mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
455 lines
18 KiB
Bash
455 lines
18 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
# Output formatting functions
|
|
|
|
EXTENSION_CSV="csv"
|
|
EXTENSION_JSON="json"
|
|
EXTENSION_ASFF="asff.json"
|
|
EXTENSION_TEXT="txt"
|
|
EXTENSION_HTML="html"
|
|
OUTPUT_DATE=$(date -u +"%Y%m%d%H%M%S")
|
|
OUTPUT_DIR="${PROWLER_DIR}/output" # default output if none
|
|
if [[ $OUTPUT_DIR_CUSTOM ]]; then
|
|
# output mode has to be set to other than text
|
|
if [[ ! " ${MODES[@]} " =~ " text " || ${check_id} == 7.1 || ${check_id} == 7.74 ]]; then
|
|
if [[ ! -d $OUTPUT_DIR_CUSTOM ]]; then
|
|
echo "$OPTRED ERROR!$OPTNORMAL directory \"$OUTPUT_DIR_CUSTOM\" does not exist."
|
|
exit 1
|
|
else
|
|
OUTPUT_DIR=$OUTPUT_DIR_CUSTOM
|
|
fi
|
|
else
|
|
echo "$OPTRED ERROR!$OPTNORMAL - Mode (-M) has to be set as well. Use -h for help."
|
|
exit 1
|
|
fi
|
|
fi
|
|
if [ -z ${OUTPUT_FILE_NAME+x} ]; then
|
|
OUTPUT_FILE_NAME="${OUTPUT_DIR}/prowler-output-${ACCOUNT_NUM}-${OUTPUT_DATE}"
|
|
else
|
|
OUTPUT_FILE_NAME="${OUTPUT_DIR}/$OUTPUT_FILE_NAME"
|
|
fi
|
|
HTML_LOGO_URL="https://github.com/prowler-cloud/prowler/"
|
|
HTML_LOGO_IMG="https://github.com/prowler-cloud/prowler/raw/master/util/html/prowler-logo-new.png"
|
|
TIMESTAMP=$(get_iso8601_timestamp)
|
|
PROWLER_PARAMETERS=$@
|
|
|
|
# Available parameters for outputs formats (implemented this in CSV from v2.4):
|
|
|
|
# $PROFILE profile used to run Prowler (--profile in AWS CLI)
|
|
# $ACCOUNT_NUM AWS Account ID
|
|
# $REPREGION AWS region scanned
|
|
# $TITLE_ID Numeric identifier of each check (1.2, 2.3, etc), originally based on CIS checks.
|
|
# $CHECK_RESULT values can be PASS, FAIL, INFO or WARNING if allowlisted
|
|
# $ITEM_SCORED corresponds to CHECK_SCORED, values can be Scored/Not Scored. This is CIS only, will be deprecated in Prowler.
|
|
# $ITEM_CIS_LEVEL corresponds to CHECK_TYPE_ currently only for CIS Level 1, CIS Level 2 and Extras (all checks not part of CIS)
|
|
# $TITLE_TEXT corresponds to CHECK_TITLE_ shows title of each check
|
|
# $CHECK_RESULT_EXTENDED shows response of each check per resource like sg-123438 is open!
|
|
# $CHECK_ASFF_COMPLIANCE_TYPE specify type from taxonomy https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format-type-taxonomy.html
|
|
# $CHECK_SEVERITY severity Low, Medium, High, Critical
|
|
# $CHECK_SERVICENAME AWS service name short name
|
|
# $CHECK_ASFF_RESOURCE_TYPE values from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html#asff-resources
|
|
# $CHECK_ASFF_TYPE generic type from taxonomy here https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format-type-taxonomy.html
|
|
# $CHECK_RISK text about risk
|
|
# $CHECK_REMEDIATION text about remediation
|
|
# $CHECK_DOC link to related documentation
|
|
# $CHECK_CAF_EPIC it can be Logging and Monitoring, IAM, Data Protection, Infrastructure Security. Incident Response is not included since CAF has not specific checks on it logs enablement are part of Logging and Monitoring.
