mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
51 lines
2.9 KiB
Bash
51 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2020) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
CHECK_ID_extra782="7.82"
|
|
CHECK_TITLE_extra782="[extra782] Check if Amazon Elasticsearch Service (ES) domains has node-to-node encryption enabled"
|
|
CHECK_SCORED_extra782="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_extra782="EXTRA"
|
|
CHECK_SEVERITY_extra782="Medium"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra782="AwsElasticsearchDomain"
|
|
CHECK_ALTERNATE_check782="extra782"
|
|
CHECK_SERVICENAME_extra782="es"
|
|
CHECK_RISK_extra782='Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure.'
|
|
CHECK_REMEDIATION_extra782='Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console; Actions; and Modify encryption.'
|
|
CHECK_DOC_extra782='https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html'
|
|
CHECK_CAF_EPIC_extra782='Data Protection'
|
|
|
|
extra782(){
|
|
for regx in $REGIONS; do
|
|
LIST_OF_DOMAINS=$($AWSCLI es list-domain-names $PROFILE_OPT --region $regx --query 'DomainNames[].DomainName' --output text 2>&1)
|
|
if [[ $(echo "$LIST_OF_DOMAINS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "$regx: Access Denied trying to list domain names" "$regx"
|
|
continue
|
|
fi
|
|
if [[ $LIST_OF_DOMAINS ]]; then
|
|
for domain in $LIST_OF_DOMAINS;do
|
|
CHECK_IF_NODETOENCR_ENABLED=$($AWSCLI es describe-elasticsearch-domain --domain-name $domain $PROFILE_OPT --region $regx --query 'DomainStatus.NodeToNodeEncryptionOptions.Enabled' --output text 2>&1)
|
|
if [[ $(echo "$CHECK_IF_NODETOENCR_ENABLED" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "$regx: Access Denied trying to get ES domain $domain" "$regx"
|
|
continue
|
|
fi
|
|
if [[ $(echo "$CHECK_IF_NODETOENCR_ENABLED" | grep -i true) ]];then
|
|
textPass "$regx: Amazon ES domain $domain has node-to-node encryption enabled" "$regx" "$domain"
|
|
else
|
|
textFail "$regx: Amazon ES domain $domain does not have node-to-node encryption enabled" "$regx" "$domain"
|
|
fi
|
|
done
|
|
else
|
|
textInfo "$regx: No Amazon ES domain found" "$regx"
|
|
fi
|
|
done
|
|
}
|