diff --git a/checks/check_extra768 b/checks/check_extra768 new file mode 100644 index 00000000..5aa77651 --- /dev/null +++ b/checks/check_extra768 @@ -0,0 +1,38 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra763="7.63" +CHECK_TITLE_extra763="[extra763] Check if S3 buckets have object versioning enabled (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra763="NOT_SCORED" +CHECK_TYPE_extra763="EXTRA" +CHECK_ALTERNATE_check763="extra763" + +extra763(){ + # "Check if S3 buckets have object versioning enabled (Not Scored) (Not part of CIS benchmark)" + LIST_OF_BUCKETS=$($AWSCLI s3api list-buckets $PROFILE_OPT --query Buckets[*].Name --output text|xargs -n1) + if [[ $LIST_OF_BUCKETS ]]; then + for bucket in $LIST_OF_BUCKETS;do + BUCKET_VERSIONING_ENABLED=$($AWSCLI s3api get-bucket-versioning --bucket $bucket $PROFILE_OPT --query Status --output text 2>&1) + if [[ $(echo "$BUCKET_VERSIONING_ENABLED" | grep AccessDenied) ]]; then + textFail "Access Denied Trying to Get Bucket Versioning for $bucket" + continue + fi + if [[ $(echo "$BUCKET_VERSIONING_ENABLED" | grep "^Enabled$") ]]; then + textPass "Bucket $bucket has versioning enabled" + else + textFail "Bucket $bucket has versioning disabled!" + fi + done + else + textInfo "No S3 Buckets found" + fi +} diff --git a/groups/group11_secrets b/groups/group11_secrets index ec0b971f..b66a6f88 100644 --- a/groups/group11_secrets +++ b/groups/group11_secrets @@ -15,7 +15,7 @@ GROUP_ID[11]='secrets' GROUP_NUMBER[11]='11.0' GROUP_TITLE[11]='Look for keys secrets or passwords around resources - [secrets] **' GROUP_RUN_BY_DEFAULT[11]='N' # but it runs when execute_all is called (default) -GROUP_CHECKS[11]='extra741,extra742,extra759,extra760' +GROUP_CHECKS[11]='extra741,extra742,extra759,extra760,extra768' # requires https://github.com/Yelp/detect-secrets # `pip install detect-secrets`