aws_recon 0.2.19 → 0.2.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aceb7412370bc6945f910f6579dcc9f7a188070fd35f7ec3325300d544f01d12
-  data.tar.gz: f35b334bead563849a2a1bce8623076c7d23237c21eb85409b7371d93ebc9f9d
+  metadata.gz: '091d2a7a27fb6c37494ec2bbddfc029c73e915925ea93e4011dbaaf6fbf637e5'
+  data.tar.gz: a6f2cfb73e6a667f3d3faff70956d26e065d3f83a6dedcdbdf0cd8eb82102385
 SHA512:
-  metadata.gz: 9f31da81396ac07fee4d331a05cbe5706fde48bc9c0617a5bc5640c61e68b56f499b4be8b659d6cdf61335665c898f638f20380968df68ad536c5114966d25bd
-  data.tar.gz: 958d528054caefa1c8d3e9b7d2a005f52ddaeaa0b89d566e5a3fddcfb81300e497a40e3fab039656fa2dc091d89d15535d76b863f4ded6c133118aea2fc59df9
+  metadata.gz: b488755dd29b5d262e2b6775a9de1830f024975874a4f617f0cd01f80a621e2a18e1955b4a590418aa0d1efc203b2427221129ae069c01a038d1ed35bdc0b500
+  data.tar.gz: 8997f3f3350fc9c8a6ded6fbd437816005d5a17a7b6db76c2e3e646b9076af210c4b803a68e2b568bff8ea277950bfb99031c6baa767b23138db5da9869c41c0

data/lib/aws_recon/collectors/backup.rb

@@ -0,0 +1,25 @@
+class Backup < Mapper
+  #
+  # Returns an array of resources.
+  #
+  def collect
+    resources = []
+
+    #
+    # list_backup_plans
+    #
+    @client.list_protected_resources.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      response.results.each do |resource|
+        struct = OpenStruct.new(resource.to_h)
+        struct.type = 'protected_resource'
+        struct.arn = resource.resource_arn
+
+        resources.push(struct.to_h)
+      end
+    end
+
+    resources
+  end
+end

data/lib/aws_recon/collectors/dms.rb

@@ -14,7 +14,7 @@ class DatabaseMigrationService < Mapper
       response.replication_instances.each do |instance|
         struct = OpenStruct.new(instance.to_h)
         struct.type = 'replication_instance'
-        struct.arb = "arn:aws:#{@service}:#{@region}::replication_instance/#{instance.replication_instance_identifier}"
+        struct.arn = "arn:aws:#{@service}:#{@region}::replication_instance/#{instance.replication_instance_identifier}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/dynamodb.rb

@@ -29,6 +29,7 @@ class DynamoDB < Mapper
         struct = OpenStruct.new(@client.describe_table({ table_name: table_name }).table.to_h)
         struct.type = 'table'
         struct.arn = struct.table_arn
+        struct.continuous_backups_description = @client.describe_continuous_backups({ table_name: table_name }).continuous_backups_description.to_h
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/ecr.rb

@@ -16,7 +16,7 @@ class ECR < Mapper
         struct.type = 'repository'
         struct.arn = repo.repository_arn
         struct.policy = @client
-                        .get_repository_policy({ repository_name: repo.repository_name }).to_h
+                        .get_repository_policy({ repository_name: repo.repository_name }).policy_text.parse_policy
 
       rescue Aws::ECR::Errors::ServiceError => e
         raise e unless suppressed_errors.include?(e.code)

data/lib/aws_recon/collectors/emr.rb

@@ -0,0 +1,39 @@
+class EMR < Mapper
+  #
+  # Returns an array of resources.
+  #
+  def collect
+    resources = []
+
+    #
+    # get_block_public_access_configuration
+    #
+    @client.get_block_public_access_configuration.each do |response|
+      log(response.context.operation_name)
+
+      struct = OpenStruct.new(response.block_public_access_configuration.to_h)
+      struct.type = 'configuration'
+
+      resources.push(struct.to_h)
+    end
+
+    #
+    # list_clusters
+    #
+    @client.list_clusters.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      response.clusters.each do |cluster|
+        log(response.context.operation_name, cluster.id)
+
+        struct = OpenStruct.new(@client.describe_cluster({ cluster_id: cluster.id }).cluster.to_h)
+        struct.type = 'cluster'
+        struct.arn = cluster.cluster_arn
+
+        resources.push(struct.to_h)
+      end
+    end
+
+    resources
+  end
+end

data/lib/aws_recon/collectors/guardduty.rb

@@ -21,8 +21,21 @@ class GuardDuty < Mapper
         struct.type = 'detector'
         struct.arn = "arn:aws:guardduty:#{@region}:detector/#{detector}"
 
