forked from webpwnized/gcp-audit
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcis-2.2.2-folder-cloud-logging-sinks.sh
executable file
·159 lines (128 loc) · 5.55 KB
/
cis-2.2.2-folder-cloud-logging-sinks.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
#!/bin/bash
source functions.inc
declare ORGANIZATION_IDS="";
declare FOLDER_ID="";
declare DEBUG="False";
declare CSV="False";
declare ICH="False";
declare HELP=$(cat << EOL
$0 [-o, --organization ORGANIZATION] [-f, --folder FOLDER] [-c, --csv] [-i, --include-column-headers] [-d, --debug] [-h, --help]
EOL
);
for arg in "$@"; do
shift
case "$arg" in
"--help") set -- "$@" "-h" ;;
"--debug") set -- "$@" "-d" ;;
"--csv") set -- "$@" "-c" ;;
"--include-column-headers") set -- "$@" "-i" ;;
"--orgnanization") set -- "$@" "-o" ;;
"--folder") set -- "$@" "-f" ;;
*) set -- "$@" "$arg"
esac
done
while getopts "hdcio:f:" option
do
case "${option}"
in
o)
ORGNAIZATION_IDS=${OPTARG};;
f)
FOLDER_IDS=${OPTARG};;
d)
DEBUG="True";;
c)
CSV="True";;
i)
ICH="True";;
h)
echo $HELP;
exit 0;;
esac;
done;
if ! api_enabled logging.googleapis.com; then
echo "WARNING: Logging API is not enabled";
exit 1000;
fi;
declare DEFAULT_DEFAULT_LOG_SINK_FILTER="NOT LOG_ID(\"cloudaudit.googleapis.com/activity\") AND NOT LOG_ID(\"externalaudit.googleapis.com/activity\") AND NOT LOG_ID(\"cloudaudit.googleapis.com/system_event\") AND NOT LOG_ID(\"externalaudit.googleapis.com/system_event\") AND NOT LOG_ID(\"cloudaudit.googleapis.com/access_transparency\") AND NOT LOG_ID(\"externalaudit.googleapis.com/access_transparency\")";
declare DEFAULT_REQUIRED_LOG_SINK_FILTER="LOG_ID(\"cloudaudit.googleapis.com/activity\") OR LOG_ID(\"externalaudit.googleapis.com/activity\") OR LOG_ID(\"cloudaudit.googleapis.com/system_event\") OR LOG_ID(\"externalaudit.googleapis.com/system_event\") OR LOG_ID(\"cloudaudit.googleapis.com/access_transparency\") OR LOG_ID(\"externalaudit.googleapis.com/access_transparency\")";
declare SINK_FILTER_IS_DEFAULT_DEFAULT_MESSAGE="NOTICE: Google _Default log sink filter is in use";
declare SINK_FILTER_IS_REQUIRED_DEFAULT_MESSAGE="NOTICE: Google _Required log sink filter is in use";
declare SINK_FILTER_IS_NOT_DEFAULT_MESSAGE="NOTICE: Custom log sink filter is in use";
if [[ $ORGANIZATIONAL_IDS == "" ]]; then
declare ORGANIZATIONS=$(gcloud organizations list --format="json");
fi;
if [[ $DEBUG == "True" ]]; then
echo "Organizations (JSON): $ORGANIZATIONS";
fi;
if [[ $ICH == "True" ]]; then
echo "\"ORGANIZATION_DISPLAY_NAME\", \"FOLDER_DISPLAY_NAME\", \"SINK_NAME\", \"SINK_DESTINATION\", \"SINK_FILTER_IS_DEFAULT_DEFAULT\", \"SINK_FILTER_IS_REQUIRED_DEFAULT\", \"SINK_FILTER_MESSAGE\", \"SINK_FILTER\"";
fi;
echo $ORGANIZATIONS | jq -rc '.[]' | while IFS='' read -r ORGANIZATION; do
