ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #222 from tmonk42/tmonk42/missing_profiles

Browse Source 
Fix extra727 and extra728 #221
This commit is contained in:
Toni de la Fuente
2018-06-13 19:33:42 -04:00
committed by GitHub
parent a97069e1ed f7737a9efd
commit be9cbf893b
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
checks/check_extra727
View File

@@ -23,7 +23,7 @@ extra727(){
if [[ $LIST_SQS ]]; then
for queue in $LIST_SQS; do
# check if the policy has Principal as *
PUBLIC_SQS=$($AWSCLI sqs get-queue-attributes --queue-url $queue --region $regx --attribute-names All --query Attributes.Policy --output text | awk -v k="text" '{n=split($0,a,","); for (i=1; i<=n; i++) print a[i]}' | awk '/Principal/ && !skip { print } { skip = /Deny/} '|grep \"Principal|grep \*)
PUBLIC_SQS=$($AWSCLI sqs get-queue-attributes --queue-url $queue $PROFILE_OPT --region $regx --attribute-names All --query Attributes.Policy --output text | awk -v k="text" '{n=split($0,a,","); for (i=1; i<=n; i++) print a[i]}' | awk '/Principal/ && !skip { print } { skip = /Deny/} '|grep \"Principal|grep \*)
if [[ $PUBLIC_SQS ]]; then
textFail "$regx: SQS queue $queue seems to be public (Principal: \"*\")" "$regx"
else

2
checks/check_extra728
View File

@@ -23,7 +23,7 @@ extra728(){
if [[ $LIST_SQS ]]; then
for queue in $LIST_SQS; do
# check if the policy has KmsMasterKeyId therefore SSE enabled
SSE_ENABLED_QUEUE=$($AWSCLI sqs get-queue-attributes --queue-url $queue --region $regx --attribute-names All --query Attributes.KmsMasterKeyId --output text|grep -v ^None)
SSE_ENABLED_QUEUE=$($AWSCLI sqs get-queue-attributes --queue-url $queue $PROFILE_OPT --region $regx --attribute-names All --query Attributes.KmsMasterKeyId --output text|grep -v ^None)
if [[ $SSE_ENABLED_QUEUE ]]; then
textPass "$regx: SQS queue $queue is using Server Side Encryption" "$regx"
else