mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
Add AWS Advance Shield protection checks @michael-dickinson-sainsburys
Add AWS Advance Shield protection checks @michael-dickinson-sainsburys
This commit is contained in:
Toni de la Fuente
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7166="7.166"
|
||||
CHECK_TITLE_extra7166="[extra7166] Check if Elastic IP addresses with associations are protected by AWS Shield Advanced"
|
||||
CHECK_SCORED_extra7166="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7166="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7166="AwsEc2Eip"
|
||||
CHECK_ALTERNATE_extra7166="extra7166"
|
||||
CHECK_SERVICENAME_extra7166="shield"
|
||||
CHECK_RISK_extra7166='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7166='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7166='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7166='Infrastructure security'
|
||||
|
||||
extra7166() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
|
||||
PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
|
||||
ACCOUNT_ID=$(echo $CALLER_IDENTITY | cut -d: -f5)
|
||||
for regx in $REGIONS; do
|
||||
LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS=$($AWSCLI ec2 describe-addresses $PROFILE_OPT --region $regx --query 'Addresses[?AssociationId].AllocationId' --output text)
|
||||
if [[ $LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS ]]; then
|
||||
for elastic_ip in $LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS; do
|
||||
EIP_ARN="arn:${PARTITION}:ec2:${regx}:${ACCOUNT_ID}:eip-allocation/${elastic_ip}"
|
||||
if aws shield describe-protection --resource-arn $EIP_ARN >/dev/null 2>&1; then
|
||||
textPass "$regx: EIP $elastic_ip is protected by AWS Shield Advanced" "$regx" "$elastic_ip"
|
||||
else
|
||||
textFail "$regx: EIP $elastic_ip is not protected by AWS Shield Advanced" "$regx" "$elastic_ip"
|
||||
fi
|
||||
done
|
||||
else
|
||||
textPass "$regx: no elastic IP addresses with assocations found" "$regx"
|
||||
fi
|
||||
done
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7167="7.167"
|
||||
CHECK_TITLE_extra7167="[extra7167] Check if Cloudfront distributions are protected by AWS Shield"
|
||||
CHECK_SCORED_extra7167="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7167="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7167="AwsCloudFrontDistribution"
|
||||
CHECK_ALTERNATE_extra7167="extra7167"
|
||||
CHECK_SERVICENAME_extra7167="shield"
|
||||
CHECK_RISK_extra7167='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7167='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7167='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7167='Infrastructure security'
|
||||
|
||||
extra7167() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
LIST_OF_CLOUDFRONT_DISTRIBUTIONS=$($AWSCLI cloudfront list-distributions $PROFILE_OPT --query 'DistributionList.Items[*].[Id,ARN]' --output text)
|
||||
if [[ $LIST_OF_CLOUDFRONT_DISTRIBUTIONS ]]; then
|
||||
while read -r distribution; do
|
||||
DISTRIBUTION_ID=$(echo $distribution | awk '{ print $1; }')
|
||||
DISTRIBUTION_ARN=$(echo $distribution | awk '{ print $2; }')
|
||||
if aws shield describe-protection --resource-arn $DISTRIBUTION_ARN >/dev/null 2>&1; then
|
||||
textPass "$REGION: Cloudfront distribution $DISTRIBUTION_ID is protected by AWS Shield Advanced" "$REGION" "$DISTRIBUTION_ID"
|
||||
else
|
||||
textFail "$REGION: Cloudfront distribution $DISTRIBUTION_ID is not protected by AWS Shield Advanced" "$REGION" "$DISTRIBUTION_ID"
|
||||
fi
|
||||
done <<<"$LIST_OF_CLOUDFRONT_DISTRIBUTIONS"
|
||||
else
|
||||
