/
check_aws_cloudtrails_event_selectors.py
executable file
·154 lines (134 loc) · 5.96 KB
/
check_aws_cloudtrails_event_selectors.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
#!/usr/bin/env python3
# vim:ts=4:sts=4:sw=4:et
#
# Author: Hari Sekhon
# Date: 2020-01-17 16:46:43 +0000 (Fri, 17 Jan 2020)
#
# https://github.com/HariSekhon/Nagios-Plugins
#
# License: see accompanying Hari Sekhon LICENSE file
#
# If you're using my code you're welcome to connect with me on LinkedIn
# and optionally send me feedback to help steer this or other code I publish
#
# https://www.linkedin.com/in/HariSekhon
#
"""
Nagios Plugin to check AWS CloudTrails have at least 1 event selector enabled and
that for each event selector management events are enabled and ReadWrite type = ALL
Can check one specifically name Cloud Trail or defaults to checking all of them
Uses the Boto python library, read here for the list of ways to configure your AWS credentials:
https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html
See also various AWS tools in DevOps Bash Tools and DevOps Python tools repos
- https://github.com/HariSekhon/DevOps-Bash-tools
- https://github.com/HariSekhon/DevOps-Python-tools
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
#from __future__ import unicode_literals
import os
import sys
import traceback
import boto3
srcdir = os.path.abspath(os.path.dirname(__file__))
libdir = os.path.join(srcdir, 'pylib')
sys.path.append(libdir)
try:
# pylint: disable=wrong-import-position
from harisekhon.utils import CriticalError, ERRORS, log, jsonpp
from harisekhon import NagiosPlugin
except ImportError:
print(traceback.format_exc(), end='')
sys.exit(4)
__author__ = 'Hari Sekhon'
__version__ = '0.1.0'
class CheckAWSCloudTrailEventSelectors(NagiosPlugin):
def __init__(self):
# Python 2.x
super(CheckAWSCloudTrailEventSelectors, self).__init__()
# Python 3.x
# super().__init__()
self.trail_name = None
self.no_logfile_validation = False
self.no_multi_region = False
self.msg = 'CheckAWSCloudTrailEventSelectors msg not defined'
self.ok()
def add_options(self):
self.add_opt('-n', '--name', help='Name of a specific cloud trail to check (defaults to all of them')
self.add_opt('--no-multi-region', action='store_true',
help='Do not require multi-region to be enabled (not recommended)')
self.add_opt('--no-logfile-validation', action='store_true',
help='Do not require logfile validation to be enabled (not recommended)')
self.add_opt('-l', '--list-trails', action='store_true',
help='List trails and exit')
def process_args(self):
self.no_args()
self.trail_name = self.get_opt('name')
self.no_multi_region = self.get_opt('no_multi_region')
self.no_logfile_validation = self.get_opt('no_logfile_validation')
def run(self):
client = boto3.client('cloudtrail')
log.info('describing cloud trails')
_ = client.describe_trails()
log.debug('%s', jsonpp(_))
trail_list = _['trailList']
num_trails = len(trail_list)
log.info('found %s trails', num_trails)
if self.get_opt('list_trails'):
print('Cloud Trails:\n')
for trail in trail_list:
print(trail['Name'])
sys.exit(ERRORS['UNKNOWN'])
if self.trail_name:
self.msg = 'AWS cloudtrail \'{}\''.format(self.trail_name)
else:
self.msg = 'AWS {} cloudtrails'.format(num_trails)
(num_event_selectors, num_management, num_readwrite_all, trails_without_selectors) \
= self.process_event_selectors(client, trail_list)
self.msg += ' event selectors IncludeManagement: {mgt}/{total}, ReadWriteALL: {readwrite}/{total}'\
.format(total=num_event_selectors,
mgt=num_management,
readwrite=num_readwrite_all)
self.msg += ', trails without event selectors: {}'.format(trails_without_selectors)
self.msg += ' |'
self.msg += ' num_trails={}'.format(num_trails)
self.msg += ' trails_without_event_selectors={}'.format(trails_without_selectors)
self.msg += ' num_event_selectors={}'.format(num_event_selectors)
self.msg += ' num_management={}'.format(num_management)
self.msg += ' num_readwrite_all={}'.format(num_readwrite_all)
def process_event_selectors(self, client, trail_list):
total_event_selectors = 0
num_management = 0
num_readwrite_all = 0
trails_without_selectors = 0
found = False
for trail in trail_list:
name = trail['Name']
if self.trail_name and self.trail_name != name:
continue
found = True
trail_info = client.get_event_selectors(TrailName=name)
log.debug('%s', jsonpp(trail_info))
event_selectors = trail_info['EventSelectors']
num_event_selectors = len(event_selectors)
total_event_selectors += num_event_selectors
if num_event_selectors < 1:
log.warn('cloud trail %s has no event selectors', trail)
self.warning()
trails_without_selectors += 1
for event_selector in event_selectors:
if event_selector['IncludeManagementEvents']:
num_management += 1
if event_selector['ReadWriteType'].lower() == 'all': # All
num_readwrite_all += 1
if num_management < num_event_selectors or \
num_readwrite_all < num_event_selectors:
self.warning()
if self.trail_name and not found:
raise CriticalError('cloud trail \'{}\' not found'.format(self.trail_name))
if total_event_selectors == 0:
self.warning()
return (total_event_selectors, num_management, num_readwrite_all, trails_without_selectors)
if __name__ == '__main__':
CheckAWSCloudTrailEventSelectors().main()