aws_recon 0.2.13 → 0.2.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7898588f7e210d1467a7778c88f4d9c63c1bf60383071fca0632157a3b865ad
-  data.tar.gz: e7e61fdbe18430ea7f4409bc3a916723b6e2ea76103bb254537ea7b64836d421
+  metadata.gz: eda49a53171d4ca65cdead1238f92429a594e80a644a199eb5bbcccc13514671
+  data.tar.gz: 1fa1d7b45fe39c8ef90f49e31bebbf7a5c5569b524fc9a5aa0bfe08262d760fa
 SHA512:
-  metadata.gz: ef31d6b755b2ca26f978ca16f7a3dff9f1db3d8f29c6ec5bfe3c2b2c0dbdccc965a4382bafbbe4fd778ec519c2406d829a48d2c174cca4a70808a1be7ce43fb5
-  data.tar.gz: c1d132733f149b3a985e0093bbc2d504127556b352fbc687707c0e24d79395ca5f4098031c65efb5218e0ceea381551dae2e3c71cb7f78f9e92d8af3b5cccad3
+  metadata.gz: b68650f9efd7f4a522b5aa6240ddaba6d31837634b5d897361838fb17abab065fb756f8d5e9cd94480980fefdfd89317fabbcf1245add3e8fda83a2e5ccf259c
+  data.tar.gz: 85a2604470ec75b83cb82ad2829411fa6927183cba241a6fb72ed409c0ee277443101f999cf883620d056ee90d13edbb3e84787e1e37dde415670a9ff196bdb0

data/.github/workflows/docker-build.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: build
     paths:
-      - 'lib/aws_recon/version.rb '
+      - 'lib/aws_recon/version.rb'
 
 jobs:
   docker-build:

data/lib/aws_recon.rb

@@ -3,6 +3,9 @@
 module AwsRecon
 end
 
+require 'aws_recon/lib/patch.rb'
+String.include PolicyStringParser
+
 require 'parallel'
 require 'ostruct'
 require 'optparse'

data/lib/aws_recon/collectors/cloudtrail.rb

@@ -21,6 +21,7 @@ class CloudTrail < Mapper
         struct = OpenStruct.new(trail.to_h)
         struct.tags = client.list_tags({ resource_id_list: [trail.trail_arn] }).resource_tag_list.first.tags_list
         struct.type = 'cloud_trail'
+        struct.event_selectors = client.get_event_selectors({ trail_name: trail.name }).to_h
         struct.status = client.get_trail_status({ name: trail.name }).to_h
         struct.arn = trail.trail_arn
 

data/lib/aws_recon/collectors/ec2.rb

@@ -175,6 +175,21 @@ class EC2 < Mapper
         end
       end
 
+      #
+      # describe_internet_gateways
+      #
+      @client.describe_internet_gateways.each_with_index do |response, page|
+        log(response.context.operation_name, page)
+
+        response.internet_gateways.each do |gateway|
+          struct = OpenStruct.new(gateway.to_h)
+          struct.type = 'internet_gateway'
+          struct.arn = gateway.internet_gateway_id # no true ARN
+
+          resources.push(struct.to_h)
+        end
+      end
+
       #
       # describe_route_tables
       #
@@ -215,6 +230,10 @@ class EC2 < Mapper
           struct = OpenStruct.new(snapshot.to_h)
           struct.type = 'snapshot'
           struct.arn = snapshot.snapshot_id # no true ARN
+          struct.create_volume_permissions = @client.describe_snapshot_attribute({
+                                                                                   attribute: 'createVolumePermission',
+                                                                                   snapshot_id: snapshot.snapshot_id
+                                                                                 }).create_volume_permissions.map(&:to_h)
 
           resources.push(struct.to_h)
         end

data/lib/aws_recon/collectors/lambda.rb

@@ -12,7 +12,11 @@ class Lambda < Mapper
         struct = OpenStruct.new(function)
         struct.type = 'function'
         struct.arn = function.function_arn
+        struct.policy = @client.get_policy({ function_name: function.function_name }).policy.parse_policy
 
+      rescue Aws::Lambda::Errors::ResourceNotFoundException => e
+        log_error(e.code)
+      ensure
         resources.push(struct.to_h)
       end
     end

data/lib/aws_recon/collectors/s3.rb

@@ -29,16 +29,20 @@ class S3 < Mapper
         # to create a bucket, you must set the location_constraint
         # bucket parameter to the same region. (https://docs.aws.amazon.com/general/latest/gr/s3.html)
         client = if location.empty?
+                   struct.location = 'us-east-1'
                    @client
                  else
+                   struct.location = location
                    Aws::S3::Client.new({ region: location })
                  end
 
