From 9ed7d75c44b5aa6c6c7154838cdb27b18b7afd47 Mon Sep 17 00:00:00 2001
From: root <root@ip-172-16-13-190.ec2.internal>
Date: Sat, 11 Jan 2020 21:38:21 -0500
Subject: [PATCH 01/16] Add command for check119

---
 checks/check119 | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/checks/check119 b/checks/check119
index 5555bbe785..27f9b3a38b 100644
--- a/checks/check119
+++ b/checks/check119
@@ -9,13 +9,27 @@
 # work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
 
 CHECK_ID_check119="1.19"
-CHECK_TITLE_check119="[check119] Ensure IAM instance roles are used for AWS resource access from instances (Not Scored)"
-CHECK_SCORED_check119="NOT_SCORED"
+CHECK_TITLE_check119="[check119] Ensure IAM instance roles are used for AWS resource access from instances (Scored)"
+CHECK_SCORED_check119="SCORED"
 CHECK_TYPE_check119="LEVEL2"
 CHECK_ALTERNATE_check119="check119"
 
 check119(){
-  # "Ensure IAM instance roles are used for AWS resource access from instances (Not Scored)"
-  textInfo "No command available for check 1.19 "
-  textInfo "See section 1.19 on the CIS Benchmark guide for details "
+  for regx in $REGIONS; do
+    EC2_DATA=$($AWSCLI ec2 describe-instances $PROFILE_OPT --region $regx --query 'Reservations[].Instances[].[InstanceId, IamInstanceProfile.Arn]')
+    EC2_DATA=$(echo $EC2_DATA | jq '.[]|{InstanceId: .[0], ProfileArn: .[1]}')
+    INSTANCE_LIST=$(echo $EC2_DATA | jq -r '.InstanceId')
+    if [[ $INSTANCE_LIST ]]; then
+      for instance in $INSTANCE_LIST; do
+        PROFILEARN=$(echo $EC2_DATA | jq -r --arg i "$instance" 'select(.InstanceId==$i)|.ProfileArn')
+        if [[ $PROFILEARN == "null" ]]; then
+          textFail "$regx: Instance $instance not associated with an instance role." $regx
+        else
+          textPass "$regx: Instance $instance associated with role ${PROFILEARN##*/}." $regx
+        fi
+      done
+    else
+      textInfo "$regx: No EC2 instances found" $regx
+    fi
+  done
 }

From a824e064b36b451bbbd2d112d46f92ee620496bc Mon Sep 17 00:00:00 2001
From: jonnyCodev <yonicodev@gmail.com>
Date: Tue, 4 Feb 2020 14:39:42 +0200
Subject: [PATCH 02/16] Check if user have unused console login

---
 checks/check_extra774 | 33 +++++++++++++++++++++++++++++++++
 groups/group1_iam     |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 checks/check_extra774

diff --git a/checks/check_extra774 b/checks/check_extra774
new file mode 100644
index 0000000000..22b17327ad
--- /dev/null
+++ b/checks/check_extra774
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+CHECK_ID_extra774="1.23"
+CHECK_TITLE_extra774="[extra774] Check if user have unused console login"
+CHECK_SCORED_extra774="NOT_SCORED"
+CHECK_TYPE_extra774="EXTRA"
+CHECK_ALTERNATE_check774="extra774"
+MAX_DAYS=-30
+extra774(){
+  LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4,$5 }' |grep true | awk '{ print $1 }')
+
+  for i in $LIST_USERS_WITH_PASSWORD_ENABLED; do
+    user=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $1 }')
+    last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $2 }')
+
+    days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
+    if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then
+        textFail "User $user has not used console login for more then ${MAX_DAYS#-} days"
+      else
+        textPass "User $user has used console login in the past ${MAX_DAYS#-} days"
+    fi
+  done
+}
\ No newline at end of file
diff --git a/groups/group1_iam b/groups/group1_iam
index e999b7c74e..190260305c 100644
--- a/groups/group1_iam
+++ b/groups/group1_iam
@@ -12,4 +12,4 @@ GROUP_ID[1]='group1'
 GROUP_NUMBER[1]='1.0'
 GROUP_TITLE[1]='Identity and Access Management - [group1] **********************'
 GROUP_RUN_BY_DEFAULT[1]='Y' # run it when execute_all is called
-GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122'
+GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122,extra774'

