Skip to content

Commit 2777a6b

Browse files
patrykorwatpatrykorwat
authored
Merge pull request #157 from Cloud-Architects/develop
v 2.2.4
2 parents 1f155d6 + bc8c4f4 commit 2777a6b

25 files changed

+1022
-392
lines changed

‎README.md

+18-83
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ cloudiscovery aws-all --region-name xx-xxxx-xxx [--profile-name profile] [--serv
6161
cloudiscovery aws-limit --region-name xx-xxxx-xxx [--profile-name profile] [--services xxx,xxx] [--usage 0-100] [--verbose]
6262
```
6363
64+
1.6 To run AWS security controls (experimental feature):
65+
66+
```sh
67+
cloudiscovery aws-security --region-name xx-xxxx-xxx [--profile-name profile] [--commands x] [--verbose]
68+
```
69+
6470
2. For help use:
6571
6672
```sh
@@ -113,89 +119,10 @@ More on credentials configuration: [Configuration basics](https://docs.aws.amazo
113119
114120
#### AWS Permissions
115121
116-
The configured credentials must be associated to a user or role with proper permissions to do all checks. If you want to use a role with narrowed set of permissions just to perform cloud discovery, use a role from the following CF template shown below. To further increase security, you can add a block to check `aws:MultiFactorAuthPresent` condition in `AssumeRolePolicyDocument`. More on using IAM roles in the [configuration file](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html).
117-
118-
```json
119-
{
120-
"AWSTemplateFormatVersion": "2010-09-09",
121-
"Description": "Setups a role for diagram builder for all resources within an account",
122-
"Resources": {
123-
"cloudiscoveryRole": {
124-
"Type": "AWS::IAM::Role",
125-
"Properties": {
126-
"AssumeRolePolicyDocument" : {
127-
"Statement" : [
128-
{
129-
"Effect" : "Allow",
130-
"Principal" : {
131-
"AWS": { "Fn::Join" : [ "", [
132-
"arn:aws:iam::", { "Ref" : "AWS::AccountId" }, ":root"
133-
]]}
134-
},
135-
"Action" : [ "sts:AssumeRole" ]
136-
}
137-
]
138-
},
139-
"Policies": [{
140-
"PolicyName": "additional-permissions",
141-
"PolicyDocument": {
142-
"Version": "2012-10-17",
143-
"Statement" : [
144-
{
145-
"Effect" : "Allow",
146-
"Action" : [
147-
"kafka:ListClusters",
148-
"synthetics:DescribeCanaries",
149-
"medialive:ListInputs",
150-
"cloudhsm:DescribeClusters",
151-
"ssm:GetParametersByPath",
152-
"servicequotas:Get*",
153-
"amplify:ListApps",
154-
"autoscaling-plans:DescribeScalingPlans",
155-
"medialive:ListChannels",
156-
"medialive:ListInputDevices",
157-
"mediapackage:ListChannels",
158-
"qldb:ListLedgers",
159-
"transcribe:ListVocabularies",
160-
"glue:GetDatabases",
161-
"glue:GetUserDefinedFunctions",
162-
"glue:GetSecurityConfigurations",
163-
"glue:GetTriggers",
164-
"glue:GetCrawlers",
165-
"glue:ListWorkflows",
166-
"glue:ListMLTransforms",
167-
"codeguru-reviewer:ListCodeReviews",
168-
"servicediscovery:ListNamespaces",
169-
"apigateway:GET",
170-
"forecast:ListPredictors",
171-
"frauddetector:GetDetectors",
172-
"forecast:ListDatasetImportJobs",
173-
"frauddetector:GetModels",
174-
"frauddetector:GetOutcomes",
175-
"networkmanager:DescribeGlobalNetworks",
176-
"codeartifact:ListDomains",
177-
"ses:GetSendQuota"
178-
],
179-
"Resource": [ "*" ]
180-
}
181-
]
182-
}
183-
}],
184-
"Path" : "/",
185-
"ManagedPolicyArns" : [
186-
"arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
187-
"arn:aws:iam::aws:policy/SecurityAudit"
188-
]
189-
}
190-
}
191-
},
192-
"Outputs" : {
193-
"cloudiscoveryRoleArn" : {
194-
"Value" : { "Fn::GetAtt": [ "cloudiscoveryRole", "Arn" ]}
195-
}
196-
}
197-
}
198-
```
122+
The configured credentials must be associated to a user or role with proper permissions to do all checks. If you want to use a role with narrowed set of permissions just to perform cloud discovery, use a role from the following the [CF template maintained by our team](docs/assets/role-template.json).
123+
124+
To further increase security, you can add a block to check `aws:MultiFactorAuthPresent` condition in `AssumeRolePolicyDocument`. More on using IAM roles in the [configuration file](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html).
125+
199126
200127
(Optional) If you want to be able to switch between multiple AWS credentials and settings, you can configure [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and later pass profile name when running the tool.
201128
@@ -379,6 +306,14 @@ An administrator can ask to increase the quota value of a certain service via ti
379306
380307
More information: [AWS WA, REL 1 How do you manage service limits?](https://wa.aws.amazon.com/wat.question.REL_1.en.html)
381308
309+
### AWS Security
310+
This features is experimental, but now you can run commands to check and analyze some security issues. The following commands are available now:
311+
312+
* Access key age
313+
* EBS Encryption enabled
314+
* EC2 IMDSV2 Check
315+
* DynamoDB PITR Enabled
316+
382317
## Using a Docker container
383318
To build docker container using Dockerfile
384319