|
|
# $ACCOUNT_DETAILS_EMAIL
|
|
# $ACCOUNT_DETAILS_NAME
|
|
# $ACCOUNT_DETAILS_ARN
|
|
# $ACCOUNT_DETAILS_ORG
|
|
# $ACCOUNT_DETAILS_TAGS
|
|
|
|
# Ensure that output directory always exists when -M is used
|
|
if [[ $MODE ]];then
|
|
mkdir -p "${OUTPUT_DIR}"
|
|
if [[ "${MODES[@]}" =~ "html" ]]; then
|
|
addHtmlHeader > ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
HTML_REPORT_INIT="1"
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "csv" ]]; then
|
|
printCsvHeader
|
|
fi
|
|
fi
|
|
|
|
# textInfo "HTML report will be saved: ${OUTPUT_FILE_NAME}.$EXTENSION_HTML"
|
|
# textInfo "JSON ASFF report will be saved: ${OUTPUT_FILE_NAME}.$EXTENSION_ASFF"
|
|
# textInfo "CSV report will be saved: ${OUTPUT_FILE_NAME}.$EXTENSION_CSV"
|
|
# textInfo "JSON report will be saved: ${OUTPUT_FILE_NAME}.$EXTENSION_JSON"
|
|
|
|
if [[ $PROFILE == "" ]];then
|
|
PROFILE="ENV"
|
|
fi
|
|
|
|
textPass(){
|
|
CHECK_RESULT="PASS"
|
|
CHECK_RESULT_EXTENDED="$1"
|
|
CHECK_RESOURCE_ID="$3"
|
|
|
|
if [[ "$QUIET" == 1 ]]; then
|
|
return
|
|
fi
|
|
|
|
PASS_COUNTER=$((PASS_COUNTER+1))
|
|
if [[ $2 ]]; then
|
|
REPREGION=$2
|
|
else
|
|
REPREGION=$REGION
|
|
fi
|
|
|
|
if [[ "${MODES[@]}" =~ "csv" ]]; then
|
|
# Writting csv file replacing commas
|
|
echo "${PROFILE/,/--}${SEP}${ACCOUNT_NUM/,/--}${SEP}${REPREGION/,/--}${SEP}${TITLE_ID/,/--}${SEP}${CHECK_RESULT/,/--}${SEP}${ITEM_SCORED/,/--}${SEP}${ITEM_CIS_LEVEL/,/--}${SEP}${TITLE_TEXT/,/--}${SEP}${CHECK_RESULT_EXTENDED/,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE/,/--}${SEP}${CHECK_SEVERITY/,/--}${SEP}${CHECK_SERVICENAME/,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE/,/--}${SEP}${CHECK_ASFF_TYPE/,/--}${SEP}${CHECK_RISK/,/--}${SEP}${CHECK_REMEDIATION/,/--}${SEP}${CHECK_DOC/,/--}${SEP}${CHECK_CAF_EPIC/,/--}${SEP}${CHECK_RESOURCE_ID/,/--}${SEP}${PROWLER_START_TIME/,/--}${SEP}${ACCOUNT_DETAILS_EMAIL/,/--}${SEP}${ACCOUNT_DETAILS_NAME/,/--}${SEP}${ACCOUNT_DETAILS_ARN/,/--}${SEP}${ACCOUNT_DETAILS_ORG/,/--}${SEP}${ACCOUNT_DETAILS_TAGS/,/--}" >> ${OUTPUT_FILE_NAME}.$EXTENSION_CSV
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "json" ]]; then
|
|
generateJsonOutput "$1" "Pass" "$CHECK_RESOURCE_ID" >> ${OUTPUT_FILE_NAME}.$EXTENSION_JSON
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "json-asff" ]]; then
|
|
JSON_ASFF_OUTPUT=$(generateJsonAsffOutput "$1" "PASSED" "$CHECK_RESOURCE_ID")
|
|
echo "${JSON_ASFF_OUTPUT}" >> $OUTPUT_FILE_NAME.$EXTENSION_ASFF
|
|
if [[ "${SEND_TO_SECURITY_HUB}" -eq 1 ]]; then
|
|
sendToSecurityHub "${JSON_ASFF_OUTPUT}" "${REPREGION}"
|
|
fi
|
|
fi
|
|
if is_junit_output_enabled; then
