mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-11 15:25:10 +00:00
57 lines
3.0 KiB
Bash
57 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
||
|
||
# Prowler - the handy cloud security tool (c) by Toni de la Fuente
|
||
#
|
||
# This Prowler check is licensed under a
|
||
# Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
|
||
#
|
||
# You should have received a copy of the license along with this
|
||
# work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
|
||
|
||
CHECK_ID_check27="2.7"
|
||
CHECK_TITLE_check27="[check27] Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)"
|
||
CHECK_SCORED_check27="SCORED"
|
||
CHECK_TYPE_check27="LEVEL2"
|
||
CHECK_SEVERITY_check27="Medium"
|
||
CHECK_ASFF_TYPE_check27="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||
CHECK_ASFF_RESOURCE_TYPE_check27="AwsCloudTrailTrail"
|
||
CHECK_ALTERNATE_check207="check27"
|
||
CHECK_ASFF_COMPLIANCE_TYPE_check27="ens-op.exp.10.aws.trail.5"
|
||
CHECK_SERVICENAME_check27="cloudtrail"
|
||
CHECK_RISK_check27='By default; the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable; you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.'
|
||
CHECK_REMEDIATION_check27='This approach has the following advantages: You can create and manage the CMK encryption keys yourself. You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions. You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users. You have enhanced security.'
|
||
CHECK_DOC_check27='https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html'
|
||
CHECK_CAF_EPIC_check27='Logging and Monitoring'
|
||
|
||
check27(){
|
||
trail_count=0
|
||
# "Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)"
|
||
for regx in $REGIONS; do
|
||
TRAILS_AND_REGIONS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].{Name:TrailARN, HomeRegion:HomeRegion}' --output text 2>&1 | tr " " ',')
|
||
if [[ $(echo "$TRAILS_AND_REGIONS" | grep AccessDenied) ]]; then
|
||
textFail "Access Denied trying to describe trails in $regx"
|
||
continue
|
||
fi
|
||
if [[ $TRAILS_AND_REGIONS ]]; then
|
||
for reg_trail in $TRAILS_AND_REGIONS; do
|
||
TRAIL_REGION=$(echo $reg_trail | cut -d',' -f1)
|
||
if [ $TRAIL_REGION != $regx ]; then # Only report trails once in home region
|
||
continue
|
||
fi
|
||
trail=$(echo $reg_trail | cut -d',' -f2)
|
||
trail_count=$((trail_count + 1))
|
||
|
||
KMSKEYID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $TRAIL_REGION --query 'trailList[*].KmsKeyId' --output text --trail-name-list $trail)
|
||
if [[ "$KMSKEYID" ]];then
|
||
textPass "Trail $trail in $regx has encryption enabled"
|
||
else
|
||
textFail "Trail $trail in $regx has encryption disabled"
|
||
fi
|
||
done
|
||
fi
|
||
done
|
||
if [[ $trail_count == 0 ]]; then
|
||
textFail "No CloudTrail trails were found in the account"
|
||
fi
|
||
}
|