Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fail early #60

Merged
merged 4 commits into from
Jul 12, 2017
Merged

Fail early #60

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8913ca8
exit script if there are problems with the credentials.
ballensans Jul 11, 2017
5c335b2
handle permission failure on list-subscriptions-by-topic gracefully
ballensans Jul 11, 2017
95a4b56
swallow error message for list-subscriptions-by-topic
ballensans Jul 11, 2017
cf9a73d
gather count of topics per region, even when unable to list subscribers.
ballensans Jul 11, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 39 additions & 5 deletions prowler
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,14 @@ prowlerBanner() {
# Get whoami in AWS, who is the user running this shell script
getWhoami(){
if [[ $MODE == "csv" ]]; then
CALLER_ARN=$($AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION --query "Arn" | tr -d '"')
CALLER_ARN_RAW=$($AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION --query "Arn")
if [[ 255 -eq $? ]]; then
# Failed to get own identity ... exit
echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
>&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
exit 2
fi
CALLER_ARN=$(echo $CALLER_ARN_RAW | tr -d '"')
textTitle "0.0" "Show report generation info"
textNotice "ARN: $CALLER_ARN TIMESTAMP: $SCRIPT_START_TIME"
else
Expand All @@ -333,10 +340,24 @@ getWhoami(){
echo ""
echo -e "AWS-CLI Profile: $NOTICE[$PROFILE]$NORMAL AWS API Region: $NOTICE[$REGION]$NORMAL AWS Filter Region: $NOTICE[${FILTERREGION:-all}]$NORMAL\n"
if [[ $MONOCHROME -eq 1 ]]; then
$AWSCLI sts get-caller-identity --output json --profile $PROFILE --region $REGION | grep ':'
echo "Caller Identity:"
$AWSCLI sts get-caller-identity --output text --profile $PROFILE --region $REGION --query "Arn"
if [[ 255 -eq $? ]]; then
# Failed to get own identity ... exit
echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
>&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
exit 2
fi
echo ""
else
echo "Caller Identity:"
$AWSCLI sts get-caller-identity --output table --profile $PROFILE --region $REGION
if [[ 255 -eq $? ]]; then
# Failed to get own identity ... exit
echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
>&2 echo "ERROR WITH $PROFILE CREDENTIALS - EXITING!"
exit 2
fi
echo ""
fi
fi
Expand Down Expand Up @@ -1209,12 +1230,21 @@ check315(){
ID315="3.15"
TITLE315="Ensure appropriate subscribers to each SNS topic (Not Scored)"
textTitle "$ID315" "$TITLE315" "0"
CAN_SNS_LIST_SUBS=1
for regx in $REGIONS; do
TOPICS_LIST=$($AWSCLI sns list-topics --profile $PROFILE --region $regx --output text --query 'Topics[*].TopicArn')
if [[ $TOPICS_LIST ]];then
if [[ $TOPICS_LIST && $CAN_SNS_LIST_SUBS -eq 1 ]];then
for topic in $TOPICS_LIST; do
CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS | grep -v "None")
if [[ $CHECK_TOPIC_LIST ]]; then
CHECK_TOPIC_LIST=$($AWSCLI sns list-subscriptions-by-topic --topic-arn $topic --profile $PROFILE --region $regx --query 'Subscriptions[*].{Endpoint:Endpoint,Protocol:Protocol}' --output text --max-items $MAXITEMS 2> /dev/null)
if [[ $? -eq 255 ]]; then
# Permission error
export CAN_SNS_LIST_SUBS=0
textNotice "No permission to list subscribers in topics"
ntopics=$(echo $TOPICS_LIST | wc -w )
textNotice "Region $regx has $ntopics topics" "$regx"
break;
fi
if [[ $(grep -v 'None' $CHECK_TOPIC_LIST) ]]; then
TOPIC_SHORT=$(echo $topic | awk -F: '{ print $7 }')
textNotice "Region $regx with Topic $TOPIC_SHORT:" "$regx"
textNotice "- Suscription: $CHECK_TOPIC_LIST" "$regx"
Expand All @@ -1223,6 +1253,10 @@ check315(){
textWarn " - Region $regx and Topic $topic" "$regx"
fi
done
elif [[ $CAN_SNS_LIST_SUBS -eq 0 ]]; then
ntopics=$(echo $TOPICS_LIST | wc -w )
textNotice "Region $regx has $ntopics topics" "$regx"
# break
else
textNotice "Region $regx doesn't have topics" "$regx"
fi
Expand Down