From e12f1f6957fa745f8470664f8f9298dd2eb72044 Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni.delafuente@alfresco.com>
Date: Thu, 26 Jul 2018 21:44:59 -0400
Subject: [PATCH] fixed and improved check27

---
 checks/check27 | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/checks/check27 b/checks/check27
index ba926a0a..f32b7bfe 100644
--- a/checks/check27
+++ b/checks/check27
@@ -16,17 +16,15 @@ CHECK_ALTERNATE_check207="check27"
 
 check27(){
   # "Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)"
-  CLOUDTRAILNAME=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].Name' --output text $PROFILE_OPT --region $REGION)
-    if [[ $CLOUDTRAILNAME ]];then
-      for trail in $CLOUDTRAILNAME;do
-        CLOUDTRAILENC_ENABLED=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $REGION --trail $trail --query 'trailList[*].KmsKeyId' --output text)
-        if [[ $CLOUDTRAILENC_ENABLED ]];then
-          textPass "KMS key found for $trail"
+  $AWSCLI cloudtrail describe-trails --query 'trailList[].[Name,KmsKeyId]' --output text $PROFILE_OPT --region $REGION | while read trail key; do
+    if [[ "$trail" ]] ; then
+        if [[ "$key" != "None" ]] ; then
+            textPass "KMS key found for $trail"
         else
-          textFail "encryption is not enabled in your CloudTrail trail $trail (KMS key not found)!"
+            textFail "Encryption is not enabled in your CloudTrail trail $trail (KMS key not found)!"
         fi
-      done
     else
-      textFail "CloudTrail bucket doesn't exist!"
+        textFail "CloudTrail bucket doesn't exist!"
     fi
+  done
 }