ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(instance-metadata): Credentials recovering (#1207)

Browse Source 
* fix(instance-metadata): Credentials recovering

* fix(expr): Dockerfile to root and expr in SESSION_TIME_REMAINING.

Co-authored-by: Pepe Fagoaga <pepe@verica.io>
Co-authored-by: sergargar <sergio@verica.io>
This commit is contained in:
Sergio Garcia
2022-06-17 14:23:56 +02:00
committed by GitHub
parent 3944ea2055
commit 633d7bd8a8
8 changed files with 46 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/Dockerfile → Dockerfile
View File
include/assume_role
+5 -1
View File
@@ -88,10 +88,14 @@ cleanSTSAssumeFile() {
}
backupInitialAWSCredentials() {
if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]]; then
if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]]
then
INITIAL_AWS_ACCESS_KEY_ID=$(printenv AWS_ACCESS_KEY_ID)
INITIAL_AWS_SECRET_ACCESS_KEY=$(printenv AWS_SECRET_ACCESS_KEY)
INITIAL_AWS_SESSION_TOKEN=$(printenv AWS_SESSION_TOKEN)
else
echo -e "$RED ERROR Can't Backup Initial AWS Credentials $NORMAL"
exit 1
fi
}
include/aws_profile_loader
+20 -9
View File
@@ -27,20 +27,31 @@ aws_profile_loader() {
elif [[ $AWS_ACCESS_KEY_ID && $AWS_SECRET_ACCESS_KEY || $AWS_SESSION_TOKEN || $AWS_PROFILE ]];then
PROFILE="$AWS_PROFILE"
PROFILE_OPT=""
elif [[ -n $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ]] && [[ -z $INSTANCE_PROFILE ]]; then
elif [[ -n $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ]] && [[ -z $INSTANCE_PROFILE ]]
then
PROFILE="INSTANCE-PROFILE"
AWS_ACCESS_KEY_ID=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | grep AccessKeyId | cut -d':' -f2 | sed 's/[^0-9A-Z]*//g')
AWS_SECRET_ACCESS_KEY_ID=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | grep SecretAccessKey | cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g')
AWS_SESSION_TOKEN=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI grep Token| cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g')
CONTAINER_METADATA=$(curl -s 169.254.170.2"${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}")
AWS_ACCESS_KEY_ID=$(jq -r '.AccessKeyId' <<< "${CONTAINER_METADATA}")
export AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY=$(jq -r '.SecretAccessKey' <<< "${CONTAINER_METADATA}")
export AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN=$(jq -r '.Token' <<< "${CONTAINER_METADATA}")
export AWS_SESSION_TOKEN
elif [[ $AWS_WEB_IDENTITY_TOKEN_FILE ]]; then
PROFILE=""
PROFILE_OPT=""
elif [[ $INSTANCE_PROFILE ]]; then
elif [[ $INSTANCE_PROFILE ]]
then
PROFILE="INSTANCE-PROFILE"
AWS_ACCESS_KEY_ID=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} | grep AccessKeyId | cut -d':' -f2 | sed 's/[^0-9A-Z]*//g')
AWS_SECRET_ACCESS_KEY_ID=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} | grep SecretAccessKey | cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g')
AWS_SESSION_TOKEN=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} grep Token| cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g')
elif [[ $AWS_EXECUTION_ENV == "CloudShell" ]]; then
INSTANCE_METADATA=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/"${INSTANCE_PROFILE}")
AWS_ACCESS_KEY_ID=$(jq '.AccessKeyId' <<< "${INSTANCE_METADATA}")
export AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY=$(jq '.SecretAccessKey' <<< "${INSTANCE_METADATA}")
export AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN=$(jq '.Token' <<< "${INSTANCE_METADATA}")
export AWS_SESSION_TOKEN
elif [[ $AWS_EXECUTION_ENV == "CloudShell" ]]
then
PROFILE_OPT=""
else
PROFILE="default"
include/execute_check
+1 -1
View File
@@ -21,7 +21,7 @@ execute_check() {
# Following logic looks for time remaining in the session and review it
# if it is less than 600 seconds, 10 minutes.
CURRENT_TIMESTAMP=$(date -u "+%s")
SESSION_TIME_REMAINING=$(("${AWS_SESSION_EXPIRATION}" - "${CURRENT_TIMESTAMP}"))
SESSION_TIME_REMAINING=$(expr "${AWS_SESSION_EXPIRATION}" - "${CURRENT_TIMESTAMP}")
MINIMUM_REMAINING_TIME_ALLOWED=600
if (( "${MINIMUM_REMAINING_TIME_ALLOWED}" > "${SESSION_TIME_REMAINING}" )); then
# echo LESS THAN 10 MIN LEFT: RE-ASSUMING...
include/organizations_metadata
-3
View File
@@ -20,9 +20,6 @@
get_orgs_account_details(){
echo " Prowler is getting details from the AWS Organizations Management Account: ${MANAGEMENT_ACCOUNT_ID}..."
# Assume role to recover AWS Organizations metadata
assume_role
# The following code requires organizations:ListTagsForResource
ACCOUNTS_DETAILS=$($AWSCLI $PROFILE_OPT --region "${REGION}" organizations list-accounts --output json 2>&1)
if ! grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${ACCOUNTS_DETAILS}"
include/validate_options
+10 -5
View File
@@ -72,6 +72,9 @@ validate_organizations() {
# Set the new account to assume to recover AWS Organizations Metadata
ACCOUNT_TO_ASSUME="${MANAGEMENT_ACCOUNT_ID}"
# Assume role to recover AWS Organizations metadata
assume_role
# Recover AWS Organizations Metadata
get_orgs_account_details
@@ -81,12 +84,14 @@ validate_organizations() {
# Restoring initial credentials
restoreInitialAWSCredentials
fi
}
if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]]
then
backupInitialAWSCredentials
assume_role
fi
validate_assume_role() {
if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]]
then
backupInitialAWSCredentials
assume_role
fi
}
# JUnit output if -M junit-xml
include/whoami
+1 -1
View File
@@ -26,7 +26,7 @@ print_whoami(){
echo -e " Caller Identity ARN: ${NOTICE}[${CALLER_ARN}]${NORMAL}\n"
}
get_aws_credentials() {
get_caller_identity() {
case "$REGION" in
me-south-1|eu-south-1|ap-east-1|af-south-1)
REGION_FOR_STS="us-east-1"
prowler
+9 -3
View File
@@ -308,9 +308,16 @@ aws_cli_detector
aws_profile_loader
# Gather account data / test aws cli connectivity
get_aws_credentials
get_caller_identity
print_whoami
validate_allowlist
validate_organizations
# Check Assume Role
validate_assume_role
# List regions
get_regions
@@ -318,8 +325,7 @@ get_regions
validate_custom_output_directory
validate_custom_output_filename
validate_security_hub
validate_organizations
validate_allowlist
validate_custom_checks
# Add headers to certain output files