diff --git a/include/quick_inventory b/include/quick_inventory index f66f027bdc..393d772125 100644 --- a/include/quick_inventory +++ b/include/quick_inventory @@ -35,46 +35,95 @@ quick_inventory(){ TEMP_INVENTORY_FILE=$(mktemp -t prowler-inventory-${ACCOUNT_NUM}.XXXXXXXXXX) INVENTORY_FILE="$OUTPUT_DIR/prowler-inventory-${ACCOUNT_NUM}-${OUTPUT_DATE}.csv" - echo "-=- Running the inventory for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-" - echo -e "\n # Counting resources by region:" + echo "-=- Running the inventory for AWS Account ${BLUE}${ACCOUNT_NUM}${NORMAL} - ${BLUE}BETA FEATURE${NORMAL} -=-" + # get all resources per region and getting only their ARN + + echo -ne "\n # Counting IAM resources in default region $REGION... " + # since this api doesn't get IAM properly, first we get it directly: + # get IAM_ROLES + $AWSCLI iam list-roles --query "Roles[].Arn" \ + $PROFILE_OPT \ + --region $REGION \ + --output json | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" + + # get IAM_USERS + $AWSCLI iam list-users --query "Users[].Arn" \ + $PROFILE_OPT \ + --region $REGION \ + --output json \ + --query "Users[].Arn" | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" + + # get IAM_GROUPS + $AWSCLI iam list-groups --query "Groups[].Arn" \ + $PROFILE_OPT \ + --region $REGION \ + --output json | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" + + # get IAM_MANAGED_POLICIES + $AWSCLI iam list-policies --query "Policies[].Arn" \ + $PROFILE_OPT \ + --region $REGION \ + --output json | jq -r '.[]' | grep :${ACCOUNT_NUM}: >> "${TEMP_INVENTORY_FILE}" + + # get SAML PROVIDERS + $AWSCLI iam list-saml-providers --query "SAMLProviderList[].Arn" \ + $PROFILE_OPT \ + --region $REGION \ + --output json | jq -r '.[]' >> "${TEMP_INVENTORY_FILE}" + + echo -e "${OK}DONE${NORMAL}" + + # get other resources using resourcegroupstaggingapi get-resources + echo -e "\n # Counting rest of resources by region..." for region in $REGIONS; do + #( echo -ne " - $region: " AWS_RESOURCES=$($AWSCLI resourcegroupstaggingapi get-resources \ $PROFILE_OPT \ --region $region \ --query ResourceTagMappingList[].ResourceARN \ --output json 2>&1) + + # error handling if grep -q -E 'service control policy' <<< "${AWS_RESOURCES}"; then echo -e "${BAD}blocked by a SCP${NORMAL}" continue fi if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "$AWS_RESOURCES"; then - echo "${BAD}Access Denied trying to get AWS Resources${NORMAL}" + echo -e "${BAD}Access Denied trying to get AWS Resources${NORMAL}" continue fi - jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}" - TOTAL_RESOURCES_FOUND_REGION=$(grep -c "${region}" "${TEMP_INVENTORY_FILE}") + + jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}-${region}" + TOTAL_RESOURCES_FOUND_REGION=$(awk 'END { print NR }' "${TEMP_INVENTORY_FILE}-${region}") + + if [ "${region}" == "us-east-1" ]; then + TOTAL_IAM_RESOURCES_FOUND=$(grep -c :"iam": "${TEMP_INVENTORY_FILE}-${region}") + TOTAL_RESOURCES_FOUND_REGION=$(("${TOTAL_RESOURCES_FOUND_REGION}-${region}"+${TOTAL_IAM_RESOURCES_FOUND})) + fi echo -e "${OK}${TOTAL_RESOURCES_FOUND_REGION}${NORMAL} resources!" - TOTAL_RESOURCES_FOUND=$(("${TOTAL_RESOURCES_FOUND}"+"${TOTAL_RESOURCES_FOUND_REGION}")) - done - echo -e "Total resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n" - + cat "${TEMP_INVENTORY_FILE}-${region}" >> ${TEMP_INVENTORY_FILE} + cleanInventoryTemporaryFilesByRegion + #) & + done + #wait + # Generate file in CSV format # send header first echo "aws_partition,aws_service,aws_region,aws_account_id,subservice_resource,arn" > "${INVENTORY_FILE}" - while IFS=: read -r arn aws_partition aws_service aws_region aws_account_id subservice_resource; do echo "$aws_partition,$aws_service,$aws_region,$aws_account_id,$subservice_resource,$aws_partition:$aws_service:$aws_region:$aws_account_id:$subservice_resource" done < "${TEMP_INVENTORY_FILE}" >> "${INVENTORY_FILE}" # Show resources found per service + echo -e "\n-=- List of type of resources per service for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-\n" LIST_OF_DETECTED_SERVICES=$(grep -v subservice_resource < "${INVENTORY_FILE}" | awk -F',' '{ print $2 }' | sort -u ) for aws_service in $LIST_OF_DETECTED_SERVICES;do - echo "-=- ${YELLOW}$aws_service${NORMAL} inventory for AWS Account ${ACCOUNT_NUM} -=-" + echo "-=- ${YELLOW}$aws_service${NORMAL} service -=-" if [[ $aws_service == 's3' ]];then TOTAL_S3_BUCKETS=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | wc -l | xargs) echo "$TOTAL_S3_BUCKETS buckets" @@ -83,11 +132,18 @@ quick_inventory(){ echo "$TOTAL_RESOURCE_SERVICE" fi done - echo -e "\nMore details in file: ${INVENTORY_FILE}\n" + + TOTAL_RESOURCES_FOUND=$(awk 'END { print NR - 1 }' ${INVENTORY_FILE}) + echo -e "\nTotal resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n" + echo -e "More details in file: ${OK}${INVENTORY_FILE}${NORMAL}\n" # Clean temp file cleanInventoryTemporaryFiles } cleanInventoryTemporaryFiles() { rm -fr "${TEMP_INVENTORY_FILE}" +} + +cleanInventoryTemporaryFilesByRegion() { + rm -fr "${TEMP_INVENTORY_FILE}-${region}" } \ No newline at end of file