‎cloudiscovery/__init__.py

+22-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
from provider.iot.command import Iot
3333
from provider.all.command import All
3434
from provider.limit.command import Limit
35+
from provider.security.command import Security
3536

3637
from shared.common import (
3738
exit_critical,
@@ -46,7 +47,7 @@
4647
print("Python 3.6 or newer is required", file=sys.stderr)
4748
sys.exit(1)
4849

49-
__version__ = "2.2.3"
50+
__version__ = "2.2.4"
5051

5152
AVAILABLE_LANGUAGES = ["en_US", "pt_BR"]
5253
DEFAULT_REGION = "us-east-1"
@@ -107,6 +108,20 @@ def generate_parser():
107108
For example: --threshold 50 will report all resources with more than 50%% threshold.",
108109
)
109110

111+
security_parser = subparsers.add_parser(
112+
"aws-security", help="Analyze aws several security checks."
113+
)
114+
add_default_arguments(security_parser, diagram_enabled=False, filters_enabled=False)
115+
security_parser.add_argument(
116+
"-c",
117+
"--commands",
118+
action="append",
119+
required=False,
120+
help='Select the security check command that you want to run. \
121+
To see available commands, please type "-c list". \
122+
If not passed, command will check all services.',
123+
)
124+
110125
return parser
111126

112127

@@ -262,12 +277,18 @@ def main():
262277
command = Limit(
263278
region_names=region_names, session=session, threshold=args.threshold,
264279
)
280+
elif args.command == "aws-security":
281+
command = Security(
282+
region_names=region_names, session=session, commands=args.commands,
283+
)
265284
else:
266285
raise NotImplementedError("Unknown command")
286+
267287
if "services" in args and args.services is not None:
268288
services = args.services.split(",")
269289
else:
270290
services = []
291+
271292
command.run(diagram, args.verbose, services, filters)
272293

273294

‎cloudiscovery/provider/all/command.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ def run(
3333
services=services,
3434
)
3535

36-
command_runner = AwsCommandRunner(filters)
36+
command_runner = AwsCommandRunner(filters=filters)
3737
command_runner.run(
3838
provider="all",
3939
options=options,

‎cloudiscovery/provider/all/data/__init__.py

Whitespace-only changes.

