c410695fda230f2548f23b750105f Mon Sep 17 00:00:00 2001
From: Nimrod Kor <nimrodkor@gmail.com>
Date: Sun, 15 Dec 2019 15:53:46 +0200
Subject: [PATCH 1/2] Fix check26 - get the account ID from sts

(cherry picked from commit ae20d9c5b770ac593e64fa399fde55312d97ae1c)
---
 checks/check26 | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/checks/check26 b/checks/check26
index 133a4176..41281b56 100644
--- a/checks/check26
+++ b/checks/check26
@@ -18,10 +18,10 @@ check26(){
   # "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored)"
 
   CLOUDTRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].Name' --output text| tr '\011' '\012' | awk -F: '{print $1}')
+  ACCOUNT_ID=$($AWSCLI sts get-caller-identity --output json $PROFILE_OPT --region $REGION --query "Account" | tr -d '"')
 
   if [[ $CLOUDTRAILS ]];then
     for trail in $CLOUDTRAILS; do
-      CLOUDTRAIL_LOGGROUP_REGION=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].TrailARN' --output text | tr '\011' '\012' | grep "$trail" | awk -F: '{ print $4 }'  | head -n 1)
       CLOUDTRAIL_ACCOUNT_ID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].TrailARN' --output text | tr '\011' '\012' | grep "$trail" | awk -F: '{ print $5 }'  | head -n 1)
       CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $REGION --query 'trailList[*].[Name, S3BucketName]' --output text  | tr '\011' ':' |  grep "$trail" | awk -F: '{ print $2 }' )
 
@@ -29,12 +29,12 @@ check26(){
         bucket=$CLOUDTRAILBUCKET
         if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then
           CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text|grep -v None)
-        fi 
-        if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then
-          textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail"
-        elif [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then
-          textFail "Bucket access logging is not enabled in CloudTrail S3 bucket $bucket for $trail"
-        else 
+          if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then
+            textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail"
+          else
+            textFail "Bucket access logging is not enabled in CloudTrail S3 bucket $bucket for $trail"
+          fi
+        else
           textInfo "CloudTrail S3 bucket $bucket for trail $trail is not in current account"
         fi
         

From fc3f4e830e4489b68270ef194d7cac65ddd67ddb Mon Sep 17 00:00:00 2001
From: Nimrod Kor <nimrodkor@gmail.com>
Date: Tue, 17 Dec 2019 09:29:06 +0200
Subject: [PATCH 2/2] Reuse ACCOUNT_NUM

---
 checks/check26 | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/checks/check26 b/checks/check26
index 41281b56..0c6dfa0c 100644
--- a/checks/check26
+++ b/checks/check26
@@ -18,7 +18,6 @@ check26(){
   # "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored)"
 
   CLOUDTRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].Name' --output text| tr '\011' '\012' | awk -F: '{print $1}')
-  ACCOUNT_ID=$($AWSCLI sts get-caller-identity --output json $PROFILE_OPT --region $REGION --query "Account" | tr -d '"')
 
   if [[ $CLOUDTRAILS ]];then
     for trail in $CLOUDTRAILS; do
@@ -27,7 +26,7 @@ check26(){
 
       if [[ $CLOUDTRAILBUCKET ]];then
         bucket=$CLOUDTRAILBUCKET
-        if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then
+        if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_NUM" ];then
           CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text|grep -v None)
           if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then
             textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail"