feat(inventory): Prowler quick inventory (#1245)

* chore(inventory): option included in main

* chore(inventory): quick inventory

* chore(inventory): functional version

* chore(inventory): functional version without echo

* Update include/quick_inventory

Co-authored-by: Pepe Fagoaga <pepe@verica.io>

* Update prowler

Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>

* Added new line at report line

Co-authored-by: Pepe Fagoaga <pepe@verica.io>
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>

include/quick_inventory

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2021) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+###############################################################################
+
+# Probably the easier and quickest way to get a resouce inventory in AWS.
+
+# Lists (almost) all resources in all regions based on:
+# https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html
+
+# this list is not accurate https://docs.aws.amazon.com/ARG/latest/userguide/supported-resources.html
+# don't fully trust that list column "Tag-based Groups". 
+# as far as I can see it doesn't include:
+# CodeBuild build projects like arn:aws:codebuild:eu-west-1:123456789012:build/Abcdefg
+# despite the supported-resources documentation page
+
+# Requires IAM permissions:
+# resource-groups:Get*
+# resource-groups:GroupResources
+
+
+# Quick inventory part
+quick_inventory(){
+    # Create a temporary file to store all resources arn 
+    TEMP_INVENTORY_FILE=$(mktemp -t prowler-inventory-${ACCOUNT_NUM}.XXXXXXXXXX)
+    INVENTORY_FILE="$OUTPUT_DIR/prowler-inventory-${ACCOUNT_NUM}-${OUTPUT_DATE}.csv"
+
+    echo "-=- Running the inventory for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-"
+    echo -e "\n # Counting resources by region:"
+    # get all resources per region and getting only their ARN
+    for region in $REGIONS; do
+        echo -ne " - $region: "
+        AWS_RESOURCES=$($AWSCLI resourcegroupstaggingapi get-resources \
+            $PROFILE_OPT \
+            --region $region \
+            --query ResourceTagMappingList[].ResourceARN \
+            --output json 2>&1)
+        if grep -q -E 'service control policy' <<< "${AWS_RESOURCES}"; then
+            echo -e "${BAD}blocked by a SCP${NORMAL}"
+            continue
+        fi
+
+        if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "$AWS_RESOURCES"; then
+            echo "${BAD}Access Denied trying to get AWS Resources${NORMAL}"
+            continue
+        fi
+        jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}" 
+        TOTAL_RESOURCES_FOUND_REGION=$(grep -c "${region}" "${TEMP_INVENTORY_FILE}")
+
+        echo -e "${OK}${TOTAL_RESOURCES_FOUND_REGION}${NORMAL} resources!"
+        
+        TOTAL_RESOURCES_FOUND=$(("${TOTAL_RESOURCES_FOUND}"+"${TOTAL_RESOURCES_FOUND_REGION}"))
+    done
+    echo -e "Total resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n"
+
+    # Generate file in CSV format
+    # send header first
+    echo "aws_partition,aws_service,aws_region,aws_account_id,subservice_resource,arn" > "${INVENTORY_FILE}"
+    
+    while IFS=: read -r arn aws_partition aws_service aws_region aws_account_id subservice_resource; do
+        echo "$aws_partition,$aws_service,$aws_region,$aws_account_id,$subservice_resource,$aws_partition:$aws_service:$aws_region:$aws_account_id:$subservice_resource"
+    done < "${TEMP_INVENTORY_FILE}" >> "${INVENTORY_FILE}"
+
+    # Show resources found per service
+    LIST_OF_DETECTED_SERVICES=$(grep -v subservice_resource < "${INVENTORY_FILE}" | awk -F',' '{ print $2 }' | sort -u )
+    for aws_service in $LIST_OF_DETECTED_SERVICES;do
+        echo "-=- ${YELLOW}$aws_service${NORMAL} inventory for AWS Account ${ACCOUNT_NUM} -=-"
+        if [[ $aws_service == 's3' ]];then
+            TOTAL_S3_BUCKETS=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | wc -l | xargs)
+            echo "$TOTAL_S3_BUCKETS buckets"
+        else
+            TOTAL_RESOURCE_SERVICE=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | awk -F'/' '{ print $1 }' | awk -F':' '{ print $1 }' | sort | uniq -c)
+            echo "$TOTAL_RESOURCE_SERVICE"
+        fi
+    done
+    echo -e "\nMore details in file: ${INVENTORY_FILE}\n"
+    # Clean temp file
+    cleanInventoryTemporaryFiles
+}
+
+cleanInventoryTemporaryFiles() {
+    rm -fr "${TEMP_INVENTORY_FILE}"
+}