mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 23:05:05 +00:00
55 lines
3.0 KiB
Bash
55 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
CHECK_ID_extra796="7.96"
|
|
CHECK_TITLE_extra796="[extra796] Restrict Access to the EKS Control Plane Endpoint"
|
|
CHECK_SCORED_extra796="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_extra796="EXTRA"
|
|
CHECK_SEVERITY_extra796="High"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra796="AwsEksCluster"
|
|
CHECK_ALTERNATE_check796="extra796"
|
|
CHECK_SERVICENAME_extra796="eks"
|
|
CHECK_RISK_extra796='By default; this API server endpoint is public to the internet; and access to the API server is secured using a combination of AWS Identity and Access Management (IAM) and native Kubernetes Role Based Access Control (RBAC).'
|
|
CHECK_REMEDIATION_extra796='You should enable private access to the Kubernetes API server so that all communication between your nodes and the API server stays within your VPC. You can limit the IP addresses that can access your API server from the internet; or completely disable internet access to the API server.'
|
|
CHECK_DOC_extra796='https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html'
|
|
CHECK_CAF_EPIC_extra796='Infrastructure Security'
|
|
|
|
extra796(){
|
|
for regx in $REGIONS; do
|
|
CLUSTERS=$($AWSCLI eks list-clusters $PROFILE_OPT --region $regx --query 'clusters[]' --output text 2>&1)
|
|
if [[ $(echo "$CLUSTERS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "$regx: Access Denied trying to list EKS clusters" "$regx"
|
|
continue
|
|
fi
|
|
if [[ $CLUSTERS ]]; then
|
|
for CLUSTER in $CLUSTERS;do
|
|
CLUSTERDEF=$($AWSCLI eks describe-cluster $PROFILE_OPT --region $regx --name $CLUSTER --query 'cluster.resourcesVpcConfig')
|
|
PUB_ENABLED=$(echo $CLUSTERDEF | jq -r '.endpointPublicAccess')
|
|
PRIV_ENABLED=$(echo $CLUSTERDEF | jq -r '.endpointPrivateAccess')
|
|
PUB_ACCESS_CIDRS=$(echo $CLUSTERDEF | jq -r '.publicAccessCidrs')
|
|
|
|
if [[ $PUB_ENABLED == "false" ]] && [[ $PRIV_ENABLED == "true" ]] ; then
|
|
textPass "$regx: Cluster endpoint access is private for EKS cluster $CLUSTER" "$regx"
|
|
else
|
|
if [[ $(echo $PUB_ACCESS_CIDRS | grep "0.0.0.0/0") ]] ; then
|
|
textFail "$regx: Cluster control plane access is not restricted for EKS cluster $CLUSTER" "$regx" "$CLUSTER"
|
|
else
|
|
textPass "$regx: Cluster control plane access is restricted for EKS cluster $CLUSTER" "$regx" "$CLUSTER"
|
|
fi
|
|
fi
|
|
done
|
|
else
|
|
textInfo "$regx: No EKS clusters found" "$regx"
|
|
fi
|
|
done
|
|
}
|