ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 23:05:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,144 Commits 1 Branch 0 Tags
ef4d2d33bec44b1df2ede9f6d067597527617698
Commit Graph

395 Commits

Author SHA1 Message Date
Nimrod Kor
ef4d2d33be Fix extra734 - handle us-east-1 
(cherry picked from commit 5f2eb7f82e3814478b380ae5fbb6c8a69536e043)
 2020-06-04 23:15:21 +03:00
Jon Jozwiak
06e81a7f33 Update check_extra792 ASFF resource tye 2020-05-26 09:35:48 -05:00
Jon Jozwiak
70337ecd84 Add ASFF resource type 2020-05-26 09:34:37 -05:00
jonjozwiak
df15388577 Adding insecure SSL checks for CloudFront and CLB/ALB 
(cherry picked from commit c9a60c07a2b5497cbed2d70c53821d826171dd68)
 2020-05-26 16:33:18 +03:00
Toni de la Fuente
c7ed6a6693 Improved region handing for extra734 and extra764 2020-05-19 15:03:42 +02:00
Toni de la Fuente
e0c2ca2436 Fixed issue #596 for extra71 2020-05-11 13:21:06 +02:00
Toni de la Fuente
c79d346961 Fixed issue #596 on check114 2020-05-11 13:16:38 +02:00
Toni de la Fuente
996f785af6 Improve check21 If no account cloudtrail trail is found, check org trail @nimrodkor @bridgecrewio 
check21 - If no account CloudTrail trail is found, check org trail
 2020-04-29 22:24:24 +02:00
Nimrod Kor
dd0ef8c0b4 If no local cloudtrail trail is found - check org trail 2020-04-29 21:39:27 +03:00
Toni de la Fuente
5450bf949e Fix check12's grep to find users with true in their name who really have password access @nimrodkor @bridgecrewio 
Fix check12's grep to find users with true in their name who really have password access @nimrodkor @bridgecrewio
 2020-04-29 13:02:26 +02:00
Toni de la Fuente
1f949b4175 Improved AWS partition handle 2020-04-29 12:06:47 +02:00
Nimrod Kor
dbca70ef2e Add $ to end of regex 2020-04-28 14:28:59 +03:00
Nimrod Kor
54f2b72cb6 Fix check12's grep to find users who really have password access 
(cherry picked from commit 4006c581a06c449b66ede8892b9ae18c735ad34c)
 2020-04-28 14:13:32 +03:00
Toni de la Fuente
13ca147d02 Updated checks with hardcoded arn to support GovCloud partition 2020-04-22 23:23:17 +02:00
Toni de la Fuente
dbb3ed9663 Improved extra734 for GovCloud 2020-04-22 22:19:21 +02:00
Toni de la Fuente
1beb483be3 Fixed issue with govcloud on extra764 #536 2020-04-22 20:40:18 +02:00
Toni de la Fuente
7dc790a3f5 Fixed issue with govcloud on extra764 #536 2020-04-22 20:05:39 +02:00
Toni de la Fuente
b9051e6fc9 Merge pull request #563 from marcjay/correct-check13-496 
Extend check13 to meet all CIS rules and consolidate with extra774
 2020-04-22 10:46:37 +02:00
Toni de la Fuente
92091d9ecd Rollback #562 fix issue #564 2020-04-22 10:31:30 +02:00
Marc Jay
ad66254b45 Extend check13 to meet all CIS rules and consolidate with extra774 
Create `include/check_creds_last_used` and move all logic for checking last usages of passwords and access keys there
Modify check13 and extra774 to call new function, specifying time-range of last 90 days and last 30 days respectively
Modify messages in check14 and check121 so that all mentions of 'access key's are consistent

Fixes #496
 2020-04-21 01:21:55 +01:00
Toni de la Fuente
d6374f8bc8 Updated textInfo message on extra712 2020-04-20 19:27:39 +02:00
Toni de la Fuente
0c7805356e Enhancement: extra712 improved with Macie API call instead of IAM @eko0126 
using api commands to check if macie is enabled instead of looking ia…
 2020-04-20 19:20:13 +02:00
Toni de la Fuente
86ea46d77c Update check_extra712 2020-04-20 19:19:05 +02:00
Toni de la Fuente
38a970f4fc Enhancement: extra768 only check latest version of ECS task definition 
Only check latest version of task definition
 2020-04-20 19:00:26 +02:00
Toni de la Fuente
d02d9e1c95 Merge branch 'extra725' of https://github.com/nalansitan/prowler into nalansitan-extra725 2020-04-20 18:46:39 +02:00
Alex Gray
5b8370179a Get the list of families and then get latest task definition 2020-04-20 09:15:15 -04:00
He.Longfei
b42cc33a6c using api commands to check if macie is enabled instead of looking iam role 2020-04-20 15:01:38 +08:00
Toni de la Fuente
6747b208ce Improved extra716 and extra788 2020-04-17 15:16:55 +02:00
Alex Gray
172f4b2681 Only check latest version of task definition 2020-04-15 15:19:44 -04:00
Toni de la Fuente
3311acf82c Merge branch 'simplify-check-id-variables' of https://github.com/marcjay/prowler into marcjay-simplify-check-id-variables 2020-04-15 00:23:54 +02:00
Toni de la Fuente
973f6b39a0 Merge branch 'master' of https://github.com/toniblyx/prowler 2020-04-14 16:45:54 +02:00
Toni de la Fuente
11c182c5fe Fixed issue with regions on check21 2020-04-14 16:45:37 +02:00
nalansitan
036ae640e5 support arn:aws:s3::: on extra725 2020-04-14 10:38:01 +08:00
Marc Jay
0f49468601 Limit CHECK_ID to a single value, handing the left-pad formatting in one place 
Remove the second entry in any comma-separated check IDs from each check, formatting
the check ID with leading zeros in `include/outputs` if the `-n` flag is active
 2020-04-14 02:02:48 +01:00
Marc Jay
460f65618b Add clarifying text to pass/fail messages 2020-04-13 22:43:22 +01:00
Marc Jay
c4374a2818 Extra741 - Check if User Data is a valid GZIP file before attempting to gunzip 
Test if the user data is a valid GZIP file using `gunzip -t` and only then attempt to gunzip it
Remove some code duplication