From d473ebe3f21ed0fbd2184653c7c2de56b52aca58 Mon Sep 17 00:00:00 2001
From: jonnyCodev <42693227+jonnyCodev@users.noreply.github.com>
Date: Wed, 5 Feb 2020 11:15:14 +0200
Subject: [PATCH 03/16] moving MAX_DAYS to the inner scope of the function

---
 checks/check_extra774 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/checks/check_extra774 b/checks/check_extra774
index 22b17327ad..baae7869a9 100644
--- a/checks/check_extra774
+++ b/checks/check_extra774
@@ -15,8 +15,9 @@ CHECK_TITLE_extra774="[extra774] Check if user have unused console login"
 CHECK_SCORED_extra774="NOT_SCORED"
 CHECK_TYPE_extra774="EXTRA"
 CHECK_ALTERNATE_check774="extra774"
-MAX_DAYS=-30
+
 extra774(){
+  MAX_DAYS=-30
   LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4,$5 }' |grep true | awk '{ print $1 }')
 
   for i in $LIST_USERS_WITH_PASSWORD_ENABLED; do
@@ -30,4 +31,4 @@ extra774(){
         textPass "User $user has used console login in the past ${MAX_DAYS#-} days"
     fi
   done
-}
\ No newline at end of file
+}

From 2abe36083f7959d55d03ccce98120771eb71148d Mon Sep 17 00:00:00 2001
From: jonnyCodev <42693227+jonnyCodev@users.noreply.github.com>
Date: Wed, 5 Feb 2020 15:55:09 +0200
Subject: [PATCH 04/16] Update group7_extras

---
 groups/group7_extras | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/groups/group7_extras b/groups/group7_extras
index 5a36dbca30..84280f8e21 100644
--- a/groups/group7_extras
+++ b/groups/group7_extras
@@ -15,7 +15,7 @@ GROUP_ID[7]='extras'
 GROUP_NUMBER[7]='7.0'
 GROUP_TITLE[7]='Extras - [extras] **********************************************'
 GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called
-GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773'
+GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774'
 
 # Extras 759 and 760 (lambda variables and code secrets finder are not included)
 # to run detect-secrets use `./prowler -g secrets`

From 029c330ed1c8f716605f23d4e478e351ec8b3faf Mon Sep 17 00:00:00 2001
From: Or Evron <orevron@gmail.com>
Date: Wed, 29 Jan 2020 12:51:36 +0200
Subject: [PATCH 05/16] fix check extra 764

(cherry picked from commit 0db690ad5fa26c0157f6f40ea651495bdd9e9715)
---
 checks/check_extra764 | 36 ++++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/checks/check_extra764 b/checks/check_extra764
index 6fd2c51381..7767077c29 100644
--- a/checks/check_extra764
+++ b/checks/check_extra764
@@ -24,25 +24,29 @@ extra764(){
 
       # get bucket policy
       $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1
-      if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then
-        textFail "Access Denied Trying to Get Bucket Policy for $bucket"
-        rm -f $TEMP_STP_POLICY_FILE
-        continue
-      fi
-      if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then
-        textFail "No bucket policy for $bucket"
-        rm -f $TEMP_STP_POLICY_FILE
-        continue
-      fi
+      cat $TEMP_STP_POLICY_FILE
+      cat $bucket
+#      if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then
+#        textFail "Access Denied Trying to Get Bucket Policy for $bucket"
+#        rm -f $TEMP_STP_POLICY_FILE
+#        continue
+#      fi
+#      if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then
+#        textFail "No bucket policy for $bucket"
+#        rm -f $TEMP_STP_POLICY_FILE
+#        continue
+#      fi
 
       # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/
-      CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")')
-      if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then
-        textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport"
-      else
-        textFail "Bucket $bucket allows requests over insecure transport"
+      # checking if $TEMP_STP_POLICY_FILE is a valid json before converting it to json with jq
+      if jq -e . >/dev/null 2>&1 <<< "$TEMP_STP_POLICY_FILE"; then
+        CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")')
+        if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then
+          textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport"
+        else
+          textFail "Bucket $bucket allows requests over insecure transport"
+        fi
       fi
-
       rm -fr $TEMP_STP_POLICY_FILE
     done
 

From aca93b75267c50be488940e9ed21079279a8b8b3 Mon Sep 17 00:00:00 2001
From: Or Evron <orevron@gmail.com>
Date: Wed, 29 Jan 2020 12:54:00 +0200
Subject: [PATCH 06/16] typo

