fix(add-checks-regions): Missing regions in checks (#1247)

* add regions to checks

* add root as resource

Co-authored-by: sergargar <sergio@verica.io>

checks/check115

@@ -26,9 +26,9 @@ CHECK_CAF_EPIC_check115='IAM'
 
 check115(){
   if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then
-    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks."
+    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root"
   else
     # "Ensure security questions are registered in the AWS account (Not Scored)"
-    textInfo "${REGION}: No command available for check 1.15. Login to the AWS Console as root & click on the Account. Name -> My Account -> Configure Security Challenge Questions."
+    textInfo "${REGION}: No command available for check 1.15. Login to the AWS Console as root & click on the Account. Name -> My Account -> Configure Security Challenge Questions." "$REGION" "root"
   fi
 }

checks/check117

@@ -26,10 +26,10 @@ CHECK_CAF_EPIC_check117='IAM'
 
 check117(){
   if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then
-    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks."
+    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root"
   else
     # "Maintain current contact details (Scored)"
     # No command available
-    textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details."
+    textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details." "$REGION" "root"
   fi
 }

checks/check118

@@ -26,10 +26,10 @@ CHECK_CAF_EPIC_check118='IAM'
 
 check118(){
   if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then
-    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks."
+    textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root"
   else
     # "Ensure security contact information is registered (Scored)"
     # No command available
-    textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details."
+    textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details." "$REGION" "root"
   fi
 }

checks/check23

@@ -46,13 +46,13 @@ check23(){
 
         CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $TRAIL_REGION --query 'trailList[*].[S3BucketName]' --output text --trail-name-list $trail)
         if [[ -z $CLOUDTRAILBUCKET ]]; then
-          textFail "Trail $trail in $TRAIL_REGION does not publish to S3"
+          textFail "Trail $trail in $TRAIL_REGION does not publish to S3" "$regx" "$trail"
           continue
         fi
 
         CLOUDTRAIL_ACCOUNT_ID=$(echo $trail | awk -F: '{ print $5 }')
         if [ "$CLOUDTRAIL_ACCOUNT_ID" != "$ACCOUNT_NUM" ]; then
-          textInfo "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not in current account"
+          textInfo "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not in current account" "$regx" "$trail"
           continue
         fi
 
@@ -63,7 +63,7 @@ check23(){
         #
         BUCKET_LOCATION=$($AWSCLI s3api get-bucket-location $PROFILE_OPT --region $regx --bucket $CLOUDTRAILBUCKET --output text 2>&1)
         if [[ $(echo "$BUCKET_LOCATION" | grep AccessDenied) ]]; then
-          textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket location for $CLOUDTRAILBUCKET"
+          textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket location for $CLOUDTRAILBUCKET" "$regx" "$trail"
           continue
         fi
         if [[ $BUCKET_LOCATION == "None" ]]; then
@@ -75,14 +75,14 @@ check23(){
 
         CLOUDTRAILBUCKET_HASALLPERMISIONS=$($AWSCLI s3api get-bucket-acl --bucket $CLOUDTRAILBUCKET $PROFILE_OPT --region $BUCKET_LOCATION --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' --output text 2>&1)
         if [[ $(echo "$CLOUDTRAILBUCKET_HASALLPERMISIONS" | grep AccessDenied) ]]; then
-          textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket acl for $CLOUDTRAILBUCKET"
+          textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket acl for $CLOUDTRAILBUCKET" "$regx" "$trail"
           continue
         fi
 
         if [[ -z $CLOUDTRAILBUCKET_HASALLPERMISIONS ]]; then
-          textPass "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not publicly accessible"
+          textPass "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not publicly accessible" "$regx" "$trail"
         else
-          textFail "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is publicly accessible"
+          textFail "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is publicly accessible" "$regx" "$trail"
         fi
 
       done

checks/check_extra7100

@@ -68,8 +68,7 @@ extra7100(){
 
     done
     if [[ $PERMISSIVE_POLICIES_LIST ]]; then
-      textInfo "STS AssumeRole Policies should only include the complete ARNs for the Roles that the user needs"
-      textInfo "Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy"
+      textInfo "STS AssumeRole Policies should only include the complete ARNs for the Roles that the user needs. Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy" "$REGION"
       for policy in $PERMISSIVE_POLICIES_LIST; do
         textFail "$REGION: Policy $policy allows permissive STS Role assumption" "$REGION" "$policy"
       done

checks/check_extra7102

@@ -23,7 +23,7 @@ CHECK_REMEDIATION_extra7102='Check Identified IPs; consider changing them to pri
 CHECK_DOC_extra7102='https://www.shodan.io/'
 CHECK_CAF_EPIC_extra7102='Infrastructure Security'
 
