Create credentials file & run.sh

Dockerfile

@@ -0,0 +1,8 @@
+FROM python
+MAINTAINER Bridgecrew <www.bridgecrew.io>
+
+RUN apt-get update && apt-get upgrade -y && apt-get install jq -y && pip install awscli detect-secrets
+
+RUN curl -sL https://github.com/bridgecrewio/prowler/archive/master.tar.gz | tar xz
+
+RUN run.sh

credentials.py

@@ -0,0 +1,26 @@
+import boto3
+import sys
+import json
+import os
+
+sts = boto3.client('sts')
+aws_lambda = boto3.client('lambda', region_name='us-west-2')
+
+aws_account_id = sys.argv[1]
+
+if aws_account_id is None:
+    raise ValueError('Must provide an AWS account ID')
+
+account_details_response = aws_lambda.invoke(
+    FunctionName='customers-api',
+    Payload=json.dumps({"path": "/invoke/getTenantDetails", "body": {"awsAccountId": sys.argv[1]}, "headers": {"Content-Type": "application/json"}}).encode('utf-8')
+)
+
+account_details = json.loads(json.loads(account_details_response['Payload'].read())['body'])
+
+print('Got account details, assuming role')
+
+temporary_creds = sts.assume_role(RoleArn=account_details['cross_account_role_arn'], ExternalId=account_details['external_id'], RoleSessionName='prowler')['Credentials']
+
+os.environ['AWS_ACCESS_KEY_ID2'] = temporary_creds['AccessKeyId']
+os.environ['AWS_SECRET_ACCESS_KEY2'] = temporary_creds['SecretAccessKey']

run.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+AccountId=$1
+Alias=$2
+
+echo $AWS_ACCESS_KEY_ID
+python3 credentials.py $AccountId
+
+echo $AWS_ACCESS_KEY_ID
+echo $AWS_ACCESS_KEY_ID2
+echo "Running prowler on $Alias"
+./prowler -c extra741 -M json > output.json
+
+unset AWS_ACCESS_KEY_ID
+echo $AWS_ACCESS_KEY_ID