From 65cf527d5a06b4424ccc915364fddbe20f1feda1 Mon Sep 17 00:00:00 2001
From: Daniel Peladeau <dcpeladeau@gmail.com>
Date: Sun, 21 Nov 2021 16:36:49 -0500
Subject: [PATCH 1/2] New check_extra7163 Secrets Manager key rotation enabled

---
 checks/check_extra7163 | 57 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 checks/check_extra7163

diff --git a/checks/check_extra7163 b/checks/check_extra7163
new file mode 100644
index 0000000000..a85f2a854c
--- /dev/null
+++ b/checks/check_extra7163
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+# Remediation:
+#
+#   https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/rotate-secret.html
+#
+#   rotate-secret
+#       --secret-id <value>
+#       [--client-request-token <value>]
+#       [--rotation-lambda-arn <value>]
+#       [--rotation-rules <value>]
+#       [--cli-input-json <value>]
+#       [--generate-cli-skeleton <value>]
+
+
+CHECK_ID_extra7163="7.163"
+CHECK_TITLE_extra7163="[extra7163] Check if Secrets Manager key rotation enabled"
+CHECK_SCORED_extra7163="NOT_SCORED"
+CHECK_TYPE_extra7163="EXTRA"
+CHECK_SEVERITY_extra7163="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7163="AwsSecretsManagerSecret"
+CHECK_ALTERNATE_extra7163="extra7163"
+CHECK_SERVICENAME_extra7163="secretsmanager"
+CHECK_RISK_extra7163="Rotating secrets minimizes exposure to attacks using stolen keys."
+CHECK_REMEDITATION_extra7163="Enable key rotation on Secrets Manager key."
+CHECK_DOC_extra7163="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html"
+CHECK_CAF_EPIC_extra7163="Data Protection"
+
+extra7163(){
+    # "Check if Secrets Manager key rotation enabled"
+    for regx in $REGIONS; do
+      LIST_OF_SECRETS=$($AWSCLI secretsmanager list-secrets $PROFILE_OPT --region $regx --query 'SecretList[*].Name' --output text)
+      if [[ $LIST_OF_SECRETS ]]; then
+        for secret in $LIST_OF_SECRETS; do
+          KEY_ROTATION_ENABLED=$($AWSCLI secretsmanager describe-secret $PROFILE_OPT --region $regx --secret-id $secret | jq '.RotationEnabled')
+          if [[ $KEY_ROTATION_ENABLED == true ]]; then
+            textPass "$regx: $secret has key rotation enabled." "$regx" "$secret"
+          else
+            textFail "$regx: $secret does not have key rotation enabled." "$regx" "$secret"
+          fi
+        done
+      else
+        textPass "$regx: No SecretsManager secrets found." "$regx"
+      fi
+    done
+}

From a101352219df8996127c961ca444a96dda314824 Mon Sep 17 00:00:00 2001
From: Daniel Peladeau <dcpeladeau@gmail.com>
Date: Tue, 23 Nov 2021 22:29:12 -0500
Subject: [PATCH 2/2] Updating check_extra7163 with requested changes

---
 checks/check_extra7163 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/checks/check_extra7163 b/checks/check_extra7163
index a85f2a854c..60bf8750a0 100644
--- a/checks/check_extra7163
+++ b/checks/check_extra7163
@@ -25,7 +25,7 @@
 
 
 CHECK_ID_extra7163="7.163"
-CHECK_TITLE_extra7163="[extra7163] Check if Secrets Manager key rotation enabled"
+CHECK_TITLE_extra7163="[extra7163] Check if Secrets Manager key rotation is enabled"
 CHECK_SCORED_extra7163="NOT_SCORED"
 CHECK_TYPE_extra7163="EXTRA"
 CHECK_SEVERITY_extra7163="Medium"
@@ -38,12 +38,12 @@ CHECK_DOC_extra7163="https://docs.aws.amazon.com/secretsmanager/latest/userguide
 CHECK_CAF_EPIC_extra7163="Data Protection"
 
 extra7163(){
-    # "Check if Secrets Manager key rotation enabled"
+    # "Check if Secrets Manager key rotation is enabled"
     for regx in $REGIONS; do
       LIST_OF_SECRETS=$($AWSCLI secretsmanager list-secrets $PROFILE_OPT --region $regx --query 'SecretList[*].Name' --output text)
       if [[ $LIST_OF_SECRETS ]]; then
         for secret in $LIST_OF_SECRETS; do
-          KEY_ROTATION_ENABLED=$($AWSCLI secretsmanager describe-secret $PROFILE_OPT --region $regx --secret-id $secret | jq '.RotationEnabled')
+          KEY_ROTATION_ENABLED=$($AWSCLI secretsmanager describe-secret $PROFILE_OPT --region $regx --secret-id $secret --output json | jq '.RotationEnabled')
           if [[ $KEY_ROTATION_ENABLED == true ]]; then
             textPass "$regx: $secret has key rotation enabled." "$regx" "$secret"
           else
@@ -51,7 +51,7 @@ extra7163(){
           fi
         done
       else
-        textPass "$regx: No SecretsManager secrets found." "$regx"
+        textPass "$regx: No Secrets Manager secrets found." "$regx"
       fi
     done
 }