From e0a8e0f31840a4ed827d62985de5bfcc75bc5c65 Mon Sep 17 00:00:00 2001
From: dlpzx <dlpzx@amazon.com>
Date: Mon, 9 Nov 2020 18:48:11 +0100
Subject: [PATCH] checks for glue - 7119, 7121, 7123,7124,7125

---
 checks/check_extra7119 |  2 +-
 checks/check_extra7121 |  2 +-
 checks/check_extra7123 |  2 +-
 checks/check_extra7124 |  2 +-
 checks/check_extra7125 | 16 +++++++---------
 5 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/checks/check_extra7119 b/checks/check_extra7119
index 78919000..b21937ed 100644
--- a/checks/check_extra7119
+++ b/checks/check_extra7119
@@ -23,7 +23,7 @@
 #	[--apply-immediately | --no-apply-immediately]
 
 CHECK_ID_extra7119="7.119"
-CHECK_TITLE_extra7119="[extra7119] Security configurations used by ETL Development endpoints must have S3 encryption enabled."
+CHECK_TITLE_extra7119="[extra7119] Check if Security configurations used by ETL Development endpoints have S3 encryption enabled."
 CHECK_SCORED_extra7119="NOT_SCORED"
 CHECK_TYPE_extra7119="EXTRA"
 CHECK_SEVERITY_extra7119="Medium"
diff --git a/checks/check_extra7121 b/checks/check_extra7121
index ba7d77c2..7a0cd218 100644
--- a/checks/check_extra7121
+++ b/checks/check_extra7121
@@ -23,7 +23,7 @@
 #	[--apply-immediately | --no-apply-immediately]
 
 CHECK_ID_extra7121="7.121"
-CHECK_TITLE_extra7121="[extra7121] Security configurations used by ETL Development endpoints must have CloudWatch logs encryption enabled."
+CHECK_TITLE_extra7121="[extra7121] Check if Security configurations used by ETL Development endpoints have CloudWatch logs encryption enabled."
 CHECK_SCORED_extra7121="NOT_SCORED"
 CHECK_TYPE_extra7121="EXTRA"
 CHECK_SEVERITY_extra7121="Medium"
diff --git a/checks/check_extra7123 b/checks/check_extra7123
index ab2032f6..52c451b2 100644
--- a/checks/check_extra7123
+++ b/checks/check_extra7123
@@ -23,7 +23,7 @@
 #	[--apply-immediately | --no-apply-immediately]
 
 CHECK_ID_extra7123="7.123"
-CHECK_TITLE_extra7123="[extra7123] Security configurations used by ETL Development endpoints must have Job bookmark encryption enabled."
+CHECK_TITLE_extra7123="[extra7123] Check if Security configurations used by ETL Development endpoints have Job bookmark encryption enabled."
 CHECK_SCORED_extra7123="NOT_SCORED"
 CHECK_TYPE_extra7123="EXTRA"
 CHECK_SEVERITY_extra7123="Medium"
diff --git a/checks/check_extra7124 b/checks/check_extra7124
index 6a85ba75..cdc814ba 100644
--- a/checks/check_extra7124
+++ b/checks/check_extra7124
@@ -23,7 +23,7 @@
 #	[--apply-immediately | --no-apply-immediately]
 
 CHECK_ID_extra7124="7.124"
-CHECK_TITLE_extra7124="[extra7124] ETL Job Server-side encryption (Enables Amazon S3-managed encryption of the data at the target (SSE-S3) must be enabled."
+CHECK_TITLE_extra7124="[extra7124] Check if ETL Job Server-side encryption (Enables Amazon S3-managed encryption of the data at the target, SSE-S3) is enabled."
 CHECK_SCORED_extra7124="NOT_SCORED"
 CHECK_TYPE_extra7124="EXTRA"
 CHECK_SEVERITY_extra7124="Medium"
diff --git a/checks/check_extra7125 b/checks/check_extra7125
index 5ad80d83..c5097c9c 100644
--- a/checks/check_extra7125
+++ b/checks/check_extra7125
@@ -23,7 +23,7 @@
 #	[--apply-immediately | --no-apply-immediately]
 
 CHECK_ID_extra7125="7.125"
-CHECK_TITLE_extra7125="[extra7125] AWS Glue must be used with VPC Endpoints."
+CHECK_TITLE_extra7125="[extra7125] Checks if AWS Glue is used with VPC Endpoints."
 CHECK_SCORED_extra7125="NOT_SCORED"
 CHECK_TYPE_extra7125="EXTRA"
 CHECK_SEVERITY_extra7125="Medium"
@@ -33,19 +33,17 @@ CHECK_ALTERNATE_check7125="extra7125"
 extra7125(){
   textInfo "Looking for Development Endpoints in all regions...  "
   for regx in $REGIONS; do
-    LIST_GLUE_SC=$($AWSCLI glue get-jobs $PROFILE_OPT --region $regx --query 'Jobs[*].SecurityConfiguration'--output text)
+    LIST_GLUE_SC=$($AWSCLI glue get-dev-endpoints $PROFILE_OPT --region $regx --query 'DevEndpoints[*].PrivateAddress' --output text)
     if [[ $LIST_GLUE_SC ]]; then
-      for sc in $(echo '${LIST_GLUE_SC}'| jq -r '.[] | @base64');do
-        textInfo "$ENDPOINT_SECURITY"
-        ENDPOINT_SC_ENCRYPTION=$($AWSCLI $PROFILE_OPT --region $regx glue get-security-configurations $sc --query 'SecurityConfiguration.EncryptionConfiguration.JobBookmarksEncryption.JobBookmarksEncryptionMode' --output text)
-        if [[ENDPOINT_SC_ENCRYPTION == "SSE-S3" ]]; then
-          textFail "$regx: ETL Job Security Configuration $sc has (SSE-S3) encryption enabled" "$regx"
+      for pa in $(echo '${LIST_GLUE_SC}'| jq -r '.[] | @base64');do
+        if [[ ! pa ]]; then
+          textFail "$regx: AWS Glue uses a VPC Endpoint $pa" "$regx"
         else
-          textPass "$regx: ETL Job Security Configuration $sc has (SSE-S3) encryption is not enabled!" "$regx"
+          textPass "$regx: AWS Glue does not use a VPC Endpoint $pa" "$regx"
         fi
       done
     else
-      textInfo "$regx: No ETL Development endpoints found" "$regx"
+      textInfo "$regx: No Security Configuration found" "$regx"
     fi
   done
 }
\ No newline at end of file