prowler/providers/aws/services/cloudtrail/cloudtrail_service.py

import datetime
import threading
from dataclasses import dataclass

from lib.logger import logger
from providers.aws.aws_provider import (
    generate_regional_clients,
    get_region_global_service,
)


################### CLOUDTRAIL
class Cloudtrail:
    def __init__(self, audit_info):
        self.service = "cloudtrail"
        self.session = audit_info.audit_session
        self.audited_account = audit_info.audited_account
        self.region = get_region_global_service(audit_info)
        self.regional_clients = generate_regional_clients(self.service, audit_info)
        self.trails = []
        self.__threading_call__(self.__get_trails__)
        self.__get_trail_status__()
        self.__get_event_selectors__()

    def __get_session__(self):
        return self.session

    def __threading_call__(self, call):
        threads = []
        for regional_client in self.regional_clients.values():
            threads.append(threading.Thread(target=call, args=(regional_client,)))
        for t in threads:
            t.start()
        for t in threads:
            t.join()

    def __get_trails__(self, regional_client):
        logger.info("Cloudtrail - Getting trails...")
        try:
            describe_trails = regional_client.describe_trails()["trailList"]
            if describe_trails:
                for trail in describe_trails:
                    kms_key_id = None
                    log_group_arn = None
                    if "KmsKeyId" in trail:
                        kms_key_id = trail["KmsKeyId"]
                    if "CloudWatchLogsLogGroupArn" in trail:
                        log_group_arn = trail["CloudWatchLogsLogGroupArn"]
                    self.trails.append(
                        Trail(
                            name=trail["Name"],
                            is_multiregion=trail["IsMultiRegionTrail"],
                            home_region=trail["HomeRegion"],
                            arn=trail["TrailARN"],
                            region=regional_client.region,
                            is_logging=False,
                            log_file_validation_enabled=trail[
                                "LogFileValidationEnabled"
                            ],
                            latest_cloudwatch_delivery_time=None,
                            s3_bucket=trail["S3BucketName"],
                            kms_key=kms_key_id,
                            log_group_arn=log_group_arn,
                            data_events=[],
                        )
                    )
            else:
                self.trails.append(
                    Trail(
                        name=None,
                        is_multiregion=None,
                        home_region=None,
                        arn=None,
                        region=regional_client.region,
                        is_logging=None,
                        log_file_validation_enabled=None,
                        latest_cloudwatch_delivery_time=None,
                        s3_bucket=None,
                        kms_key=None,
                        log_group_arn=None,
                        data_events=[],
                    )
                )

        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
            )

    def __get_trail_status__(self):
        logger.info("Cloudtrail - Getting trail status")
        try:
            for trail in self.trails:
                for region, client in self.regional_clients.items():
                    if trail.region == region and trail.name:
                        status = client.get_trail_status(Name=trail.arn)
                        trail.is_logging = status["IsLogging"]
                        if "LatestCloudWatchLogsDeliveryTime" in status:
                            trail.latest_cloudwatch_delivery_time = status[
                                "LatestCloudWatchLogsDeliveryTime"
                            ]

        except Exception as error:
            logger.error(
                f"{client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
            )

    def __get_event_selectors__(self):
        logger.info("Cloudtrail - Getting event selector")
        try:
            for trail in self.trails:
                for region, client in self.regional_clients.items():
                    if trail.region == region and trail.name:
                        data_events = client.get_event_selectors(TrailName=trail.arn)
                        if "EventSelectors" in data_events:
                            for event in data_events["EventSelectors"]:
                                trail.data_events.append(event)
        except Exception as error:
            logger.error(
                f"{client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
            )


@dataclass
class Trail:
    name: str
    is_multiregion: bool
    home_region: str
    arn: str
    region: str
    is_logging: bool
    log_file_validation_enabled: bool
    latest_cloudwatch_delivery_time: datetime
    s3_bucket: str
    kms_key: str
    log_group_arn: str
    data_events: list

    def __init__(
        self,
        name,
        is_multiregion,
        home_region,
        arn,
        region,
        is_logging,
        log_file_validation_enabled,
        latest_cloudwatch_delivery_time,
        s3_bucket,
        kms_key,
        log_group_arn,
        data_events,
    ):
        self.name = name
        self.is_multiregion = is_multiregion
        self.home_region = home_region
        self.arn = arn
        self.region = region
        self.is_logging = is_logging
        self.log_file_validation_enabled = log_file_validation_enabled
        self.latest_cloudwatch_delivery_time = latest_cloudwatch_delivery_time
        self.s3_bucket = s3_bucket
        self.kms_key = kms_key
        self.log_group_arn = log_group_arn
        self.data_events = data_events