Skip to content

Commit 30407d0

Browse files
Bharadwajshivam28Bharadwajshivam28
authored
feat/prowler shared workflow for AWS and GCP (#146)
1 parent 1e5db60 commit 30407d0

File tree

4 files changed

+261
-4
lines changed

4 files changed

+261
-4
lines changed

‎.github/workflows/prowler.yml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
name: Prowler Reusable Workflow
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
cloud_provider:
8+
required: true
9+
type: string
10+
description: 'Cloud Provider'
11+
project_id:
12+
required: false
13+
type: string
14+
description: 'Project ID for GCP'
15+
aws_region:
16+
required: false
17+
type: string
18+
description: 'AWS Region'
19+
access_token_lifetime:
20+
required: false
21+
type: number
22+
default: 300
23+
description: 'Duration for which an access token remains valid.'
24+
role_duration_seconds:
25+
required: false
26+
type: number
27+
default: 900
28+
description: 'Duration of the session.'
29+
30+
secrets:
31+
WIP:
32+
required: false
33+
description: 'WIP Connected with Service Account'
34+
SERVICE_ACCOUNT:
35+
required: false
36+
description: 'GCP service account'
37+
BUILD_ROLE:
38+
required: false
39+
description: 'AWS OIDC role for AWS authentication.'
40+
AWS_ACCESS_KEY_ID:
41+
required: false
42+
description: 'AWS Access Key ID'
43+
AWS_SECRET_ACCESS_KEY:
44+
required: false
45+
description: 'AWS Secret Access Key'
46+
AWS_SESSION_TOKEN:
47+
required: false
48+
description: 'AWS Session Token'
49+
AZURE_CLIENT_ID:
50+
required: false
51+
description: 'Azure Client ID'
52+
AZURE_CLIENT_SECRET:
53+
required: false
54+
description: 'Azure Client Secret'
55+
AZURE_TENANT_ID:
56+
required: false
57+
description: 'Azure Tenant ID'
58+
59+
jobs:
60+
prowler:
61+
runs-on: macos-latest
62+
63+
steps:
64+
- name: Check out code
65+
uses: actions/checkout@v3
66+
67+
- name: Install Homebrew
68+
run: |
69+
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
70+
71+
- name: Install Prowler
72+
run: |
73+
brew install prowler
74+
75+
- name: Authenticate with Google Cloud
76+
if: ${{ inputs.cloud_provider == 'gcp' }}
77+
uses: google-github-actions/auth@v1
78+
with:
79+
token_format: access_token
80+
workload_identity_provider: ${{ secrets.WIP }}
81+
service_account: ${{ secrets.SERVICE_ACCOUNT }}
82+
access_token_lifetime: ${{ inputs.access_token_lifetime }}
83+
project_id: ${{ inputs.project_id }}
84+
85+
- name: Install AWS CLI
86+
if: ${{ inputs.cloud_provider == 'aws' }}
87+
uses: aws-actions/configure-aws-credentials@v4
88+
with:
89+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
90+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
91+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
92+
role-to-assume: ${{ secrets.BUILD_ROLE }}
93+
aws-region: ${{ inputs.aws_region }}
94+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
95+
role-skip-session-tagging: true
96+
97+
- name: Run Prowler for GCP
98+
if: ${{ inputs.cloud_provider == 'gcp' }}
99+
id: prowler-gcp
100+
run: |
101+
prowler gcp \
102+
--project-ids ${{ inputs.project_id }} \
103+
-o ${{ github.workspace }}/report/
104+
continue-on-error: true
105+
106+
- name: Run Prowler for AWS
107+
if: ${{ inputs.cloud_provider == 'aws' }}
108+
id: prowler-aws
109+
run: |
110+
prowler aws -o ${{ github.workspace }}/report/
111+
continue-on-error: true
112+
113+
- name: Run Prowler for Azure
114+
if: ${{ inputs.cloud_provider == 'azure' }}
115+
id: prowler-azure
116+
run: |
117+
export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
118+
export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
119+
export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
120+
prowler azure --sp-env-auth -o ${{ github.workspace }}/report/
121+
continue-on-error: true
122+
123+
- name: Upload report directory
124+
uses: actions/upload-artifact@v3
125+
with:
126+
name: compliance-report
127+
path: ${{ github.workspace }}/report/
128+
...

