ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-11-08 20:33:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added -D option to copy to S3 with the initial AWS credentials

Browse Source
This commit is contained in:
Andrea Di Fabio committed 2021-12-21 11:11:53 -05:00
1 parent 6cb3d23ed2
commit 949c2056ab
3 files changed
+55 -35
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

include/assume_role
+34 -22
View File
@@ -12,10 +12,9 @@
# specific language governing permissions and limitations under the License.
assume_role(){
MY_AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
MY_AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
MY_SESSION_TOKEN=$AWS_SESSION_TOKEN
PROFILE_OPT=$PROFILE_OPT_BAK
# Both variables are mandatory to be set together
if [[ -z $ROLE_TO_ASSUME || -z $ACCOUNT_TO_ASSUME ]]; then
echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
@@ -67,18 +66,18 @@ assume_role(){
PROFILE_OPT=""
# Set AWS environment variables with assumed role credentials
AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "${TEMP_STS_ASSUMED_FILE}")
export AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_TOKEN
AWS_SESSION_EXPIRATION=$(jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_EXPIRATION
echo TEMP AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
echo TEMP AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
echo TEMP AWS_SESSION_TOKEN: $AWS_SESSION_TOKEN
echo EXPIRATION EPOCH TIME: $AWS_SESSION_EXPIRATION
ASSUME_AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "${TEMP_STS_ASSUMED_FILE}")
export AWS_ACCESS_KEY_ID=$ASSUME_AWS_ACCESS_KEY_ID
ASSUME_AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SECRET_ACCESS_KEY=$ASSUME_AWS_SECRET_ACCESS_KEY
ASSUME_AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_TOKEN=$ASSUME_AWS_SESSION_TOKEN
ASSUME_AWS_SESSION_EXPIRATION=$(jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601' "${TEMP_STS_ASSUMED_FILE}")
export AWS_SESSION_EXPIRATION=$ASSUME_AWS_SESSION_EXPIRATION
echo TEMP AWS_ACCESS_KEY_ID: $ASSUME_AWS_ACCESS_KEY_ID
echo TEMP AWS_SECRET_ACCESS_KEY: $ASSUME_AWS_SECRET_ACCESS_KEY
echo TEMP AWS_SESSION_TOKEN: $ASSUME_AWS_SESSION_TOKEN
echo EXPIRATION EPOCH TIME: $ASSUME_AWS_SESSION_EXPIRATION
cleanSTSAssumeFile
}
@@ -88,11 +87,24 @@ cleanSTSAssumeFile() {
rm -fr "${TEMP_STS_ASSUMED_ERROR}"
}
restoreAWSCredentials() {
AWS_ACCESS_KEY_ID=$MY_AWS_ACCESS_KEY_ID
export AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY=$MY_AWS_SECRET_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY
SESSION_TOKEN=$MY_AWS_SESSION_TOKEN
export SESSION_TOKEN
backupInitialAWSCredentials() {
# echo Backing up current AWS ENV Credentials
if [[ $(printenv AWS_ACCESS_KEY_ID) ]]; then
# echo Current AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
MY_AWS_ACCESS_KEY_ID=$(printenv AWS_ACCESS_KEY_ID)
fi
if [[ $(printenv AWS_SECRET_ACCESS_KEY) ]]; then
# echo AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
MY_AWS_SECRET_ACCESS_KEY=$(printenv AWS_SECRET_ACCESS_KEY)
fi
if [[ $(printenv AWS_SESSION_TOKEN) ]]; then
# echo AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN
MY_AWS_SESSION_TOKEN=$(printenv AWS_SESSION_TOKEN)
fi
}
restoreInitialAWSCredentials() {
export AWS_ACCESS_KEY_ID=$MY_AWS_ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY=$MY_AWS_SECRET_ACCESS_KEY
export AWS_SESSION_TOKEN=$MY_AWS_SESSION_TOKEN
}
include/outputs_bucket
+6 -6
View File
@@ -15,18 +15,18 @@ if [[ $OUTPUT_BUCKET ]]; then
# output mode has to be set to other than text
if [[ "${MODES[@]}" =~ "html" ]] || [[ "${MODES[@]}" =~ "csv" ]] || [[ "${MODES[@]}" =~ "json" ]] || [[ "${MODES[@]}" =~ "json-asff" ]]; then
OUTPUT_BUCKET_WITHOUT_FOLDERS=$(echo $OUTPUT_BUCKET | awk -F'/' '{ print $1 }')
OUTPUT_BUCKET_STATUS=$($AWSCLI s3api head-bucket --bucket "$OUTPUT_BUCKET" 2>&1 || true)
if [[ ! -z $OUTPUT_BUCKET_STATUS ]]; then
echo "$OPTRED ERROR!$OPTNORMAL wrong bucket name or not right permissions."
exit 1
else
# OUTPUT_BUCKET_STATUS=$($AWSCLI s3api head-bucket --bucket "$OUTPUT_BUCKET" 2>&1 || true)
# if [[ -z $OUTPUT_BUCKET_STATUS ]]; then
# echo "$OPTRED ERROR!$OPTNORMAL wrong bucket name or not right permissions."
# exit 1
# else
# need to make sure last / is not set to avoid // in S3
if [[ $OUTPUT_BUCKET != *"/" ]]; then
OUTPUT_BUCKET="$OUTPUT_BUCKET"
else
OUTPUT_BUCKET=${OUTPUT_BUCKET::-1}
fi
fi
# fi
else
echo "$OPTRED ERROR!$OPTNORMAL - Mode (-M) has to be set as well. Use -h for help."
exit 1