ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-02-09 02:30:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

#938 issue assume_role multiple times should be fixed

Browse Source
This commit is contained in:
root
2021-11-30 15:29:10 -05:00
parent 42e54c42cf
commit e5eb066c61
3 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
include/assume_role
View File

@@ -13,6 +13,12 @@
# both variables are mandatory to be set together
assume_role(){
echo ASSUMING ROLE...
PROFILE_OPT=$PROFILE_OPT_BAK
echo PROFILE $PROFILE
echo PROFILE_OPT $PROFILE_OPT
if [[ -z $ROLE_TO_ASSUME ]]; then
echo "$OPTRED ERROR!$OPTNORMAL - Both Account ID (-A) and IAM Role to assume (-R) must be set"
exit 1
@@ -50,6 +56,8 @@ assume_role(){
--region $REGION_FOR_STS \
--external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE 2>&1
fi
echo FILE WITH TEMP CREDS: $TEMP_STS_ASSUMED_FILE
if [[ $(grep AccessDenied $TEMP_STS_ASSUMED_FILE) ]]; then
textFail "Access Denied assuming role $PROWLER_ROLE"
EXITCODE=1
@@ -84,9 +92,13 @@ assume_role(){
export AWS_SECRET_ACCESS_KEY=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.SessionToken')
export AWS_SESSION_EXPIRATION=$(cat $TEMP_STS_ASSUMED_FILE | jq -r '.Credentials.Expiration | sub("\\+00:00";"Z") | fromdateiso8601')
echo TEMP AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
echo TEMP AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
echo TEMP AWS_SESSION_TOKEN: $AWS_SESSION_TOKEN
echo EXPIRATION EPOCH TIME: $AWS_SESSION_EXPIRATION
cleanSTSAssumeFile
}
cleanSTSAssumeFile() {
rm -fr "${TEMP_STS_ASSUMED_FILE}"
}
}

3
include/aws_profile_loader
View File

@@ -45,7 +45,8 @@ else
PROFILE="default"
PROFILE_OPT="--profile $PROFILE"
fi
# Backing up $PROFILE_OPT needed to renew assume_role
PROFILE_OPT_BAK=$PROFILE_OPT
# Set default region by aws config, fall back to us-east-1
REGION_CONFIG=$(aws configure get region)
if [[ $REGION_OPT ]]; then

10
prowler
View File

@@ -135,6 +135,7 @@ while getopts ":hlLkqp:r:c:C:g:f:m:M:E:x:enbVsSI:A:R:T:w:N:o:B:F:zZ:" OPTION; do
;;
p )
PROFILE=$OPTARG
AWS_PROFILE=$OPTARG
;;
r )
REGION_OPT=$OPTARG
@@ -338,6 +339,7 @@ TOTAL_CHECKS=($(echo "${TOTAL_CHECKS[*]}" | tr ' ' '\n' | awk '!seen[$0]++' | so
get_regions() {
# Get list of regions based on include/whoami
REGIONS=$($AWSCLI ec2 describe-regions --query 'Regions[].RegionName' --output text $PROFILE_OPT --region $REGION_FOR_STS --region-names $FILTERREGION 2>&1)
echo $REGIONS
ret=$?
if [[ $ret -ne 0 ]]; then
echo "$OPTRED Access Denied trying to describe regions! Review permissions as described here: https://github.com/toniblyx/prowler/#requirements-and-installation $OPTNORMAL"
@@ -397,8 +399,10 @@ execute_check() {
# if it is less than 600 seconds, 10 minutes.
CURRENT_TIMESTAMP=$(date -u "+%s")
SESSION_TIME_REMAINING=$(expr $AWS_SESSION_EXPIRATION - $CURRENT_TIMESTAMP)
MINIMUM_REMAINING_TIME_ALLOWED="600"
if [[ $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING ]]; then
echo SESSION TIME REMAINING IN SECONDS: $SESSION_TIME_REMAINING
MINIMUM_REMAINING_TIME_ALLOWED=600
if (( $MINIMUM_REMAINING_TIME_ALLOWED > $SESSION_TIME_REMAINING )); then
echo LESS THAN 10 MIN LEFT: RE-ASSUMING...
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN
@@ -644,7 +648,9 @@ if [[ $ACCOUNT_TO_ASSUME ]]; then
fi
# List regions
echo REGIONS_init
get_regions
echo REGIONS_end
# Execute group of checks if called with -g
if [[ $GROUP_ID_READ ]];then