From b6a30df808e22a0969cd6519cce62d83919ff11d Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Wed, 7 Nov 2018 22:00:28 -0500 Subject: [PATCH] Added extra735 check encrypted RDS --- README.md | 15 ++++++++++++++- checks/check_extra735 | 36 ++++++++++++++++++++++++++++++++++++ groups/group7_extras | 2 +- groups/group9_gdpr | 2 +- 4 files changed, 52 insertions(+), 3 deletions(-) create mode 100644 checks/check_extra735 diff --git a/README.md b/README.md index e15fb1f9..976f5f7b 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ It covers hardening and security best practices for all AWS regions related to t - Networking (4 checks) [group4] - CIS Level 1 [cislevel1] - CIS Level 2 [cislevel2] -- Extras (33 checks) *see Extras section* [extras] +- Extras (35 checks) *see Extras section* [extras] - Forensics related group of checks [forensics-ready] - GDPR [gdpr] Read more [here](https://github.com/toniblyx/prowler/issues/189) - HIPPA [hippa] @@ -440,6 +440,19 @@ With this group of checks, Prowler looks if each service with logging or audit c - 7.20 Check if Lambda functions are being recorded by CloudTrail (Not Scored) (Not part of CIS benchmark) - 7.21 Check if Redshift cluster has audit logging enabled (Not Scored) (Not part of CIS benchmark) - 7.22 Check if API Gateway has logging enabled (Not Scored) (Not part of CIS benchmark) +- 7.23 [extra723] Check if RDS Snapshots are public (Not Scored) (Not part of CIS benchmark) +- 7.24 [extra724] Check if ACM certificates have Certificate Transparency logging enabled (Not Scored) (Not part of CIS benchmark) +- 7.25 [extra725] Check if S3 buckets have Object-level logging enabled in CloudTrail (Not Scored) (Not part of CIS benchmark) +- 7.26 [extra726] Check Trusted Advisor for errors and warnings (Not Scored) (Not part of CIS benchmark) +- 7.27 [extra727] Check if SQS queues have policy set as Public (Not Scored) (Not part of CIS benchmark) +- 7.28 [extra728] Check if SQS queues have Server Side Encryption enabled (Not Scored) (Not part of CIS benchmark) +- 7.29 [extra729] Ensure there are no EBS Volumes unencrypted (Not Scored) (Not part of CIS benchmark) +- 7.30 [extra730] Check if ACM Certificates are about to expire in 7 days or less (Not Scored) (Not part of CIS benchmark) +- 7.31 [extra731] Check if SNS topics have policy set as Public (Not Scored) (Not part of CIS benchmark) +- 7.32 [extra732] Check if Geo restrictions are enabled in CloudFront distributions (Not Scored) (Not part of CIS benchmark) +- 7.33 [extra733] Check if there are SAML Providers then STS can be used (Not Scored) (Not part of CIS benchmark) +- 7.34 [extra734] Check if S3 buckets have default encryption (SSE) enabled and policy to enforce it (Not Scored) (Not part of CIS benchmark) +- 7.35 [extra735] Check if RDS instances storage is encrypted (Not Scored) (Not part of CIS benchmark) The `forensics-ready` group of checks uses existing and extra checks. To get a forensics readiness report, run this command: diff --git a/checks/check_extra735 b/checks/check_extra735 new file mode 100644 index 00000000..b538e7ab --- /dev/null +++ b/checks/check_extra735 @@ -0,0 +1,36 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra735="7.35" +CHECK_TITLE_extra735="[extra735] Check if RDS instances storage is encrypted (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra735="NOT_SCORED" +CHECK_TYPE_extra735="EXTRA" +CHECK_ALTERNATE_check734="extra735" + +extra735(){ + textInfo "Looking for RDS Volumes in all regions... " + for regx in $REGIONS; do + LIST_OF_RDS_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[*].DBInstanceIdentifier' --output text) + if [[ $LIST_OF_RDS_INSTANCES ]];then + for rdsinstance in $LIST_OF_RDS_INSTANCES; do + IS_ENCRYPTED=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --db-instance-identifier $rdsinstance --query 'DBInstances[*].StorageEncrypted' --output text) + if [[ $IS_ENCRYPTED == "False" ]]; then + textFail "$regx: RDS instance $rdsinstance is not encrypted!" "$regx" + else + textPass "$regx: RDS instance $rdsinstance is encrypted" "$regx" + fi + done + else + textInfo "$regx: No RDS instances found" "$regx" + fi + done +} diff --git a/groups/group7_extras b/groups/group7_extras index 00dcd9da..f0be7309 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,4 +15,4 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735' diff --git a/groups/group9_gdpr b/groups/group9_gdpr index 17d009fc..cd000add 100644 --- a/groups/group9_gdpr +++ b/groups/group9_gdpr @@ -15,7 +15,7 @@ GROUP_ID[9]='gdpr' GROUP_NUMBER[9]='9.0' GROUP_TITLE[9]='GDPR Readiness - WORK IN PROGRESS!! - [gdpr] *******************' GROUP_RUN_BY_DEFAULT[9]='N' # run it when execute_all is called -GROUP_CHECKS[9]='extra718,extra725,extra727,check12,check113,check114,extra71,extra731,extra732,extra733,check25,check39,check21,check22,check23,check24,check26,check27,check35,extra726,extra714,extra715,extra717,extra719,extra720,extra721,extra722,check43,check25,extra714,extra729,extra734' +GROUP_CHECKS[9]='extra718,extra725,extra727,check12,check113,check114,extra71,extra731,extra732,extra733,check25,check39,check21,check22,check23,check24,check26,check27,check35,extra726,extra714,extra715,extra717,extra719,extra720,extra721,extra722,check43,check25,extra714,extra729,extra734,extra735' # Resources: # https://d1.awsstatic.com/whitepapers/compliance/GDPR_Compliance_on_AWS.pdf