Create a script which assumes the role, runs prowler, and uploads to s3

Dockerfile

@@ -1,10 +0,0 @@
-FROM python:3.7-slim
-MAINTAINER Bridgecrew <www.bridgecrew.io>
-
-RUN apt-get update && apt-get upgrade -y && apt-get install jq curl -y && pip install awscli detect-secrets boto3
-
-RUN curl -sL https://github.com/bridgecrewio/prowler/archive/feature/dockerized_prowler.tar.gz | tar xz
-
-WORKDIR "./prowler-feature-dockerized_prowler"
-
-ENTRYPOINT ["./run.sh"]

bridgecrew-prowler/Dockerfile

@@ -0,0 +1,14 @@
+FROM toniblyx/prowler
+MAINTAINER Bridgecrew <www.bridgecrew.io>
+
+USER root
+
+WORKDIR "./prowler"
+
+COPY "./run.sh" "."
+
+RUN chown -R prowler /prowler/
+
+USER prowler
+
+ENTRYPOINT ["./run.sh"]

bridgecrew-prowler/run.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+echo "Assuming role for ${ACCOUNT_ID}"
+creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --external-id ${EXTERNAL_ID} --role-session-name prowler | jq '.Credentials')
+export AWS_ACCESS_KEY_ID=$(echo $creds | jq ".AccessKeyId" | sed 's/\"//g')
+export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq ".SecretAccessKey" | sed 's/\"//g')
+export AWS_SESSION_TOKEN=$(echo $creds | jq ".SessionToken" | sed 's/\"//g')
+
+echo "Running prowler on ${ACCOUNT_ID}"
+./prowler -c extra741,extra742,extra759 -M json > output.json
+
+echo "Results:"
+cat output.json
+
+unset AWS_ACCESS_KEY_ID
+unset AWS_SECRET_ACCESS_KEY
+unset AWS_SESSION_TOKEN
+
+echo "Uploading result to s3://${BUCKET}/prowler/${ACCOUNT_ID}/output.json"
+aws s3api put-object --bucket ${BUCKET} --key prowler/$ACCOUNT_ID/output.json --body output.json

run.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-python3 credentials.py $ACCOUNT_ID
-
-echo "Running prowler on $ALIAS"
-./prowler -c extra741 -M json > output.json
-
-cat output.json
-
-aws s3api put-object --bucket $BUCKET --key prowler/$ACCOUNT_ID/results