diff --git a/util/Dockerfile b/Dockerfile similarity index 100% rename from util/Dockerfile rename to Dockerfile diff --git a/include/assume_role b/include/assume_role index c8ed1e6bb9..304dc1be76 100644 --- a/include/assume_role +++ b/include/assume_role @@ -88,10 +88,14 @@ cleanSTSAssumeFile() { } backupInitialAWSCredentials() { - if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]]; then + if [[ $(printenv AWS_ACCESS_KEY_ID) && $(printenv AWS_SECRET_ACCESS_KEY) && $(printenv AWS_SESSION_TOKEN) ]] + then INITIAL_AWS_ACCESS_KEY_ID=$(printenv AWS_ACCESS_KEY_ID) INITIAL_AWS_SECRET_ACCESS_KEY=$(printenv AWS_SECRET_ACCESS_KEY) INITIAL_AWS_SESSION_TOKEN=$(printenv AWS_SESSION_TOKEN) + else + echo -e "$RED ERROR Can't Backup Initial AWS Credentials $NORMAL" + exit 1 fi } diff --git a/include/aws_profile_loader b/include/aws_profile_loader index 656fd09b27..0b7d4cc2c5 100644 --- a/include/aws_profile_loader +++ b/include/aws_profile_loader @@ -27,20 +27,31 @@ aws_profile_loader() { elif [[ $AWS_ACCESS_KEY_ID && $AWS_SECRET_ACCESS_KEY || $AWS_SESSION_TOKEN || $AWS_PROFILE ]];then PROFILE="$AWS_PROFILE" PROFILE_OPT="" - elif [[ -n $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ]] && [[ -z $INSTANCE_PROFILE ]]; then + elif [[ -n $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ]] && [[ -z $INSTANCE_PROFILE ]] + then PROFILE="INSTANCE-PROFILE" - AWS_ACCESS_KEY_ID=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | grep AccessKeyId | cut -d':' -f2 | sed 's/[^0-9A-Z]*//g') - AWS_SECRET_ACCESS_KEY_ID=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | grep SecretAccessKey | cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g') - AWS_SESSION_TOKEN=$(curl -s 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI grep Token| cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g') + CONTAINER_METADATA=$(curl -s 169.254.170.2"${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}") + AWS_ACCESS_KEY_ID=$(jq -r '.AccessKeyId' <<< "${CONTAINER_METADATA}") + export AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY=$(jq -r '.SecretAccessKey' <<< "${CONTAINER_METADATA}") + export AWS_SECRET_ACCESS_KEY + AWS_SESSION_TOKEN=$(jq -r '.Token' <<< "${CONTAINER_METADATA}") + export AWS_SESSION_TOKEN elif [[ $AWS_WEB_IDENTITY_TOKEN_FILE ]]; then PROFILE="" PROFILE_OPT="" - elif [[ $INSTANCE_PROFILE ]]; then + elif [[ $INSTANCE_PROFILE ]] + then PROFILE="INSTANCE-PROFILE" - AWS_ACCESS_KEY_ID=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} | grep AccessKeyId | cut -d':' -f2 | sed 's/[^0-9A-Z]*//g') - AWS_SECRET_ACCESS_KEY_ID=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} | grep SecretAccessKey | cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g') - AWS_SESSION_TOKEN=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/${INSTANCE_PROFILE} grep Token| cut -d':' -f2 | sed 's/[^0-9A-Za-z/+=]*//g') - elif [[ $AWS_EXECUTION_ENV == "CloudShell" ]]; then + INSTANCE_METADATA=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/"${INSTANCE_PROFILE}") + AWS_ACCESS_KEY_ID=$(jq '.AccessKeyId' <<< "${INSTANCE_METADATA}") + export AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY=$(jq '.SecretAccessKey' <<< "${INSTANCE_METADATA}") + export AWS_SECRET_ACCESS_KEY + AWS_SESSION_TOKEN=$(jq '.Token' <<< "${INSTANCE_METADATA}") + export AWS_SESSION_TOKEN + elif [[ $AWS_EXECUTION_ENV == "CloudShell" ]] + then PROFILE_OPT="" else PROFILE="default" diff --git a/include/execute_check b/include/execute_check index 364b056c7c..9c1c958c17 100644 --- a/include/execute_check +++ b/include/execute_check @@ -21,7 +21,7 @@ execute_check() { # Following logic looks for time remaining in the session and review it # if it is less than 600 seconds, 10 minutes. CURRENT_TIMESTAMP=$(date -u "+%s") - SESSION_TIME_REMAINING=$(("${AWS_SESSION_EXPIRATION}" - "${CURRENT_TIMESTAMP}")) + SESSION_TIME_REMAINING=$(expr "${AWS_SESSION_EXPIRATION}" - "${CURRENT_TIMESTAMP}") MINIMUM_REMAINING_TIME_ALLOWED=600 if (( "${MINIMUM_REMAINING_TIME_ALLOWED}" > "${SESSION_TIME_REMAINING}" )); then # echo LESS THAN 10 MIN LEFT: RE-ASSUMING... diff --git a/include/organizations_metadata b/include/organizations_metadata index bb51df8306..3f085091d1 100644 --- a/include/organizations_metadata +++ b/include/organizations_metadata @@ -20,9 +20,6 @@ get_orgs_account_details(){ echo " Prowler is getting details from the AWS Organizations Management Account: ${MANAGEMENT_ACCOUNT_ID}..." - # Assume role to recover AWS Organizations metadata - assume_role - # The following code requires organizations:ListTagsForResource ACCOUNTS_DETAILS=$($AWSCLI $PROFILE_OPT --region "${REGION}" organizations list-accounts --output json 2>&1) if ! grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${ACCOUNTS_DETAILS}" diff --git a/include/validate_options b/include/validate_options index a7e2d5bd8d..3ae627f61e 100644 --- a/include/validate_options +++ b/include/validate_options @@ -72,6 +72,9 @@ validate_organizations() { # Set the new account to assume to recover AWS Organizations Metadata ACCOUNT_TO_ASSUME="${MANAGEMENT_ACCOUNT_ID}" + # Assume role to recover AWS Organizations metadata + assume_role + # Recover AWS Organizations Metadata get_orgs_account_details @@ -81,12 +84,14 @@ validate_organizations() { # Restoring initial credentials restoreInitialAWSCredentials fi +} - if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]] - then - backupInitialAWSCredentials - assume_role - fi +validate_assume_role() { + if [[ -n "${ACCOUNT_TO_ASSUME}" || -n "${ROLE_TO_ASSUME}" ]] + then + backupInitialAWSCredentials + assume_role + fi } # JUnit output if -M junit-xml diff --git a/include/whoami b/include/whoami index edb2e98b30..bbfb7e896e 100644 --- a/include/whoami +++ b/include/whoami @@ -26,7 +26,7 @@ print_whoami(){ echo -e " Caller Identity ARN: ${NOTICE}[${CALLER_ARN}]${NORMAL}\n" } -get_aws_credentials() { +get_caller_identity() { case "$REGION" in me-south-1|eu-south-1|ap-east-1|af-south-1) REGION_FOR_STS="us-east-1" diff --git a/prowler b/prowler index 3068391630..0486c55da8 100755 --- a/prowler +++ b/prowler @@ -308,9 +308,16 @@ aws_cli_detector aws_profile_loader # Gather account data / test aws cli connectivity -get_aws_credentials +get_caller_identity print_whoami +validate_allowlist + + +validate_organizations +# Check Assume Role +validate_assume_role + # List regions get_regions @@ -318,8 +325,7 @@ get_regions validate_custom_output_directory validate_custom_output_filename validate_security_hub -validate_organizations -validate_allowlist + validate_custom_checks # Add headers to certain output files