|
|
output_junit_success "$1"
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "mono" ]]; then
|
|
echo " $OK PASS!$NORMAL $1" >> ${OUTPUT_FILE_NAME}.$EXTENSION_TEXT
|
|
fi
|
|
# if [[ "${MODES[@]}" =~ "text" || "${MODES[@]}" =~ "mono" ]]; then
|
|
# runs showing console output no mater what output is selected
|
|
echo " $OK PASS!$NORMAL $1"
|
|
# fi
|
|
if [[ "${MODES[@]}" =~ "html" ]]; then
|
|
generateHtmlOutput "$1" "PASS"
|
|
fi
|
|
}
|
|
|
|
textInfo(){
|
|
CHECK_RESULT="INFO"
|
|
CHECK_RESULT_EXTENDED="$1"
|
|
CHECK_RESOURCE_ID="$3"
|
|
|
|
if [[ "$QUIET" == 1 ]]; then
|
|
return
|
|
fi
|
|
|
|
if [[ $2 ]]; then
|
|
REPREGION=$2
|
|
else
|
|
REPREGION=$REGION
|
|
fi
|
|
|
|
if [[ "${MODES[@]}" =~ "csv" ]]; then
|
|
# Writing csv file replacing commas
|
|
echo "${PROFILE/,/--}${SEP}${ACCOUNT_NUM/,/--}${SEP}${REPREGION/,/--}${SEP}${TITLE_ID/,/--}${SEP}${CHECK_RESULT/,/--}${SEP}${ITEM_SCORED/,/--}${SEP}${ITEM_CIS_LEVEL/,/--}${SEP}${TITLE_TEXT/,/--}${SEP}${CHECK_RESULT_EXTENDED/,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE/,/--}${SEP}${CHECK_SEVERITY/,/--}${SEP}${CHECK_SERVICENAME/,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE/,/--}${SEP}${CHECK_ASFF_TYPE/,/--}${SEP}${CHECK_RISK/,/--}${SEP}${CHECK_REMEDIATION/,/--}${SEP}${CHECK_DOC/,/--}${SEP}${CHECK_CAF_EPIC/,/--}${SEP}${CHECK_RESOURCE_ID/,/--}${SEP}${PROWLER_START_TIME/,/--}${SEP}${ACCOUNT_DETAILS_EMAIL/,/--}${SEP}${ACCOUNT_DETAILS_NAME/,/--}${SEP}${ACCOUNT_DETAILS_ARN/,/--}${SEP}${ACCOUNT_DETAILS_ORG/,/--}${SEP}${ACCOUNT_DETAILS_TAGS/,/--}" >> ${OUTPUT_FILE_NAME}.$EXTENSION_CSV
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "json" ]]; then
|
|
generateJsonOutput "$1" "Info" "$CHECK_RESOURCE_ID" >> ${OUTPUT_FILE_NAME}.${EXTENSION_JSON}
|
|
fi
|
|
if is_junit_output_enabled; then
|
|
output_junit_info "$1"
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "mono" ]]; then
|
|
echo " $NOTICE INFO! $1 $NORMAL" >> ${OUTPUT_FILE_NAME}.$EXTENSION_TEXT
|
|
fi
|
|
# if [[ "${MODES[@]}" =~ "text" ]]; then
|
|
echo " $NOTICE INFO! $1 $NORMAL"
|
|
# fi
|
|
if [[ "${MODES[@]}" =~ "html" ]]; then
|
|
generateHtmlOutput "$1" "INFO" "$CHECK_RESOURCE_ID"
|
|
fi
|
|
}
|
|
|
|
textFail(){
|
|
## ignore allowlists for current check
|
|
level="FAIL"
|
|
colorcode="$BAD"
|
|
while read -r excluded_item; do
|
|
# ignore_check_name is the check with resources allowlisted
|
|
ignore_check_name=$(awk -F ":" '{print $1}' <<< "${excluded_item}")
|
|
# Resource value is what it comes after CHECK_NAME: :
|
|
resource_value=$(awk -F "$CHECK_NAME:" '{print $2}' <<< "${excluded_item}")
|
|
