ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-12 15:55:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use TrailARN property to query get-event-selectors in checks_extra725

Browse Source 
This will work to query cloudtrail's that are in different accounts.
e.g. in the case of organisation managed cloudtrails.
This commit is contained in:
Patrick Downey
2020-04-08 13:27:09 +01:00
parent 9c4e629647
commit fc83a9896c
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
checks/check_extra725
View File

@@ -33,15 +33,15 @@ extra725(){
# now create a list with all trails available and their region # now create a list with all trails available and their region
TEMP_TRAILS_LIST_FILE=$(mktemp -t prowler.trails-list-XXXXXX) TEMP_TRAILS_LIST_FILE=$(mktemp -t prowler.trails-list-XXXXXX)
for regx in $REGIONS; do for regx in $REGIONS; do
$AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query trailList[?HomeRegion==\`$regx\`].[Name,HomeRegion] --output text >> $TEMP_TRAILS_LIST_FILE $AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query trailList[?HomeRegion==\`$regx\`].[TrailARN,HomeRegion] --output text >> $TEMP_TRAILS_LIST_FILE
done done
# look for buckets being logged per trail and create a list with them # look for buckets being logged per trail and create a list with them
TEMP_BUCKETS_LOGGING_LIST_FILE=$(mktemp -t prowler.buckets-logging-list-XXXXXX) TEMP_BUCKETS_LOGGING_LIST_FILE=$(mktemp -t prowler.buckets-logging-list-XXXXXX)
while IFS='' read -r LINE || [[ -n "${LINE}" ]]; do while IFS='' read -r LINE || [[ -n "${LINE}" ]]; do
TRAIL_REGION=$(echo "${LINE}" | awk '{ print $2 }') TRAIL_REGION=$(echo "${LINE}" | awk '{ print $2 }')
TRAIL_NAME=$(echo "${LINE}" | awk '{ print $1 }') TRAIL_ARN=$(echo "${LINE}" | awk '{ print $1 }')
BUCKETS_OBJECT_LOGGING_ENABLED=$($AWSCLI cloudtrail get-event-selectors --trail-name "${TRAIL_NAME}" $PROFILE_OPT --region $TRAIL_REGION --query "EventSelectors[*].DataResources[?Type == \`AWS::S3::Object\`].Values" --output text |xargs -n1 |cut -d: -f 6|sed 's/\///g') BUCKETS_OBJECT_LOGGING_ENABLED=$($AWSCLI cloudtrail get-event-selectors --trail-name "${TRAIL_ARN}" $PROFILE_OPT --region $TRAIL_REGION --query "EventSelectors[*].DataResources[?Type == \`AWS::S3::Object\`].Values" --output text |xargs -n1 |cut -d: -f 6|sed 's/\///g')
echo $BUCKETS_OBJECT_LOGGING_ENABLED |tr " " "\n"|sort >> $TEMP_BUCKETS_LOGGING_LIST_FILE echo $BUCKETS_OBJECT_LOGGING_ENABLED |tr " " "\n"|sort >> $TEMP_BUCKETS_LOGGING_LIST_FILE
if [[ $BUCKETS_OBJECT_LOGGING_ENABLED ]]; then if [[ $BUCKETS_OBJECT_LOGGING_ENABLED ]]; then
for bucket in $BUCKETS_OBJECT_LOGGING_ENABLED; do for bucket in $BUCKETS_OBJECT_LOGGING_ENABLED; do