diff --git a/checks/check115 b/checks/check115 index 65448e5b44..38a3dd2f7c 100644 --- a/checks/check115 +++ b/checks/check115 @@ -26,9 +26,9 @@ CHECK_CAF_EPIC_check115='IAM' check115(){ if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." + textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root" else # "Ensure security questions are registered in the AWS account (Not Scored)" - textInfo "${REGION}: No command available for check 1.15. Login to the AWS Console as root & click on the Account. Name -> My Account -> Configure Security Challenge Questions." + textInfo "${REGION}: No command available for check 1.15. Login to the AWS Console as root & click on the Account. Name -> My Account -> Configure Security Challenge Questions." "$REGION" "root" fi } diff --git a/checks/check117 b/checks/check117 index b3dfd2147b..2a635e1e2e 100644 --- a/checks/check117 +++ b/checks/check117 @@ -26,10 +26,10 @@ CHECK_CAF_EPIC_check117='IAM' check117(){ if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." + textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root" else # "Maintain current contact details (Scored)" # No command available - textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details." + textInfo "No command available for check 1.17. See section 1.17 on the CIS Benchmark guide for details." "$REGION" "root" fi } diff --git a/checks/check118 b/checks/check118 index c01ed801d0..32a041c3b9 100644 --- a/checks/check118 +++ b/checks/check118 @@ -26,10 +26,10 @@ CHECK_CAF_EPIC_check118='IAM' check118(){ if [[ "${REGION}" == "us-gov-west-1" || "${REGION}" == "us-gov-east-1" ]]; then - textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." + textInfo "${REGION}: This is an AWS GovCloud account and there is no root account to perform checks." "$REGION" "root" else # "Ensure security contact information is registered (Scored)" # No command available - textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details." + textInfo "No command available for check 1.18. See section 1.18 on the CIS Benchmark guide for details." "$REGION" "root" fi } diff --git a/checks/check23 b/checks/check23 index f8c5fde06c..55be872c92 100644 --- a/checks/check23 +++ b/checks/check23 @@ -46,13 +46,13 @@ check23(){ CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $TRAIL_REGION --query 'trailList[*].[S3BucketName]' --output text --trail-name-list $trail) if [[ -z $CLOUDTRAILBUCKET ]]; then - textFail "Trail $trail in $TRAIL_REGION does not publish to S3" + textFail "Trail $trail in $TRAIL_REGION does not publish to S3" "$regx" "$trail" continue fi CLOUDTRAIL_ACCOUNT_ID=$(echo $trail | awk -F: '{ print $5 }') if [ "$CLOUDTRAIL_ACCOUNT_ID" != "$ACCOUNT_NUM" ]; then - textInfo "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not in current account" + textInfo "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not in current account" "$regx" "$trail" continue fi @@ -63,7 +63,7 @@ check23(){ # BUCKET_LOCATION=$($AWSCLI s3api get-bucket-location $PROFILE_OPT --region $regx --bucket $CLOUDTRAILBUCKET --output text 2>&1) if [[ $(echo "$BUCKET_LOCATION" | grep AccessDenied) ]]; then - textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket location for $CLOUDTRAILBUCKET" + textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket location for $CLOUDTRAILBUCKET" "$regx" "$trail" continue fi if [[ $BUCKET_LOCATION == "None" ]]; then @@ -75,14 +75,14 @@ check23(){ CLOUDTRAILBUCKET_HASALLPERMISIONS=$($AWSCLI s3api get-bucket-acl --bucket $CLOUDTRAILBUCKET $PROFILE_OPT --region $BUCKET_LOCATION --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' --output text 2>&1) if [[ $(echo "$CLOUDTRAILBUCKET_HASALLPERMISIONS" | grep AccessDenied) ]]; then - textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket acl for $CLOUDTRAILBUCKET" + textInfo "Trail $trail in $TRAIL_REGION Access Denied getting bucket acl for $CLOUDTRAILBUCKET" "$regx" "$trail" continue fi if [[ -z $CLOUDTRAILBUCKET_HASALLPERMISIONS ]]; then - textPass "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not publicly accessible" + textPass "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is not publicly accessible" "$regx" "$trail" else - textFail "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is publicly accessible" + textFail "Trail $trail in $TRAIL_REGION S3 logging bucket $CLOUDTRAILBUCKET is publicly accessible" "$regx" "$trail" fi done diff --git a/checks/check_extra7100 b/checks/check_extra7100 index cd5d8e01e5..0e61f232b4 100644 --- a/checks/check_extra7100 +++ b/checks/check_extra7100 @@ -68,8 +68,7 @@ extra7100(){ done if [[ $PERMISSIVE_POLICIES_LIST ]]; then - textInfo "STS AssumeRole Policies should only include the complete ARNs for the Roles that the user needs" - textInfo "Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy" + textInfo "STS AssumeRole Policies should only include the complete ARNs for the Roles that the user needs. Learn more: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-createpolicy" "$REGION" for policy in $PERMISSIVE_POLICIES_LIST; do textFail "$REGION: Policy $policy allows permissive STS Role assumption" "$REGION" "$policy" done diff --git a/checks/check_extra7102 b/checks/check_extra7102 index f70492c7c5..bb04ea3d34 100644 --- a/checks/check_extra7102 +++ b/checks/check_extra7102 @@ -23,7 +23,7 @@ CHECK_REMEDIATION_extra7102='Check Identified IPs; consider changing them to pri CHECK_DOC_extra7102='https://www.shodan.io/' CHECK_CAF_EPIC_extra7102='Infrastructure Security' -# Watch out, always use Shodan API key, if you use `curl https://www.shodan.io/host/{ip}` massively +# Watch out, always use Shodan API key, if you use `curl https://www.shodan.io/host/{ip}` massively # your IP will be banned by Shodan # This is the right way to do so @@ -33,8 +33,8 @@ CHECK_CAF_EPIC_extra7102='Infrastructure Security' extra7102(){ if [[ ! $SHODAN_API_KEY ]]; then - textInfo "[extra7102] Requires a Shodan API key to work. Use -N " - else + textInfo "[extra7102] Requires a Shodan API key to work. Use -N " "$REGION" + else for regx in $REGIONS; do LIST_OF_EIP=$($AWSCLI $PROFILE_OPT --region $regx ec2 describe-network-interfaces --query 'NetworkInterfaces[*].Association.PublicIp' --output text 2>&1) if [[ $(echo "$LIST_OF_EIP" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then diff --git a/checks/check_extra7123 b/checks/check_extra7123 index fecf5185a1..e4d5050465 100644 --- a/checks/check_extra7123 +++ b/checks/check_extra7123 @@ -33,6 +33,6 @@ extra7123(){ textFail "User $user has 2 active access keys" "$REGION" "$user" done else - textPass "No