(cherry picked from commit b89f67bba131da263828e258cc474a460ee3ebcc)
---
 checks/check_extra764 | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/checks/check_extra764 b/checks/check_extra764
index 7767077c29..255f2a6bec 100644
--- a/checks/check_extra764
+++ b/checks/check_extra764
@@ -26,16 +26,16 @@ extra764(){
       $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1
       cat $TEMP_STP_POLICY_FILE
       cat $bucket
-#      if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then
-#        textFail "Access Denied Trying to Get Bucket Policy for $bucket"
-#        rm -f $TEMP_STP_POLICY_FILE
-#        continue
-#      fi
-#      if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then
-#        textFail "No bucket policy for $bucket"
-#        rm -f $TEMP_STP_POLICY_FILE
-#        continue
-#      fi
+      if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then
+        textFail "Access Denied Trying to Get Bucket Policy for $bucket"
+        rm -f $TEMP_STP_POLICY_FILE
+        continue
+      fi
+      if [[ $(grep NoSuchBucketPolicy $TEMP_STP_POLICY_FILE) ]]; then
+        textFail "No bucket policy for $bucket"
+        rm -f $TEMP_STP_POLICY_FILE
+        continue
+      fi
 
       # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/
       # checking if $TEMP_STP_POLICY_FILE is a valid json before converting it to json with jq

From e575fcd6b2fc23b5c68ddeb371adbd2ee2859967 Mon Sep 17 00:00:00 2001
From: Or Evron <orevron@gmail.com>
Date: Wed, 29 Jan 2020 12:54:52 +0200
Subject: [PATCH 07/16] typo

(cherry picked from commit eb4f33642844a1e6150ea5c2862bc4f8fef4bb58)
---
 checks/check_extra764 | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/checks/check_extra764 b/checks/check_extra764
index 255f2a6bec..eaf682d965 100644
--- a/checks/check_extra764
+++ b/checks/check_extra764
@@ -24,8 +24,6 @@ extra764(){
 
       # get bucket policy
       $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_STP_POLICY_FILE 2>&1
-      cat $TEMP_STP_POLICY_FILE
-      cat $bucket
       if [[ $(grep AccessDenied $TEMP_STP_POLICY_FILE) ]]; then
         textFail "Access Denied Trying to Get Bucket Policy for $bucket"
         rm -f $TEMP_STP_POLICY_FILE
@@ -47,6 +45,7 @@ extra764(){
           textFail "Bucket $bucket allows requests over insecure transport"
         fi
       fi
+
       rm -fr $TEMP_STP_POLICY_FILE
     done
 

From 74cbbddc5c9a6c7a42e9775ed19f1f794abb17c2 Mon Sep 17 00:00:00 2001
From: Or Evron <orevron@gmail.com>
Date: Thu, 30 Jan 2020 16:07:29 +0200
Subject: [PATCH 08/16] add text info in case of error occurred

(cherry picked from commit b28917beb758d5c2588a374f3ad8d9f2b4b59f80)
---
 checks/check_extra764 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/checks/check_extra764 b/checks/check_extra764
index eaf682d965..cc8a357497 100644
--- a/checks/check_extra764
+++ b/checks/check_extra764
@@ -44,6 +44,8 @@ extra764(){
         else
           textFail "Bucket $bucket allows requests over insecure transport"
         fi
+      else
+          textInfo "Unknown Error occurred: $TEMP_STP_POLICY_FILE"
       fi
 
       rm -fr $TEMP_STP_POLICY_FILE

From fe2d2b45bb66df98b91e6b42f4a5755a84516be7 Mon Sep 17 00:00:00 2001
From: jonnyCodev <yonicodev@gmail.com>
Date: Thu, 6 Feb 2020 11:10:10 +0200
Subject: [PATCH 09/16] check root account access login and fail if used in the
 last day

---
 checks/check11 | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/checks/check11 b/checks/check11
index a72c704c13..1150ac8b94 100644
--- a/checks/check11
+++ b/checks/check11
@@ -16,6 +16,14 @@ CHECK_ALTERNATE_check101="check11"
 
 check11(){
   # "Avoid the use of the root account (Scored)."
-  COMMAND11=$(cat $TEMP_REPORT_FILE| grep '<root_account>' | cut -d, -f5,11,16 | sed 's/,/\ /g')
-  textInfo "Root account last accessed (password key_1 key_2): $COMMAND11"
+  MAX_DAYS=-1
+  last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep '<root_account>' | awk '{ print $2 }')
+  arn=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$2 }' |grep '<root_account>' | awk '{ print $2 }')
+  days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
+
+  if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
+      textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+  else
+      textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+  fi
 }