textPass "$REGION: no Cloudfront distributions found" "$REGION"
|
||||
fi
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7168="7.168"
|
||||
CHECK_TITLE_extra7168="[extra7168] Check if Route53 hosted zones are protected by AWS Shield"
|
||||
CHECK_SCORED_extra7168="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7168="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7168="AwsRoute53Domain"
|
||||
CHECK_ALTERNATE_extra7168="extra7168"
|
||||
CHECK_SERVICENAME_extra7168="shield"
|
||||
CHECK_RISK_extra7168='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7168='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7168='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7168='Infrastructure security'
|
||||
|
||||
extra7168() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
|
||||
PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
|
||||
LIST_OF_ROUTE53_HOSTED_ZONES=$($AWSCLI route53 list-hosted-zones $PROFILE_OPT --query 'HostedZones[*].[Id,Name]' --output text)
|
||||
if [[ $LIST_OF_ROUTE53_HOSTED_ZONES ]]; then
|
||||
while read -r hosted_zone; do
|
||||
HOSTED_ZONE_ID=$(echo $hosted_zone | awk '{ print $1; }')
|
||||
HOSTED_ZONE_NAME=$(echo $hosted_zone | awk '{ print $2; }')
|
||||
HOSTED_ZONE_ARN="arn:${PARTITION}:route53:::${HOSTED_ZONE_ID:1}"
|
||||
if aws shield describe-protection --resource-arn $HOSTED_ZONE_ARN >/dev/null 2>&1; then
|
||||
textPass "$REGION: Route53 Hosted Zone $HOSTED_ZONE_NAME is protected by AWS Shield Advanced" "$REGION" "$HOSTED_ZONE_NAME"
|
||||
else
|
||||
textFail "$REGION: Route53 Hosted Zone $HOSTED_ZONE_NAME is not protected by AWS Shield Advanced" "$REGION" "$HOSTED_ZONE_NAME"
|
||||
fi
|
||||
done <<<"$LIST_OF_ROUTE53_HOSTED_ZONES"
|
||||
else
|
||||
textPass "$REGION: no Route53 hosted zones found" "$REGION"
|
||||
fi
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7169="7.169"
|
||||
CHECK_TITLE_extra7169="[extra7169] Check if global accelerators are protected by AWS Shield"
|
||||
CHECK_SCORED_extra7169="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7169="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7169="AwsGlobalAccelerator"
|
||||
CHECK_ALTERNATE_extra7169="extra7169"
|
||||
CHECK_SERVICENAME_extra7169="shield"
|
||||
CHECK_RISK_extra7169='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7169='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7169='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7169='Infrastructure security'
|
||||
|
||||
extra7169() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
LIST_OF_GLOBAL_ACCELERATORS=$($AWSCLI globalaccelerator list-accelerators --region us-west-2 $PROFILE_OPT --query 'Accelerators[?Enabled].[Name,AcceleratorArn]' --output text)
|
||||
if [[ $LIST_OF_GLOBAL_ACCELERATORS ]]; then
|
||||
while read -r accelerator; do
|
||||
ACCELERATOR_NAME=$(echo $accelerator | awk '{ print $1; }')
|
||||
ACCELERATOR_ARN=$(echo $accelerator | awk '{ print $2; }')
|
||||
if aws shield describe-protection --resource-arn $ACCELERATOR_ARN >/dev/null 2>&1; then
|
||||
textPass "$REGION: Global Accelerator $ACCELERATOR_NAME is protected by AWS Shield Advanced" "$REGION" "$ACCELERATOR_NAME"
|
||||
else
|
||||
textFail "$REGION: Global Accelerator $ACCELERATOR_NAME is not protected by AWS Shield Advanced" "$REGION" "$ACCELERATOR_NAME"
|
||||
fi
|
||||
done <<<"$LIST_OF_GLOBAL_ACCELERATORS"
|
||||
else
|
||||
textPass "$REGION: no global accelerators found" "$REGION"
|
||||
fi
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7170="7.170"
|
||||
CHECK_TITLE_extra7170="[extra7170] Check if internet-facing application load balancers are protected by AWS Shield"
|
||||