‎cloudiscovery/provider/all/data/omitted_resources.py

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
OMITTED_RESOURCES = [
2+
"aws_cloudhsm_available_zone",
3+
"aws_cloudhsm_hapg",
4+
"aws_cloudhsm_hsm",
5+
"aws_cloudhsm_luna_client",
6+
"aws_dax_default_parameter",
7+
"aws_dax_parameter_group",
8+
"aws_ec2_reserved_instances_offering",
9+
"aws_ec2_snapshot",
10+
"aws_ec2_spot_price_history",
11+
"aws_ssm_available_patch",
12+
"aws_ssm_document",
13+
"aws_polly_voice",
14+
"aws_lightsail_blueprint",
15+
"aws_lightsail_bundle",
16+
"aws_lightsail_region",
17+
"aws_elastictranscoder_preset",
18+
"aws_ec2_vpc_endpoint_service",
19+
"aws_dms_endpoint_type",
20+
"aws_elasticache_service_update",
21+
"aws_elasticache_cache_parameter_group",
22+
"aws_rds_source_region",
23+
"aws_ssm_association",
24+
"aws_ssm_patch_baseline",
25+
"aws_ec2_prefix",
26+
"aws_ec2_image",
27+
"aws_ec2_region",
28+
"aws_opsworks_operating_system",
29+
"aws_rds_account_attribute",
30+
"aws_route53_geo_location",
31+
"aws_redshift_cluster_track",
32+
"aws_redshift_reserved_node_offering",
33+
"aws_directconnect_location",
34+
"aws_dms_account_attribute",
35+
"aws_securityhub_standard",
36+
"aws_ram_resource_type",
37+
"aws_ram_permission",
38+
"aws_ec2_account_attribute",
39+
"aws_elasticbeanstalk_available_solution_stack",
40+
"aws_redshift_account_attribute",
41+
"aws_opsworks_user_profile",
42+
"aws_directconnect_direct_connect_gateway_association", # DirectConnect resources endpoint are complicated
43+
"aws_directconnect_direct_connect_gateway_attachment",
44+
"aws_directconnect_interconnect",
45+
"aws_dms_replication_task_assessment_result",
46+
"aws_ec2_fpga_image",
47+
"aws_ec2_launch_template_version",
48+
"aws_ec2_reserved_instancesing",
49+
"aws_ec2_spot_datafeed_subscription",
50+
"aws_ec2_transit_gateway_multicast_domain",
51+
"aws_elasticbeanstalk_configuration_option",
52+
"aws_elasticbeanstalk_platform_version",
53+
"aws_iam_credential_report",
54+
"aws_iam_account_password_policy",
55+
"aws_importexport_job",
56+
"aws_iot_o_taupdate",
57+
"aws_iot_default_authorizer",
58+
"aws_workspaces_account",
59+
"aws_workspaces_account_modification",
60+
"aws_rds_export_task",
61+
"aws_rds_custom_availability_zone",
62+
"aws_rds_installation_media",
63+
"aws_rds_d_bsecurity_group",
64+
"aws_rds_reserved_db_instances_offering",
65+
"aws_translate_text_translation_job",
66+
"aws_rekognition_project",
67+
"aws_rekognition_stream_processor",
68+
"aws_sdb_domain",
69+
"aws_redshift_table_restore_status",
70+
"aws_iot_v2_logging_level",
71+
"aws_license_manager_resource_inventory",
72+
"aws_license_manager_license_configuration",
73+
"aws_logs_query_definition",
74+
"aws_autoscaling_scaling_activity",
75+
"aws_autoscaling_auto_scaling_notification_type",
76+
"aws_autoscaling_scaling_process_type",
77+
"aws_autoscaling_termination_policy_type",
78+
"aws_ec2_host_reservation_offering",
79+
"aws_ec2_availability_zone",
80+
"aws_cloudwatch_metric",
81+
"aws_organizations_handshakes_for_organization",
82+
"aws_config_organization_config_rule",
83+
"aws_organizations_root",
84+
"aws_organizations_delegated_administrator",
85+
"aws_organizations_create_account_status",
86+
"aws_config_organization_conformance_pack_status",
87+
"aws_config_organization_conformance_pack",
88+
"aws_ec2_reserved_instances_listing",
89+
"aws_redshift_cluster_security_group",
90+
"aws_guardduty_organization_admin_account",
91+
"aws_elasticache_cache_security_group",
92+
"aws_elasticache_reserved_cache_nodes_offering",
93+
"aws_organizations_aws_service_access_for_organization",
94+
"aws_organizations_account",
95+
"aws_config_organization_config_rule_status",
96+
"aws_dynamodb_backup",
97+
"aws_ec2_prefix_list",
98+
"aws_route53_hosted_zones_by_name",
99+
"aws_es_reserved_elasticsearch_instance_offering",
100+
"aws_ssm_automation_execution",
101+
"aws_route53_checker_ip_range",
102+
]

