Skip to content

Commit cb3778a

Browse files
ruchit-cdruchit-cd
authored
Updated workflow of prowler for AWS (#167)
1 parent 707f967 commit cb3778a

File tree

2 files changed

+203
-0
lines changed

2 files changed

+203
-0
lines changed

‎.github/workflows/prowlerAWS.yml‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
---
2+
name: Prowler Reusable Workflow
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
cloud_provider:
8+
required: true
9+
type: string
10+
default: aws
11+
description: 'Cloud Provider'
12+
aws_region:
13+
required: false
14+
type: string
15+
description: 'AWS Region'
16+
access_token_lifetime:
17+
required: false
18+
type: number
19+
default: 300
20+
description: 'Duration for which an access token remains valid.'
21+
role_duration_seconds:
22+
required: false
23+
type: number
24+
default: 900
25+
description: 'Duration of the session.'
26+
retention_days:
27+
required: false
28+
type: number
29+
default: 1
30+
description: 'Duration of the reports retention period.'
31+
enable_s3_upload:
32+
required: false
33+
type: boolean
34+
default: false
35+
description: 'Enable this to upload the reports to S3 bucket.'
36+
enable_slack_notification:
37+
required: false
38+
type: boolean
39+
default: false
40+
description: 'Enable Slack notifications for workflow results.'
41+
SLACK_MESSAGE:
42+
required: false
43+
type: string
44+
default: 'Updated prowler workflow notification'
45+
description: 'Message to display in Slack Notification'
46+
SLACK_ENV:
47+
required: false
48+
type: string
49+
default: ''
50+
description: 'Workflow Environment to show in Slack Notification'
51+
send_to_securityhub:
52+
type: boolean
53+
required: false
54+
default: false
55+
description: 'Send findings to Security Hub'
56+
57+
secrets:
58+
BUILD_ROLE:
59+
required: false
60+
description: 'AWS OIDC role for AWS authentication.'
61+
PROWLER_ROLE_NAME:
62+
required: false
63+
description: 'AWS IAM Role Name for running prowler.'
64+
AWS_ACCESS_KEY_ID:
65+
required: false
66+
description: 'AWS Access Key ID'
67+
AWS_SECRET_ACCESS_KEY:
68+
required: false
69+
description: 'AWS Secret Access Key'
70+
AWS_SESSION_TOKEN:
71+
required: false
72+
description: 'AWS Session Token'
73+
TARGET_ACCOUNT_ID:
74+
required: false
75+
description: 'All aws account ids you want to scan.'
76+
S3_BUCKET_NAME:
77+
required: false
78+
description: 'S3 bucket to store the prowler reports.'
79+
SLACK_WEBHOOK:
80+
required: false
81+
description: 'The slack channel webhook URL to send the notification'
82+
SLACK_USERNAME:
83+
required: false
84+
description: 'The slack channel webhook URL to send the notification'
85+
86+
jobs:
87+
prowler:
88+
runs-on: ubuntu-latest
89+
90+
steps:
91+
- name: Check out code
92+
uses: actions/checkout@v3
93+
94+
- name: Install pip
95+
run: |
96+
sudo apt update
97+
sudo apt install -y python3 python3-pip
98+
99+
- name: Install Prowler
100+
run: |
101+
python3 -m pip install --upgrade pip
102+
pip3 install prowler
103+
104+
- name: Install AWS CLI
105+
if: ${{ inputs.cloud_provider == 'aws' }}
106+
uses: aws-actions/configure-aws-credentials@v4
107+
with:
108+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
109+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
110+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
111+
role-to-assume: ${{ secrets.BUILD_ROLE }}
112+
aws-region: ${{ inputs.aws_region }}
113+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
114+
role-skip-session-tagging: true
115+
116+
- name: Running Prowler for AWS
117+
env:
118+
ACCOUNT_ID: ${{ secrets.TARGET_ACCOUNT_ID }}
119+
run: |
120+
export MONTH_NAME=$(date +%B)
121+
for ACCOUNTID in $ACCOUNT_ID; do
122+
{
123+
echo "Scanning AWS Account: $ACCOUNTID"
124+
PROWLER_CMD="prowler aws \
125+
--role arn:aws:iam::${ACCOUNTID}:role/${{ secrets.PROWLER_ROLE_NAME }} \
126+
--output-directory /home/runner/work/prowler/prowler/output/$MONTH_NAME \
127+
--output-modes html csv json-asff \
128+
--ignore-exit-code-3"
129+
if [ "${{ inputs.send_to_securityhub }}" = "true" ]; then
130+
PROWLER_CMD="$PROWLER_CMD --security-hub"
131+
fi
132+
eval $PROWLER_CMD
133+
}
134+
done
135+
136+
- name: Upload Artifact
137+
if: ${{ inputs.enable_s3_upload == false }}
138+
uses: actions/upload-artifact@v4
139+
with:
140+
name: prowler-reports
141+
path: /home/runner/work/prowler/prowler/output/
142+
retention-days: ${{ inputs.retention_days }}
143+
144+
- name: Upload Prowler Results to AWS S3
145+
if: ${{ inputs.enable_s3_upload == true }}
146+
run: |
147+
YEAR=$(date +'%Y')
148+
MONTH=$(date +'%m')
149+
aws s3 cp /home/runner/work/prowler/prowler/output/ s3://${{ secrets.S3_BUCKET_NAME }}/$YEAR/$MONTH/ --recursive
150+
151+
- name: 'Notify Slack'
152+
uses: clouddrove/action-slack-notify@1
153+
if: ${{ inputs.enable_slack_notification == true }}
154+
env:
155+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
156+
SLACK_MESSAGE: ${{ inputs.SLACK_MESSAGE }}
157+
SLACK_ENV: ${{ inputs.SLACK_ENV }}
158+
SLACK_USERNAME: ${{ secrets.SLACK_USERNAME}}
159+
SLACK_COLOR: ${{ job.status == 'success' && 'good' || job.status == 'failure' && 'danger' || 'warning' }}
160+
...