users with 2 active access keys" + textPass "No users with 2 active access keys" "$REGION" fi -} \ No newline at end of file +} diff --git a/checks/check_extra7125 b/checks/check_extra7125 index d41b847503..9678202a2f 100644 --- a/checks/check_extra7125 +++ b/checks/check_extra7125 @@ -31,15 +31,15 @@ extra7125(){ for user in $LIST_USERS; do # Would be virtual if sms-mfa or mfa, hardware is u2f or different. MFA_TYPE=$($AWSCLI iam list-mfa-devices --user-name $user $PROFILE_OPT --region $REGION --query MFADevices[].SerialNumber --output text | awk -F':' '{ print $6 }'| awk -F'/' '{ print $1 }') - if [[ $MFA_TYPE == "mfa" || $MFA_TYPE == "sms-mfa" ]]; then - textInfo "User $user has virtual MFA enabled" - elif [[ $MFA_TYPE == "" ]]; then + if [[ $MFA_TYPE == "mfa" || $MFA_TYPE == "sms-mfa" ]]; then + textInfo "User $user has virtual MFA enabled" "$REGION" "$user" + elif [[ $MFA_TYPE == "" ]]; then textFail "User $user has not hardware MFA enabled" "$REGION" "$user" - else + else textPass "User $user has hardware MFA enabled" "$REGION" "$user" fi done else - textPass "No users found" + textPass "No users found" "$REGION" fi -} \ No newline at end of file +} diff --git a/checks/check_extra7132 b/checks/check_extra7132 index a2bbba7449..f31a11d717 100644 --- a/checks/check_extra7132 +++ b/checks/check_extra7132 @@ -34,14 +34,14 @@ extra7132(){ for rdsinstance in ${RDS_INSTANCES}; do RDS_NAME="$rdsinstance" MONITORING_FLAG=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --db-instance-identifier $rdsinstance --query 'DBInstances[*].[EnhancedMonitoringResourceArn]' --output text) - if [[ $MONITORING_FLAG == "None" ]];then - textFail "$regx: RDS instance: $RDS_NAME has enhanced monitoring disabled!" "$rex" "$RDS_NAME" + if [[ $MONITORING_FLAG == "None" ]];then + textFail "$regx: RDS instance: $RDS_NAME has enhanced monitoring disabled!" "$regx" "$RDS_NAME" else textPass "$regx: RDS instance: $RDS_NAME has enhanced monitoring enabled." "$regx" "$RDS_NAME" fi done else - textInfo "$regx: no RDS instances found" "$regx" "$RDS_NAME" + textInfo "$regx: no RDS instances found" "$regx" fi done } diff --git a/checks/check_extra7142 b/checks/check_extra7142 index ded331ecfb..2db9bcb83e 100644 --- a/checks/check_extra7142 +++ b/checks/check_extra7142 @@ -41,8 +41,8 @@ extra7142(){ textFail "$regx: Application Load Balancer $alb is not dropping invalid header fields" "$regx" "$alb" fi done - else - textInfo "$regx: no ALBs found" + else + textInfo "$regx: no ALBs found" "$regx" fi done } diff --git a/checks/check_extra7166 b/checks/check_extra7166 index 4a8430f5f8..d4cc93bdcc 100644 --- a/checks/check_extra7166 +++ b/checks/check_extra7166 @@ -45,6 +45,6 @@ extra7166() { fi done else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$regx: no AWS Shield Advanced subscription found. Skipping check" "$regx" fi } diff --git a/checks/check_extra7167 b/checks/check_extra7167 index c349c35270..5b837c3607 100644 --- a/checks/check_extra7167 +++ b/checks/check_extra7167 @@ -41,6 +41,6 @@ extra7167() { textInfo "$REGION: no Cloudfront distributions found" "$REGION" fi else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION" fi } diff --git a/checks/check_extra7168 b/checks/check_extra7168 index e2f2514d1a..ad37a8e20a 100644 --- a/checks/check_extra7168 +++ b/checks/check_extra7168 @@ -44,6 +44,6 @@ extra7168() { textInfo "$REGION: no Route53 hosted zones found" "$REGION" fi else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION" fi } diff --git a/checks/check_extra7169 b/checks/check_extra7169 index 573c0415ee..f6eaa16a13 100644 --- a/checks/check_extra7169 +++ b/checks/check_extra7169 @@ -41,6 +41,6 @@ extra7169() { textInfo "$REGION: no global accelerators found" "$REGION" fi else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION" fi } diff --git a/checks/check_extra7170 b/checks/check_extra7170 index f8675a5c37..ee197f9e1a 100644 --- a/checks/check_extra7170 +++ b/checks/check_extra7170 @@ -43,6 +43,6 @@ extra7170() { fi done else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION" fi } diff --git a/checks/check_extra7171 b/checks/check_extra7171 index 61834e58fc..a713083303 100644 --- a/checks/check_extra7171 +++ b/checks/check_extra7171 @@ -45,6 +45,6 @@ extra7171() { fi done else - textInfo "No AWS Shield Advanced subscription found. Skipping check." + textInfo "$REGION: no AWS Shield Advanced subscription found. Skipping check." "$REGION" fi } diff --git a/checks/check_extra732 b/checks/check_extra732 index 6cbb715dac..b4531066e4 100644 --- a/checks/check_extra732 +++ b/checks/check_extra732 @@ -36,6 +36,6 @@ extra732(){ fi done else - textInfo "$REGION: No CloudFront distributions found" + textInfo "$REGION: No CloudFront distributions found" "$REGION" "$ACCOUNT_NUM" fi } diff --git a/checks/check_extra740 b/checks/check_extra740 index 6695c8fbf1..4632f05da3 100644 --- a/checks/check_extra740 +++ b/checks/check_extra740 @@ -26,7 +26,7 @@ CHECK_CAF_EPIC_extra740='Data Protection' extra740(){ # This does NOT use max-items, which would limit the number of items - # considered. It considers all snapshots, but only reports at most + # considered. It considers all snapshots, but only reports at most # max-items passing and max-items failing. for regx in ${REGIONS}; do UNENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \ @@ -36,8 +36,8 @@ extra740(){ if [[ $(echo "$UNENCRYPTED_SNAPSHOTS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then textInfo "$regx: Access Denied trying to describe snapshots" "$regx" continue - fi - + fi + ENCRYPTED_SNAPSHOTS=$(${AWSCLI} ec2 describe-snapshots ${PROFILE_OPT} \ --region ${regx} --owner-ids ${ACCOUNT_NUM} --output text \ --query 'Snapshots[?Encrypted==`true`]|[*].{Id:SnapshotId}' 2>&1 \ @@ -45,7 +45,7 @@ extra740(){ if [[ $(echo "$ENCRYPTED_SNAPSHOTS" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then textInfo "$regx: Access Denied trying to describe snapshots" "$regx" continue - fi + fi typeset -i unencrypted typeset -i encrypted unencrypted=0 @@ -73,10 +73,10 @@ extra740(){ typeset -i total total=${encrypted}+${unencrypted} if [[ "${unencrypted}" -ge "${MAXITEMS}" ]]; then - textFail "${unencrypted} unencrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} unencrypted snapshots are reported!" + textFail "${unencrypted} unencrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} unencrypted snapshots are reported!" "${regx}" fi if [[ "${encrypted}" -ge "${MAXITEMS}" ]]; then - textPass "${encrypted} encrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} encrypted snapshots are reported." + textPass "${encrypted} encrypted snapshots out of ${total} snapshots found. Only the first ${MAXITEMS} encrypted snapshots are reported." "${regx}" fi # Bit of 'bc' magic to print something like 10.42% or 0.85% or similar. 