ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 12:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(session_duration): Use jq with TZ=UTC (#1195)

Browse Source
This commit is contained in:
Pepe Fagoaga
2022-06-15 13:25:43 +02:00
committed by GitHub
parent d85d0f5877
commit 3944ea2055
3 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/assume_role
+7 -7
View File
@@ -18,7 +18,7 @@ assume_role(){
# If profile is not defined, restore original credentials from environment variables, if they exists!
restoreInitialAWSCredentials
fi
# Both variables are mandatory to be set together
if [[ -z $ROLE_TO_ASSUME || -z $ACCOUNT_TO_ASSUME ]]; then
echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
@@ -62,12 +62,12 @@ assume_role(){
EXITCODE=1
exit $EXITCODE
fi
# echo FILE WITH TEMP CREDS: $TEMP_STS_ASSUMED_FILE
# The profile shouldn't be used for CLI
PROFILE=""
PROFILE_OPT=""
PROFILE_OPT=""
# Set AWS environment variables with assumed role credentials
ASSUME_AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "${TEMP_STS_ASSUMED_FILE}")
@@ -76,7 +76,7 @@ assume_role(){
export AWS_SECRET_ACCESS_KEY=$ASSUME_AWS_SECRET_ACCESS_KEY
ASSUME_AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_TOKEN=$ASSUME_AWS_SESSION_TOKEN
ASSUME_AWS_SESSION_EXPIRATION=$(convert_date_to_timestamp "$(jq -r '.Credentials.Expiration' "${TEMP_STS_ASSUMED_FILE}")")
ASSUME_AWS_SESSION_EXPIRATION=$(jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_EXPIRATION=$ASSUME_AWS_SESSION_EXPIRATION
cleanSTSAssumeFile
@@ -88,11 +88,11 @@ cleanSTSAssumeFile() {
}
backupInitialAWSCredentials() {
if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]]; then
if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]]; then
INITIAL_AWS_ACCESS_KEY_ID=$(printenv AWS_ACCESS_KEY_ID)
INITIAL_AWS_SECRET_ACCESS_KEY=$(printenv AWS_SECRET_ACCESS_KEY)
INITIAL_AWS_SESSION_TOKEN=$(printenv AWS_SESSION_TOKEN)
fi
fi
}
restoreInitialAWSCredentials() {
include/default_variables
+2
View File
@@ -36,6 +36,8 @@ SEND_TO_SECURITY_HUB=0
export SEND_TO_SECURITY_HUB
# Date & Time
TZ=UTC
export TZ
PROWLER_START_TIME=$( date -u +"%Y-%m-%dT%H:%M:%S%z" )
export PROWLER_START_TIME
OUTPUT_DATE=$(date -u +"%Y%m%d%H%M%S")
include/execute_check
+2 -3
View File
@@ -21,10 +21,9 @@ execute_check() {
# Following logic looks for time remaining in the session and review it
# if it is less than 600 seconds, 10 minutes.
CURRENT_TIMESTAMP=$(date -u "+%s")
SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP)
# echo SESSION TIME REMAINING IN SECONDS: $SESSION_TIME_REMAINING
SESSION_TIME_REMAINING=$(("${AWS_SESSION_EXPIRATION}" - "${CURRENT_TIMESTAMP}"))
MINIMUM_REMAINING_TIME_ALLOWED=600
if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then
if (( "${MINIMUM_REMAINING_TIME_ALLOWED}" > "${SESSION_TIME_REMAINING}" )); then
# echo LESS THAN 10 MIN LEFT: RE-ASSUMING...
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY