feat(inventory): Prowler quick inventory including IAM resources (#1258)

* chore(inventory): option included in main

* chore(inventory): quick inventory

* chore(inventory): functional version

* chore(inventory): functional version without echo

* Update include/quick_inventory

Co-authored-by: Pepe Fagoaga <pepe@verica.io>

* Update prowler

Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>

* Added new line at report line

* Added more information from IAM

Co-authored-by: Pepe Fagoaga <pepe@verica.io>
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>

include/quick_inventory

@@ -35,46 +35,95 @@ quick_inventory(){
     TEMP_INVENTORY_FILE=$(mktemp -t prowler-inventory-${ACCOUNT_NUM}.XXXXXXXXXX)
     INVENTORY_FILE="$OUTPUT_DIR/prowler-inventory-${ACCOUNT_NUM}-${OUTPUT_DATE}.csv"
 
-    echo "-=- Running the inventory for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-"
-    echo -e "\n # Counting resources by region:"
+    echo "-=- Running the inventory for AWS Account ${BLUE}${ACCOUNT_NUM}${NORMAL} - ${BLUE}BETA FEATURE${NORMAL} -=-"
+
     # get all resources per region and getting only their ARN
+
+    echo -ne "\n # Counting IAM resources in default region $REGION... "
+    # since this api doesn't get IAM properly, first we get it directly:
+    # get IAM_ROLES
+    $AWSCLI iam list-roles --query "Roles[].Arn" \
+        $PROFILE_OPT \
+        --region $REGION \
+        --output json | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" 
+
+    # get IAM_USERS
+    $AWSCLI iam list-users --query "Users[].Arn" \
+        $PROFILE_OPT \
+        --region $REGION \
+        --output json \
+        --query "Users[].Arn" | jq -r '.[]'  >> "${TEMP_INVENTORY_FILE}" 
+
+    # get IAM_GROUPS
+    $AWSCLI iam list-groups --query "Groups[].Arn" \
+        $PROFILE_OPT \
+        --region $REGION \
+        --output json | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" 
+
+    # get IAM_MANAGED_POLICIES
+    $AWSCLI iam list-policies --query "Policies[].Arn" \
+        $PROFILE_OPT \
+        --region $REGION \
+        --output json | jq -r '.[]' | grep :${ACCOUNT_NUM}:  >> "${TEMP_INVENTORY_FILE}" 
+
+    # get SAML PROVIDERS
+    $AWSCLI iam list-saml-providers --query "SAMLProviderList[].Arn" \
+        $PROFILE_OPT \
+        --region $REGION \
+        --output json | jq -r '.[]'  >> "${TEMP_INVENTORY_FILE}" 
+
+    echo -e "${OK}DONE${NORMAL}"
+
+    # get other resources using resourcegroupstaggingapi get-resources
+    echo -e "\n # Counting rest of resources by region..."
     for region in $REGIONS; do
+    #(
         echo -ne " - $region: "
         AWS_RESOURCES=$($AWSCLI resourcegroupstaggingapi get-resources \
             $PROFILE_OPT \
             --region $region \
             --query ResourceTagMappingList[].ResourceARN \
             --output json 2>&1)
+        
+        # error handling 
         if grep -q -E 'service control policy' <<< "${AWS_RESOURCES}"; then
             echo -e "${BAD}blocked by a SCP${NORMAL}"
             continue
         fi
 
         if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "$AWS_RESOURCES"; then
-            echo "${BAD}Access Denied trying to get AWS Resources${NORMAL}"
+            echo -e "${BAD}Access Denied trying to get AWS Resources${NORMAL}"
             continue
         fi
-        jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}" 
-        TOTAL_RESOURCES_FOUND_REGION=$(grep -c "${region}" "${TEMP_INVENTORY_FILE}")
+       
+        jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}-${region}" 
+        TOTAL_RESOURCES_FOUND_REGION=$(awk 'END { print NR }' "${TEMP_INVENTORY_FILE}-${region}")
+
+        if [ "${region}" == "us-east-1" ]; then
+            TOTAL_IAM_RESOURCES_FOUND=$(grep -c :"iam": "${TEMP_INVENTORY_FILE}-${region}")
+            TOTAL_RESOURCES_FOUND_REGION=$(("${TOTAL_RESOURCES_FOUND_REGION}-${region}"+${TOTAL_IAM_RESOURCES_FOUND}))
+        fi 
 
         echo -e "${OK}${TOTAL_RESOURCES_FOUND_REGION}${NORMAL} resources!"
         
-        TOTAL_RESOURCES_FOUND=$(("${TOTAL_RESOURCES_FOUND}"+"${TOTAL_RESOURCES_FOUND_REGION}"))
-    done
-    echo -e "Total resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n"
-
+        cat "${TEMP_INVENTORY_FILE}-${region}" >> ${TEMP_INVENTORY_FILE}
+        cleanInventoryTemporaryFilesByRegion
+    #) &
+    done 
+    #wait
+    
     # Generate file in CSV format
     # send header first
     echo "aws_partition,aws_service,aws_region,aws_account_id,subservice_resource,arn" > "${INVENTORY_FILE}"
-    
     while IFS=: read -r arn aws_partition aws_service aws_region aws_account_id subservice_resource; do
         echo "$aws_partition,$aws_service,$aws_region,$aws_account_id,$subservice_resource,$aws_partition:$aws_service:$aws_region:$aws_account_id:$subservice_resource"
     done < "${TEMP_INVENTORY_FILE}" >> "${INVENTORY_FILE}"
 
     # Show resources found per service
+    echo -e "\n-=- List of type of resources per service for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-\n"
     LIST_OF_DETECTED_SERVICES=$(grep -v subservice_resource < "${INVENTORY_FILE}" | awk -F',' '{ print $2 }' | sort -u )
     for aws_service in $LIST_OF_DETECTED_SERVICES;do
-        echo "-=- ${YELLOW}$aws_service${NORMAL} inventory for AWS Account ${ACCOUNT_NUM} -=-"
+        echo "-=- ${YELLOW}$aws_service${NORMAL} service -=-"
         if [[ $aws_service == 's3' ]];then
             TOTAL_S3_BUCKETS=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | wc -l | xargs)
             echo "$TOTAL_S3_BUCKETS buckets"
@@ -83,11 +132,18 @@ quick_inventory(){
             echo "$TOTAL_RESOURCE_SERVICE"
         fi
     done
-    echo -e "\nMore details in file: ${INVENTORY_FILE}\n"
+    
+    TOTAL_RESOURCES_FOUND=$(awk 'END { print NR - 1 }' ${INVENTORY_FILE})
+    echo -e "\nTotal resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n"
+    echo -e "More details in file: ${OK}${INVENTORY_FILE}${NORMAL}\n"
     # Clean temp file
     cleanInventoryTemporaryFiles
 }
 
 cleanInventoryTemporaryFiles() {
     rm -fr "${TEMP_INVENTORY_FILE}"
+}
+
+cleanInventoryTemporaryFilesByRegion() {
+    rm -fr "${TEMP_INVENTORY_FILE}-${region}"
 }