+        # get_findings_statistics (only active findings)
+        struct.findings_statistics = @client.get_findings_statistics({
+                                                                       detector_id: detector,
+                                                                       finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                       finding_criteria: {
+                                                                         criterion: {
+                                                                           'service.archived': {
+                                                                             eq: ['false']
+                                                                           }
+                                                                         }
+                                                                       }
+                                                                     }).finding_statistics.to_h
+
         # get_master_account
-        struct.master_account = @client.get_master_account({ detector_id: detector }).to_h
+        struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/iam.rb

@@ -89,14 +89,19 @@ class IAM < Mapper
     #
     # get_account_password_policy
     #
-    @client.get_account_password_policy.each do |response|
-      log(response.context.operation_name)
+    begin
+      @client.get_account_password_policy.each do |response|
+        log(response.context.operation_name)
 
-      struct = OpenStruct.new(response.password_policy.to_h)
-      struct.type = 'password_policy'
-      struct.arn = "arn:aws:iam::#{@account}:account_password_policy/global"
+        struct = OpenStruct.new(response.password_policy.to_h)
+        struct.type = 'password_policy'
+        struct.arn = "arn:aws:iam::#{@account}:account_password_policy/global"
 
-      resources.push(struct.to_h)
+        resources.push(struct.to_h)
+      end
+    rescue Aws::IAM::Errors::ServiceError => e
+      log_error(e.code)
+      raise e unless suppressed_errors.include?(e.code)
     end
 
     #
@@ -190,6 +195,7 @@ class IAM < Mapper
   def suppressed_errors
     %w[
       ReportNotPresent
+      NoSuchEntity
     ]
   end
 end

data/lib/aws_recon/collectors/organizations.rb

@@ -34,18 +34,32 @@ class Organizations < Mapper
     #
     # list_policies
     #
-    @client.list_policies({ filter: 'SERVICE_CONTROL_POLICY' }).each_with_index do |response, page|
-      log(response.context.operation_name, page)
+    begin
+      @client.list_policies({ filter: 'SERVICE_CONTROL_POLICY' }).each_with_index do |response, page|
+        log(response.context.operation_name, page)
 
-      response.policies.each do |policy|
-        struct = OpenStruct.new(policy.to_h)
-        struct.type = 'service_control_policy'
-        struct.content = @client.describe_policy({ policy_id: policy.id }).policy.content.parse_policy
+        response.policies.each do |policy|
+          struct = OpenStruct.new(policy.to_h)
+          struct.type = 'service_control_policy'
+          struct.content = @client.describe_policy({ policy_id: policy.id }).policy.content.parse_policy
 
-        resources.push(struct.to_h)
+          resources.push(struct.to_h)
+        end
       end
+    rescue Aws::Organizations::Errors::ServiceError => e
+      log_error(e.code)
+      raise e unless suppressed_errors.include?(e.code)
     end
 
     resources
   end
+
+  private
+
+  # not an error
+  def suppressed_errors
+    %w[
+      AccessDeniedException
+    ]
+  end
 end

data/lib/aws_recon/collectors/redshift.rb

@@ -15,6 +15,7 @@ class Redshift < Mapper
         struct = OpenStruct.new(cluster.to_h)
         struct.type = 'cluster'
         struct.arn = cluster.cluster_identifier
+        struct.logging_status = @client.describe_logging_status({ cluster_identifier: cluster.cluster_identifier }).to_h
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/secretsmanager.rb

