ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-11 07:15:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

checks for glue - 7119, 7121, 7123,7124,7125

Browse Source
This commit is contained in:
dlpzx
2020-11-09 18:48:11 +01:00
parent 65c63d5bdd
commit e0a8e0f318
5 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
checks/check_extra7119
View File

@@ -23,7 +23,7 @@
# [--apply-immediately | --no-apply-immediately]
CHECK_ID_extra7119="7.119"
CHECK_TITLE_extra7119="[extra7119] Security configurations used by ETL Development endpoints must have S3 encryption enabled."
CHECK_TITLE_extra7119="[extra7119] Check if Security configurations used by ETL Development endpoints have S3 encryption enabled."
CHECK_SCORED_extra7119="NOT_SCORED"
CHECK_TYPE_extra7119="EXTRA"
CHECK_SEVERITY_extra7119="Medium"

2
checks/check_extra7121
View File

@@ -23,7 +23,7 @@
# [--apply-immediately | --no-apply-immediately]
CHECK_ID_extra7121="7.121"
CHECK_TITLE_extra7121="[extra7121] Security configurations used by ETL Development endpoints must have CloudWatch logs encryption enabled."
CHECK_TITLE_extra7121="[extra7121] Check if Security configurations used by ETL Development endpoints have CloudWatch logs encryption enabled."
CHECK_SCORED_extra7121="NOT_SCORED"
CHECK_TYPE_extra7121="EXTRA"
CHECK_SEVERITY_extra7121="Medium"

2
checks/check_extra7123
View File

@@ -23,7 +23,7 @@
# [--apply-immediately | --no-apply-immediately]
CHECK_ID_extra7123="7.123"
CHECK_TITLE_extra7123="[extra7123] Security configurations used by ETL Development endpoints must have Job bookmark encryption enabled."
CHECK_TITLE_extra7123="[extra7123] Check if Security configurations used by ETL Development endpoints have Job bookmark encryption enabled."
CHECK_SCORED_extra7123="NOT_SCORED"
CHECK_TYPE_extra7123="EXTRA"
CHECK_SEVERITY_extra7123="Medium"

2
checks/check_extra7124
View File

@@ -23,7 +23,7 @@
# [--apply-immediately | --no-apply-immediately]
CHECK_ID_extra7124="7.124"
CHECK_TITLE_extra7124="[extra7124] ETL Job Server-side encryption (Enables Amazon S3-managed encryption of the data at the target (SSE-S3) must be enabled."
CHECK_TITLE_extra7124="[extra7124] Check if ETL Job Server-side encryption (Enables Amazon S3-managed encryption of the data at the target, SSE-S3) is enabled."
CHECK_SCORED_extra7124="NOT_SCORED"
CHECK_TYPE_extra7124="EXTRA"
CHECK_SEVERITY_extra7124="Medium"

16
checks/check_extra7125
View File

@@ -23,7 +23,7 @@
# [--apply-immediately | --no-apply-immediately]
CHECK_ID_extra7125="7.125"
CHECK_TITLE_extra7125="[extra7125] AWS Glue must be used with VPC Endpoints."
CHECK_TITLE_extra7125="[extra7125] Checks if AWS Glue is used with VPC Endpoints."
CHECK_SCORED_extra7125="NOT_SCORED"
CHECK_TYPE_extra7125="EXTRA"
CHECK_SEVERITY_extra7125="Medium"
@@ -33,19 +33,17 @@ CHECK_ALTERNATE_check7125="extra7125"
extra7125(){
textInfo "Looking for Development Endpoints in all regions... "
for regx in $REGIONS; do
LIST_GLUE_SC=$($AWSCLI glue get-jobs $PROFILE_OPT --region $regx --query 'Jobs[*].SecurityConfiguration'--output text)
LIST_GLUE_SC=$($AWSCLI glue get-dev-endpoints $PROFILE_OPT --region $regx --query 'DevEndpoints[*].PrivateAddress' --output text)
if [[ $LIST_GLUE_SC ]]; then
for sc in $(echo '${LIST_GLUE_SC}'| jq -r '.[] | @base64');do
textInfo "$ENDPOINT_SECURITY"
ENDPOINT_SC_ENCRYPTION=$($AWSCLI $PROFILE_OPT --region $regx glue get-security-configurations $sc --query 'SecurityConfiguration.EncryptionConfiguration.JobBookmarksEncryption.JobBookmarksEncryptionMode' --output text)
if [[ENDPOINT_SC_ENCRYPTION == "SSE-S3" ]]; then
textFail "$regx: ETL Job Security Configuration $sc has (SSE-S3) encryption enabled" "$regx"
for pa in $(echo '${LIST_GLUE_SC}'| jq -r '.[] | @base64');do
if [[ ! pa ]]; then
textFail "$regx: AWS Glue uses a VPC Endpoint $pa" "$regx"
else
textPass "$regx: ETL Job Security Configuration $sc has (SSE-S3) encryption is not enabled!" "$regx"
textPass "$regx: AWS Glue does not use a VPC Endpoint $pa" "$regx"
fi
done
else
textInfo "$regx: No ETL Development endpoints found" "$regx"
textInfo "$regx: No Security Configuration found" "$regx"
fi
done
}