mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-19 18:41:50 +00:00
Sergio Garcia
633d7bd8a8
* fix(instance-metadata): Credentials recovering * fix(expr): Dockerfile to root and expr in SESSION_TIME_REMAINING. Co-authored-by: Pepe Fagoaga <pepe@verica.io> Co-authored-by: sergargar <sergio@verica.io>
60 lines
2.3 KiB
Bash
60 lines
2.3 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
|
|
|
|
# Get whoami in AWS, who is the user running this shell script
|
|
# Get a list of all available AWS Regions
|
|
# sice describe-regions doesn't seem to work at me-south-1|eu-south-1|ap-east-1|af-south-1.
|
|
# Probably dased on https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
|
|
# when invoking regions with -r, those regions with STS disabled make GETCALLER fail then
|
|
# this if will filter them out (Africa (Cape Town), Asia Pacific (Hong Kong), Europe (Milan) and Middle East (Bahrain) ):
|
|
|
|
print_whoami(){
|
|
echo -e "\n This report is being generated using credentials below:\n"
|
|
echo -e " AWS-CLI Profile: ${NOTICE}[${PROFILE}]${NORMAL} AWS API Region: ${NOTICE}[${REGION}]${NORMAL} AWS Filter Region: ${NOTICE}[${FILTERREGION:-all}]${NORMAL}"
|
|
echo -e " AWS Account: ${NOTICE}[${ACCOUNT_NUM}]${NORMAL} UserId: ${NOTICE}[${USER_ID}]${NORMAL}"
|
|
echo -e " Caller Identity ARN: ${NOTICE}[${CALLER_ARN}]${NORMAL}\n"
|
|
}
|
|
|
|
get_caller_identity() {
|
|
case "$REGION" in
|
|
me-south-1|eu-south-1|ap-east-1|af-south-1)
|
|
REGION_FOR_STS="us-east-1"
|
|
;;
|
|
*)
|
|
REGION_FOR_STS=$REGION
|
|
;;
|
|
esac
|
|
|
|
if ! GETCALLER=$("${AWSCLI}" sts get-caller-identity \
|
|
${PROFILE_OPT} \
|
|
--output text \
|
|
--region "${REGION_FOR_STS}" \
|
|
--query '[Arn,UserId,Account]' 2>&1)
|
|
then
|
|
echo -e "$RED ERROR Getting credentials to run Prowler - EXITING! $NORMAL"
|
|
EXITCODE=2
|
|
exit $EXITCODE
|
|
fi
|
|
read -r CALLER_ARN USER_ID ACCOUNT_NUM <<< "${GETCALLER}"
|
|
|
|
if [[ $ACCOUNT_TO_ASSUME ]]
|
|
then
|
|
ACCOUNT_NUM=$ACCOUNT_TO_ASSUME
|
|
fi
|
|
|
|
# Set AWS partition
|
|
AWS_PARTITION=$(cut -d: -f2 <<< "${CALLER_ARN}")
|
|
export AWS_PARTITION
|
|
}
|