ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

using api commands to check if macie is enabled instead of looking iam role

Browse Source
This commit is contained in:
He.Longfei
2020-04-20 15:01:38 +08:00
parent 6747b208ce
commit b42cc33a6c
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
checks/check_extra712
View File

@@ -18,12 +18,16 @@ CHECK_ALTERNATE_check712="extra712"
extra712(){
# "Check if Amazon Macie is enabled (Not Scored) (Not part of CIS benchmark)"
textInfo "No API commands available to check if Macie is enabled,"
textInfo "just looking if IAM Macie related permissions exist. "
MACIE_IAM_ROLES_CREATED=$($AWSCLI iam list-roles $PROFILE_OPT --query 'Roles[*].Arn'|grep AWSMacieServiceCustomer|wc -l)
if [[ $MACIE_IAM_ROLES_CREATED -eq 2 ]];then
textPass "Macie related IAM roles exist so it might be enabled. Check it out manually"
else
textFail "No Macie related IAM roles found. It is most likely not to be enabled"
fi
}
MACIE_NOT_SUPPORTED="Could not connect to the endpoint URL"
MACIE_NOT_ENABLED="Macie is not enabled for this AWS account"
for regx in $REGIONS; do
MACIE_MEMBER_ACCOUNTS=$($AWSCLI macie list-member-accounts $PROFILE_OPT --region $regx --output text --query 'memberAccounts[*]' 2>&1)
if [[ ${MACIE_MEMBER_ACCOUNTS} == *${MACIE_NOT_SUPPORTED}* ]];then
textInfo "Macie is not supported in the $regx AWS Regions"
elif [[ ${MACIE_MEMBER_ACCOUNTS} == *${MACIE_NOT_ENABLED}* ]];then
textFail "$regx: Amazon Macie is not enabled!"
else
textPass "$regx: Amazon Macie is enabled!"
fi
done
}