Merge branch 'feature/dockerized_prowler'

bridgecrew-prowler/Dockerfile

@@ -0,0 +1,14 @@
+FROM toniblyx/prowler
+MAINTAINER Bridgecrew <www.bridgecrew.io>
+
+USER root
+
+WORKDIR "./prowler"
+
+COPY "./run.sh" "."
+
+RUN chown -R prowler /prowler/
+
+USER prowler
+
+ENTRYPOINT ["./run.sh"]

bridgecrew-prowler/run.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+echo "Assuming role for ${ACCOUNT_ID}"
+creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --external-id ${EXTERNAL_ID} --role-session-name prowler | jq '.Credentials')
+export AWS_ACCESS_KEY_ID=$(echo $creds | jq ".AccessKeyId" | sed 's/\"//g')
+export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq ".SecretAccessKey" | sed 's/\"//g')
+export AWS_SESSION_TOKEN=$(echo $creds | jq ".SessionToken" | sed 's/\"//g')
+
+echo "Running prowler on ${ACCOUNT_ID}"
+./prowler ${CHECKS} -M json > output.json
+
+echo "Results:"
+cat output.json
+
+unset AWS_ACCESS_KEY_ID
+unset AWS_SECRET_ACCESS_KEY
+unset AWS_SESSION_TOKEN
+
+echo "Uploading result to s3://${BUCKET}/prowler/${ACCOUNT_ID}/output.json"
+aws s3api put-object --bucket ${BUCKET} --key prowler/$ACCOUNT_ID/output.json --body output.json

credentials.py

@@ -0,0 +1,26 @@
+import boto3
+import sys
+import json
+import os
+
+sts = boto3.client('sts')
+aws_lambda = boto3.client('lambda', region_name='us-west-2')
+
+aws_account_id = sys.argv[1]
+
+if aws_account_id is None:
+    raise ValueError('Must provide an AWS account ID')
+
+account_details_response = aws_lambda.invoke(
+    FunctionName='customers-api',
+    Payload=json.dumps({"path": "/invoke/getTenantDetails", "body": {"awsAccountId": sys.argv[1]}, "headers": {"Content-Type": "application/json"}}).encode('utf-8')
+)
+
+account_details = json.loads(json.loads(account_details_response['Payload'].read())['body'])
+
+print('Got account details, assuming role')
+
+temporary_creds = sts.assume_role(RoleArn=account_details['cross_account_role_arn'], ExternalId=account_details['external_id'], RoleSessionName='prowler')['Credentials']
+
+os.environ['AWS_ACCESS_KEY_ID'] = temporary_creds['AccessKeyId']
+os.environ['AWS_SECRET_ACCESS_KEY'] = temporary_creds['SecretAccessKey']