-# Watch out, always use Shodan API key, if you use `curl https://www.shodan.io/host/{ip}` massively 
+# Watch out, always use Shodan API key, if you use `curl https://www.shodan.io/host/{ip}` massively
 # your IP will be banned by Shodan
 
 # This is the right way to do so
@@ -33,8 +33,8 @@ CHECK_CAF_EPIC_extra7102='Infrastructure Security'
 
 extra7102(){
   if [[ ! $SHODAN_API_KEY ]]; then
-    textInfo "[extra7102] Requires a Shodan API key to work. Use -N <shodan_api_key>"
-  else 
+    textInfo "[extra7102] Requires a Shodan API key to work. Use -N <shodan_api_key>" "$REGION"
+  else
     for regx in $REGIONS; do
       LIST_OF_EIP=$($AWSCLI $PROFILE_OPT --region $regx ec2 describe-network-interfaces --query 'NetworkInterfaces[*].Association.PublicIp' --output text 2>&1)
       if [[ $(echo "$LIST_OF_EIP" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then

checks/check_extra7123

@@ -33,6 +33,6 @@ extra7123(){
       textFail "User $user has 2 active access keys" "$REGION" "$user"
     done
   else
-    textPass "No users with 2 active access keys"
+    textPass "No users with 2 active access keys" "$REGION"
   fi
-}
+}

checks/check_extra7125

@@ -31,15 +31,15 @@ extra7125(){
     for user in $LIST_USERS; do
       # Would be virtual if sms-mfa or mfa, hardware is u2f or different.
       MFA_TYPE=$($AWSCLI iam list-mfa-devices --user-name $user $PROFILE_OPT --region $REGION --query MFADevices[].SerialNumber --output text | awk -F':' '{ print $6 }'| awk -F'/' '{ print $1 }')
-      if [[ $MFA_TYPE == "mfa" || $MFA_TYPE == "sms-mfa" ]]; then 
-        textInfo "User $user has virtual MFA enabled" 
-      elif [[ $MFA_TYPE == "" ]]; then 
+      if [[ $MFA_TYPE == "mfa" || $MFA_TYPE == "sms-mfa" ]]; then
+        textInfo "User $user has virtual MFA enabled" "$REGION" "$user"
+      elif [[ $MFA_TYPE == "" ]]; then
         textFail "User $user has not hardware MFA enabled" "$REGION" "$user"
-      else 
+      else
         textPass "User $user has hardware MFA enabled" "$REGION" "$user"
       fi
     done
   else
-    textPass "No users found"
+    textPass "No users found" "$REGION"
   fi
-}
+}

checks/check_extra7132

@@ -34,14 +34,14 @@ extra7132(){
       for rdsinstance in ${RDS_INSTANCES}; do
           RDS_NAME="$rdsinstance"
           MONITORING_FLAG=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --db-instance-identifier $rdsinstance --query 'DBInstances[*].[EnhancedMonitoringResourceArn]' --output text)
-          if [[ $MONITORING_FLAG == "None" ]];then 
-              textFail "$regx: RDS instance: $RDS_NAME has enhanced monitoring disabled!" "$rex" "$RDS_NAME"
+          if [[ $MONITORING_FLAG == "None" ]];then
+              textFail "$regx: RDS instance: $RDS_NAME has enhanced monitoring disabled!" "$regx" "$RDS_NAME"
           else
               textPass "$regx: RDS instance: $RDS_NAME has enhanced monitoring enabled." "$regx" "$RDS_NAME"
           fi
       done
     else
-      textInfo "$regx: no RDS instances found" "$regx" "$RDS_NAME"
+      textInfo "$regx: no RDS instances found" "$regx"
     fi
   done
 }

