mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-10 05:24:20 +00:00
f691046c1f
* chore(inventory): option included in main * chore(inventory): quick inventory * chore(inventory): functional version * chore(inventory): functional version without echo * Update include/quick_inventory Co-authored-by: Pepe Fagoaga <pepe@verica.io> * Update prowler Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com> * Added new line at report line Co-authored-by: Pepe Fagoaga <pepe@verica.io> Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
93 lines
4.3 KiB
Bash
93 lines
4.3 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2021) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
###############################################################################
|
|
|
|
# Probably the easier and quickest way to get a resouce inventory in AWS.
|
|
|
|
# Lists (almost) all resources in all regions based on:
|
|
# https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html
|
|
|
|
# this list is not accurate https://docs.aws.amazon.com/ARG/latest/userguide/supported-resources.html
|
|
# don't fully trust that list column "Tag-based Groups".
|
|
# as far as I can see it doesn't include:
|
|
# CodeBuild build projects like arn:aws:codebuild:eu-west-1:123456789012:build/Abcdefg
|
|
# despite the supported-resources documentation page
|
|
|
|
# Requires IAM permissions:
|
|
# resource-groups:Get*
|
|
# resource-groups:GroupResources
|
|
|
|
|
|
# Quick inventory part
|
|
quick_inventory(){
|
|
# Create a temporary file to store all resources arn
|
|
TEMP_INVENTORY_FILE=$(mktemp -t prowler-inventory-${ACCOUNT_NUM}.XXXXXXXXXX)
|
|
INVENTORY_FILE="$OUTPUT_DIR/prowler-inventory-${ACCOUNT_NUM}-${OUTPUT_DATE}.csv"
|
|
|
|
echo "-=- Running the inventory for AWS Account ${OK}${ACCOUNT_NUM}${NORMAL} -=-"
|
|
echo -e "\n # Counting resources by region:"
|
|
# get all resources per region and getting only their ARN
|
|
for region in $REGIONS; do
|
|
echo -ne " - $region: "
|
|
AWS_RESOURCES=$($AWSCLI resourcegroupstaggingapi get-resources \
|
|
$PROFILE_OPT \
|
|
--region $region \
|
|
--query ResourceTagMappingList[].ResourceARN \
|
|
--output json 2>&1)
|
|
if grep -q -E 'service control policy' <<< "${AWS_RESOURCES}"; then
|
|
echo -e "${BAD}blocked by a SCP${NORMAL}"
|
|
continue
|
|
fi
|
|
|
|
if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "$AWS_RESOURCES"; then
|
|
echo "${BAD}Access Denied trying to get AWS Resources${NORMAL}"
|
|
continue
|
|
fi
|
|
jq -r '.[]' <<< "${AWS_RESOURCES}" >> "${TEMP_INVENTORY_FILE}"
|
|
TOTAL_RESOURCES_FOUND_REGION=$(grep -c "${region}" "${TEMP_INVENTORY_FILE}")
|
|
|
|
echo -e "${OK}${TOTAL_RESOURCES_FOUND_REGION}${NORMAL} resources!"
|
|
|
|
TOTAL_RESOURCES_FOUND=$(("${TOTAL_RESOURCES_FOUND}"+"${TOTAL_RESOURCES_FOUND_REGION}"))
|
|
done
|
|
echo -e "Total resources found: ${OK}$TOTAL_RESOURCES_FOUND${NORMAL}\n"
|
|
|
|
# Generate file in CSV format
|
|
# send header first
|
|
echo "aws_partition,aws_service,aws_region,aws_account_id,subservice_resource,arn" > "${INVENTORY_FILE}"
|
|
|
|
while IFS=: read -r arn aws_partition aws_service aws_region aws_account_id subservice_resource; do
|
|
echo "$aws_partition,$aws_service,$aws_region,$aws_account_id,$subservice_resource,$aws_partition:$aws_service:$aws_region:$aws_account_id:$subservice_resource"
|
|
done < "${TEMP_INVENTORY_FILE}" >> "${INVENTORY_FILE}"
|
|
|
|
# Show resources found per service
|
|
LIST_OF_DETECTED_SERVICES=$(grep -v subservice_resource < "${INVENTORY_FILE}" | awk -F',' '{ print $2 }' | sort -u )
|
|
for aws_service in $LIST_OF_DETECTED_SERVICES;do
|
|
echo "-=- ${YELLOW}$aws_service${NORMAL} inventory for AWS Account ${ACCOUNT_NUM} -=-"
|
|
if [[ $aws_service == 's3' ]];then
|
|
TOTAL_S3_BUCKETS=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | wc -l | xargs)
|
|
echo "$TOTAL_S3_BUCKETS buckets"
|
|
else
|
|
TOTAL_RESOURCE_SERVICE=$(grep ",$aws_service," < "${INVENTORY_FILE}" | awk -F',' '{ print $5 }' | awk -F'/' '{ print $1 }' | awk -F':' '{ print $1 }' | sort | uniq -c)
|
|
echo "$TOTAL_RESOURCE_SERVICE"
|
|
fi
|
|
done
|
|
echo -e "\nMore details in file: ${INVENTORY_FILE}\n"
|
|
# Clean temp file
|
|
cleanInventoryTemporaryFiles
|
|
}
|
|
|
|
cleanInventoryTemporaryFiles() {
|
|
rm -fr "${TEMP_INVENTORY_FILE}"
|
|
} |