mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-02-09 02:30:43 +00:00
55 lines
3.0 KiB
Bash
55 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
||
|
||
# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
|
||
#
|
||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||
# use this file except in compliance with the License. You may obtain a copy
|
||
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
||
#
|
||
# Unless required by applicable law or agreed to in writing, software distributed
|
||
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
||
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
||
# specific language governing permissions and limitations under the License.
|
||
|
||
CHECK_ID_check27="2.7"
|
||
CHECK_TITLE_check27="[check27] Ensure CloudTrail logs are encrypted at rest using KMS CMKs"
|
||
CHECK_SCORED_check27="SCORED"
|
||
CHECK_CIS_LEVEL_check27="LEVEL2"
|
||
CHECK_SEVERITY_check27="Medium"
|
||
CHECK_ASFF_TYPE_check27="Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
|
||
CHECK_ASFF_RESOURCE_TYPE_check27="AwsCloudTrailTrail"
|
||
CHECK_ALTERNATE_check207="check27"
|
||
CHECK_ASFF_COMPLIANCE_TYPE_check27="ens-op.exp.10.aws.trail.5"
|
||
CHECK_SERVICENAME_check27="cloudtrail"
|
||
CHECK_RISK_check27='By default; the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable; you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.'
|
||
CHECK_REMEDIATION_check27='This approach has the following advantages: You can create and manage the CMK encryption keys yourself. You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions. You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users. You have enhanced security.'
|
||
CHECK_DOC_check27='https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html'
|
||
CHECK_CAF_EPIC_check27='Logging and Monitoring'
|
||
|
||
check27(){
|
||
for regx in $REGIONS; do
|
||
TRAILS_DETAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].{Name:Name, KeyID:KmsKeyId}' --output text 2>&1)
|
||
if [[ $(echo "$TRAILS_DETAILS" | grep AccessDenied) ]]; then
|
||
textInfo "$regx: Access Denied trying to describe trails" "$regx"
|
||
continue
|
||
fi
|
||
if [[ $TRAILS_DETAILS ]]
|
||
then
|
||
for REGION_TRAIL in "${TRAILS_DETAILS}"
|
||
do
|
||
while read -r TRAIL_KEY_ID TRAIL_NAME
|
||
do
|
||
if [[ "${TRAIL_KEY_ID}" != "None" ]]
|
||
then
|
||
textPass "$regx: Trail $TRAIL_NAME has encryption enabled" "$regx" "$TRAIL_NAME"
|
||
else
|
||
textFail "$regx: Trail $TRAIL_NAME has encryption disabled" "$regx" "$TRAIL_NAME"
|
||
fi
|
||
done <<< "${REGION_TRAIL}"
|
||
done
|
||
else
|
||
textPass "$regx: No CloudTrail trails were found for the region" "${regx}" "No trails found"
|
||
fi
|
||
done
|
||
}
|