'bc' has a # bug where it will never print leading zeros. So 0.5 is output as ".5". This has a diff --git a/checks/check_extra763 b/checks/check_extra763 index 409f193178..aebb7d0858 100644 --- a/checks/check_extra763 +++ b/checks/check_extra763 @@ -41,7 +41,7 @@ extra763(){ BUCKET_VERSIONING_ENABLED=$("${AWSCLI}" s3api get-bucket-versioning --bucket "${bucket}" ${PROFILE_OPT} --region "${BUCKET_REGION}" --query Status --output text 2>&1) if grep -q 'AccessDenied' <<< "${BUCKET_VERSIONING_ENABLED}"; then - textInfo "${BUCKET_REGION}: Access Denied Trying to Get Bucket Versioning for $bucket" + textInfo "${BUCKET_REGION}: Access Denied Trying to Get Bucket Versioning for $bucket" "${REGION}" continue fi if grep -q "^Enabled$" <<< "${BUCKET_VERSIONING_ENABLED}"; then diff --git a/checks/check_extra773 b/checks/check_extra773 index 12f0ccdf0c..346f204336 100644 --- a/checks/check_extra773 +++ b/checks/check_extra773 @@ -37,6 +37,6 @@ extra773(){ fi done else - textInfo "No CloudFront distributions found" + textInfo "No CloudFront distributions found" "us-east-1" fi } diff --git a/include/outputs b/include/outputs index b93625c22d..c8c4d06dce 100644 --- a/include/outputs +++ b/include/outputs @@ -129,7 +129,6 @@ general_output() { CHECK_RESULT_EXTENDED="${2}" CHECK_RESOURCE_ID="${3}" REGION_FROM_CHECK="${4}" - CSV_LINE="${PROFILE//,/--}${SEP}${ACCOUNT_NUM//,/--}${SEP}${REGION_FROM_CHECK//,/--}${SEP}${TITLE_ID//,/--}${SEP}${CHECK_RESULT//,/--}${SEP}${ITEM_SCORED//,/--}${SEP}${ITEM_CIS_LEVEL//,/--}${SEP}${TITLE_TEXT//,/--}${SEP}${CHECK_RESULT_EXTENDED//,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE//,/--}${SEP}${CHECK_SEVERITY//,/--}${SEP}${CHECK_SERVICENAME//,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE//,/--}${SEP}${CHECK_ASFF_TYPE//,/--}${SEP}${CHECK_RISK//,/--}${SEP}${CHECK_REMEDIATION//,/--}${SEP}${CHECK_DOC//,/--}${SEP}${CHECK_CAF_EPIC//,/--}${SEP}${CHECK_RESOURCE_ID//,/--}${SEP}${PROWLER_START_TIME//,/--}${SEP}${ACCOUNT_DETAILS_EMAIL//,/--}${SEP}${ACCOUNT_DETAILS_NAME//,/--}${SEP}${ACCOUNT_DETAILS_ARN//,/--}${SEP}${ACCOUNT_DETAILS_ORG//,/--}${SEP}${ACCOUNT_DETAILS_TAGS//,/--}" COLOR_CODE="$OK" # Check if color is different than normal (pass) @@ -148,6 +147,7 @@ general_output() { then REGION_FROM_CHECK=$REGION fi + CSV_LINE="${PROFILE//,/--}${SEP}${ACCOUNT_NUM//,/--}${SEP}${REGION_FROM_CHECK//,/--}${SEP}${TITLE_ID//,/--}${SEP}${CHECK_RESULT//,/--}${SEP}${ITEM_SCORED//,/--}${SEP}${ITEM_CIS_LEVEL//,/--}${SEP}${TITLE_TEXT//,/--}${SEP}${CHECK_RESULT_EXTENDED//,/--}${SEP}${CHECK_ASFF_COMPLIANCE_TYPE//,/--}${SEP}${CHECK_SEVERITY//,/--}${SEP}${CHECK_SERVICENAME//,/--}${SEP}${CHECK_ASFF_RESOURCE_TYPE//,/--}${SEP}${CHECK_ASFF_TYPE//,/--}${SEP}${CHECK_RISK//,/--}${SEP}${CHECK_REMEDIATION//,/--}${SEP}${CHECK_DOC//,/--}${SEP}${CHECK_CAF_EPIC//,/--}${SEP}${CHECK_RESOURCE_ID//,/--}${SEP}${PROWLER_START_TIME//,/--}${SEP}${ACCOUNT_DETAILS_EMAIL//,/--}${SEP}${ACCOUNT_DETAILS_NAME//,/--}${SEP}${ACCOUNT_DETAILS_ARN//,/--}${SEP}${ACCOUNT_DETAILS_ORG//,/--}${SEP}${ACCOUNT_DETAILS_TAGS//,/--}" # Iterating over input modes OIFS="${IFS}" IFS=','