checks/check_extra7142

@@ -41,8 +41,8 @@ extra7142(){
           textFail "$regx: Application Load Balancer $alb is not dropping invalid header fields" "$regx" "$alb"
         fi
       done
-    else 
-      textInfo "$regx: no ALBs found"
+    else
+      textInfo "$regx: no ALBs found" "$regx"
     fi
   done
 }

checks/check_extra7166

@@ -45,6 +45,6 @@ extra7166() {
       fi
     done
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$regx: no AWS Shield Advanced subscription found. Skipping check" "$regx"
   fi
 }

checks/check_extra7167

@@ -41,6 +41,6 @@ extra7167() {
       textInfo "$REGION: no Cloudfront distributions found" "$REGION"
     fi
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION"
   fi
 }

checks/check_extra7168

@@ -44,6 +44,6 @@ extra7168() {
       textInfo "$REGION: no Route53 hosted zones found" "$REGION"
     fi
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION"
   fi
 }

checks/check_extra7169

@@ -41,6 +41,6 @@ extra7169() {
       textInfo "$REGION: no global accelerators found" "$REGION"
     fi
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION"
   fi
 }

checks/check_extra7170

@@ -43,6 +43,6 @@ extra7170() {
       fi
     done
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION"
   fi
 }

checks/check_extra7171

@@ -45,6 +45,6 @@ extra7171() {
       fi
     done
   else
-    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+    textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION"
   fi
 }

checks/check_extra732

@@ -36,6 +36,6 @@ extra732(){
       fi
     done
   else
-    textInfo "$REGION: No CloudFront distributions found"
+    textInfo "$REGION: No CloudFront distributions found" "$REGION" "$ACCOUNT_NUM"
   fi
 }

checks/check_extra740

@@ -26,7 +26,7 @@ CHECK_CAF_EPIC_extra740='Data Protection'
 
 extra740(){
   # This does NOT use max-items, which would limit the number of items
-  # considered. It considers all snapshots, but only reports at most 
+  # considered. It considers all snapshots, but only reports at most
   # max-items passing and max-items failing.
   for regx in ${REGIONS}; do
     UNENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \
@@ -36,8 +36,8 @@ extra740(){
     if [[ $(echo "$UNENCRYPTED_SNAPSHOTS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
         textInfo "$regx: Access Denied trying to describe snapshots" "$regx"
         continue
-    fi 
-     
+    fi
+
     ENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \
     --region ${regx} --owner-ids ${ACCOUNT_NUM} --output text \
     --query 'Snapshots[?Encrypted==`true`]|[*].{Id:SnapshotId}' 2>&1 \
@@ -45,7 +45,7 @@ extra740(){
     if [[ $(echo "$ENCRYPTED_SNAPSHOTS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
         textInfo "$regx: Access Denied trying to describe snapshots" "$regx"
         continue
-    fi 
+    fi
     typeset -i unencrypted
     typeset -i encrypted
     unencrypted=0
@@ -73,10 +73,10 @@ extra740(){
       typeset -i total
       total=${encrypted}+${unencrypted}
       if [[ "${unencrypted}" -ge "${MAXITEMS}" ]]; then
-        textFail "${unencrypted} unencrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} unencrypted snapshots are reported!"
+        textFail "${unencrypted} unencrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} unencrypted snapshots are reported!" "${regx}"
       fi
       if [[ "${encrypted}" -ge "${MAXITEMS}" ]]; then
-        textPass "${encrypted} encrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} encrypted snapshots are reported."
+        textPass "${encrypted} encrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} encrypted snapshots are reported." "${regx}"
       fi
       # Bit of 'bc' magic to print something like 10.42% or 0.85% or similar. 'bc' has a
       # bug where it will never print leading zeros. So 0.5 is output as ".5". This has a