‎docs/prowlerAWS.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
## [Prowler Workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/.github/workflows/prowlerAWS.yml)
2+
Prowler an open cloud security platform for our cloud environment. We get a complete report of our cloud infra.
3+
4+
### Usage
5+
This workflow is used to run Prowler scan on your cloud infra for AWS. In the Workflow you can choose to send your report to your S3 Bucket or you can also disable that and at the end of the workflow you will get a Artifact which you can download. You can also enable the feature of Security Hub which will send the findings into your account. It also supports Multi-AWS account.
6+
7+
### Example for AWS cloud provider
8+
9+
```yaml
10+
name: 'Running Prowler'
11+
12+
on:
13+
workflow_dispatch:
14+
15+
permissions:
16+
id-token: write
17+
contents: read
18+
19+
jobs:
20+
aws-assessment:
21+
name: Run prowler security
22+
# uses: clouddrove/github-shared-workflows/.github/workflows/prowler.yml@master
23+
uses: clouddrove-sandbox/test-shared-workflow/.github/workflows/prowler.yml@master
24+
with:
25+
cloud_provider: 'aws'
26+
aws_region: ## aws region
27+
role_duration_seconds: 900
28+
retention_period: ## retention period of reports
29+
SLACK_MESSAGE: ## Message to display in Slack Notification
30+
SLACK_ENV: ## Workflow Environment to display in Slack Notification
31+
enable_s3_upload: true ## to upload reports into your S3 Bucket
32+
enable_slack_notification: false ## to get the notification on slack for successfull running the workflow
33+
send_to_securityhub: ## Enable this to get the findings in your security hub
34+
secrets:
35+
BUILD_ROLE: ${{ secrets.BUILD_ROLE }} ## OIDC Role
36+
PROWLER_ROLE_NAME: ${{ secrets.PROWLER_ROLE_NAME }} ## Prowler Role
37+
TARGET_ACCOUNT_ID: ${{ secrets.TARGET_ACCOUNT_ID }}
38+
S3_BUCKET_NAME: ${{ secrets.S3_BUCKET_NAME }}
39+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
40+
SLACK_USERNAME: ${{ secrets.SLACK_USERNAME }}
41+
```
42+
43+
It uses Clouddrove Github-Shared-Workflow. [HERE](https://github.com/clouddrove/github-shared-workflows/blob/master/.github/workflows/prowlerAWS.yml)

0 commit comments

Comments
 (0)