From 1e1de4fa463a6c0db99dd2547bb11154d72a90ea Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni@blyx.com>
Date: Fri, 7 Feb 2020 17:00:23 +0100
Subject: [PATCH 10/16] Added Security Hub integration link

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index ac703a8137..bc1a3fa1a1 100644
--- a/README.md
+++ b/README.md
@@ -434,6 +434,10 @@ In order to add any new check feel free to create a new extra check in the extra
 
 ## Third Party Integrations
 
+### AWS Security Hub 
+
+There is a blog post about that integration in the AWS Security blog here <https://aws.amazon.com/blogs/security/use-aws-fargate-prowler-send-security-configuration-findings-about-aws-services-security-hub/>
+
 ### Telegram
 
 Javier Pecete has done an awesome job integrating Prowler with Telegram, you have more details here <https://github.com/i4specete/ServerTelegramBot>

From 528e14d4cfa26da3bde0fe99ce62d7632d803240 Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni@blyx.com>
Date: Mon, 10 Feb 2020 22:55:57 +0100
Subject: [PATCH 11/16] Update check119

updated to not scored
---
 checks/check119 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/checks/check119 b/checks/check119
index 27f9b3a38b..015836e392 100644
--- a/checks/check119
+++ b/checks/check119
@@ -9,8 +9,8 @@
 # work. If not, see <http://creativecommons.org/licenses/by-nc-sa/4.0/>.
 
 CHECK_ID_check119="1.19"
-CHECK_TITLE_check119="[check119] Ensure IAM instance roles are used for AWS resource access from instances (Scored)"
-CHECK_SCORED_check119="SCORED"
+CHECK_TITLE_check119="[check119] Ensure IAM instance roles are used for AWS resource access from instances (Not Scored)"
+CHECK_SCORED_check119="NOT_SCORED"
 CHECK_TYPE_check119="LEVEL2"
 CHECK_ALTERNATE_check119="check119"
 

From 274d02576fac75c067cd1f8b47aa7d85d882f964 Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni@blyx.com>
Date: Mon, 10 Feb 2020 23:31:02 +0100
Subject: [PATCH 12/16] Revert "Feature/handle get bucket policy error"

---
 checks/check_extra764 | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/checks/check_extra764 b/checks/check_extra764
index cc8a357497..6fd2c51381 100644
--- a/checks/check_extra764
+++ b/checks/check_extra764
@@ -36,16 +36,11 @@ extra764(){
       fi
 
       # https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/
-      # checking if $TEMP_STP_POLICY_FILE is a valid json before converting it to json with jq
-      if jq -e . >/dev/null 2>&1 <<< "$TEMP_STP_POLICY_FILE"; then
-        CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")')
-        if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then
-          textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport"
-        else
-          textFail "Bucket $bucket allows requests over insecure transport"
-        fi
+      CHECK_BUCKET_STP_POLICY_PRESENT=$(cat $TEMP_STP_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}" '.Statement[]|select(((.Principal|type == "string") and .Principal == "*") and .Action=="s3:*" and (.Resource|type == "array") and (.Resource|map({(.):0})[]|has($arn)) and (.Resource|map({(.):0})[]|has($arn+"/*")) and .Condition.Bool."aws:SecureTransport" == "false")')
+      if [[ $CHECK_BUCKET_STP_POLICY_PRESENT ]]; then
+        textPass "Bucket $bucket has S3 bucket policy to deny requests over insecure transport"
       else
-          textInfo "Unknown Error occurred: $TEMP_STP_POLICY_FILE"
+        textFail "Bucket $bucket allows requests over insecure transport"
       fi
 
       rm -fr $TEMP_STP_POLICY_FILE

From 0d1807bd336f62c9d77824d210db0d1c4da64224 Mon Sep 17 00:00:00 2001
From: Nick Malcolm <nick@malcolm.net.nz>
Date: Wed, 12 Feb 2020 11:38:23 +1300
Subject: [PATCH 13/16] Remove `ses:sendemails`

Prowler doesn't need to send emails via SES. https://github.com/toniblyx/prowler/issues/124
---
 iam/prowler-additions-policy.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json
index ccb178dd3a..213c811ea0 100644
--- a/iam/prowler-additions-policy.json
+++ b/iam/prowler-additions-policy.json
@@ -92,7 +92,6 @@
               "secretsmanager:listsecretversionids",
               "servicecatalog:list*",
               "ses:list*",
-              "ses:sendemail",
               "sns:list*",
               "sqs:listqueuetags",
               "ssm:listassociations",