# Checked value is the whole log message that comes as argument
|
|
checked_value=$1
|
|
if [[ "${ignore_check_name}" != "${CHECK_NAME}" ]]; then
|
|
# not for this check
|
|
continue
|
|
fi
|
|
# To set WARNING flag checked_value have to include value of resource_value
|
|
# If it is treated as only expanse (*[]*) will not detect regex like [:alpha:]
|
|
if [[ "${checked_value}" =~ ${resource_value} ]]; then
|
|
level="WARNING"
|
|
colorcode="${WARNING}"
|
|
break
|
|
fi
|
|
done <<< "$IGNORES"
|
|
|
|
# only set non-0 exit code on FAIL mode, WARN is ok
|
|
if [[ "$level" == "FAIL" ]]; then
|
|
FAIL_COUNTER=$((FAIL_COUNTER+1))
|
|
if [ "$FAILED_CHECK_FAILED_SCAN" == 1 ] && [ -z "$FAILED_CHECK_FAILED_SCAN_LIST" ] ; then
|
|
EXITCODE=3
|
|
fi
|
|
if [[ "${FAILED_CHECK_FAILED_SCAN_LIST[@]}" =~ "$CHECK_NAME" ]]; then
|
|
EXITCODE=3
|
|
fi
|
|
fi
|
|
|
|
CHECK_RESULT=$level
|
|
CHECK_RESULT_EXTENDED="$1"
|
|
CHECK_RESOURCE_ID="$3"
|
|
|
|
if [[ $2 ]]; then
|
|
REPREGION=$2
|
|
else
|
|
REPREGION=$REGION
|
|
fi
|
|
|
|
if [[ "${MODES[@]}" =~ "csv" ]]; then
|
|
# Writing csv file replacing commas
|
|
echo "${PROFILE/,/--}${SEP}${ACCOUNT_NUM/,/--}${SEP}${REPREGION/,/--}${SEP}${TITLE_ID/,/--}${SEP}${CHECK_RESULT/,/--}${SEP}${ITEM_SCORED/,/--}${SEP}${ITEM_CIS_LEVEL/,/--}${SEP}${TITLE_TEXT/,/--}${SEP}${CHECK_RESULT_EXTENDED/,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE/,/--}${SEP}${CHECK_SEVERITY/,/--}${SEP}${CHECK_SERVICENAME/,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE/,/--}${SEP}${CHECK_ASFF_TYPE/,/--}${SEP}${CHECK_RISK/,/--}${SEP}${CHECK_REMEDIATION/,/--}${SEP}${CHECK_DOC/,/--}${SEP}${CHECK_CAF_EPIC/,/--}${SEP}${CHECK_RESOURCE_ID/,/--}${SEP}${PROWLER_START_TIME/,/--}${SEP}${ACCOUNT_DETAILS_EMAIL/,/--}${SEP}${ACCOUNT_DETAILS_NAME/,/--}${SEP}${ACCOUNT_DETAILS_ARN/,/--}${SEP}${ACCOUNT_DETAILS_ORG/,/--}${SEP}${ACCOUNT_DETAILS_TAGS/,/--}" >> ${OUTPUT_FILE_NAME}.$EXTENSION_CSV
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "json" ]]; then
|
|
generateJsonOutput "$1" "${level}" "$CHECK_RESOURCE_ID">> ${OUTPUT_FILE_NAME}.${EXTENSION_JSON}
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "json-asff" ]]; then
|
|
JSON_ASFF_OUTPUT=$(generateJsonAsffOutput "$1" "${level}" "$CHECK_RESOURCE_ID")
|
|
echo "${JSON_ASFF_OUTPUT}" >> ${OUTPUT_FILE_NAME}.${EXTENSION_ASFF}
|
|
if [[ "${SEND_TO_SECURITY_HUB}" -eq 1 ]]; then
|
|
sendToSecurityHub "${JSON_ASFF_OUTPUT}" "${REPREGION}"
|
|
fi
|
|
fi
|
|
if is_junit_output_enabled; then
|
|
if [[ "${level}" == "FAIL" ]]; then
|
|
output_junit_failure "$1"
|
|
elif [[ "${level}" == "WARNING" ]]; then
|
|
output_junit_skipped "$1"
