mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
57 lines
3.5 KiB
Bash
57 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2020) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
CHECK_ID_extra785="7.85"
|
|
CHECK_TITLE_extra785="[extra785] Check if Amazon Elasticsearch Service (ES) domains have updates available"
|
|
CHECK_SCORED_extra785="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_extra785="EXTRA"
|
|
CHECK_SEVERITY_extra785="Low"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra785="AwsElasticsearchDomain"
|
|
CHECK_ALTERNATE_check785="extra785"
|
|
CHECK_SERVICENAME_extra785="es"
|
|
CHECK_RISK_extra785='Amazon ES regularly releases system software updates that add features or otherwise improve your domains.'
|
|
CHECK_REMEDIATION_extra785='The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge. If you take no action on required updates; Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation; Amazon ES sends notifications when it starts the update and when the update is complete.'
|
|
CHECK_DOC_extra785='https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html'
|
|
CHECK_CAF_EPIC_extra785='Infrastructure Security'
|
|
|
|
# NOTE!
|
|
# API does not properly shows if an update is available while it is a new version available
|
|
# that can be done using the Console but not the API, not sure if it is a bug
|
|
# I have to investigate further
|
|
|
|
extra785(){
|
|
for regx in ${REGIONS}; do
|
|
LIST_OF_DOMAINS=$("${AWSCLI}" es list-domain-names ${PROFILE_OPT} --region "${regx}" --query 'DomainNames[].DomainName' --output text 2>&1)
|
|
if [[ $(echo "${LIST_OF_DOMAINS}" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "${regx}: Access Denied trying to list domain names" "${regx}"
|
|
continue
|
|
fi
|
|
if [[ "${LIST_OF_DOMAINS}" ]]; then
|
|
for domain in ${LIST_OF_DOMAINS}; do
|
|
CHECK_IF_UPDATE_AVAILABLE_AND_VERSION=$("${AWSCLI}" es describe-elasticsearch-domain --domain-name "${domain}" ${PROFILE_OPT} --region "${regx}" --query 'DomainStatus.[ServiceSoftwareOptions.UpdateAvailable,ElasticsearchVersion]' --output text 2>&1)
|
|
if [[ $(echo "${CHECK_IF_UPDATE_AVAILABLE_AND_VERSION}" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "${regx}: Access Denied trying to get ES domain ${domain}" "${regx}"
|
|
continue
|
|
fi
|
|
read -r update_status es_version <<< "${CHECK_IF_UPDATE_AVAILABLE_AND_VERSION}" &&
|
|
if [[ $(tr '[:upper:]' '[:lower:]' <<< "${update_status}") != "false" ]]; then
|
|
textInfo "${regx}: Amazon ES domain ${domain} v${es_version} has updates available" "${regx}" "${domain}"
|
|
else
|
|
textPass "${regx}: Amazon ES domain ${domain} v${es_version} does not have have updates available" "${regx}" "${domain}"
|
|
fi
|
|
done
|
|
else
|
|
textInfo "${regx}: No Amazon ES domain found" "${regx}"
|
|
fi
|
|
done
|
|
}
|