Fixes #535
 2020-04-13 22:27:22 +01:00
Toni de la Fuente
a4264628cb Extra725 - Improved support cross account and region cloudtrail @patdowney 
Extra725 - Support cross account and region cloudtrail
 2020-04-13 18:34:31 +02:00
Toni de la Fuente
8a7344ef86 Extra720 - Support cross account and cross-region cloudtrail @patdowney 2020-04-13 18:33:38 +02:00
Toni de la Fuente
4cf66a2f32 Merge pull request #527 from yumminhuang/master 
Remove --output text in CLOUDTRAILBUCKET_LOGENABLED
 2020-04-13 18:18:55 +02:00
Toni de la Fuente
7f2e097205 Merge pull request #518 from bridgecrewio/bugfix/check_23_error_fails 
check23 - on failure, output info and not failure
 2020-04-13 16:50:30 +02:00
Toni de la Fuente
67504e8591 Merge pull request #519 from bridgecrewio/bugfix/check_26_error_fails 
check26 - on failure, output info and not failure
 2020-04-13 16:50:05 +02:00
Toni de la Fuente
958a54e337 Merge pull request #530 from marcjay/aws-security-hub-output-524 
Add 'json-asff' output mode and ability to send output to AWS Security Hub
 2020-04-13 14:03:50 +02:00
Toni de la Fuente
3c77130f65 Merge pull request #540 from marcjay/check121-filter-out-password-access-513 
check121 - Filter out users who do not have a console password
 2020-04-13 13:31:33 +02:00
Marc Jay
4f623b4e31 check121 - Filter out users who do not have a console password 
According to the benchmark, only users with a console password should be considered for this check,
therefore filter out any users who do not have a console password

Fixes #513
 2020-04-12 02:18:42 +01:00
Marc Jay
ce1058dfed Remove the varying number of days in the message so that message stays consistent over time 2020-04-12 01:22:34 +01:00
Marc Jay
8d9c7e8ab0 Handle IAM credential report containing 'no_information' for a user's last console login date 
A user who has never logged into the console, or not logged in since Oct 2014 will present as 'no_information' in the
'password_last_used' column of the credential report. Handle this scenario and output a failed message if it has been
more than MAX_DAYS days since the user was created, or an info message if it is less than MAX_DAYS

Fixes #501
 2020-04-11 20:07:03 +01:00
Marc Jay
c02811f411 Add CHECK_ASFF_RESOURCE_TYPE variables for recently added checks 2020-04-11 03:34:32 +01:00
Marc Jay
4bae0ca5f5 Merge branch 'master' into aws-security-hub-output-524 2020-04-11 03:16:23 +01:00
Marc Jay
5bab65c56d - Remove securityhub output mode and replace with '-S' flag to send findings to Security Hub 
- Move Security Hub related code to a dedicated include/securityhub_integration file
- Check that Security Hub is enabled in the target region before beginning checks when -S is specified
- Add error handling to the batch-import-findings call
- Add CHECK_ASFF_TYPE variables to all CIS checks to override the default
- Add support for CHECK_ASFF_RESOURCE_TYPE variables which override the default 'AwsAccount' value for the resource a finding relates to.
- Add CHECK_ASFF_RESOURCE_TYPE variables to all checks where there is a suitable value in the schema
- Remove json-asff output for info messages as they are not appropriate for possible submission to Security Hub
- Update the README to cover Security Hub integration
- Add an IAM policy JSON document that provides the necessary BatchImportFindings permission for Security Hub
- Remove trailing whitespace and periods in pass/fail messages to be consistent with the majority of messages, to prevent future tidy-up from changing the finding IDs
 2020-04-11 03:04:03 +01:00
Huang Yaming
7982cc462a Remove --output text in CLOUDTRAILBUCKET_LOGENABLED 
When adding `--output text`, aws cli will return `None` instead of
`null`. It makes the following if check misjudge LoggingEnabled
status.
 2020-04-10 10:18:20 +08:00