diff --git a/services/ecs.py b/services/ecs.py index 7e899b0..0345a08 100644 --- a/services/ecs.py +++ b/services/ecs.py @@ -76,7 +76,7 @@ def ecs_containers_readonly_access(): containers = task_definition["containerDefinitions"] for container in containers: - if container.get("readonlyRootFilesystem") == False: + if not container.get("readonlyRootFilesystem"): non_compliant_resources.append(task_definition["taskDefinitionArn"]) break else: @@ -92,20 +92,16 @@ def ecs_containers_readonly_access(): def ecs_container_insights_enabled(): compliant_resources = [] non_compliant_resources = [] - cluster_arns = client.list_clusters()["clusterArns"] - for cluster_arn in cluster_arns: - clusters = client.describe_clusters(clusters=[cluster_arn], include=["SETTINGS"])["clusters"] + clusters = client.describe_clusters(include=["SETTINGS"])["clusters"] - for cluster in clusters: - settings = cluster["settings"] + for cluster in clusters: + container_insights_setting = [setting for setting in cluster["settings"] if setting["name"] == "containerInsights"] - for setting in settings: - if setting["name"] == "containerInsights" and setting["value"] == "enabled": - compliant_resources.append(cluster_arn) - break - else: - non_compliant_resources.append(cluster_arn) + if container_insights_setting and container_insights_setting[0]["value"] == "enabled": + compliant_resources.append(cluster["clusterArn"]) + else: + non_compliant_resources.append(cluster["clusterArn"]) return RuleCheckResult( passed=not non_compliant_resources, @@ -120,18 +116,14 @@ def ecs_fargate_latest_platform_version(): cluster_arns = client.list_clusters()["clusterArns"] for cluster_arn in cluster_arns: - services = client.list_services(cluster=cluster_arn, launchType="FARGATE")["serviceArns"] - + service_arns = client.list_services(cluster=cluster_arn, launchType="FARGATE")["serviceArns"] + services = client.describe_services(cluster=cluster_arn, services=service_arns)["services"] + for service in services: - service = client.describe_services(cluster=cluster_arn, services=[service])["services"][0] - - if service["launchType"] == "FARGATE": - if service["platformVersion"] == "LATEST": - compliant_resources.append(service["serviceArn"]) - else: - non_compliant_resources.append(service["serviceArn"]) - else: + if service["platformVersion"] == "LATEST": compliant_resources.append(service["serviceArn"]) + else: + non_compliant_resources.append(service["serviceArn"]) return RuleCheckResult( passed=not non_compliant_resources,