‎README.md‎

Lines changed: 48 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1-
<p align="center"> <img src="images/logo.png" width="100" height="100"></p>
1+
[![Banner](https://github.com/clouddrove/terraform-module-template/assets/119565952/67a8a1af-2eb7-40b7-ae07-c94cde9ce062)][website]
22

33
<h1 align="center">GitHub Shared Workflows</h1>
44

5+
6+
57
<p align="center">
68
GitHub shared workflow defines a workflow that we can use in multiple repos with a simple structure.
79
</p>
810

911

12+
1013
<p align="center">
1114
<a href="LICENSE">
1215
<img src="https://img.shields.io/badge/License-APACHE-blue.svg" alt="Licence">
@@ -69,21 +72,62 @@ Above example is just a simple example to call workflow from github shared workf
6972
13. [ Readme Generation workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/docs/readme.md)
7073
14. [ AWS SSM Send Command workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/docs/AWSSSMSendCommand.md)
7174
15. [ Remote SSH Command workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/docs/RemoteSSHCommand.md)
75+
16. [ Prowler workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/docs/prowler.md)
7276
7377
## Feedback
7478
If you come accross a bug or have any feedback, please log it in our [issue tracker](https://github.com/clouddrove/github-shared-workflows/issues), or feel free to drop us an email at [[email protected]](mailto:[email protected]).
7579
7680
If you have found it worth your time, go ahead and give us a ★ on [our GitHub](https://github.com/clouddrove/github-shared-workflows)!
7781
78-
## About us
82+
## :rocket: Our Accomplishment
83+
84+
We have [*100+ Terraform modules*][terraform_modules] 🙌. You could consider them finished, but, with enthusiasts like yourself, we are able to ever improve them, so we call our status - improvement in progress.
85+
86+
- [Terraform Module Registry:](https://registry.terraform.io/namespaces/clouddrove) Discover our Terraform modules here.
87+
88+
- [Terraform Modules for AWS/Azure Modules:](https://github.com/clouddrove/toc) Explore our comprehensive Table of Contents for easy navigation through our documentation for modules pertaining to AWS, Azure & GCP.
89+
90+
- [Terraform Modules for Digital Ocean:](https://github.com/terraform-do-modules/toc) Check out our specialized Terraform modules for Digital Ocean.
91+
92+
## Join Our Slack Community
93+
94+
Join our vibrant open-source slack community and embark on an ever-evolving journey with CloudDrove; helping you in moving upwards in your career path.
95+
Join our vibrant Open Source Slack Community and embark on a learning journey with CloudDrove. Grow with us in the world of DevOps and set your career on a path of consistency.
96+
97+
🌐💬What you'll get after joining this Slack community:
98+
99+
- 🚀 Encouragement to upgrade your best version.
100+
- 🌈 Learning companionship with our DevOps squad.
101+
- 🌱 Relentless growth with daily updates on new advancements in technologies.
102+
103+
Join our tech elites [Join Now][slack] 🚀
104+
105+
## ✨ Contributors
106+
107+
Big thanks to our contributors for elevating our project with their dedication and expertise! But, we do not wish to stop there, would like to invite contributions from the community in improving these projects and making them more versatile for better reach. Remember, every bit of contribution is immensely valuable, as, together, we are moving in only 1 direction, i.e. forward.
108+
109+
<a href="https://github.com/clouddrove/github-shared-workflows/graphs/contributors">
110+
<img src="https://contrib.rocks/image?repo=clouddrove/github-shared-workflows&max" />
111+
</a>
112+
<br>
113+
<br>
114+
115+
## Explore Our Blogs
116+
117+
Click [here][blog] :books: :star2:
118+
119+
## Tap into our capabilities
120+
We provide a platform for organizations to engage with experienced top-tier DevOps & Cloud services. Tap into our pool of certified engineers and architects to elevate your DevOps and Cloud Solutions.
79121
80-
At [CloudDrove][website], we offer expert guidance, implementation support and services to help organisations accelerate their journey to the cloud. Our services include docker and container orchestration, cloud migration and adoption, infrastructure automation, application modernisation and remediation, and performance engineering.
122+
At [CloudDrove][website], has extensive experience in designing, building & migrating environments, securing, consulting, monitoring, optimizing, automating, and maintaining complex and large modern systems. With remarkable client footprints in American & European corridors, our certified architects & engineers are ready to serve you as per your requirements & schedule. Write to us at [[email protected]](mailto:[email protected]).
81123
82124
<p align="center">We are <b> The Cloud Experts!</b></p>
83125
<hr />
84-
<p align="center">We ❤️ <a href="https://github.com/clouddrove">Open Source</a> and you can check out <a href="https://github.com/clouddrove">our other modules</a> to get help with your new Cloud ideas.</p>
126+
<p align="center">We ❤️ <a href="https://github.com/clouddrove">Open Source</a> and you can check out <a href="https://registry.terraform.io/namespaces/clouddrove">our other modules</a> to get help with your new Cloud ideas.</p>
85127
86128
[website]: https://clouddrove.com
129+
[blog]: https://blog.clouddrove.com
130+
[slack]: https://www.launchpass.com/devops-talks
87131
[github]: https://github.com/clouddrove
88132
[linkedin]: https://cpco.io/linkedin
89133
[twitter]: https://twitter.com/clouddrove/

