From 50a670fbc428a913de52a29f12d447b48766cc23 Mon Sep 17 00:00:00 2001
From: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
Date: Tue, 7 Jun 2022 14:49:22 +0200
Subject: [PATCH] fix(codebuild_update): AWS CLI and permissions update.
 (#1183)

---
 include/securityhub_integration                         | 4 ++--
 util/codebuild/codebuild-prowler-audit-account-cfn.yaml | 8 +++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/securityhub_integration b/include/securityhub_integration
index 7a380e75a9..6824f892e8 100644
--- a/include/securityhub_integration
+++ b/include/securityhub_integration
@@ -93,11 +93,11 @@ sendToSecurityHub(){
 
   local finding_id=$(echo ${findings} | jq -r .Id )
   SECURITYHUB_NEW_FINDINGS_IDS+=( "$finding_id" )
-  BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region "$region" $PROFILE_OPT batch-import-findings --findings "${findings}")
+  BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region "$region" $PROFILE_OPT batch-import-findings --findings "${findings}" 2>&1)
   
   # Check for success if imported
   if [[ -z "${BATCH_IMPORT_RESULT}" ]] || ! jq -e '.SuccessCount == 1' <<< "${BATCH_IMPORT_RESULT}" > /dev/null 2>&1; then
-    echo -e "\n$RED ERROR!$NORMAL Failed to send check output to AWS Security Hub\n"
+    echo "${BAD} ERROR! Failed to send check output to AWS Security Hub.${NORMAL}"
   fi
 
 }
diff --git a/util/codebuild/codebuild-prowler-audit-account-cfn.yaml b/util/codebuild/codebuild-prowler-audit-account-cfn.yaml
index f00af6857f..f2d2599e06 100644
--- a/util/codebuild/codebuild-prowler-audit-account-cfn.yaml
+++ b/util/codebuild/codebuild-prowler-audit-account-cfn.yaml
@@ -243,7 +243,7 @@ Resources:
             Statement:
               - Action: securityhub:BatchImportFindings
                 Effect: Allow
-                Resource: !Sub 'arn:${AWS::Partition}:securityhub:${AWS::Region}::product/prowler/prowler'
+                Resource: !Sub 'arn:${AWS::Partition}:securityhub:*::product/prowler/prowler'
 
   CodeBuildLogPolicy:
     Type: AWS::IAM::Policy
@@ -298,6 +298,12 @@ Resources:
               commands:
                 - echo "Installing Prowler and dependencies..."
                 - pip3 install detect-secrets 
+                # uninstall awscli version 1
+                - pip3 uninstall -y awscli
+                # install awscli version 2
+                - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+                - unzip awscliv2.zip
+                - ./aws/install
             build:
               commands:
                 - echo "Running Prowler as ./prowler $PROWLER_OPTIONS"