From 8913ca84d038405c9b3608b9bf8f2517b4c3ed5a Mon Sep 17 00:00:00 2001 From: Ben Allen Date: Tue, 11 Jul 2017 14:59:20 -0500 Subject: [PATCH 1/4] exit script if there are problems with the credentials. --- prowler | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/prowler b/prowler index d623447b..8488183d 100755 --- a/prowler +++ b/prowler @@ -324,7 +324,14 @@ prowlerBanner() { # Get whoami in AWS, who is the user running this shell script getWhoami(){ if [[ $MODE == "csv" ]]; then - CALLER_ARN=$($AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION --query "Arn" | tr -d '"') + CALLER_ARN_RAW=$($AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION --query "Arn") + if [[ 255 -eq $? ]]; then + # Failed to get own identity ... exit + echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + >&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + exit 2 + fi + CALLER_ARN=$(echo $CALLER_ARN_RAW | tr -d '"') textTitle "0.0" "Show report generation info" textNotice "ARN: $CALLER_ARN TIMESTAMP: $SCRIPT_START_TIME" else @@ -333,10 +340,24 @@ getWhoami(){ echo "" echo -e "AWS-CLI Profile: $NOTICE[$PROFILE]$NORMAL AWS API Region: $NOTICE[$REGION]$NORMAL AWS Filter Region: $NOTICE[${FILTERREGION:-all}]$NORMAL\n" if [[ $MONOCHROME -eq 1 ]]; then - $AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION | grep ':' + echo "Caller Identity:" + $AWSCLI sts get-caller-identity --output text --profile $PROFILE --region $REGION --query "Arn" + if [[ 255 -eq $? ]]; then + # Failed to get own identity ... exit + echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + >&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + exit 2 + fi + echo "" else echo "Caller Identity:" $AWSCLI sts get-caller-identity --output table --profile $PROFILE --region $REGION + if [[ 255 -eq $? ]]; then + # Failed to get own identity ... exit + echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + >&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!" + exit 2 + fi echo "" fi fi From 5c335b28b2fb49bcb90ebe17b10a0a38ebd5d139 Mon Sep 17 00:00:00 2001 From: Ben Allen Date: Tue, 11 Jul 2017 15:36:35 -0500 Subject: [PATCH 2/4] handle permission failure on list-subscriptions-by-topic gracefully --- prowler | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/prowler b/prowler index 8488183d..b51176b9 100755 --- a/prowler +++ b/prowler @@ -1230,12 +1230,19 @@ check315(){ ID315="3.15" TITLE315="Ensure appropriate subscribers to each SNS topic (Not Scored)" textTitle "$ID315" "$TITLE315" "0" + CAN_SNS_LIST_SUBS=1 for regx in $REGIONS; do TOPICS_LIST=$($AWSCLI sns list-topics --profile $PROFILE --region $regx --output text --query 'Topics[*].TopicArn') - if [[ $TOPICS_LIST ]];then + if [[ $TOPICS_LIST && $CAN_SNS_LIST_SUBS -eq 1 ]];then for topic in $TOPICS_LIST; do - CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS | grep -v "None") - if [[ $CHECK_TOPIC_LIST ]]; then + CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS) + if [[ $? -eq 255 ]]; then + # Permission error + export CAN_SNS_LIST_SUBS=0 + textNotice "No permission to list topics" + break; + fi + if [[ $(grep -v 'None' $CHECK_TOPIC_LIST) ]]; then TOPIC_SHORT=$(echo $topic | awk -F: '{ print $7 }') textNotice "Region $regx with Topic $TOPIC_SHORT:" "$regx" textNotice "- Suscription: $CHECK_TOPIC_LIST" "$regx" @@ -1244,6 +1251,8 @@ check315(){ textWarn " - Region $regx and Topic $topic" "$regx" fi done + elif [[ $CAN_SNS_LIST_SUBS -eq 0 ]]; then + break else textNotice "Region $regx doesn't have topics" "$regx" fi From 95a4b565754144f28a48de2518a7f46fb432ed2e Mon Sep 17 00:00:00 2001 From: Ben Allen Date: Tue, 11 Jul 2017 15:47:06 -0500 Subject: [PATCH 3/4] swallow error message for list-subscriptions-by-topic --- prowler | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/prowler b/prowler index b51176b9..1d033ba7 100755 --- a/prowler +++ b/prowler @@ -1235,7 +1235,7 @@ check315(){ TOPICS_LIST=$($AWSCLI sns list-topics --profile $PROFILE --region $regx --output text --query 'Topics[*].TopicArn') if [[ $TOPICS_LIST && $CAN_SNS_LIST_SUBS -eq 1 ]];then for topic in $TOPICS_LIST; do - CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS) + CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS 2> /dev/null) if [[ $? -eq 255 ]]; then # Permission error export CAN_SNS_LIST_SUBS=0 From cf9a73d5392c40a11bdec37f8978c0409dc29541 Mon Sep 17 00:00:00 2001 From: Ben Allen Date: Tue, 11 Jul 2017 15:52:21 -0500 Subject: [PATCH 4/4] gather count of topics per region, even when unable to list subscribers. --- prowler | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/prowler b/prowler index 1d033ba7..c70f154c 100755 --- a/prowler +++ b/prowler @@ -1239,7 +1239,9 @@ check315(){ if [[ $? -eq 255 ]]; then # Permission error export CAN_SNS_LIST_SUBS=0 - textNotice "No permission to list topics" + textNotice "No permission to list subscribers in topics" + ntopics=$(echo $TOPICS_LIST | wc -w ) + textNotice "Region $regx has $ntopics topics" "$regx" break; fi if [[ $(grep -v 'None' $CHECK_TOPIC_LIST) ]]; then @@ -1252,7 +1254,9 @@ check315(){ fi done elif [[ $CAN_SNS_LIST_SUBS -eq 0 ]]; then - break + ntopics=$(echo $TOPICS_LIST | wc -w ) + textNotice "Region $regx has $ntopics topics" "$regx" + # break else textNotice "Region $regx doesn't have topics" "$regx" fi