From c7bfd72d2d6233be8a93a48484211475a10a14c3 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Wed, 31 Oct 2018 23:09:24 -0400 Subject: [PATCH] Add check extra733 SAML Provider STS --- README.md | 2 +- checks/check_extra733 | 30 ++++++++++++++++++++++++++++++ groups/group7_extras | 2 +- 3 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 checks/check_extra733 diff --git a/README.md b/README.md index d1bf92f2..ad8e1c74 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ It covers hardening and security best practices for all AWS regions related to t - Networking (4 checks) [group4] - CIS Level 1 [cislevel1] - CIS Level 2 [cislevel2] -- Extras (31 checks) *see Extras section* [extras] +- Extras (33 checks) *see Extras section* [extras] - Forensics related group of checks [forensics-ready] - GDPR [gdpr] - HIPPA [hippa] diff --git a/checks/check_extra733 b/checks/check_extra733 new file mode 100644 index 00000000..12665cb3 --- /dev/null +++ b/checks/check_extra733 @@ -0,0 +1,30 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. + +CHECK_ID_extra733="7.33" +CHECK_TITLE_extra733="[extra733] Check if there are SAML Providers then STS can be used (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra733="NOT_SCORED" +CHECK_TYPE_extra733="EXTRA" +CHECK_ALTERNATE_check733="extra733" + +extra733(){ + LIST_SAML_PROV=$($AWSCLI iam list-saml-providers $PROFILE_OPT --query 'SAMLProviderList[*].Arn' --output text |grep -v ^None) + if [[ $LIST_SAML_PROV ]]; then + for provider in $LIST_SAML_PROV; do + PROVIDER_NAME=$(echo $provider| cut -d/ -f2) + textInfo "SAML Provider $PROVIDER_NAME has been found" + done + else + textFail "No SAML Provider found, add one and use STS" + fi +} diff --git a/groups/group7_extras b/groups/group7_extras index 02f96984..34b4f91a 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,4 +15,4 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733'