From 029c330ed1c8f716605f23d4e478e351ec8b3faf Mon Sep 17 00:00:00 2001 From: Or Evron Date: Wed, 29 Jan 2020 12:51:36 +0200 Subject: [PATCH 1/4] fix check extra 764 (cherry picked from commit 0db690ad5fa26c0157f6f40ea651495bdd9e9715) --- checks/check_extra764 | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/checks/check_extra764 b/checks/check_extra764 index 6fd2c51381..7767077c29 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -24,25 +24,29 @@ extra764(){ # get bucket policy $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1 - if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then - textFail "Access Denied Trying to Get Bucket Policy for $bucket" - rm -f $TEMP_STP_POLICY_FILE - continue - fi - if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then - textFail "No bucket policy for $bucket" - rm -f $TEMP_STP_POLICY_FILE - continue - fi + cat $TEMP_STP_POLICY_FILE + cat $bucket +# if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then +# textFail "Access Denied Trying to Get Bucket Policy for $bucket" +# rm -f $TEMP_STP_POLICY_FILE +# continue +# fi +# if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then +# textFail "No bucket policy for $bucket" +# rm -f $TEMP_STP_POLICY_FILE +# continue +# fi # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/ - CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")') - if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then - textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport" - else - textFail "Bucket $bucket allows requests over insecure transport" + # checking if $TEMP_STP_POLICY_FILE is a valid json before converting it to json with jq + if jq -e . >/dev/null 2>&1 <<< "$TEMP_STP_POLICY_FILE"; then + CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")') + if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then + textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport" + else + textFail "Bucket $bucket allows requests over insecure transport" + fi fi - rm -fr $TEMP_STP_POLICY_FILE done From aca93b75267c50be488940e9ed21079279a8b8b3 Mon Sep 17 00:00:00 2001 From: Or Evron Date: Wed, 29 Jan 2020 12:54:00 +0200 Subject: [PATCH 2/4] typo (cherry picked from commit b89f67bba131da263828e258cc474a460ee3ebcc) --- checks/check_extra764 | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/checks/check_extra764 b/checks/check_extra764 index 7767077c29..255f2a6bec 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -26,16 +26,16 @@ extra764(){ $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1 cat $TEMP_STP_POLICY_FILE cat $bucket -# if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then -# textFail "Access Denied Trying to Get Bucket Policy for $bucket" -# rm -f $TEMP_STP_POLICY_FILE -# continue -# fi -# if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then -# textFail "No bucket policy for $bucket" -# rm -f $TEMP_STP_POLICY_FILE -# continue -# fi + if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then + textFail "Access Denied Trying to Get Bucket Policy for $bucket" + rm -f $TEMP_STP_POLICY_FILE + continue + fi + if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then + textFail "No bucket policy for $bucket" + rm -f $TEMP_STP_POLICY_FILE + continue + fi # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/ # checking if $TEMP_STP_POLICY_FILE is a valid json before converting it to json with jq From e575fcd6b2fc23b5c68ddeb371adbd2ee2859967 Mon Sep 17 00:00:00 2001 From: Or Evron Date: Wed, 29 Jan 2020 12:54:52 +0200 Subject: [PATCH 3/4] typo (cherry picked from commit eb4f33642844a1e6150ea5c2862bc4f8fef4bb58) --- checks/check_extra764 | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/checks/check_extra764 b/checks/check_extra764 index 255f2a6bec..eaf682d965 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -24,8 +24,6 @@ extra764(){ # get bucket policy $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1 - cat $TEMP_STP_POLICY_FILE - cat $bucket if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then textFail "Access Denied Trying to Get Bucket Policy for $bucket" rm -f $TEMP_STP_POLICY_FILE @@ -47,6 +45,7 @@ extra764(){ textFail "Bucket $bucket allows requests over insecure transport" fi fi + rm -fr $TEMP_STP_POLICY_FILE done From 74cbbddc5c9a6c7a42e9775ed19f1f794abb17c2 Mon Sep 17 00:00:00 2001 From: Or Evron Date: Thu, 30 Jan 2020 16:07:29 +0200 Subject: [PATCH 4/4] add text info in case of error occurred (cherry picked from commit b28917beb758d5c2588a374f3ad8d9f2b4b59f80) --- checks/check_extra764 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/checks/check_extra764 b/checks/check_extra764 index eaf682d965..cc8a357497 100644 --- a/checks/check_extra764 +++ b/checks/check_extra764 @@ -44,6 +44,8 @@ extra764(){ else textFail "Bucket $bucket allows requests over insecure transport" fi + else + textInfo "Unknown Error occurred: $TEMP_STP_POLICY_FILE" fi rm -fr $TEMP_STP_POLICY_FILE