CHECK_SCORED_extra7170="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7170="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7170="AwsElasticLoadBalancingV2LoadBalancer"
|
||||
CHECK_ALTERNATE_extra7170="extra7170"
|
||||
CHECK_SERVICENAME_extra7170="shield"
|
||||
CHECK_RISK_extra7170='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7170='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7170='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7170='Infrastructure security'
|
||||
|
||||
extra7170() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
for regx in $REGIONS; do
|
||||
LIST_OF_APPLICATION_LOAD_BALANCERS=$($AWSCLI elbv2 describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancers[?Type == `application` && Scheme == `internet-facing`].[LoadBalancerName,LoadBalancerArn]' --output text)
|
||||
if [[ $LIST_OF_APPLICATION_LOAD_BALANCERS ]]; then
|
||||
while read -r alb; do
|
||||
ALB_NAME=$(echo $alb | awk '{ print $1; }')
|
||||
ALB_ARN=$(echo $alb | awk '{ print $2; }')
|
||||
if aws shield describe-protection --resource-arn $ALB_ARN >/dev/null 2>&1; then
|
||||
textPass "$regx: ALB $ALB_NAME is protected by AWS Shield Advanced" "$regx" "$ALB_NAME"
|
||||
else
|
||||
textFail "$regx: ALB $ALB_NAME is not protected by AWS Shield Advanced" "$regx" "$ALB_NAME"
|
||||
fi
|
||||
done <<<"$LIST_OF_APPLICATION_LOAD_BALANCERS"
|
||||
else
|
||||
textPass "$regx: no application load balancers found" "$regx"
|
||||
fi
|
||||
done
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy
|
||||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software distributed
|
||||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations under the License.
|
||||
|
||||
CHECK_ID_extra7171="7.171"
|
||||
CHECK_TITLE_extra7171="[extra7171] Check if classic load balancers are protected by AWS Shield"
|
||||
CHECK_SCORED_extra7171="NOT_SCORED"
|
||||
CHECK_CIS_LEVEL_extra7171="EXTRA"
|
||||
CHECK_SEVERITY_check="Medium"
|
||||
CHECK_ASFF_RESOURCE_TYPE_extra7171="AwsElasticLoadBalancingLoadBalancer"
|
||||
CHECK_ALTERNATE_extra7171="extra7171"
|
||||
CHECK_SERVICENAME_extra7171="shield"
|
||||
CHECK_RISK_extra7171='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
|
||||
CHECK_REMEDIATION_extra7171='Add as a protected resource in AWS Shield Advanced.'
|
||||
CHECK_DOC_extra7171='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
|
||||
CHECK_CAF_EPIC_extra7171='Infrastructure security'
|
||||
|
||||
extra7171() {
|
||||
if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
|
||||
CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
|
||||
PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
|
||||
ACCOUNT_ID=$(echo $CALLER_IDENTITY | cut -d: -f5)
|
||||
for regx in $REGIONS; do
|
||||
LIST_OF_CLASSIC_LOAD_BALANCERS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancerDescriptions[?Scheme == `internet-facing`].[LoadBalancerName]' --output text |grep -v '^None$')
|
||||
if [[ $LIST_OF_CLASSIC_LOAD_BALANCERS ]]; then
|
||||
for elb in $LIST_OF_CLASSIC_LOAD_BALANCERS; do
|
||||
ELB_ARN="arn:${PARTITION}:elasticloadbalancing:${regx}:${ACCOUNT_ID}:loadbalancer/${elb}"
|
||||
if aws shield describe-protection --resource-arn $ELB_ARN >/dev/null 2>&1; then
|
||||
textPass "$regx: ELB $elb is protected by AWS Shield Advanced" "$regx" "$elb"
|
||||
else
|
||||
textFail "$regx: ELB $elb is not protected by AWS Shield Advanced" "$regx" "$elb"
|
||||
fi
|
||||
done
|
||||
else
|
||||
textPass "$regx: no classic load balancers found" "$regx"
|
||||
fi
|
||||
done
|
||||
else
|
||||
textInfo "No AWS Shield Advanced subscription found. Skipping check."
