sensu-plugins-aws 10.1.2 → 10.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9563afe668b4a84ecb1d41560588231c94ea851d528cf725e9b4aeec4b2dd8d6
-  data.tar.gz: f457e971482d604d8b6817d827ce6c1db1ccea3c1106a89688cd60b4642311c2
+  metadata.gz: a16969efd75d8180a047d23203b50d8def65e1fa1195c0d9aa01ad33d0fac551
+  data.tar.gz: 27dfefdff63801d47729edc185c112d1bc78027760338442b914431b75446d04
 SHA512:
-  metadata.gz: 86f975041f3167beba850ef75e2b26e04cfa9f69ec737fe26d3528184d97c1e88df9b364552c1e3a54c74e6f5ed3e19e50d3dd35a4d74f895feb5d01d1fc193f
-  data.tar.gz: c331bbacf81e08ff41b2a6ea97c68d755d6dfd6b583fad824bf91017f8ba5585e85620545cb8fffcfd4e6ba7114bfe7e642ca5b21c83fcebeabd11893886bb57
+  metadata.gz: 40bb528c7369ebac03a58c8a550c9cf691996bd1cb35d48e5c82907033c342abb611129cd95a76e8653d7e9d17644e71d71a7cbb26a026f1c8ea84e90acee557
+  data.tar.gz: 840436086db63a6e42b8c86d51c30c92d942efb25f2cd8451d199cc07f7205ec7a0a98a8d24f3ed71585a88349d05c19dd29bd520df2444f548bdb74c86f7eb6

data/CHANGELOG.md

@@ -5,6 +5,11 @@ This CHANGELOG follows the format listed [here](https://github.com/sensu-plugins
 
 ## [Unreleased]
 
+## [10.2.0] - 2018-01-20
+### Added
+- `check-s3-bucket-visiblity.rb` - checks an S3 bucket for existence of a website configuration or bucket policy containing `Get*`,
+`List*` or `*` statements. (@rhussmann)
+
 ## [10.1.2] - 2018-01-13
 ### Security
 - updated rubocop dependency to `~> 0.51.0` per: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8418. (@majormoses)
@@ -422,7 +427,8 @@ WARNING:  This release contains major breaking changes that will impact all user
 ### Added
 - initial release
 
-[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.1.1...HEAD
+[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.2.0...HEAD
+[10.2.0]:https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.1.2...10.2.0
 [10.1.2]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.1.1...10.1.2
 [10.1.1]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.1.0...10.1.1
 [10.1.0]: https://github.com/sensu-plugins/sensu-plugins-aws/compare/10.1.0...10.0.3