@@ -0,0 +1,26 @@
+class SecretsManager < Mapper
+  #
+  # Returns an array of resources.
+  #
+  def collect
+    resources = []
+
+    #
+    # describe_auto_scaling_groups
+    #
+    @client.list_secrets.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      response.secret_list.each_with_index do |secret, i|
+        log(response.context.operation_name, i)
+
+        struct = OpenStruct.new(secret.to_h)
+        struct.type = 'secret'
+
+        resources.push(struct.to_h)
+      end
+    end
+
+    resources
+  end
+end

data/lib/aws_recon/collectors/securityhub.rb

@@ -0,0 +1,37 @@
+class SecurityHub < Mapper
+  #
+  # Returns an array of resources.
+  #
+  def collect
+    resources = []
+
+    #
+    # describe_hub
+    #
+    begin
+      @client.describe_hub.each do |response|
+        log(response.context.operation_name)
+
+        struct = OpenStruct.new(response.to_h)
+        struct.type = 'hub'
+        struct.arn = response.hub_arn
+
+        resources.push(struct.to_h)
+      end
+    rescue Aws::SecurityHub::Errors::ServiceError => e
+      log_error(e.code)
+      raise e unless suppressed_errors.include?(e.code)
+    end
+
+    resources
+  end
+
+  private
+
+  # not an error
+  def suppressed_errors
+    %w[
+      InvalidAccessException
+    ]
+  end
+end

data/lib/aws_recon/collectors/support.rb

@@ -37,6 +37,7 @@ class Support < Mapper
   # not an error
   def suppressed_errors
     %w[
+      AccessDeniedException
       SubscriptionRequiredException
     ]
   end

data/lib/aws_recon/services.yaml

@@ -6,6 +6,8 @@
   alias: aa
 - name: ApplicationAutoScaling
   alias: aas
+- name: Backup
+  alias: backup
 - name: ConfigService
   alias: config
 - name: CodeBuild
@@ -37,6 +39,13 @@
     - ap-southeast-1
 - name: ElastiCache
   alias: elasticache
+- name: EMR
+  alias: emr
+  excluded_regions:
+    - ap-east-1
+    - af-south-1
+    - eu-south-1
+    - me-south-1
 - name: IAM
   global: true
   alias: iam
@@ -91,6 +100,10 @@
   alias: cloudwatchlogs
 - name: Kafka
   alias: kafka
+- name: SecretsManager
+  alias: sm
+- name: SecurityHub
+  alias: sh
 - name: Support
   global: true
   alias: support

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.19"
+  VERSION = "0.2.24"
 end

data/readme.md

@@ -226,6 +226,7 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
 - [x] AdvancedShield
 - [x] ApplicationAutoScaling
 - [x] Athena
+- [x] Backup
 - [x] GuardDuty
 - [ ] Macie
 - [x] Systems Manager
@@ -249,8 +250,9 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
 - [x] ECR
 - [x] ECS
 - [x] EFS
-- [x] ELB
 - [x] EKS
+- [x] ELB
+- [x] EMR
 - [x] Elasticsearch
 - [x] ElastiCache
 - [x] Firehose
@@ -270,6 +272,8 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
 - [x] S3
 - [x] SageMaker
 - [x] SES
+- [x] SecretsManager
+- [x] SecurityHub
 - [x] ServiceQuotas
 - [x] Shield
 - [x] SNS

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.19
+  version: 0.2.24
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-11-25 00:00:00.000000000 Z
+date: 2020-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -187,6 +187,7 @@ files:
 - lib/aws_recon/collectors/applicationautoscaling.rb
 - lib/aws_recon/collectors/athena.rb
 - lib/aws_recon/collectors/autoscaling.rb
+- lib/aws_recon/collectors/backup.rb
 - lib/aws_recon/collectors/cloudformation.rb
 - lib/aws_recon/collectors/cloudfront.rb
 - lib/aws_recon/collectors/cloudtrail.rb
@@ -208,6 +209,7 @@ files:
 - lib/aws_recon/collectors/elasticloadbalancing.rb
 - lib/aws_recon/collectors/elasticloadbalancingv2.rb
 - lib/aws_recon/collectors/elasticsearch.rb
+- lib/aws_recon/collectors/emr.rb
 - lib/aws_recon/collectors/firehose.rb
 - lib/aws_recon/collectors/guardduty.rb
 - lib/aws_recon/collectors/iam.rb
@@ -223,6 +225,8 @@ files:
 - lib/aws_recon/collectors/route53domains.rb
 - lib/aws_recon/collectors/s3.rb
 - lib/aws_recon/collectors/sagemaker.rb
+- lib/aws_recon/collectors/secretsmanager.rb
+- lib/aws_recon/collectors/securityhub.rb
 - lib/aws_recon/collectors/servicequotas.rb
 - lib/aws_recon/collectors/ses.rb
 - lib/aws_recon/collectors/shield.rb