From c630c02a2671bcfaf7cfc782402a69d9aa866613 Mon Sep 17 00:00:00 2001 From: barnhartguy <31373662+barnhartguy@users.noreply.github.com> Date: Sun, 24 Nov 2019 14:37:09 +0200 Subject: [PATCH 1/8] Update check_extra768 fixed typo --- checks/check_extra768 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/checks/check_extra768 b/checks/check_extra768 index 66ea5a7bb2..2c10e1dde1 100644 --- a/checks/check_extra768 +++ b/checks/check_extra768 @@ -1,6 +1,6 @@ #!/usr/bin/env bash -``# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente +# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente # # Licensed under the Apache License, Version 2.0 (the "License"); you may not # use this file except in compliance with the License. You may obtain a copy @@ -52,4 +52,4 @@ extra768(){ fi done # rm -rf $SECRETS_TEMP_FOLDER -} \ No newline at end of file +} From 2e11e0a3f208f0dd76426cd2802b8850eff44c97 Mon Sep 17 00:00:00 2001 From: Will Thames Date: Mon, 25 Nov 2019 15:57:35 +1000 Subject: [PATCH 2/8] Fix extra764 check Add missing bracket to prevent: ``` jq: error: syntax error, unexpected INVALID_CHARACTER, expecting $end (Unix shell quoting issues?) at , line 1: .Statement[]|select(((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false") ``` (line breaks added to reduce commit width) --- checks/check_extra764 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check_extra764 b/checks/check_extra764 index 8ef4a80654..a479531e87 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -34,7 +34,7 @@ extra764(){ fi # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/ - CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}/*" '.Statement[]|select(((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")') + CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}/*" '.Statement[]|select((((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")') if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport" else From 25d1aa9126f1b1d7f29d1c82982402c4a20eed9f Mon Sep 17 00:00:00 2001 From: zfLQ2qx2 <31103058+zfLQ2qx2@users.noreply.github.com> Date: Tue, 26 Nov 2019 00:56:52 -0500 Subject: [PATCH 3/8] Make check3x more tolerant --- include/check3x | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/include/check3x b/include/check3x index 70bf9b910a..238853c68a 100644 --- a/include/check3x +++ b/include/check3x @@ -14,30 +14,35 @@ check3x(){ local CHECK_WARN local CHECK_CROSS_ACCOUNT_WARN - CLOUDWATCH_GROUP=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text| tr '\011' '\012' | awk -F: '{print $7}') + DESCRIBE_TRAILS_CACHE=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION") + CLOUDWATCH_GROUPS=$(echo $DESCRIBE_TRAILS_CACHE | jq -r '.trailList[]|@base64') CURRENT_ACCOUNT_ID=$($AWSCLI sts $PROFILE_OPT get-caller-identity --region "$REGION" --query Account --output text) - if [[ $CLOUDWATCH_GROUP ]];then - for group in $CLOUDWATCH_GROUP; do - CLOUDWATCH_LOGGROUP_REGION=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text | tr '\011' '\012' | grep "$group" | awk -F: '{ print $4 }' | head -n 1) - CLOUDWATCH_ACCOUNT_ID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text | tr '\011' '\012' | grep "$group" | awk -F: '{ print $5 }' | head -n 1) - if [ "$CLOUDWATCH_ACCOUNT_ID" == "$CURRENT_ACCOUNT_ID" ];then - METRICFILTER_SET=$($AWSCLI logs describe-metric-filters --log-group-name "$group" $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --output text | grep METRICFILTERS | grep -E "$grep_filter" | awk '{ print $3 }') + if [[ $CLOUDWATCH_GROUPS != "" ]]; then + for group_obj_enc in $CLOUDWATCH_GROUPS; do + group_obj_raw=$(echo $group_obj_enc | base64 --decode) + CLOUDWATCH_LOGGROUP_NAME=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[6]') + CLOUDWATCH_LOGGROUP_REGION=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[3]') + CLOUDWATCH_LOGGROUP_ACCOUNT=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[4]') + if [ "$CLOUDWATCH_LOGGROUP_ACCOUNT" == "$CURRENT_ACCOUNT_ID" ];then + # Filter control and whitespace from .metricFilters[*].filterPattern for easier matching later + METRICFILTER_CACHE=$($AWSCLI logs describe-metric-filters --log-group-name "$CLOUDWATCH_LOGGROUP_NAME" $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION"|jq '.metricFilters|=map(.filterPattern|=gsub("[[:space:]]+"; " "))') + METRICFILTER_SET=$(echo $METRICFILTER_CACHE | jq -r --arg re "$grep_filter" '.metricFilters[]|select(.filterPattern|test($re))|.filterName') fi if [[ $METRICFILTER_SET ]];then for metric in $METRICFILTER_SET; do - metric_name=$($AWSCLI logs describe-metric-filters $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --log-group-name "$group" --filter-name-prefix "$metric" --output text --query 'metricFilters[0].metricTransformations[0].metricName') + metric_name=$(echo $METRICFILTER_CACHE | jq -r --arg name $metric '.metricFilters[]|select(.filterName==$name)|.metricTransformations[0].metricName') HAS_ALARM_ASSOCIATED=$($AWSCLI cloudwatch describe-alarms $PROFILE_OPT --region "$CLOUDWATCH_LOGGROUP_REGION" --query 'MetricAlarms[?MetricName==`'"$metric_name"'`]' --output text) if [[ $HAS_ALARM_ASSOCIATED ]];then - CHECK_OK="$CHECK_OK $group:$metric" + CHECK_OK="$CHECK_OK $CLOUDWATCH_LOGGROUP_NAME:$metric" else - CHECK_WARN="$CHECK_WARN $group:$metric" + CHECK_WARN="$CHECK_WARN $CLOUDWATCH_LOGGROUP_NAME:$metric" fi done - elif [ "$CLOUDWATCH_ACCOUNT_ID" == "$CURRENT_ACCOUNT_ID" ];then - CHECK_WARN="$CHECK_WARN $group" + elif [ "$CLOUDWATCH_LOGGROUP_ACCOUNT" == "$CURRENT_ACCOUNT_ID" ];then + CHECK_WARN="$CHECK_WARN $CLOUDWATCH_LOGGROUP_NAME" else - CHECK_CROSS_ACCOUNT_WARN="$CHECK_CROSS_ACCOUNT_WARN $group" + CHECK_CROSS_ACCOUNT_WARN="$CHECK_CROSS_ACCOUNT_WARN $CLOUDWATCH_LOGGROUP_NAME" fi done From 3f68accf6f77944f1154b8e5f7fa17cb544e5552 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Tue, 26 Nov 2019 09:57:29 +0100 Subject: [PATCH 4/8] Added missing file iam/prowler-additions-policy.json --- iam/prowler-additions-policy.json | 106 ++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 iam/prowler-additions-policy.json diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json new file mode 100644 index 0000000000..c706b6f487 --- /dev/null +++ b/iam/prowler-additions-policy.json @@ -0,0 +1,106 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": [ + "apigateway:get*", + "apigatewayv2:get*", + "aws-marketplace:viewsubscriptions", + "batch:listjobs", + "clouddirectory:listappliedschemaarns", + "clouddirectory:listdevelopmentschemaarns", + "clouddirectory:listpublishedschemaarns", + "cloudformation:list*", + "cloudhsm:listavailablezones", + "cloudsearch:list*", + "cloudwatch:get*", + "cloudwatch:list*", + "codebuild:listbuilds*", + "codestar:verify*", + "cognito-identity:listidentities", + "cognito-idp:list*", + "cognito-sync:listdatasets", + "connect:list*", + "datapipeline:getaccountlimits", + "dax:describeclusters", + "dax:describedefaultparameters", + "dax:describeevents", + "dax:describeparametergroups", + "dax:describeparameters", + "dax:describesubnetgroups", + "dax:describetable", + "dax:listtables", + "devicefarm:list*", + "discovery:list*", + "dms:list*", + "dynamodb:describebackup", + "dynamodb:describeglobaltablesettings", + "dynamodb:describelimits", + "dynamodb:describereservedcapacity", + "dynamodb:describereservedcapacityofferings", + "dynamodb:describestream", + "dynamodb:listtagsofresource", + "ec2:get*", + "ecr:describe*", + "ecr:listimages", + "elasticbeanstalk:listavailablesolutionstacks", + "elasticmapreduce:list*", + "elastictranscoder:list*", + "gamelift:list*", + "glacier:list*", + "importexport:listjobs", + "lex:getbotaliases", + "lex:getbotchannelassociations", + "lex:getbots", + "lex:getbotversions", + "lex:getintents", + "lex:getintentversions", + "lex:getslottypes", + "lex:getslottypeversions", + "lex:getutterancesview", + "lightsail:getblueprints", + "lightsail:getbundles", + "lightsail:getinstancesnapshots", + "lightsail:getkeypair", + "lightsail:getregions", + "lightsail:getstaticips", + "lightsail:isvpcpeered", + "machinelearning:describe*", + "mobilehub:listavailablefeatures", + "mobilehub:listavailableregions", + "mobilehub:listprojects", + "mobiletargeting:getapplicationsettings", + "mobiletargeting:getcampaigns", + "mobiletargeting:getimportjobs", + "mobiletargeting:getsegments", + "opsworks-cm:describe*", + "opsworks:describe*", + "polly:describe*", + "polly:list*", + "redshift:viewqueriesinconsole", + "route53domains:list*", + "s3:listbucket", + "sdb:list*", + "secretsmanager:listsecretversionids", + "servicecatalog:list*", + "ses:list*", + "ses:sendemail", + "sns:list*", + "sqs:listqueuetags", + "ssm:listassociations", + "states:listactivities", + "support:describe*", + "swf:list*", + "tag:gettagkeys", + "trustedadvisor:describe*", + "waf-regional:list*", + "waf:list*", + "workdocs:describeavailabledirectories", + "workdocs:describeinstances", + "workmail:describe*" + ], + "Effect": "Allow", + "Resource": "*" + } + ] +} \ No newline at end of file From 4af3dc1254b4fee60ed9d42ce0f65ddf6be3d63c Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Mon, 2 Dec 2019 15:26:48 +0100 Subject: [PATCH 5/8] Fix issue #426 updated base64 function --- include/check3x | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/check3x b/include/check3x index 238853c68a..6809ed9ed6 100644 --- a/include/check3x +++ b/include/check3x @@ -20,7 +20,7 @@ check3x(){ if [[ $CLOUDWATCH_GROUPS != "" ]]; then for group_obj_enc in $CLOUDWATCH_GROUPS; do - group_obj_raw=$(echo $group_obj_enc | base64 --decode) + group_obj_raw=$(echo $group_obj_enc | decode_report) CLOUDWATCH_LOGGROUP_NAME=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[6]') CLOUDWATCH_LOGGROUP_REGION=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[3]') CLOUDWATCH_LOGGROUP_ACCOUNT=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[4]') From fe65eaf3730296ea01e4a372028b4908abcb63f6 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Tue, 3 Dec 2019 15:27:09 +0100 Subject: [PATCH 6/8] New check ECS scan on push issue #427 --- checks/check_extra766 | 46 +++++++++++++++++++++++++++++++++++++++++++ groups/group7_extras | 2 +- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 checks/check_extra766 diff --git a/checks/check_extra766 b/checks/check_extra766 new file mode 100644 index 0000000000..2382f4ace8 --- /dev/null +++ b/checks/check_extra766 @@ -0,0 +1,46 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. + +# Remediation: +# +# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#configuring-instance-metadata-service +# +# aws ecr put-image-scanning-configuration \ +# --region \ +# --repository-name \ +# --image-scanning-configuration scanOnPush=true + + +CHECK_ID_extra766="7.66" +CHECK_TITLE_extra766="[extra766] Check if ECR image scan on push is enabled (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra766="NOT_SCORED" +CHECK_TYPE_extra766="EXTRA" +CHECK_ALTERNATE_check766="extra766" + +extra766(){ + for regx in $REGIONS; do + LIST_ECR_REPOS=$($AWSCLI ecr describe-repositories $PROFILE_OPT --region $regx --query "repositories[*].[repositoryName]" --output text 2>&1) + if [[ $LIST_ECR_REPOS ]]; then + for repo in $LIST_ECR_REPOS; do + SCAN_ENABLED=$($AWSCLI ecr describe-repositories $PROFILE_OPT --region $regx --query "repositories[?repositoryName==\`$repo\`].