checks/check_extra763

@@ -41,7 +41,7 @@ extra763(){
 
       BUCKET_VERSIONING_ENABLED=$("${AWSCLI}" s3api get-bucket-versioning --bucket "${bucket}" ${PROFILE_OPT} --region "${BUCKET_REGION}" --query Status --output text 2>&1)
       if grep -q 'AccessDenied' <<< "${BUCKET_VERSIONING_ENABLED}"; then
-        textInfo "${BUCKET_REGION}: Access Denied Trying to Get Bucket Versioning for $bucket"
+        textInfo "${BUCKET_REGION}: Access Denied Trying to Get Bucket Versioning for $bucket" "${REGION}"
         continue
       fi
       if  grep -q "^Enabled$" <<< "${BUCKET_VERSIONING_ENABLED}"; then

checks/check_extra773

@@ -37,6 +37,6 @@ extra773(){
       fi
     done
   else
-    textInfo "No CloudFront distributions found"
+    textInfo "No CloudFront distributions found" "us-east-1"
   fi
 }

include/outputs

@@ -129,7 +129,6 @@ general_output() {
   CHECK_RESULT_EXTENDED="${2}"
   CHECK_RESOURCE_ID="${3}"
   REGION_FROM_CHECK="${4}"
-  CSV_LINE="${PROFILE//,/--}${SEP}${ACCOUNT_NUM//,/--}${SEP}${REGION_FROM_CHECK//,/--}${SEP}${TITLE_ID//,/--}${SEP}${CHECK_RESULT//,/--}${SEP}${ITEM_SCORED//,/--}${SEP}${ITEM_CIS_LEVEL//,/--}${SEP}${TITLE_TEXT//,/--}${SEP}${CHECK_RESULT_EXTENDED//,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE//,/--}${SEP}${CHECK_SEVERITY//,/--}${SEP}${CHECK_SERVICENAME//,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE//,/--}${SEP}${CHECK_ASFF_TYPE//,/--}${SEP}${CHECK_RISK//,/--}${SEP}${CHECK_REMEDIATION//,/--}${SEP}${CHECK_DOC//,/--}${SEP}${CHECK_CAF_EPIC//,/--}${SEP}${CHECK_RESOURCE_ID//,/--}${SEP}${PROWLER_START_TIME//,/--}${SEP}${ACCOUNT_DETAILS_EMAIL//,/--}${SEP}${ACCOUNT_DETAILS_NAME//,/--}${SEP}${ACCOUNT_DETAILS_ARN//,/--}${SEP}${ACCOUNT_DETAILS_ORG//,/--}${SEP}${ACCOUNT_DETAILS_TAGS//,/--}"
   COLOR_CODE="$OK"
 
   # Check if color is different than normal (pass)
@@ -148,6 +147,7 @@ general_output() {
   then
       REGION_FROM_CHECK=$REGION
   fi
+  CSV_LINE="${PROFILE//,/--}${SEP}${ACCOUNT_NUM//,/--}${SEP}${REGION_FROM_CHECK//,/--}${SEP}${TITLE_ID//,/--}${SEP}${CHECK_RESULT//,/--}${SEP}${ITEM_SCORED//,/--}${SEP}${ITEM_CIS_LEVEL//,/--}${SEP}${TITLE_TEXT//,/--}${SEP}${CHECK_RESULT_EXTENDED//,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE//,/--}${SEP}${CHECK_SEVERITY//,/--}${SEP}${CHECK_SERVICENAME//,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE//,/--}${SEP}${CHECK_ASFF_TYPE//,/--}${SEP}${CHECK_RISK//,/--}${SEP}${CHECK_REMEDIATION//,/--}${SEP}${CHECK_DOC//,/--}${SEP}${CHECK_CAF_EPIC//,/--}${SEP}${CHECK_RESOURCE_ID//,/--}${SEP}${PROWLER_START_TIME//,/--}${SEP}${ACCOUNT_DETAILS_EMAIL//,/--}${SEP}${ACCOUNT_DETAILS_NAME//,/--}${SEP}${ACCOUNT_DETAILS_ARN//,/--}${SEP}${ACCOUNT_DETAILS_ORG//,/--}${SEP}${ACCOUNT_DETAILS_TAGS//,/--}"
   # Iterating over input modes
   OIFS="${IFS}"
   IFS=','