prowler/checks/check27

#!/usr/bin/env bash

# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy
# of the License at http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
# specific language governing permissions and limitations under the License.

CHECK_ID_check27="2.7"
CHECK_TITLE_check27="[check27] Ensure CloudTrail logs are encrypted at rest using KMS CMKs"
CHECK_SCORED_check27="SCORED"
CHECK_CIS_LEVEL_check27="LEVEL2"
CHECK_SEVERITY_check27="Medium"
CHECK_ASFF_TYPE_check27="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
CHECK_ASFF_RESOURCE_TYPE_check27="AwsCloudTrailTrail"
CHECK_ALTERNATE_check207="check27"
CHECK_ASFF_COMPLIANCE_TYPE_check27="ens-op.exp.10.aws.trail.5"
CHECK_SERVICENAME_check27="cloudtrail"
CHECK_RISK_check27='By default; the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable; you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.'
CHECK_REMEDIATION_check27='This approach has the following advantages: You can create and manage the CMK encryption keys yourself. You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions. You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users. You have enhanced security.'
CHECK_DOC_check27='https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html'
CHECK_CAF_EPIC_check27='Logging and Monitoring'

check27(){
  trail_count=0
  # "Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)"
  for regx in $REGIONS; do
    TRAILS_AND_REGIONS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].{Name:TrailARN, HomeRegion:HomeRegion}' --output text 2>&1 | tr "	" ',')
    if [[ $(echo "$TRAILS_AND_REGIONS" | grep AccessDenied) ]]; then
      textInfo "$regx: Access Denied trying to describe trails" "$regx" "$trail"
      continue
    fi
    if [[ $TRAILS_AND_REGIONS ]]; then
      for reg_trail in $TRAILS_AND_REGIONS; do
        TRAIL_REGION=$(echo $reg_trail | cut -d',' -f1)
        if [ $TRAIL_REGION != $regx ]; then # Only report trails once in home region
          continue
        fi
        trail=$(echo $reg_trail | cut -d',' -f2)
        trail_count=$((trail_count + 1))

        KMSKEYID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $TRAIL_REGION --query 'trailList[*].KmsKeyId' --output text --trail-name-list $trail)
        if [[ "$KMSKEYID" ]];then
          textPass "$regx: Trail $trail has encryption enabled" "$regx" "$trail"
        else
          textFail "$regx: Trail $trail has encryption disabled" "$regx" "$trail"
        fi
      done
    fi
  done
  if [[ $trail_count == 0 ]]; then
    textFail "$REGION: No CloudTrail trails were found in the account" "$REGION" "$trail"
  fi
}