[imageScanningConfiguration.scanOnPush]" --output text|grep True) + if [[ $SCAN_ENABLED ]];then + textPass "$regx: ECR repository $repo has scan on push enabled" "$regx" + else + textFail "$regx: ECR repository $repo has scan on push disabled!" "$regx" + fi + done + else + textInfo "$regx: No ECR repositories found" "$regx" + fi + done +} diff --git a/groups/group7_extras b/groups/group7_extras index c3d80d3487..482e1a88bd 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,7 +15,7 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra766,extra767,extra768' # Extras 759 and 760 (lambda variables and code secrets finder are not included) # to run detect-secrets use `./prowler -g secrets` From 7b5ece80074573bb6fcfe2558ad479af4bab882c Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Tue, 3 Dec 2019 15:58:19 +0100 Subject: [PATCH 7/8] New check IAM Access Analyzer issue #428 --- checks/check_extra769 | 35 +++++++++++++++++++++++++++++++++++ groups/group7_extras | 2 +- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 checks/check_extra769 diff --git a/checks/check_extra769 b/checks/check_extra769 new file mode 100644 index 0000000000..8ec529e23a --- /dev/null +++ b/checks/check_extra769 @@ -0,0 +1,35 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra769="7.69" +CHECK_TITLE_extra769="[extra769] Check if IAM Access Analyzer is enabled and its findings (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra769="NOT_SCORED" +CHECK_TYPE_extra769="EXTRA" +CHECK_ALTERNATE_check769="extra769" + +extra769(){ + for regx in $REGIONS; do + LIST_OF_ACCESS_ANALYZERS=$($AWSCLI accessanalyzer list-analyzers $PROFILE_OPT --region $regx --query analyzers[*].arn --output text) + if [[ $LIST_OF_ACCESS_ANALYZERS ]]; then + for accessAnalyzerArn in $LIST_OF_ACCESS_ANALYZERS;do + ANALYZER_ACTIVE_FINDINGS_COUNT=$($AWSCLI accessanalyzer list-findings $PROFILE_OPT --region $regx --analyzer-arn $accessAnalyzerArn --query 'findings[?status == `ACTIVE`].[id,status]' --output text | wc -l | tr -d ' ') + if [[ $ANALYZER_ACTIVE_FINDINGS_COUNT -eq 0 ]];then + textPass "$regx: IAM Access Analyzer $accessAnalyzerArn has no active findings" "$regx" + else + textInfo "$regx: IAM Access Analyzer $accessAnalyzerArn has $ANALYZER_ACTIVE_FINDINGS_COUNT active findings" "$regx" + fi + done + else + textInfo "$regx: No IAM Access Analyzers found" "$regx" + fi + done +} diff --git a/groups/group7_extras b/groups/group7_extras index 482e1a88bd..c9eaa5ad63 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,7 +15,7 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra766,extra767,extra768' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra766,extra767,extra768,extra769' # Extras 759 and 760 (lambda variables and code secrets finder are not included) # to run detect-secrets use `./prowler -g secrets` From b6e34adc248eac668be6a0b6273d550aca1cc997 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Thu, 5 Dec 2019 12:52:19 +0100 Subject: [PATCH 8/8] Fix issue #409 --- include/check3x | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/include/check3x b/include/check3x index 6809ed9ed6..5b75d3151a 100644 --- a/include/check3x +++ b/include/check3x @@ -15,11 +15,12 @@ check3x(){ local CHECK_CROSS_ACCOUNT_WARN DESCRIBE_TRAILS_CACHE=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION") - CLOUDWATCH_GROUPS=$(echo $DESCRIBE_TRAILS_CACHE | jq -r '.trailList[]|@base64') + TRAIL_LIST=$(echo $DESCRIBE_TRAILS_CACHE | jq -r '.trailList[]|@base64') CURRENT_ACCOUNT_ID=$($AWSCLI sts $PROFILE_OPT get-caller-identity --region "$REGION" --query Account --output text) + CLOUDWATCH_LOGGROUP=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].CloudWatchLogsLogGroupArn' --output text| tr '\011' '\012' | awk -F: '{print $7}') - if [[ $CLOUDWATCH_GROUPS != "" ]]; then - for group_obj_enc in $CLOUDWATCH_GROUPS; do + if [[ $CLOUDWATCH_LOGGROUP != "" ]]; then + for group_obj_enc in $TRAIL_LIST; do group_obj_raw=$(echo $group_obj_enc | decode_report) CLOUDWATCH_LOGGROUP_NAME=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[6]') CLOUDWATCH_LOGGROUP_REGION=$(echo $group_obj_raw | jq -r '.CloudWatchLogsLogGroupArn|split(":")[3]')