|
|
fi
|
|
fi
|
|
if [[ "${MODES[@]}" =~ "mono" ]]; then
|
|
echo " $colorcode ${level}! $1 $NORMAL" >> ${OUTPUT_FILE_NAME}.$EXTENSION_TEXT
|
|
fi
|
|
# if [[ "${MODES[@]}" =~ "text" ]]; then
|
|
echo " $colorcode ${level}! $1 $NORMAL"
|
|
# fi
|
|
if [[ "${MODES[@]}" =~ "html" ]]; then
|
|
generateHtmlOutput "$1" "${level}" "$CHECK_RESOURCE_ID"
|
|
fi
|
|
}
|
|
|
|
textTitle(){
|
|
CHECKS_COUNTER=$((CHECKS_COUNTER+1))
|
|
TITLE_ID="$1"
|
|
if [[ $NUMERAL ]]; then
|
|
# Left-pad the check ID with zeros to simplify sorting, e.g. 1.1 -> 1.01
|
|
TITLE_ID=$(awk -F'.' '{ printf "%d.%02d", $1, $2 }' <<< "$TITLE_ID")
|
|
fi
|
|
|
|
TITLE_TEXT=$2
|
|
local CHECK_SERVICENAME="$MAGENTA$3$NORMAL"
|
|
local CHECK_SEVERITY="$BROWN[$4]$NORMAL"
|
|
|
|
case "$6" in
|
|
LEVEL1) ITEM_CIS_LEVEL="CIS Level 1";;
|
|
LEVEL2) ITEM_CIS_LEVEL="CIS Level 2";;
|
|
EXTRA) ITEM_CIS_LEVEL="Extra";;
|
|
SUPPORT) ITEM_CIS_LEVEL="Support";;
|
|
*) ITEM_CIS_LEVEL="Unspecified or Invalid";;
|
|
esac
|
|
|
|
local group_ids
|
|
# if [[ -n "$4" ]]; then
|
|
group_ids="$CYAN[$5]$NORMAL"
|
|
# fi
|
|
|
|
# if [[ "${MODES[@]}" =~ "csv" ]]; then
|
|
# >&2 echo "$TITLE_ID $TITLE_TEXT" >> ${OUTPUT_FILE_NAME}.${EXTENSION_CSV}
|
|
# elif [[ "${MODES[@]}" =~ "json" || "${MODES[@]}" =~ "json-asff" ]]; then
|
|
# :
|
|
# else
|
|
# # if [[ "$ITEM_SCORED" == "Scored" ]]; then
|
|
# echo -e "$TITLE_ID $CHECK_SERVICENAME $TITLE_TEXT $CHECK_SEVERITY $group_ids "
|
|
echo -e "$TITLE_ID $TITLE_TEXT - $CHECK_SERVICENAME $CHECK_SEVERITY"
|
|
# # else
|
|
# # echo -e "\n$PURPLE $TITLE_ID $TITLE_TEXT $6 $NORMAL $group_ids "
|
|
# # fi
|
|
# fi
|
|
}
|
|
|
|
generateJsonOutput(){
|
|
local message=$1
|
|
local status=$2
|
|
local resource_id=$3
|
|
jq -M -c \
|
|
--arg PROFILE "$PROFILE" \
|
|
--arg ACCOUNT_NUM "$ACCOUNT_NUM" \
|
|
--arg TITLE_TEXT "$TITLE_TEXT" \
|
|
--arg MESSAGE "$(echo -e "${message}" | sed -e 's/^[[:space:]]*//')" \
|
|
--arg STATUS "$status" \
|
|
--arg SEVERITY "$(echo $CHECK_SEVERITY | sed 's/[][]//g')" \
|
|
--arg SCORED "$ITEM_SCORED" \
|
|
--arg ITEM_CIS_LEVEL "$ITEM_CIS_LEVEL" \
|
|
--arg TITLE_ID "$TITLE_ID" \
|
|
--arg REPREGION "$REPREGION" \
|
|
--arg TYPE "$CHECK_ASFF_COMPLIANCE_TYPE" \
|
|
--arg TIMESTAMP "$(get_iso8601_timestamp)" \
|
|
--arg SERVICENAME "$CHECK_SERVICENAME" \
|
|
--arg CHECK_CAF_EPIC "$CHECK_CAF_EPIC" \
|
|
--arg CHECK_RISK "$CHECK_RISK" \
|
|
--arg CHECK_REMEDIATION "$CHECK_REMEDIATION" \
|
|
--arg CHECK_DOC "$CHECK_DOC" \
|
|
--arg CHECK_RESOURCE_ID "$resource_id" \
|
|
--arg ACCOUNT_DETAILS_EMAIL "$ACCOUNT_DETAILS_EMAIL" \
|
|
--arg ACCOUNT_DETAILS_NAME "$ACCOUNT_DETAILS_NAME" \