From 5069fd29f9dd813481cfde5d56bc1361bb1a3a04 Mon Sep 17 00:00:00 2001
From: alphad05 <alphad05@yahoo.com>
Date: Tue, 11 Feb 2020 20:55:30 -0800
Subject: [PATCH 14/16] Associate VPCFlowLog with VPC

Associate VPCFlowLow with the VPC it is for to ensure accurate check. If there are multiple VPCs in a region and only some have VPC flow logs, current check will pass all VPCs even those without VPC flow logs.
---
 checks/check29 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/checks/check29 b/checks/check29
index c92542b0d5..d1f23dc8c1 100644
--- a/checks/check29
+++ b/checks/check29
@@ -19,13 +19,13 @@ check29(){
   for regx in $REGIONS; do
     AVAILABLE_VPC=$($AWSCLI ec2 describe-vpcs $PROFILE_OPT --region $regx --query 'Vpcs[?State==`available`].VpcId' --output text)
     for vpcx in $AVAILABLE_VPC; do
-      CHECK_FL=$($AWSCLI ec2 describe-flow-logs $PROFILE_OPT --region $regx --query 'FlowLogs[?FlowLogStatus==`ACTIVE`||ResourceId==`${vpcx}`].FlowLogId' --output text)
+      CHECK_FL=$($AWSCLI ec2 describe-flow-logs $PROFILE_OPT --region $regx --filter Name="resource-id",Values="${vpcx}" --query 'FlowLogs[?FlowLogStatus==`ACTIVE`].FlowLogId' --output text)
       if [[ $CHECK_FL ]];then
         for FL in $CHECK_FL;do
-          textPass "VPCFlowLog is enabled for LogGroupName: $FL in Region $regx" "$regx"
+          textPass "VPC $vpcx: VPCFlowLog is enabled for LogGroupName: $FL in Region $regx" "$regx"
         done
       else
-        textFail "No VPCFlowLog has been found in Region $regx" "$regx"
+        textFail "VPC $vpcx: No VPCFlowLog has been found in Region $regx" "$regx"
       fi      
     done
   done

From 447657140d74e83d8781fdf2ee7453af144960ac Mon Sep 17 00:00:00 2001
From: jonnyCodev <yonicodev@gmail.com>
Date: Wed, 12 Feb 2020 10:16:18 +0200
Subject: [PATCH 15/16] check if last_login_date is a valid date

---
 checks/check11 | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/checks/check11 b/checks/check11
index 1150ac8b94..924a14eb91 100644
--- a/checks/check11
+++ b/checks/check11
@@ -19,11 +19,17 @@ check11(){
   MAX_DAYS=-1
   last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep '<root_account>' | awk '{ print $2 }')
   arn=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$2 }' |grep '<root_account>' | awk '{ print $2 }')
-  days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
 
-  if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
-      textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+  #check if last_login_date date is a valid date, if not, its a pass.
+  if [[ ${last_login_date%T*} =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]];then
+    days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
+    if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
+        textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+    else
+        textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+    fi
   else
-      textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+    textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
   fi
+
 }

From 9bd54ca30ef0d0da52b25cd04d08003d33af3ab3 Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni@blyx.com>
Date: Wed, 12 Feb 2020 23:46:42 +0100
Subject: [PATCH 16/16] Fixed issue #378

---
 prowler | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/prowler b/prowler
index e4e096d000..7a2c80b3d5 100755
--- a/prowler
+++ b/prowler
@@ -247,7 +247,7 @@ execute_check() {
   # Generate the credential report, only if it is group1 related which checks we
   # run so that the checks can safely assume it's available
 	if [ ${alternate_name} ];then
-    if [[ ${alternate_name} == check1* ]];then
+    if [[ ${alternate_name} == check1* || ${alternate_name} == extra71 ]];then
       if [ ! -s $TEMP_REPORT_FILE ];then
         genCredReport
         saveReport
@@ -260,7 +260,7 @@ execute_check() {
     local check_id_var=CHECK_ID_$1
     local check_id=${!check_id_var}
     if [ ${check_id} ]; then
-      if [[ ${check_id} == 1* ]];then
+      if [[ ${check_id} == 1* || ${check_id} == 7.1,7.01 ]];then
         if [ ! -s $TEMP_REPORT_FILE ];then
           genCredReport
           saveReport