mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-11 07:15:15 +00:00
84 lines
3.7 KiB
Bash
84 lines
3.7 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
CHECK_ID_extra740="7.40"
|
|
CHECK_TITLE_extra740="[extra740] Check if EBS snapshots are encrypted (Not Scored) (Not part of CIS benchmark)"
|
|
CHECK_SCORED_extra740="NOT_SCORED"
|
|
CHECK_TYPE_extra740="EXTRA"
|
|
CHECK_SEVERITY_extra740="Medium"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra740="AwsEc2Snapshot"
|
|
CHECK_ALTERNATE_check740="extra740"
|
|
CHECK_ASFF_COMPLIANCE_TYPE_extra740="ens-mp.info.3.aws.ebs.3"
|
|
|
|
extra740(){
|
|
textInfo "Examining EBS Volume Snapshots ..."
|
|
# This does NOT use max-items, which would limit the number of items
|
|
# considered. It considers all snapshots, but only reports at most
|
|
# max-items passing and max-items failing.
|
|
for regx in ${REGIONS}; do
|
|
UNENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \
|
|
--region ${regx} --owner-ids ${ACCOUNT_NUM} --output text \
|
|
--query 'Snapshots[?Encrypted==`false`]|[*].{Id:SnapshotId}' \
|
|
| grep -v None 2> /dev/null)
|
|
ENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \
|
|
--region ${regx} --owner-ids ${ACCOUNT_NUM} --output text \
|
|
--query 'Snapshots[?Encrypted==`true`]|[*].{Id:SnapshotId}' \
|
|
| grep -v None 2> /dev/null)
|
|
typeset -i unencrypted
|
|
typeset -i encrypted
|
|
unencrypted=0
|
|
encrypted=0
|
|
|
|
if [[ ${UNENCRYPTED_SNAPSHOTS} ]]; then
|
|
for snapshot in ${UNENCRYPTED_SNAPSHOTS}; do
|
|
unencrypted=${unencrypted}+1
|
|
if [ "${unencrypted}" -le "${MAXITEMS}" ]; then
|
|
textFail "${regx}: ${snapshot} is not encrypted!" "${regx}"
|
|
fi
|
|
done
|
|
fi
|
|
if [[ ${ENCRYPTED_SNAPSHOTS} ]]; then
|
|
for snapshot in ${ENCRYPTED_SNAPSHOTS}; do
|
|
encrypted=${encrypted}+1
|
|
if [ "${encrypted}" -le "${MAXITEMS}" ]; then
|
|
textPass "${regx}: ${snapshot} is encrypted." "${regx}"
|
|
fi
|
|
done
|
|
fi
|
|
if [[ "${encrypted}" = "0" ]] && [[ "${unencrypted}" = "0" ]] ; then
|
|
textInfo "${regx}: No EBS volume snapshots" "${regx}"
|
|
else
|
|
typeset -i total
|
|
total=${encrypted}+${unencrypted}
|
|
if [[ "${unencrypted}" -ge "${MAXITEMS}" ]]; then
|
|
textFail "${unencrypted} unencrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} unencrypted snapshots are reported!"
|
|
fi
|
|
if [[ "${encrypted}" -ge "${MAXITEMS}" ]]; then
|
|
textPass "${encrypted} encrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} encrypted snapshots are reported."
|
|
fi
|
|
# Bit of 'bc' magic to print something like 10.42% or 0.85% or similar. 'bc' has a
|
|
# bug where it will never print leading zeros. So 0.5 is output as ".5". This has a
|
|
# little extra clause to print a 0 if 0 < x < 1.
|
|
ratio=$(echo "scale=2; p=(100*${encrypted}/(${encrypted}+${unencrypted})); if(p<1 && p>0) print 0;print p, \"%\";" | bc 2>/dev/null)
|
|
exit=$?
|
|
|
|
# maybe 'bc' doesn't exist, or it exits with an error
|
|
if [[ "${exit}" = "0" ]]
|
|
then
|
|
textInfo "${regx}: ${ratio} encrypted EBS volumes (${encrypted} out of ${total})" "${regx}"
|
|
else
|
|
textInfo "${regx}: ${unencrypted} unencrypted EBS volume snapshots out of ${total} total snapshots" "${regx}"
|
|
fi
|
|
fi
|
|
done
|
|
}
|