‎cloudiscovery/provider/all/data/on_top_policies.py

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
ON_TOP_POLICIES = [
2+
"kafka:ListClusters",
3+
"synthetics:DescribeCanaries",
4+
"medialive:ListInputs",
5+
"cloudhsm:DescribeClusters",
6+
"ssm:GetParametersByPath",
7+
"servicequotas:Get*",
8+
"amplify:ListApps",
9+
"autoscaling-plans:DescribeScalingPlans",
10+
"medialive:ListChannels",
11+
"medialive:ListInputDevices",
12+
"mediapackage:ListChannels",
13+
"qldb:ListLedgers",
14+
"transcribe:ListVocabularies",
15+
"glue:GetDatabases",
16+
"glue:GetUserDefinedFunctions",
17+
"glue:GetSecurityConfigurations",
18+
"glue:GetTriggers",
19+
"glue:GetCrawlers",
20+
"glue:ListWorkflows",
21+
"glue:ListMLTransforms",
22+
"codeguru-reviewer:ListCodeReviews",
23+
"servicediscovery:ListNamespaces",
24+
"apigateway:GET",
25+
"forecast:ListPredictors",
26+
"frauddetector:GetDetectors",
27+
"forecast:ListDatasetImportJobs",
28+
"frauddetector:GetModels",
29+
"frauddetector:GetOutcomes",
30+
"networkmanager:DescribeGlobalNetworks",
31+
"codeartifact:ListDomains",
32+
"ses:GetSendQuota",
33+
"codeguru-profiler:ListProfilingGroups",
34+
]

‎cloudiscovery/provider/all/data/required_params_override.py

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Trying to fix documentation errors or its lack made by "happy pirates" at AWS
2+
REQUIRED_PARAMS_OVERRIDE = {
3+
"batch": {"ListJobs": ["jobQueue"]},
4+
"cloudformation": {
5+
"DescribeStackEvents": ["stackName"],
6+
"DescribeStackResources": ["stackName"],
7+
"GetTemplate": ["stackName"],
8+
"ListTypeVersions": ["arn"],
9+
},
10+
"codecommit": {"GetBranch": ["repositoryName"]},
11+
"codedeploy": {
12+
"GetDeploymentTarget": ["deploymentId"],
13+
"ListDeploymentTargets": ["deploymentId"],
14+
},
15+
"ecs": {
16+
"ListTasks": ["cluster"],
17+
"ListServices": ["cluster"],
18+
"ListContainerInstances": ["cluster"],
19+
"DescribeTasks": ["cluster", "tasks"],
20+
"DescribeServices": ["cluster", "services"],
21+
"DescribeContainerInstances": ["cluster", "containerInstances"],
22+
},
23+
"elasticbeanstalk": {
24+
"DescribeEnvironmentHealth": ["environmentName"],
25+
"DescribeEnvironmentManagedActionHistory": ["environmentName"],
26+
"DescribeEnvironmentManagedActions": ["environmentName"],
27+
"DescribeEnvironmentResources": ["environmentName"],
28+
"DescribeInstancesHealth": ["environmentName"],
29+
},
30+
"iam": {
31+
"GetUser": ["userName"],
32+
"ListAccessKeys": ["userName"],
33+
"ListServiceSpecificCredentials": ["userName"],
34+
"ListSigningCertificates": ["userName"],
35+
"ListMFADevices": ["userName"],
36+
"ListSSHPublicKeys": ["userName"],
37+
},
38+
"iot": {"ListAuditFindings": ["taskId"]},
39+
"opsworks": {
40+
"ListAuditFindings": ["taskId"],
41+
"DescribeAgentVersions": ["stackId"],
42+
"DescribeApps": ["stackId"],
43+
"DescribeCommands": ["deploymentId"],
44+
"DescribeDeployments": ["appId"],
45+
"DescribeEcsClusters": ["ecsClusterArns"],
46+
"DescribeElasticIps": ["stackId"],
47+
"DescribeElasticLoadBalancers": ["stackId"],
48+
"DescribeInstances": ["stackId"],
49+
"DescribeLayers": ["stackId"],
50+
"DescribePermissions": ["stackId"],
51+
"DescribeRaidArrays": ["stackId"],
52+
"DescribeVolumes": ["stackId"],
53+
},
54+
"ssm": {"DescribeMaintenanceWindowSchedule": ["windowId"],},
55+
"shield": {"DescribeProtection": ["protectionId"],},
56+
"waf": {
57+
"ListActivatedRulesInRuleGroup": ["ruleGroupId"],
58+
"ListLoggingConfigurations": ["limit"],
59+
},
60+
"waf-regional": {
61+
"ListActivatedRulesInRuleGroup": ["ruleGroupId"],
62+
"ListLoggingConfigurations": ["limit"],
63+
},
64+
"wafv2": {"ListLoggingConfigurations": ["limit"],},
65+
}

0 commit comments

Comments
 (0)