|
|
--arg ACCOUNT_DETAILS_ARN "$ACCOUNT_DETAILS_ARN" \
|
|
--arg ACCOUNT_DETAILS_ORG "$ACCOUNT_DETAILS_ORG" \
|
|
--arg ACCOUNT_DETAILS_TAGS "$ACCOUNT_DETAILS_TAGS" \
|
|
-n '{
|
|
"Profile": $PROFILE,
|
|
"Account Number": $ACCOUNT_NUM,
|
|
"Control": $TITLE_TEXT,
|
|
"Message": $MESSAGE,
|
|
"Severity": $SEVERITY,
|
|
"Status": $STATUS,
|
|
"Scored": $SCORED,
|
|
"Level": $ITEM_CIS_LEVEL,
|
|
"Control ID": $TITLE_ID,
|
|
"Region": $REPREGION,
|
|
"Timestamp": $TIMESTAMP,
|
|
"Compliance": $TYPE,
|
|
"Service": $SERVICENAME,
|
|
"CAF Epic": $CHECK_CAF_EPIC,
|
|
"Risk": $CHECK_RISK,
|
|
"Remediation": $CHECK_REMEDIATION,
|
|
"Doc link": $CHECK_DOC,
|
|
"Resource ID": $CHECK_RESOURCE_ID,
|
|
"Account Email": $ACCOUNT_DETAILS_EMAIL,
|
|
"Account Name": $ACCOUNT_DETAILS_NAME,
|
|
"Account ARN": $ACCOUNT_DETAILS_ARN,
|
|
"Account Organization": $ACCOUNT_DETAILS_ORG,
|
|
"Account tags": $ACCOUNT_DETAILS_TAGS
|
|
}'
|
|
}
|
|
|
|
generateJsonAsffOutput(){
|
|
# UNIQUE_ID must only contain characters from the unreserved characters set defined in section 2.3 of RFC-3986
|
|
# Replace any successive non-conforming characters with a single underscore
|
|
local message=$1
|
|
local status=$2
|
|
|
|
#Checks to determine if the rule passes in a resource name that prowler uses to track the AWS Resource for allowlisting purposes
|
|
if [[ -z $3 ]]; then
|
|
local resource_id="NONE_PROVIDED"
|
|
else
|
|
local resource_id=$3
|
|
fi
|
|
|
|
if [[ "$status" == "FAIL" ]]; then
|
|
status="FAILED"
|
|
fi
|
|
jq -M -c \
|
|
--arg ACCOUNT_NUM "$ACCOUNT_NUM" \
|
|
--arg TITLE_TEXT "$CHECK_SERVICENAME.$TITLE_TEXT" \
|
|
--arg MESSAGE "$(echo -e "${message}")" \
|
|
--arg UNIQUE_ID "$(LC_ALL=C echo -e -n "${message}" | tr -cs '[:alnum:]._~-' '_')" \
|
|
--arg STATUS "$status" \
|
|
--arg SEVERITY "$(echo $CHECK_SEVERITY| awk '{ print toupper($0) }' | sed 's/[][]//g')" \
|
|
--arg TITLE_ID "$TITLE_ID" \
|
|
--arg CHECK_ID "$CHECK_ID" \
|
|
--arg TYPE "$CHECK_ASFF_COMPLIANCE_TYPE" \
|
|
--arg COMPLIANCE_RELATED_REQUIREMENTS "$CHECK_ASFF_COMPLIANCE_TYPE" \
|
|
--arg RESOURCE_TYPE "$CHECK_ASFF_RESOURCE_TYPE" \
|
|
--arg REPREGION "$REPREGION" \
|
|
--arg TIMESTAMP "$(get_iso8601_timestamp)" \
|
|
--arg PROWLER_VERSION "$PROWLER_VERSION" \
|
|
--arg AWS_PARTITION "$AWS_PARTITION" \
|
|
--arg CHECK_RESOURCE_ID "$resource_id" \
|
|
-n '{
|
|
"SchemaVersion": "2018-10-08",
|
|
"Id": "prowler-\($TITLE_ID)-\($ACCOUNT_NUM)-\($REPREGION)-\($UNIQUE_ID)",
|
|
"ProductArn": "arn:\($AWS_PARTITION):securityhub:\($REPREGION)::product/prowler/prowler",
|
|
"RecordState": "ACTIVE",