|
||||
fi
|
||||
}
|
||||
+26
-4
@@ -23,7 +23,6 @@
|
||||
# --filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }' \
|
||||
# --metric-transformations metricName=CloudTrailEventCount,metricNamespace=CloudTrailMetrics,metricValue=1
|
||||
|
||||
|
||||
# CHECK_ID_checkN="N.N"
|
||||
# CHECK_TITLE_checkN="[checkN] Description "
|
||||
# CHECK_SCORED_checkN="NOT_SCORED"
|
||||
@@ -31,8 +30,13 @@
|
||||
# CHECK_SEVERITY_check="Medium"
|
||||
# CHECK_ASFF_RESOURCE_TYPE_checkN="AwsAccount" # Choose appropriate value from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html#asff-resources
|
||||
# CHECK_ALTERNATE_checkN="extraN"
|
||||
# CHECK_SERVICENAME_checkN="service" # get service short name from `curl -s https://api.regional-table.region-services.aws.a2z.com/index.json | jq -r '.prices[] | .id' | awk -F: '{ print $1 }' | sort -u`
|
||||
#
|
||||
# CHECK_SERVICENAME_checkN="service" # get service short name from `curl -s https://api.regional-table.region-services.aws.a2z.com/index.json | jq -r '.prices[] | .id' | awk -F: '{ print $1 }' | sort -u`
|
||||
# CHECK_RISK_checkN=""
|
||||
# CHECK_REMEDIATION_checkN=""
|
||||
# CHECK_DOC_checkN=""
|
||||
# CHECK_CAF_EPIC_checkN=""
|
||||
|
||||
# Example of regional resource
|
||||
# extraN(){
|
||||
# # "Description "
|
||||
# textInfo "Looking for instances in all regions... "
|
||||
@@ -42,10 +46,28 @@
|
||||
# while read -r instance;do
|
||||
# INSTANCE_ID=$(echo $instance | awk '{ print $1; }')
|
||||
# PUBLIC_IP=$(echo $instance | awk '{ print $2; }')
|
||||
# textFail "$regx: Instance: $INSTANCE_ID at IP: $PUBLIC_IP is internet-facing!" "$regx"
|
||||
# textFail "$regx: Instance: $INSTANCE_ID at IP: $PUBLIC_IP is internet-facing!" "$regx" "$INSTANCE_ID"
|
||||
# done <<< "$LIST_OF_PUBLIC_INSTANCES"
|
||||
# else
|
||||
# textPass "$regx: no Internet Facing EC2 Instances found" "$regx"
|
||||
# fi
|
||||
# done
|
||||
# }
|
||||
|
||||
# Example of global resource
|
||||
# extraN(){
|
||||
# # "Description "
|
||||
# LIST_DISTRIBUTIONS=$($AWSCLI cloudfront list-distributions $PROFILE_OPT --query 'DistributionList.Items[*].Id' --output text |grep -v ^None)
|
||||
# if [[ $LIST_DISTRIBUTIONS ]]; then
|
||||
# for dist in $LIST_DISTRIBUTIONS; do
|
||||
# GEO_ENABLED=$($AWSCLI cloudfront get-distribution-config $PROFILE_OPT --id $dist --query DistributionConfig.Restrictions.GeoRestriction.RestrictionType --output text)
|
||||
# if [[ $GEO_ENABLED == "none" ]]; then
|
||||
# textFail "$REGION: CloudFront distribution $dist has not Geo restrictions" "$REGION" "$dist"
|
||||
# else
|
||||
# textPass "$REGION: CloudFront distribution $dist has Geo restrictions enabled" "$REGION" "$dist"
|
||||
# fi
|
||||
# done
|
||||
# else
|
||||
# textInfo "$REGION: No CloudFront distributions found"
|
||||
# fi
|
||||
# }
|
||||
|
||||
Reference in New Issue
Block a user