search

aws-samples / inspector2-enablement-with-cli

bash script to enable Amazon Inspector2 on AWS Organizations in multiple regions
MIT No Attribution
22 stars 10 forks source link

Add warning to README file to set default region in awscli config #3

Closed tolkiger closed 1 year ago

tolkiger commented 1 year ago

If a user has not set a default region for the local awscli config file, the the is_da_account function fails to verify if the current account credentials are from the Delegated Administrator account. The execution of the command returns You must specify a region. You can also configure your region by running "aws configure". So the grep command does not find the expected string: Invoking account is the delegated admin. So the script fails to verify if the account credentials are coming from the DA and returns error: Log in DA account to enable Amazon Inspector2 on members account(s)..

I'm suggesting to add a warning or a note in the README file to let users know that they MUST have a default region setup in their ~/.aws/config file to avoid this issue. One main detail about this issue is that the above error DOES NOT show up on the user's terminal. The script is not outputting the issue to the log file. It only shows an empty file.

To reproduce this issue, simply delete the default region in your ~/.aws/config file and run the script: ./inspector2_enablement_with_awscli.sh -a activate -t members -s all

./inspector2_enablement_with_awscli.sh -a activate -t members -s all
123456789012
enable_inspector2_per_region members all

 ******** Activation of Inspector2 for accounts per region ********
[ACCOUNTS_LIST]:members
Log in DA account to enable Amazon Inspector2 on members account(s).
Log in DA account to enable Amazon Inspector2 on members account(s).
Log in DA account to enable Amazon Inspector2 on members account(s).
Log in DA account to enable Amazon Inspector2 on members account(s).
Log in DA account to enable Amazon Inspector2 on members account(s).
Log in DA account to enable Amazon Inspector2 on members account(s).

Hope this helps!

stefmbappe commented 1 year ago

Hello @tolkiger

thank you for your feedback, I truly appreciate it.

I have added a warning in README.

regards