|
|
"ProductFields": {
|
|
"ProviderName": "Prowler",
|
|
"ProviderVersion": $PROWLER_VERSION,
|
|
"ProwlerResourceName": $CHECK_RESOURCE_ID
|
|
},
|
|
"GeneratorId": "prowler-\($CHECK_ID)",
|
|
"AwsAccountId": $ACCOUNT_NUM,
|
|
"Types": [
|
|
$TYPE
|
|
],
|
|
"FirstObservedAt": $TIMESTAMP,
|
|
"UpdatedAt": $TIMESTAMP,
|
|
"CreatedAt": $TIMESTAMP,
|
|
"Severity": {
|
|
"Label": $SEVERITY
|
|
},
|
|
"Title": $TITLE_TEXT,
|
|
"Description": $MESSAGE,
|
|
"Resources": [
|
|
{
|
|
"Type": $RESOURCE_TYPE,
|
|
"Id": $CHECK_RESOURCE_ID,
|
|
"Partition": $AWS_PARTITION,
|
|
"Region": $REPREGION
|
|
}
|
|
],
|
|
"Compliance": {
|
|
"Status": $STATUS,
|
|
"RelatedRequirements": [ $COMPLIANCE_RELATED_REQUIREMENTS ]
|
|
}
|
|
|
|
}'
|
|
}
|
|
|
|
generateHtmlOutput(){
|
|
local message=$1
|
|
local status=$2
|
|
|
|
if [[ $status == "INFO" ]];then
|
|
local ROW_CLASS='table-info'
|
|
fi
|
|
if [[ $status == "PASS" ]];then
|
|
local ROW_CLASS='p-3 mb-2 bg-success-custom'
|
|
fi
|
|
if [[ $status == "FAIL" ]];then
|
|
local ROW_CLASS='table-danger'
|
|
fi
|
|
if [[ $status == "WARN" ]];then
|
|
local ROW_CLASS='table-warning'
|
|
fi
|
|
|
|
local CHECK_SEVERITY="$(echo $CHECK_SEVERITY | sed 's/[][]//g')"
|
|
|
|
echo '<tr class="'$ROW_CLASS'">' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$status'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$CHECK_SEVERITY'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$ACCOUNT_NUM'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$REPREGION'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$CHECK_ASFF_COMPLIANCE_TYPE'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$CHECK_SERVICENAME'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$TITLE_ID'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$TITLE_TEXT'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$message'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$ITEM_CIS_LEVEL'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$CHECK_CAF_EPIC'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td><p class="show-read-more">'$CHECK_RISK'</p></td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td><p class="show-read-more">'$CHECK_REMEDIATION'</p></td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td><a class="read-more" href="'$CHECK_DOC'"><i class="fas fa-external-link-alt"></i></a></td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo ' <td>'$CHECK_RESOURCE_ID'</td>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo '</tr>' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
echo '' >> ${OUTPUT_FILE_NAME}.$EXTENSION_HTML
|
|
} |