diff --git a/README.md b/README.md index 2c58e1746e..9c62ebe496 100644 --- a/README.md +++ b/README.md @@ -584,7 +584,7 @@ The `gdpr` group of checks uses existing and extra checks. To get a GDPR report, With this group of checks, Prowler shows result of checks related to the AWS Foundational Technical Review, more information [here](https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html). The list of checks can be seen in the group file at: -[groups/group25_ftr](groups/group25_ftr) +[groups/group25_ftr](groups/group25_FTR) The `ftr` group of checks uses existing and extra checks. To get a AWS FTR report, run this command: diff --git a/groups/group25_FTR b/groups/group25_FTR index 7ca694f7e8..fd0f8bfd63 100644 --- a/groups/group25_FTR +++ b/groups/group25_FTR @@ -14,8 +14,8 @@ GROUP_ID[25]='ftr' GROUP_NUMBER[25]='25.0' GROUP_TITLE[25]='Amazon FTR related security checks - [ftr] ******************' -GROUP_RUN_BY_DEFAULT[9]='N' # run it when execute_all is called -GROUP_CHECKS[9]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73' +GROUP_RUN_BY_DEFAULT[25]='N' # run it when execute_all is called +GROUP_CHECKS[25]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73' # Checks from AWS FTR https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html # 1.1 [check11] Avoid the use of the root account - iam [High] diff --git a/include/assume_role b/include/assume_role index 0d5e592842..a02ae7cadd 100644 --- a/include/assume_role +++ b/include/assume_role @@ -12,7 +12,8 @@ # specific language governing permissions and limitations under the License. assume_role(){ - # Both variables are mandatory to be set togethe + PROFILE_OPT=$PROFILE_OPT_BAK + # Both variables are mandatory to be set together if [[ -z $ROLE_TO_ASSUME || -z $ACCOUNT_TO_ASSUME ]]; then echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set" exit 1 @@ -55,10 +56,12 @@ assume_role(){ EXITCODE=1 exit $EXITCODE fi - + + echo FILE WITH TEMP CREDS: $TEMP_STS_ASSUMED_FILE + # The profile shouldn't be used for CLI PROFILE="" - PROFILE_OPT="" + PROFILE_OPT="" # Set AWS environment variables with assumed role credentials AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "${TEMP_STS_ASSUMED_FILE}") @@ -69,6 +72,10 @@ assume_role(){ export AWS_SESSION_TOKEN AWS_SESSION_EXPIRATION=$(jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601' "${TEMP_STS_ASSUMED_FILE}") export AWS_SESSION_EXPIRATION + echo TEMP AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID + echo TEMP AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY + echo TEMP AWS_SESSION_TOKEN: $AWS_SESSION_TOKEN + echo EXPIRATION EPOCH TIME: $AWS_SESSION_EXPIRATION cleanSTSAssumeFile } diff --git a/include/aws_profile_loader b/include/aws_profile_loader index a2e446d306..e79cea87c0 100644 --- a/include/aws_profile_loader +++ b/include/aws_profile_loader @@ -45,7 +45,8 @@ else PROFILE="default" PROFILE_OPT="--profile $PROFILE" fi - +# Backing up $PROFILE_OPT needed to renew assume_role +PROFILE_OPT_BAK=$PROFILE_OPT # Set default region by aws config, fall back to us-east-1 REGION_CONFIG=$(aws configure get region) if [[ $REGION_OPT ]]; then diff --git a/prowler b/prowler index 6246ff3ab1..f604a0ba30 100755 --- a/prowler +++ b/prowler @@ -135,6 +135,7 @@ while getopts ":hlLkqp:r:c:C:g:f:m:M:E:x:enbVsSI:A:R:T:w:N:o:B:F:zZ:" OPTION; do ;; p ) PROFILE=$OPTARG + AWS_PROFILE=$OPTARG ;; r ) REGION_OPT=$OPTARG @@ -338,6 +339,7 @@ TOTAL_CHECKS=($(echo "${TOTAL_CHECKS[*]}" | tr ' ' '\n' | awk '!seen[$0]++' | so get_regions() { # Get list of regions based on include/whoami REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' --output text $PROFILE_OPT --region $REGION_FOR_STS --region-names $FILTERREGION 2>&1) + echo $REGIONS ret=$? if [[ $ret -ne 0 ]]; then echo "$OPTRED Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation $OPTNORMAL" @@ -397,8 +399,10 @@ execute_check() { # if it is less than 600 seconds, 10 minutes. CURRENT_TIMESTAMP=$(date -u "+%s") SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP) - MINIMUM_REMAINING_TIME_ALLOWED="600" - if [[ $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING ]]; then + echo SESSION TIME REMAINING IN SECONDS: $SESSION_TIME_REMAINING + MINIMUM_REMAINING_TIME_ALLOWED=600 + if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then + echo LESS THAN 10 MIN LEFT: RE-ASSUMING... unset AWS_ACCESS_KEY_ID unset AWS_SECRET_ACCESS_KEY unset AWS_SESSION_TOKEN @@ -644,7 +648,9 @@ if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]]; then fi # List regions +echo REGIONS_init get_regions +echo REGIONS_end # Execute group of checks if called with -g if [[ $GROUP_ID_READ ]];then