         operations = [
           { func: 'get_bucket_acl', key: 'acl', field: nil },
           { func: 'get_bucket_encryption', key: 'encryption', field: 'server_side_encryption_configuration' },
+          { func: 'get_bucket_replication', key: 'replication', field: 'replication_configuration' },
           { func: 'get_bucket_policy', key: 'policy', field: 'policy' },
           { func: 'get_bucket_policy_status', key: 'public', field: 'policy_status' },
+          { func: 'get_public_access_block', key: 'public_access_block', field: 'public_access_block_configuration' },
           { func: 'get_bucket_tagging', key: 'tagging', field: nil },
           { func: 'get_bucket_logging', key: 'logging', field: 'logging_enabled' },
           { func: 'get_bucket_versioning', key: 'versioning', field: nil },
@@ -51,7 +55,7 @@ class S3 < Mapper
           resp = client.send(op.func, { bucket: bucket.name })
 
           struct[op.key] = if op.key == 'policy'
-                             resp.policy.string
+                             JSON.parse(CGI.unescape(resp.policy.string))
                            else
                              op.field ? resp.send(op.field).to_h : resp.to_h
                            end
@@ -77,6 +81,8 @@ class S3 < Mapper
       NoSuchBucketPolicy
       NoSuchTagSet
       NoSuchWebsiteConfiguration
+      ReplicationConfigurationNotFoundError
+      NoSuchPublicAccessBlockConfiguration
     ]
   end
 end

data/lib/aws_recon/collectors/sns.rb

@@ -18,6 +18,8 @@ class SNS < Mapper
         struct = OpenStruct.new(@client.get_topic_attributes({ topic_arn: topic.topic_arn }).attributes.to_h)
         struct.type = 'topic'
         struct.arn = topic.topic_arn
+        struct.policy = JSON.parse(CGI.unescape(struct.Policy))
+        struct.effective_delivery_policy = JSON.parse(CGI.unescape(struct.EffectiveDeliveryPolicy))
         struct.subscriptions = []
 
         # list_subscriptions_by_topic

data/lib/aws_recon/collectors/sqs.rb

@@ -18,7 +18,7 @@ class SQS < Mapper
         struct = OpenStruct.new(@client.get_queue_attributes({ queue_url: queue, attribute_names: ['All'] }).attributes.to_h)
         struct.type = 'queue'
         struct.arn = struct.QueueArn
-        struct.Policy = JSON.parse(CGI.unescape(struct.Policy))
+        struct.policy = JSON.parse(CGI.unescape(struct.Policy))
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/ssm.rb

@@ -30,7 +30,7 @@ class SSM < Mapper
         struct = OpenStruct.new(parameter.to_h)
         struct.string_type = parameter.type
         struct.type = 'parameter'
-        struct.arn = "arn:aws:#{@service}:#{@region}::parameter/#{parameter.name}"
+        struct.arn = "arn:aws:#{@service}:#{@region}::parameter:#{parameter.name}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/lib/patch.rb

@@ -0,0 +1,10 @@
+#
+# Parse and unescape AWS policy document string
+#
+module PolicyStringParser
+  def parse_policy
+    JSON.parse(CGI.unescape(self))
+  rescue StandardError
+    nil
+  end
+end

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.13"
+  VERSION = "0.2.18"
 end

data/readme.md

@@ -1,5 +1,5 @@
-![smoke-test](https://github.com/darkbitio/aws-recon/workflows/smoke-test/badge.svg)
-[![Gem Version](https://badge.fury.io/rb/aws_recon.svg)](https://badge.fury.io/rb/aws_recon)
+[![GitHub Workflow Status (branch)](https://img.shields.io/github/workflow/status/darkbitio/aws-recon/smoke-test/main)](https://github.com/darkbitio/aws-recon/actions?query=branch%3Amain)
+[![Gem Version](https://badge.fury.io/rb/aws_recon.svg)](https://rubygems.org/gems/aws_recon)
 
 # AWS Recon
 
@@ -222,6 +222,7 @@ Current "coverage" by service is listed below. The services without coverage wil
 
 AWS Recon aims to collect all resources and metadata that are relevant in determining the security posture of your AWS account(s). However, it does not actually examine the resources for security posture - that is the job of other tools that take the output of AWS Recon as input.
 
+- [x] AccessAnalyzer
 - [x] AdvancedShield
 - [x] Athena
 - [x] GuardDuty

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.13
+  version: 0.2.18
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-11-18 00:00:00.000000000 Z
+date: 2020-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -235,6 +235,7 @@ files:
 - lib/aws_recon/collectors/xray.rb
 - lib/aws_recon/lib/formatter.rb
 - lib/aws_recon/lib/mapper.rb
+- lib/aws_recon/lib/patch.rb
 - lib/aws_recon/options.rb
 - lib/aws_recon/services.yaml
 - lib/aws_recon/version.rb