data/README.md

@@ -94,6 +94,8 @@
 
 **check-s3-bucket.rb**
 
+**check-s3-bucket-visibility.rb**
+
 **check-s3-object.rb**
 
 **check-s3-tag.rb**

data/bin/check-s3-bucket-visibility.rb

@@ -0,0 +1,115 @@
+#! /usr/bin/env ruby
+#
+# check-s3-bucket-visibility
+#
+# DESCRIPTION:
+#   This plugin checks a bucket for website configuration and bucket policy.
+#   It alerts if the bucket has a website configuration, or a policy that has
+#   Get or List actions.
+#
+# OUTPUT:
+#   plain-text
+#
+# PLATFORMS:
+#   Linux
+#
+# DEPENDENCIES:
+#   gem: aws-sdk
+#   gem: sensu-plugin
+#
+# USAGE:
+#   ./check-s3-bucket-visibility.rb --bucket-name mybucket --aws-region eu-west-1
+#
+# NOTES:
+#
+# LICENSE:
+#   Copyright (c) 2015, Olivier Bazoud and Ricky Hussmann,
+#     olivier.bazoud@gmail.com, ricky.hussmann@gmail.com
+#   Released under the same terms as Sensu (the MIT license); see LICENSE
+#   for details.
+#
+
+require 'aws-sdk'
+require 'sensu-plugin/check/cli'
+require 'sensu-plugins-aws'
+
+class CheckS3Bucket < Sensu::Plugin::Check::CLI
+  include Common
+  option :aws_region,
+         short: '-r AWS_REGION',
+         long: '--aws-region REGION',
+         description: 'AWS Region (defaults to us-east-1).',
+         default: 'us-east-1'
+
+  option :bucket_names,
+         short: '-b BUCKET_NAMES',
+         long: '--bucket-names',
+         description: 'A comma seperated list of S3 buckets to check'
+
+  option :critical_on_missing,
+         short: '-m ',
+         long: '--critical-on-missing',
+         description: 'The check will fail with CRITICAL rather than WARN when a bucket is not found',
+         default: 'false'
+
+  def true?(obj)
+    !obj.nil? && obj.to_s.casecmp('true') != -1
+  end
+
+  def s3_client
+    @s3_client ||= Aws::S3::Client.new
+  end
+
+  def website_configuration?(bucket_name)
+    s3_client.get_bucket_website(bucket: bucket_name)
+    true
+  rescue Aws::S3::Errors::NoSuchWebsiteConfiguration
+    false
+  end
+
+  def get_bucket_policy(bucket_name)
+    JSON.parse(s3_client.get_bucket_policy(bucket: bucket_name).policy.string)
+  rescue Aws::S3::Errors::NoSuchBucketPolicy
+    { 'Statement' => [] }
+  end
+
+  def policy_too_permissive?(policy)
+    policy['Statement'].any? { |s| statement_too_permissive? s }
+  end
+
+  def statement_too_permissive?(s)
+    actions_contain_get_or_list? Array(s['Action'])
+  end
+
+  def actions_contain_get_or_list?(actions)
+    actions.any? { |a| !Array(a).grep(/^s3:Get|s3:List|s3:\*/).empty? }
+  end
+
+  def run
+    errors = []
+    warnings = []
+    buckets = config[:bucket_names].split ','
+
+    buckets.each do |bucket_name|
+      begin
+        if website_configuration?(bucket_name)
+          errors.push "#{bucket_name}: website configuration found"
+        end
+        if policy_too_permissive?(get_bucket_policy(bucket_name))
+          errors.push "#{bucket_name}: bucket policy too permissive"
+        end
+      rescue Aws::S3::Errors::NoSuchBucket => _
+        mesg = "Bucket #{bucket_name} not found"
+        true?(config[:critical_on_missing]) ? errors.push(mesg) : warnings.push(mesg)
+      end
+    end
+
+    if !errors.empty?
+      critical errors.join '; '
+    elsif !warnings.empty?
+      warning warnings.join '; '
+    else
+      ok "#{buckets.join ','} not exposed via website or bucket policy"
+    end
+  end
+end

data/lib/sensu-plugins-aws/version.rb

@@ -1,8 +1,8 @@
 module SensuPluginsAWS
   module Version
     MAJOR = 10
-    MINOR = 1
-    PATCH = 2
+    MINOR = 2
+    PATCH = 0
     VER_STRING = [MAJOR, MINOR, PATCH].compact.join('.')
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sensu-plugins-aws
 version: !ruby/object:Gem::Version
-  version: 10.1.2
+  version: 10.2.0
 platform: ruby
 authors:
 - Sensu-Plugins and contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-13 00:00:00.000000000 Z
+date: 2018-01-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sensu-plugin
@@ -302,6 +302,7 @@ executables:
 - check-reserved-instances.rb
 - check-route.rb
 - check-route53-domain-expiration.rb
+- check-s3-bucket-visibility.rb
 - check-s3-bucket.rb
 - check-s3-object.rb
 - check-s3-tag.rb
@@ -384,6 +385,7 @@ files:
 - bin/check-reserved-instances.rb
 - bin/check-route.rb
 - bin/check-route53-domain-expiration.rb
+- bin/check-s3-bucket-visibility.rb
 - bin/check-s3-bucket.rb
 - bin/check-s3-object.rb
 - bin/check-s3-tag.rb