Make 3.x tests simpler and more useful

include/check3x

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (c) by Toni de la Fuente
+#
+# This Prowler check is licensed under a
+# Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
+#
+# You should have received a copy of the license along with this
+# work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
+
+check3x(){
+  grep_filter=$1
+  local CHECK_OK
+  local CHECK_WARN
+
+  CLOUDWATCH_GROUP=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text| tr '      ' '
+' | awk -F: '{ print $7 }')
+  if [[ $CLOUDWATCH_GROUP ]];then
+    for group in $CLOUDWATCH_GROUP; do
+      CLOUDWATCH_LOGGROUP_REGION=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text | tr '       ' '
+' | grep "$group" | awk -F: '{ print $4 }'  | head -n 1)
+      METRICFILTER_SET=$($AWSCLI logs describe-metric-filters --log-group-name "$group" $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --output text | grep METRICFILTERS | grep -E "$grep_filter" | awk '{ print $3 }')
+      if [[ $METRICFILTER_SET ]];then
+        for metric in $METRICFILTER_SET; do
+          metric_name=$($AWSCLI logs describe-metric-filters $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --log-group-name "$group" --filter-name-prefix "$metric" --output text --query 'metricFilters[0].metricTransformations[0].metricName')
+          HAS_ALARM_ASSOCIATED=$($AWSCLI cloudwatch describe-alarms $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --query 'MetricAlarms[?MetricName==`'"$metric_name"'`]' --output text)
+          if [[ $HAS_ALARM_ASSOCIATED ]];then
+            CHECK_OK="$CHECK_OK $group:$metric"
+          else
+            CHECK_WARN="$CHECK_WARN $group:$metric"
+          fi
+        done
+      else
+        CHECK_WARN="$CHECK_WARN $group"
+      fi
+    done
+
+    if [[ $CHECK_OK ]]; then
+      for group in $CHECK_OK; do
+        metric=${group#*:}
+        group=${group%:*}
+        textPass "CloudWatch group $group found with metric filter $metric and alarms set"
+      done
+    fi
+    if [[ $CHECK_WARN ]]; then
+      for group in $CHECK_WARN; do
+        case $group in
+           *:*) metric=${group#*:}
+                group=${group%:*}
+                textFail "CloudWatch group $group found with metric filter $metric but no alarms associated"
+                ;;
+             *) textFail "CloudWatch group $group found but no metric filters or alarms associated"
+        esac
+      done
+    fi
+  else
+    textFail "No CloudWatch group found for CloudTrail events"
+  fi
+}