mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 23:05:05 +00:00
4961498562
Added a third parameter to checks textFail and textPass to identify resource name in finding.
49 lines
2.8 KiB
Bash
49 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
||
|
||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||
#
|
||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||
# use this file except in compliance with the License. You may obtain a copy
|
||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||
#
|
||
# Unless required by applicable law or agreed to in writing, software distributed
|
||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||
# specific language governing permissions and limitations under the License.
|
||
CHECK_ID_extra743="7.43"
|
||
CHECK_TITLE_extra743="[extra743] Check if API Gateway has client certificate enabled to access your backend endpoint (Not Scored) (Not part of CIS benchmark)"
|
||
CHECK_SCORED_extra743="NOT_SCORED"
|
||
CHECK_TYPE_extra743="EXTRA"
|
||
CHECK_SEVERITY_extra743="Medium"
|
||
CHECK_ASFF_RESOURCE_TYPE_extra743="AwsApiGatewayRestApi"
|
||
CHECK_ALTERNATE_check743="extra743"
|
||
CHECK_SERVICENAME_extra743="apigateway"
|
||
CHECK_RISK_extra743='Possible man in the middle attacks and other similar risks.'
|
||
CHECK_REMEDIATION_extra743='Enable client certificate. Mutual TLS is recommended and commonly used for business-to-business (B2B) applications. It’s used in standards such as Open Banking. API Gateway now provides integrated mutual TLS authentication at no additional cost.'
|
||
CHECK_DOC_extra743='https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/'
|
||
CHECK_CAF_EPIC_extra743='Data Protection'
|
||
|
||
extra743(){
|
||
for regx in $REGIONS; do
|
||
LIST_OF_REST_APIS=$($AWSCLI $PROFILE_OPT --region $regx apigateway get-rest-apis --query 'items[*].id' --output text)
|
||
if [[ $LIST_OF_REST_APIS ]];then
|
||
for api in $LIST_OF_REST_APIS; do
|
||
API_GW_NAME=$($AWSCLI apigateway get-rest-apis $PROFILE_OPT --region $regx --query "items[?id==\`$api\`].name" --output text)
|
||
LIST_OF_STAGES=$($AWSCLI $PROFILE_OPT --region $regx apigateway get-stages --rest-api-id $api --query 'item[*].stageName' --output text)
|
||
if [[ $LIST_OF_STAGES ]]; then
|
||
for stage in $LIST_OF_STAGES; do
|
||
CHECK_CERTIFICATE=$($AWSCLI $PROFILE_OPT --region $regx apigateway get-stages --rest-api-id $api --query "item[?stageName==\`$stage\`].clientCertificateId" --output text)
|
||
if [[ $CHECK_CERTIFICATE ]]; then
|
||
textPass "$regx: API Gateway $API_GW_NAME ID $api in $stage has client certificate enabled" "$regx" "$API_GW_NAME"
|
||
else
|
||
textFail "$regx: API Gateway $API_GW_NAME ID $api in $stage has not client certificate enabled" "$regx" "$API_GW_NAME"
|
||
fi
|
||
done
|
||
fi
|
||
done
|
||
else
|
||
textInfo "$regx: No API Gateways found" "$regx"
|
||
fi
|
||
done
|
||
}
|