From dd4c3a3b3d33435ab6bd74be5afaa7632c8600c7 Mon Sep 17 00:00:00 2001 From: Israel <6672089+lopmoris@users.noreply.github.com> Date: Mon, 29 Nov 2021 17:56:04 +0100 Subject: [PATCH 1/3] Update group25_FTR When trying to run the group 25 (Amazon FTR related security checks) nothing happens, after looking at the code there is a misconfiguration in 2 params: GROUP_RUN_BY_DEFAULT[9] and GROUP_CHECKS[9]. Updating values to 25 fixed the issue. --- groups/group25_FTR | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/groups/group25_FTR b/groups/group25_FTR index 7ca694f7e8..fd0f8bfd63 100644 --- a/groups/group25_FTR +++ b/groups/group25_FTR @@ -14,8 +14,8 @@ GROUP_ID[25]='ftr' GROUP_NUMBER[25]='25.0' GROUP_TITLE[25]='Amazon FTR related security checks - [ftr] ******************' -GROUP_RUN_BY_DEFAULT[9]='N' # run it when execute_all is called -GROUP_CHECKS[9]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73' +GROUP_RUN_BY_DEFAULT[25]='N' # run it when execute_all is called +GROUP_CHECKS[25]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check111,check112,check113,check117,check118,check122,check21,check22,extra759,extra760,extra768,extra775,extra797,extra7141,extra73' # Checks from AWS FTR https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html # 1.1 [check11] Avoid the use of the root account - iam [High] From f8ea974142707f4ea4d4b914baa7a7ec77dc1af9 Mon Sep 17 00:00:00 2001 From: Israel <6672089+lopmoris@users.noreply.github.com> Date: Mon, 29 Nov 2021 19:11:10 +0100 Subject: [PATCH 2/3] Update README.md broken link for capital letters in group file (group25_FTR) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5cb8afde56..3cfba123a7 100644 --- a/README.md +++ b/README.md @@ -584,7 +584,7 @@ The `gdpr` group of checks uses existing and extra checks. To get a GDPR report, With this group of checks, Prowler shows result of checks related to the AWS Foundational Technical Review, more information [here](https://apn-checklists.s3.amazonaws.com/foundational/partner-hosted/partner-hosted/CVLHEC5X7.html). The list of checks can be seen in the group file at: -[groups/group25_ftr](groups/group25_ftr) +[groups/group25_ftr](groups/group25_FTR) The `ftr` group of checks uses existing and extra checks. To get a AWS FTR report, run this command: From e5eb066c61c39f91d6368004b4a840bd573d62df Mon Sep 17 00:00:00 2001 From: root Date: Tue, 30 Nov 2021 15:29:10 -0500 Subject: [PATCH 3/3] #938 issue assume_role multiple times should be fixed --- include/assume_role | 14 +++++++++++++- include/aws_profile_loader | 3 ++- prowler | 10 ++++++++-- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/include/assume_role b/include/assume_role index 95bd3e0046..74c78e0e84 100644 --- a/include/assume_role +++ b/include/assume_role @@ -13,6 +13,12 @@ # both variables are mandatory to be set together assume_role(){ + echo ASSUMING ROLE... + + PROFILE_OPT=$PROFILE_OPT_BAK + echo PROFILE $PROFILE + echo PROFILE_OPT $PROFILE_OPT + if [[ -z $ROLE_TO_ASSUME ]]; then echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set" exit 1 @@ -50,6 +56,8 @@ assume_role(){ --region $REGION_FOR_STS \ --external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE 2>&1 fi + echo FILE WITH TEMP CREDS: $TEMP_STS_ASSUMED_FILE + if [[ $(grep AccessDenied $TEMP_STS_ASSUMED_FILE) ]]; then textFail "Access Denied assuming role $PROWLER_ROLE" EXITCODE=1 @@ -84,9 +92,13 @@ assume_role(){ export AWS_SECRET_ACCESS_KEY=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SecretAccessKey') export AWS_SESSION_TOKEN=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SessionToken') export AWS_SESSION_EXPIRATION=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601') + echo TEMP AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID + echo TEMP AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY + echo TEMP AWS_SESSION_TOKEN: $AWS_SESSION_TOKEN + echo EXPIRATION EPOCH TIME: $AWS_SESSION_EXPIRATION cleanSTSAssumeFile } cleanSTSAssumeFile() { rm -fr "${TEMP_STS_ASSUMED_FILE}" -} \ No newline at end of file +} diff --git a/include/aws_profile_loader b/include/aws_profile_loader index a2e446d306..e79cea87c0 100644 --- a/include/aws_profile_loader +++ b/include/aws_profile_loader @@ -45,7 +45,8 @@ else PROFILE="default" PROFILE_OPT="--profile $PROFILE" fi - +# Backing up $PROFILE_OPT needed to renew assume_role +PROFILE_OPT_BAK=$PROFILE_OPT # Set default region by aws config, fall back to us-east-1 REGION_CONFIG=$(aws configure get region) if [[ $REGION_OPT ]]; then diff --git a/prowler b/prowler index cae80272eb..9de3dc7af9 100755 --- a/prowler +++ b/prowler @@ -135,6 +135,7 @@ while getopts ":hlLkqp:r:c:C:g:f:m:M:E:x:enbVsSI:A:R:T:w:N:o:B:F:zZ:" OPTION; do ;; p ) PROFILE=$OPTARG + AWS_PROFILE=$OPTARG ;; r ) REGION_OPT=$OPTARG @@ -338,6 +339,7 @@ TOTAL_CHECKS=($(echo "${TOTAL_CHECKS[*]}" | tr ' ' '\n' | awk '!seen[$0]++' | so get_regions() { # Get list of regions based on include/whoami REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' --output text $PROFILE_OPT --region $REGION_FOR_STS --region-names $FILTERREGION 2>&1) + echo $REGIONS ret=$? if [[ $ret -ne 0 ]]; then echo "$OPTRED Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation $OPTNORMAL" @@ -397,8 +399,10 @@ execute_check() { # if it is less than 600 seconds, 10 minutes. CURRENT_TIMESTAMP=$(date -u "+%s") SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP) - MINIMUM_REMAINING_TIME_ALLOWED="600" - if [[ $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING ]]; then + echo SESSION TIME REMAINING IN SECONDS: $SESSION_TIME_REMAINING + MINIMUM_REMAINING_TIME_ALLOWED=600 + if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then + echo LESS THAN 10 MIN LEFT: RE-ASSUMING... unset AWS_ACCESS_KEY_ID unset AWS_SECRET_ACCESS_KEY unset AWS_SESSION_TOKEN @@ -644,7 +648,9 @@ if [[ $ACCOUNT_TO_ASSUME ]]; then fi # List regions +echo REGIONS_init get_regions +echo REGIONS_end # Execute group of checks if called with -g if [[ $GROUP_ID_READ ]];then