From 70a98ec21d5de152c6c0ba5a84c2295b8bf756a5 Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sat, 16 Nov 2019 20:12:58 -0800 Subject: [PATCH 1/5] Create credentials file & run.sh --- Dockerfile | 8 ++++++++ credentials.py | 26 ++++++++++++++++++++++++++ run.sh | 14 ++++++++++++++ 3 files changed, 48 insertions(+) create mode 100644 Dockerfile create mode 100644 credentials.py create mode 100755 run.sh diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000000..335937224f --- /dev/null +++ b/Dockerfile @@ -0,0 +1,8 @@ +FROM python +MAINTAINER Bridgecrew + +RUN apt-get update && apt-get upgrade -y && apt-get install jq -y && pip install awscli detect-secrets + +RUN curl -sL https://github.com/bridgecrewio/prowler/archive/master.tar.gz | tar xz + +RUN run.sh diff --git a/credentials.py b/credentials.py new file mode 100644 index 0000000000..3f1fd9f46c --- /dev/null +++ b/credentials.py @@ -0,0 +1,26 @@ +import boto3 +import sys +import json +import os + +sts = boto3.client('sts') +aws_lambda = boto3.client('lambda', region_name='us-west-2') + +aws_account_id = sys.argv[1] + +if aws_account_id is None: + raise ValueError('Must provide an AWS account ID') + +account_details_response = aws_lambda.invoke( + FunctionName='customers-api', + Payload=json.dumps({"path": "/invoke/getTenantDetails", "body": {"awsAccountId": sys.argv[1]}, "headers": {"Content-Type": "application/json"}}).encode('utf-8') +) + +account_details = json.loads(json.loads(account_details_response['Payload'].read())['body']) + +print('Got account details, assuming role') + +temporary_creds = sts.assume_role(RoleArn=account_details['cross_account_role_arn'], ExternalId=account_details['external_id'], RoleSessionName='prowler')['Credentials'] + +os.environ['AWS_ACCESS_KEY_ID2'] = temporary_creds['AccessKeyId'] +os.environ['AWS_SECRET_ACCESS_KEY2'] = temporary_creds['SecretAccessKey'] diff --git a/run.sh b/run.sh new file mode 100755 index 0000000000..e24c258248 --- /dev/null +++ b/run.sh @@ -0,0 +1,14 @@ +#!/bin/bash +AccountId=$1 +Alias=$2 + +echo $AWS_ACCESS_KEY_ID +python3 credentials.py $AccountId + +echo $AWS_ACCESS_KEY_ID +echo $AWS_ACCESS_KEY_ID2 +echo "Running prowler on $Alias" +./prowler -c extra741 -M json > output.json + +unset AWS_ACCESS_KEY_ID +echo $AWS_ACCESS_KEY_ID From ef26086330d67eb82512f8368d696639da6e7dec Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sat, 16 Nov 2019 20:46:30 -0800 Subject: [PATCH 2/5] Update dockerfile and scripts --- Dockerfile | 8 +++++--- credentials.py | 4 ++-- run.sh | 12 +++--------- 3 files changed, 10 insertions(+), 14 deletions(-) diff --git a/Dockerfile b/Dockerfile index 335937224f..cc2ac80e0f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,10 @@ FROM python MAINTAINER Bridgecrew -RUN apt-get update && apt-get upgrade -y && apt-get install jq -y && pip install awscli detect-secrets +RUN apt-get update && apt-get upgrade -y && apt-get install jq -y && pip install awscli detect-secrets boto3 -RUN curl -sL https://github.com/bridgecrewio/prowler/archive/master.tar.gz | tar xz +RUN curl -sL https://github.com/bridgecrewio/prowler/archive/feature/dockerized_prowler.tar.gz | tar xz -RUN run.sh +WORKDIR "./prowler-feature-dockerized_prowler" + +ENTRYPOINT ["./run.sh"] diff --git a/credentials.py b/credentials.py index 3f1fd9f46c..e6233e8614 100644 --- a/credentials.py +++ b/credentials.py @@ -22,5 +22,5 @@ print('Got account details, assuming role') temporary_creds = sts.assume_role(RoleArn=account_details['cross_account_role_arn'], ExternalId=account_details['external_id'], RoleSessionName='prowler')['Credentials'] -os.environ['AWS_ACCESS_KEY_ID2'] = temporary_creds['AccessKeyId'] -os.environ['AWS_SECRET_ACCESS_KEY2'] = temporary_creds['SecretAccessKey'] +os.environ['AWS_ACCESS_KEY_ID'] = temporary_creds['AccessKeyId'] +os.environ['AWS_SECRET_ACCESS_KEY'] = temporary_creds['SecretAccessKey'] diff --git a/run.sh b/run.sh index e24c258248..b0d8f699ae 100755 --- a/run.sh +++ b/run.sh @@ -1,14 +1,8 @@ #!/bin/bash -AccountId=$1 -Alias=$2 -echo $AWS_ACCESS_KEY_ID -python3 credentials.py $AccountId +python3 credentials.py $ACCOUNT_ID -echo $AWS_ACCESS_KEY_ID -echo $AWS_ACCESS_KEY_ID2 -echo "Running prowler on $Alias" +echo "Running prowler on $ALIAS" ./prowler -c extra741 -M json > output.json -unset AWS_ACCESS_KEY_ID -echo $AWS_ACCESS_KEY_ID +aws s3api put-object --bucket $BUCKET --key prowler/$ACCOUNT_ID/results \ No newline at end of file From 592af2b5b555e825be1ffd09c74c4492d678aef1 Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sat, 16 Nov 2019 21:01:23 -0800 Subject: [PATCH 3/5] Make image smaller --- Dockerfile | 4 ++-- run.sh | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index cc2ac80e0f..c7f5eb5987 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ -FROM python +FROM python:3.7-slim MAINTAINER Bridgecrew -RUN apt-get update && apt-get upgrade -y && apt-get install jq -y && pip install awscli detect-secrets boto3 +RUN apt-get update && apt-get upgrade -y && apt-get install jq curl -y && pip install awscli detect-secrets boto3 RUN curl -sL https://github.com/bridgecrewio/prowler/archive/feature/dockerized_prowler.tar.gz | tar xz diff --git a/run.sh b/run.sh index b0d8f699ae..ae134f5cd7 100755 --- a/run.sh +++ b/run.sh @@ -5,4 +5,6 @@ python3 credentials.py $ACCOUNT_ID echo "Running prowler on $ALIAS" ./prowler -c extra741 -M json > output.json +cat output.json + aws s3api put-object --bucket $BUCKET --key prowler/$ACCOUNT_ID/results \ No newline at end of file From fd993435301d924ad30156b9ab8f49a6f233eebc Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Tue, 19 Nov 2019 22:22:15 -0800 Subject: [PATCH 4/5] Create a script which assumes the role, runs prowler, and uploads to s3 --- Dockerfile | 10 ---------- bridgecrew-prowler/Dockerfile | 14 ++++++++++++++ bridgecrew-prowler/run.sh | 20 ++++++++++++++++++++ run.sh | 10 ---------- 4 files changed, 34 insertions(+), 20 deletions(-) delete mode 100644 Dockerfile create mode 100644 bridgecrew-prowler/Dockerfile create mode 100755 bridgecrew-prowler/run.sh delete mode 100755 run.sh diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index c7f5eb5987..0000000000 --- a/Dockerfile +++ /dev/null @@ -1,10 +0,0 @@ -FROM python:3.7-slim -MAINTAINER Bridgecrew - -RUN apt-get update && apt-get upgrade -y && apt-get install jq curl -y && pip install awscli detect-secrets boto3 - -RUN curl -sL https://github.com/bridgecrewio/prowler/archive/feature/dockerized_prowler.tar.gz | tar xz - -WORKDIR "./prowler-feature-dockerized_prowler" - -ENTRYPOINT ["./run.sh"] diff --git a/bridgecrew-prowler/Dockerfile b/bridgecrew-prowler/Dockerfile new file mode 100644 index 0000000000..03a35a3027 --- /dev/null +++ b/bridgecrew-prowler/Dockerfile @@ -0,0 +1,14 @@ +FROM toniblyx/prowler +MAINTAINER Bridgecrew + +USER root + +WORKDIR "./prowler" + +COPY "./run.sh" "." + +RUN chown -R prowler /prowler/ + +USER prowler + +ENTRYPOINT ["./run.sh"] diff --git a/bridgecrew-prowler/run.sh b/bridgecrew-prowler/run.sh new file mode 100755 index 0000000000..dde80afc10 --- /dev/null +++ b/bridgecrew-prowler/run.sh @@ -0,0 +1,20 @@ +#!/bin/bash + +echo "Assuming role for ${ACCOUNT_ID}" +creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --external-id ${EXTERNAL_ID} --role-session-name prowler | jq '.Credentials') +export AWS_ACCESS_KEY_ID=$(echo $creds | jq ".AccessKeyId" | sed 's/\"//g') +export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq ".SecretAccessKey" | sed 's/\"//g') +export AWS_SESSION_TOKEN=$(echo $creds | jq ".SessionToken" | sed 's/\"//g') + +echo "Running prowler on ${ACCOUNT_ID}" +./prowler -c extra741,extra742,extra759 -M json > output.json + +echo "Results:" +cat output.json + +unset AWS_ACCESS_KEY_ID +unset AWS_SECRET_ACCESS_KEY +unset AWS_SESSION_TOKEN + +echo "Uploading result to s3://${BUCKET}/prowler/${ACCOUNT_ID}/output.json" +aws s3api put-object --bucket ${BUCKET} --key prowler/$ACCOUNT_ID/output.json --body output.json \ No newline at end of file diff --git a/run.sh b/run.sh deleted file mode 100755 index ae134f5cd7..0000000000 --- a/run.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -python3 credentials.py $ACCOUNT_ID - -echo "Running prowler on $ALIAS" -./prowler -c extra741 -M json > output.json - -cat output.json - -aws s3api put-object --bucket $BUCKET --key prowler/$ACCOUNT_ID/results \ No newline at end of file From d6c2f3c78b3d8bfebd00a02878dfce92514709da Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Thu, 21 Nov 2019 11:14:24 -0800 Subject: [PATCH 5/5] Expose checks parameter --- bridgecrew-prowler/run.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bridgecrew-prowler/run.sh b/bridgecrew-prowler/run.sh index dde80afc10..7c450d23fd 100755 --- a/bridgecrew-prowler/run.sh +++ b/bridgecrew-prowler/run.sh @@ -7,7 +7,7 @@ export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq ".SecretAccessKey" | sed 's/\"// export AWS_SESSION_TOKEN=$(echo $creds | jq ".SessionToken" | sed 's/\"//g') echo "Running prowler on ${ACCOUNT_ID}" -./prowler -c extra741,extra742,extra759 -M json > output.json +./prowler ${CHECKS} -M json > output.json echo "Results:" cat output.json