Merge branch '2.7' into fix-aws-sts-handle-errors

README.md

@@ -584,7 +584,7 @@ The `gdpr` group of checks uses existing and extra checks. To get a GDPR report,
 
 With this group of checks, Prowler shows result of checks related to the AWS Foundational Technical Review, more information [here](https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html). The list of checks can be seen in the group file at:
 
-[groups/group25_ftr](groups/group25_ftr)
+[groups/group25_ftr](groups/group25_FTR)
 
 The `ftr` group of checks uses existing and extra checks. To get a AWS FTR report, run this command:
 

groups/group25_FTR

@@ -14,8 +14,8 @@
 GROUP_ID[25]='ftr'
 GROUP_NUMBER[25]='25.0'
 GROUP_TITLE[25]='Amazon FTR related security checks - [ftr] ******************'
-GROUP_RUN_BY_DEFAULT[9]='N' # run it when execute_all is called
-GROUP_CHECKS[9]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73'
+GROUP_RUN_BY_DEFAULT[25]='N' # run it when execute_all is called
+GROUP_CHECKS[25]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73'
 
 # Checks from AWS FTR https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html
 # 1.1 [check11] Avoid the use of the root account - iam [High]

include/assume_role

@@ -12,7 +12,8 @@
 # specific language governing permissions and limitations under the License.
 
 assume_role(){
-    # Both variables are mandatory to be set togethe
+    PROFILE_OPT=$PROFILE_OPT_BAK
+    # Both variables are mandatory to be set together
     if [[ -z $ROLE_TO_ASSUME || -z $ACCOUNT_TO_ASSUME ]]; then
         echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
         exit 1
@@ -55,10 +56,12 @@ assume_role(){
         EXITCODE=1
         exit $EXITCODE
     fi
-
+    
+    echo FILE WITH TEMP CREDS: $TEMP_STS_ASSUMED_FILE
+    
     # The profile shouldn't be used for CLI
     PROFILE=""
-    PROFILE_OPT=""
+    PROFILE_OPT=""   
 
     # Set AWS environment variables with assumed role credentials
     AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "${TEMP_STS_ASSUMED_FILE}")
@@ -69,6 +72,10 @@ assume_role(){
     export AWS_SESSION_TOKEN
     AWS_SESSION_EXPIRATION=$(jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601'  "${TEMP_STS_ASSUMED_FILE}")
     export AWS_SESSION_EXPIRATION
+    echo TEMP AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
+    echo TEMP AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
+    echo TEMP AWS_SESSION_TOKEN: $AWS_SESSION_TOKEN
+    echo EXPIRATION EPOCH TIME: $AWS_SESSION_EXPIRATION
 
     cleanSTSAssumeFile
 }

include/aws_profile_loader

@@ -45,7 +45,8 @@ else
     PROFILE="default"
     PROFILE_OPT="--profile $PROFILE"
 fi
-
+# Backing up $PROFILE_OPT needed to renew assume_role
+PROFILE_OPT_BAK=$PROFILE_OPT
 # Set default region by aws config, fall back to us-east-1
 REGION_CONFIG=$(aws configure get region)
 if [[ $REGION_OPT ]]; then

prowler

@@ -135,6 +135,7 @@ while getopts ":hlLkqp:r:c:C:g:f:m:M:E:x:enbVsSI:A:R:T:w:N:o:B:F:zZ:" OPTION; do
         ;;
      p )
         PROFILE=$OPTARG
+        AWS_PROFILE=$OPTARG
         ;;
      r )
         REGION_OPT=$OPTARG
@@ -338,6 +339,7 @@ TOTAL_CHECKS=($(echo "${TOTAL_CHECKS[*]}" | tr ' ' '\n' | awk '!seen[$0]++' | so
 get_regions() {
   # Get list of regions based on include/whoami
   REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' --output text $PROFILE_OPT --region $REGION_FOR_STS --region-names $FILTERREGION 2>&1)
+  echo $REGIONS
   ret=$?
   if [[ $ret -ne 0 ]]; then
     echo "$OPTRED Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation $OPTNORMAL"
@@ -397,8 +399,10 @@ execute_check() {
     # if it is less than 600 seconds, 10 minutes.
     CURRENT_TIMESTAMP=$(date -u "+%s")
     SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP)
-    MINIMUM_REMAINING_TIME_ALLOWED="600"
-    if [[ $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING ]]; then
+    echo SESSION TIME REMAINING IN SECONDS: $SESSION_TIME_REMAINING
+    MINIMUM_REMAINING_TIME_ALLOWED=600
+    if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then
+      echo LESS THAN 10 MIN LEFT: RE-ASSUMING...
       unset AWS_ACCESS_KEY_ID
       unset AWS_SECRET_ACCESS_KEY
       unset AWS_SESSION_TOKEN
@@ -644,7 +648,9 @@ if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]]; then
 fi
 
 # List regions
+echo REGIONS_init
 get_regions
+echo REGIONS_end
 
 # Execute group of checks if called with -g
 if [[ $GROUP_ID_READ ]];then