diff --git a/checks/check_extra727 b/checks/check_extra727 index e5571716..a88ba0a2 100644 --- a/checks/check_extra727 +++ b/checks/check_extra727 @@ -30,8 +30,8 @@ extra727(){ SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION=$($AWSCLI sqs get-queue-attributes --queue-url $queue $PROFILE_OPT --region $regx --attribute-names All --query Attributes \ | jq '.Policy | fromjson' | jq '.Statement[] | select(.Effect=="Allow") | select(.Principal=="*" or .Principal.AWS=="*" or .Principal.CanonicalUser=="*") | select(has("Condition") | not)') if [[ $SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION ]]; then - SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION_DETAILS=$($AWSCLI sqs get-queue-attributes --queue-url $queue $PROFILE_OPT --region $regx --attribute-names All --query Attributes \ - | jq '.Policy | fromjson' | jq '.Statement[] | select(.Effect=="Allow") | select(.Principal=="*" or .Principal.AWS=="*" or .Principal.CanonicalUser=="*") | select(has("Condition") | not)' | jq '"[Principal: " + (.Principal|tostring) + " Action: " + (.Action|tostring) + "]"' ) + SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION_DETAILS=$(echo $SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION \ + | jq '"[Principal: " + (.Principal|tostring) + " Action: " + (.Action|tostring) + "]"' ) textFail "$regx: SQS $queue queue policy with public access: $SQS_POLICY_ALLOW_ALL_WITHOUT_CONDITION_DETAILS" "$regx" else textInfo "$regx: SQS $queue queue policy with public access but has a Condition" "$regx"