From 2af565ead1098165341104e44e8ac2aa84894ad2 Mon Sep 17 00:00:00 2001
From: Chinedu Obiakara <obiakac@amazon.com>
Date: Fri, 19 Nov 2021 13:31:14 -0600
Subject: [PATCH] changed check title, resource type and service name as well
 as making the code more dynamic

---
 checks/check_extra7162 | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/checks/check_extra7162 b/checks/check_extra7162
index 21c3443062..f0f51199f0 100644
--- a/checks/check_extra7162
+++ b/checks/check_extra7162
@@ -11,28 +11,29 @@
 # CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 CHECK_ID_extra7162="7.162"
-CHECK_TITLE_extra7162="[extra7162] Check if Log Groups have a retention policy of 365 days"
+CHECK_TITLE_extra7162="[extra7162] Check if CloudWatch Log Groups have a retention policy of 365 days"
 CHECK_SCORED_extra7162="NOT_SCORED"
 CHECK_CIS_LEVEL_extra7162="EXTRA"
 CHECK_SEVERITY_extra7162="Medium"
-CHECK_ASFF_RESOURCE_TYPE_extra7162="AwsCloudWatchLogs"
+CHECK_ASFF_RESOURCE_TYPE_extra7162="AwsLogsLogGroup"
 CHECK_ALTERNATE_check7162="extra7162"
-CHECK_SERVICENAME_extra7162="logs"
+CHECK_SERVICENAME_extra7162="cloudwatch"
 CHECK_RISK_extra7162='If log groups have a low retention policy of less than 365 days, crucial logs and data can be lost'
 CHECK_REMEDIATION_extra7162='Add Log Retention policy of 365 days to log groups. This will persist logs and traces for a long time.'
 CHECK_DOC_extra7162='https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Logs.html'
 CHECK_CAF_EPIC_extra7162='Data Retention'
 
 extra7162() {
-    # "Check if Log Groups have retention Policy of 356 days"
+    # "Check if CloudWatch Log Groups have a retention policy of 365 days"
+    declare -i LOG_GROUP_RETENTION_PERIOD_DAYS=365
     for regx in $REGIONS; do
-        LIST_OF_365_RETENTION_LOG_GROUPS=$($AWSCLI logs describe-log-groups $PROFILE_OPT --region $regx --query 'logGroups[?retentionInDays==`365`].[logGroupName]' --output text)
+        LIST_OF_365_RETENTION_LOG_GROUPS=$($AWSCLI logs describe-log-groups $PROFILE_OPT --region $regx --query 'logGroups[?retentionInDays=="${LOG_GROUP_RETENTION_PERIOD_DAYS}"].[logGroupName]' --output text)
         if [[ $LIST_OF_365_RETENTION_LOG_GROUPS ]]; then
             for log in $LIST_OF_365_RETENTION_LOG_GROUPS; do
                 textPass "$regx: $log Log Group has 365 days retention period!" "$regx" "$log"
             done
         fi
-        LIST_OF_NON_365_RETENTION_LOG_GROUPS=$($AWSCLI logs describe-log-groups $PROFILE_OPT --region $regx --query 'logGroups[?retentionInDays!=`365`].[logGroupName]' --output text)
+        LIST_OF_NON_365_RETENTION_LOG_GROUPS=$($AWSCLI logs describe-log-groups $PROFILE_OPT --region $regx --query 'logGroups[?retentionInDays!="${LOG_GROUP_RETENTION_PERIOD_DAYS}"].[logGroupName]' --output text)
         if [[ $LIST_OF_NON_365_RETENTION_LOG_GROUPS ]]; then
             for log in $LIST_OF_NON_365_RETENTION_LOG_GROUPS; do
                 textFail "$regx: $log Log Group does not have 365 days retention period!" "$regx" "$log"