ORGANIZATION_NAME=$(echo $ORGANIZATION | jq -rc '.name' | cut -d"/" -f2);
ORGANIZATION_DISPLAY_NAME=$(echo $ORGANIZATION | jq -rc '.displayName');
if [[ $CSV != "True" ]]; then
echo "---------------------------------------------------------------------------------";
echo "Organization $ORGANIZATION_DISPLAY_NAME";
echo "---------------------------------------------------------------------------------";
echo "";
fi;
if [[ $FOLDER_IDS == "" ]]; then
declare FOLDERS=$(gcloud resource-manager folders list --format="json" --organization="$ORGANIZATION_NAME");
fi;
if [[ $DEBUG == "True" ]]; then
echo "Folders (JSON): $FOLDERS";
fi;
echo $FOLDERS | jq -rc '.[]' | while IFS='' read -r FOLDER; do
FOLDER_NAME=$(echo $FOLDER | jq -rc '.name' | cut -d"/" -f2);
FOLDER_DISPLAY_NAME=$(echo $FOLDER | jq -rc '.displayName');
declare SINKS=$(gcloud logging sinks list --format="json" --folder="$FOLDER_NAME");
if [[ $DEBUG == "True" ]]; then
echo "Sinks (JSON): $SINKS";
fi;
if [[ $CSV != "True" ]]; then
echo "---------------------------------------------------------------------------------";
echo "Log Sinks for Folder $FOLDER_DISPLAY_NAME";
echo "---------------------------------------------------------------------------------";
fi;
if [[ $SINKS != "[]" ]]; then
echo $SINKS | jq -rc '.[]' | while IFS='' read -r SINK;do
if [[ $DEBUG == "True" ]]; then
echo "Log Sink (JSON): $SINK";
fi;
SINK_NAME=$(echo $SINK | jq -rc '.name');
SINK_DESTINATION=$(echo $SINK | jq -rc '.destination');
SINK_FILTER=$(echo $SINK | jq -rc '.filter');
SINK_FILTER_IS_DEFAULT_DEFAULT="False";
SINK_FILTER_IS_REQUIRED_DEFAULT="False";
if [[ $SINK_FILTER == $DEFAULT_DEFAULT_LOG_SINK_FILTER ]]; then
SINK_FILTER_IS_DEFAULT_DEFAULT="True";
SINK_FILTER_MESSAGE=$SINK_FILTER_IS_DEFAULT_DEFAULT_MESSAGE;
elif [[ $SINK_FILTER == $DEFAULT_REQUIRED_LOG_SINK_FILTER ]]; then
SINK_FILTER_IS_REQUIRED_DEFAULT="True";
SINK_FILTER_MESSAGE=$SINK_FILTER_IS_REQUIRED_DEFAULT_MESSAGE;
else
SINK_FILTER_MESSAGE=$SINK_FILTER_IS_NOT_DEFAULT_MESSAGE;
fi;
# Print the results gathered above
if [[ $CSV != "True" ]]; then
echo "Organization: $ORGANIZATION_DISPLAY_NAME";
echo "Folder: $FOLDER_DISPLAY_NAME";
echo "Log Sink Name: $SINK_NAME";
echo "Log Sink Destination: $SINK_DESTINATION";
echo "Log Sink Filter Message: $SINK_FILTER_MESSAGE";
echo "Log Sink Filter: $SINK_FILTER";
echo "";
else
echo "\"$ORGANIZATION_DISPLAY_NAME\", \"$FOLDER_DISPLAY_NAME\", \"$SINK_NAME\", \"$SINK_DESTINATION\", \"$SINK_FILTER_IS_DEFAULT_DEFAULT\", \"$SINK_FILTER_IS_REQUIRED_DEFAULT\", \"$SINK_FILTER_MESSAGE\", \"$SINK_FILTER\"";
fi;
done; #sinks
else
if [[ $CSV != "True" ]]; then
echo "No log sinks found for folder $FOLDER_DISPLAY_NAME";
echo "";
fi;
fi;
sleep 0.5;
done; #folders
done; #organizations