‎docs/helm.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ jobs:
4545
4646
#### Example for Azure cloud provider
4747
48+
4849
```yaml
4950
name: Helm Workflow Azure
5051
on:

‎docs/prolwer.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
## [Prowler Workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/.github/workflows/prowler.yml)
2+
Prowler an open cloud security platform for our cloud environment. We get a complete report of our cloud infra.
3+
4+
### Usage
5+
This workflow is used to run Prowler scan on your cloud infra for AWS, GCP or Azure. At the end of Workflow a report is also saved Artifacts.
6+
7+
### Example for AWS cloud provider
8+
9+
```yaml
10+
name: Prowler on AWS
11+
on:
12+
push:
13+
branches:
14+
- <Your_Branch>
15+
16+
jobs:
17+
prowler_aws:
18+
permissions:
19+
contents: 'read'
20+
id-token: 'write'
21+
22+
uses: clouddrove/github-shared-workflows/.github/workflows/prowler.yml@feat/master
23+
with:
24+
cloud_provider: aws
25+
aws_region: ## AWS Region
26+
27+
secrets:
28+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
29+
SERVICE_ACCOUNT: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
30+
AWS_SESSION_TOKEN: ${{ secrets.AWS_SESSION_TOKEN }}
31+
BUILD_ROLE: ${{ secrets.BUILD_ROLE }}
32+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
33+
```
34+
35+
### Example for Azure cloud provider
36+
37+
```yaml
38+
name: Prowler Azure
39+
on:
40+
push:
41+
branches:
42+
- <Your_Branch>
43+
44+
jobs:
45+
prowler_azure:
46+
permissions:
47+
contents: 'read'
48+
id-token: 'write'
49+
50+
uses: clouddrove/github-shared-workflows/.github/workflows/prowler.yml@feat/master
51+
with:
52+
cloud_provider: azure
53+
54+
secrets:
55+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
56+
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
57+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
58+
```
59+
60+
### Example for GCP cloud provider
61+
62+
```yaml
63+
name: Prowler for GCP
64+
on:
65+
push:
66+
branches:
67+
- <Your_Branch>
68+
69+
jobs:
70+
prowler_gcp:
71+
permissions:
72+
contents: 'read'
73+
id-token: 'write'
74+
75+
uses: clouddrove/github-shared-workflows/.github/workflows/prowler.yml@feat/master
76+
with:
77+
cloud_provider: gcp
78+
project_id: ## Your GCP Project ID
79+
80+
secrets:
81+
WIP: ${{ secrets.WIP }}
82+
SERVICE_ACCOUNT: ${{ secrets.SERVICE_ACCOUNT }}
83+
```
84+

0 commit comments

Comments
 (0)