How to archive artifacts of prowler output in jenkins

[gitbhavesh07]

I am running prowler using a jenkins pipeline script. Am running prowler in my infrastructure using docker . Am able to run prowler and my build got succeeded.

I need to archive my prowler report. Is there any way to archive the artifact (prowler html report) , let me attach my pipeline script below,

pipeline{
agent any

environment {
    AWS_ACCESS_KEY_ID = 'xxxxxxxxxxxxxxxxxxx'
    AWS_SECRET_ACCESS_KEY    = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
}

stages{
    stage('Pipeline Info'){
        steps{
            script{
                echo "Prowler in Execution"
            }
        }
    }

    
    stage('Setting up prowler docker container'){
        steps{
            script{
                echo "Pulling up last prowler container"
                sh 'docker pull toniblyx/prowler'
            }
        }
    }
    stage('Setting up envs AWS and run prowler'){
        steps{
                script{
                    def exitCode = sh script: 'docker run --rm --name prowler --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY toniblyx/prowler:latest -f ap-south-1 -M html', returnStatus: true  
                }
        }
    }
}
}

I need something like this ,

 post{
    always{

        archiveArtifacts artifacts: 'report.html',onlyIfSuccessful: true
      }
}

[jfagoagas]

Hi @gitbhavesh07, four your use case you have to use these Prowler options to upload the findings to S3.

 -B   Custom output bucket, requires -M <mode> and it can work also with -o flag.
         (i.e.: -M csv -B my-bucket or -M csv -B my-bucket/folder/)
 -D   Same as -B but do not use the assumed role credentials to put objects to the bucket, instead uses the initial credentials.

So you can replace your script with the following:

script{
    def exitCode = sh script: 'docker run --rm --name prowler --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY toniblyx/prowler:latest -f ap-south-1 -M html -B my-bucket/folder/', returnStatus: true  
}

Please, check it and let us know if it works for your use case.

Thanks for using Prowler!

[jfagoagas]

So we cant archive the artifacts right?

With Prowler the only way to do so is using the builtin flags for sending the outputs to S3 or using your shell to put them in another place.

[jfagoagas]

I have a root account , I have dev account and qa account, I have to run prowler checks in dev and qa by switching role . When I tried to assume role , I faced an error like no credentials . But while testing the root account , it works fine. What all permission I need to do so ?

What authentication mechanism are you using?

Remember that to use IAM Roles you have to use the -R and -A options. Also check the Prowler permissions file under the README.md.

Thanks!

[gitbhavesh07]

I have set my root account's secret and access key , I have created a assume role in dev account and gave trust relationship for root account. I can now switch from my root account to dev account using that role . So using my root credentials I want to perform prowler in my dev account . This is my goal

This command works fine , it runs prowler checks in my root account

docker run --rm --name prowler --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY toniblyx/prowler:latest -f ap-south-1 -M html

This is the command to run prowler checks in dev account right

docker run --rm --name prowler --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY toniblyx/prowler:latest -A DEVACCOUNTID -R ASSUMEROLEINDEVACCOUNT -f ap-south-1 -M html

But am getting this error ,Unable to locate credentials. You can configure credentials by running "aws configure"

[gitbhavesh07]

If not with docker , I have ran prowler like this

sh "./prowler -f ap-south-1 -M html

So is there any possibility to get the html like this ,

sh "./prowler -f ap-south-1 -M html > report.html

If this is done , then I will archive the artifacts and send the report over an email . I have to get the ouput stored in jenkins itself , so I will fetch the output and send an email

    post{
        always{

            archiveArtifacts artifacts: 'report.html',onlyIfSuccessful: true
            emailext attachLog: false, attachmentsPattern: 'report.html', body: 'prowler report', subject: 'Prowler Report', to: '[email protected]'
        }
    }

[jfagoagas]

Hi @gitbhavesh07, as you can see here in the Prowler documentation, if you use the -M option the reports generated for the output modes are stored in the ./output folder by default. So you can archive your artifacts this way.

Thanks!

[jfagoagas]

Hi @gitbhavesh07, as you can see here in the Prowler documentation, if you use the -M option the reports generated for the output modes are stored in the ./output folder by default. So you can archive your artifacts this way.

Thanks!

[gitbhavesh07]

yeah that perfectly works ,Thanks !!!

Can we run prowler in windows cmd?