check for multi region trails

prowler-cloud · Mar 26, 2024 · ad80d3b · ad80d3b
1 parent 4c85178
commit ad80d3b
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 2 deletions.
diff --git a/...oudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py b/...oudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py
@@ -106,7 +106,18 @@ def execute(self):
         findings = []
         potential_enumeration = {}
         found_potential_enumeration = False
-        for trail in cloudtrail_client.trails:
+        multiregion_trail = None
+        # Check if any trail is multi-region so we only need to check once
+        for trail in cloudtrail_client.trails.values():
+            if trail.is_multiregion:
+                multiregion_trail = trail
+                break
+        trails_to_scan = (
+            cloudtrail_client.trails.values()
+            if not multiregion_trail
+            else [multiregion_trail]
+        )
+        for trail in trails_to_scan:
             for event_name in ENUMERATION_ACTIONS:
                 for event_log in cloudtrail_client.__lookup_events__(
                     trail=trail,

diff --git a/...l_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py b/...l_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py
@@ -67,7 +67,17 @@ def execute(self):
         findings = []
         potential_privilege_escalation = {}
         found_potential_privilege_escalation = False
-        for trail in cloudtrail_client.trails:
+        multiregion_trail = None
+        # Check if any trail is multi-region so we only need to check once
+        for trail in cloudtrail_client.trails.values():
+            if trail.is_multiregion:
+                multiregion_trail = trail
+        trails_to_scan = (
+            cloudtrail_client.trails.values()
+            if not multiregion_trail
+            else [multiregion_trail]
+        )
+        for trail in trails_to_scan:
             for event_name in PRIVILEGE_ESCALATION_ACTIONS:
                 for event_log in cloudtrail_client.__lookup_events__(
                     trail=trail,