From 41ccd4517b49c8978446d0d589ddb1fd958ed6ed Mon Sep 17 00:00:00 2001
From: "C.J" <31103058+zfLQ2qx2@users.noreply.github.com>
Date: Sat, 25 Jan 2020 15:22:39 -0500
Subject: [PATCH] Add additional error checking to address issue 459

---
 checks/check23 | 10 +++++++---
 checks/check26 | 15 +++++++++------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/checks/check23 b/checks/check23
index 63ccd4d7..53d1b6f6 100644
--- a/checks/check23
+++ b/checks/check23
@@ -17,10 +17,14 @@ CHECK_ALTERNATE_check203="check23"
 check23(){
   # "Ensure the S3 bucket CloudTrail logs to is not publicly accessible (Scored)"
   CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].S3BucketName' --output text $PROFILE_OPT --region $REGION)
-  if [[ $CLOUDTRAILBUCKET ]];then
+  if [[ $CLOUDTRAILBUCKET ]]; then
     for bucket in $CLOUDTRAILBUCKET;do
-      CLOUDTRAILBUCKET_HASALLPERMISIONS=$($AWSCLI s3api get-bucket-acl --bucket $bucket --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' $PROFILE_OPT --region $REGION --output text)
-      if [[ $CLOUDTRAILBUCKET_HASALLPERMISIONS ]];then
+      CLOUDTRAILBUCKET_HASALLPERMISIONS=$($AWSCLI s3api get-bucket-acl --bucket $bucket --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' $PROFILE_OPT --region $REGION --output text 2>&1)
+      if [[ $(echo "$CLOUDTRAILBUCKET_HASALLPERMISIONS" | grep AccessDenied) ]]; then
+        textFail "Access Denied Trying to Get Bucket Acl for $bucket"
+        continue
+      fi
+      if [[ $CLOUDTRAILBUCKET_HASALLPERMISIONS ]]; then
         textFail "check your $bucket CloudTrail bucket ACL and Policy!"
       else
         textPass "Bucket $bucket is set correctly"
diff --git a/checks/check26 b/checks/check26
index 0c6dfa0c..83395527 100644
--- a/checks/check26
+++ b/checks/check26
@@ -19,16 +19,20 @@ check26(){
 
   CLOUDTRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].Name' --output text| tr '\011' '\012' | awk -F: '{print $1}')
 
-  if [[ $CLOUDTRAILS ]];then
+  if [[ $CLOUDTRAILS ]]; then
     for trail in $CLOUDTRAILS; do
       CLOUDTRAIL_ACCOUNT_ID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].TrailARN' --output text | tr '\011' '\012' | grep "$trail" | awk -F: '{ print $5 }'  | head -n 1)
       CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $REGION --query 'trailList[*].[Name, S3BucketName]' --output text  | tr '\011' ':' |  grep "$trail" | awk -F: '{ print $2 }' )
 
-      if [[ $CLOUDTRAILBUCKET ]];then
+      if [[ $CLOUDTRAILBUCKET ]]; then
         bucket=$CLOUDTRAILBUCKET
-        if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_NUM" ];then
-          CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text|grep -v None)
-          if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then
+        if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_NUM" ]; then
+          CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text 2>&1)
+          if [[ $(echo "$CLOUDTRAILBUCKET_LOGENABLED" | grep AccessDenied) ]]; then
+            textFail "Access Denied Trying to Get Bucket Logging for $bucket"
+            continue
+          fi
+          if [[ $CLOUDTRAILBUCKET_LOGENABLED != "null" ]]; then
             textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail"
           else
             textFail "Bucket access logging is not enabled in CloudTrail S3 bucket $bucket for $trail"
@@ -36,7 +40,6 @@ check26(){
         else
           textInfo "CloudTrail S3 bucket $bucket for trail $trail is not in current account"
         fi
-        
       else
         textFail "CloudTrail bucket not found!"
       fi