mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
55 lines
3.2 KiB
Bash
55 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
CHECK_ID_check119="1.19"
|
|
CHECK_TITLE_check119="[check119] Ensure IAM instance roles are used for AWS resource access from instances"
|
|
CHECK_SCORED_check119="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_check119="LEVEL2"
|
|
CHECK_SEVERITY_check119="Medium"
|
|
CHECK_ASFF_TYPE_check119="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
|
CHECK_ASFF_RESOURCE_TYPE_check119="AwsEc2Instance"
|
|
CHECK_ALTERNATE_check119="check119"
|
|
CHECK_SERVICENAME_check119="ec2"
|
|
CHECK_RISK_check119='AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. If credentials are compromised; they can be used from outside of the AWS account.'
|
|
CHECK_REMEDIATION_check119='IAM roles can only be associated at the launch of an instance. To remediate an instance to add it to a role you must create or re-launch a new instance. (Check for external dependencies on its current private ip or public addresses).'
|
|
CHECK_DOC_check119='http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html'
|
|
CHECK_CAF_EPIC_check119='IAM'
|
|
|
|
check119(){
|
|
for regx in $REGIONS; do
|
|
EC2_DATA=$($AWSCLI ec2 describe-instances $PROFILE_OPT --region $regx --query 'Reservations[].Instances[].[InstanceId, IamInstanceProfile.Arn, State.Name]' --output json 2>&1)
|
|
if [[ $(echo "$EC2_DATA" | grep UnauthorizedOperation) ]]; then
|
|
textInfo "$regx: Unauthorized Operation error trying to describe instances" "$regx"
|
|
continue
|
|
else
|
|
EC2_DATA=$(echo $EC2_DATA | jq '.[]|{InstanceId: .[0], ProfileArn: .[1], StateName: .[2]}')
|
|
INSTANCE_LIST=$(echo $EC2_DATA | jq -r '.InstanceId')
|
|
fi
|
|
if [[ $INSTANCE_LIST ]]; then
|
|
for instance in $INSTANCE_LIST; do
|
|
STATE_NAME=$(echo $EC2_DATA | jq -r --arg i "$instance" 'select(.InstanceId==$i)|.StateName')
|
|
if [[ $STATE_NAME != "terminated" && $STATE_NAME != "shutting-down" ]]; then
|
|
PROFILEARN=$(echo $EC2_DATA | jq -r --arg i "$instance" 'select(.InstanceId==$i)|.ProfileArn')
|
|
if [[ $PROFILEARN == "null" ]]; then
|
|
textFail "$regx: Instance $instance not associated with an instance role" "$regx" "$instance"
|
|
else
|
|
textPass "$regx: Instance $instance associated with role ${PROFILEARN##*/}" "$regx" "$instance"
|
|
fi
|
|
fi
|
|
done
|
|
else
|
|
textInfo "$regx: No EC2 instances found" "$regx" "$instance"
|
|
fi
|
|
done
|
|
}
|