aws_recon 0.2.19 → 0.2.24
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/aws_recon/collectors/backup.rb +25 -0
- data/lib/aws_recon/collectors/dms.rb +1 -1
- data/lib/aws_recon/collectors/dynamodb.rb +1 -0
- data/lib/aws_recon/collectors/ecr.rb +1 -1
- data/lib/aws_recon/collectors/emr.rb +39 -0
- data/lib/aws_recon/collectors/guardduty.rb +14 -1
- data/lib/aws_recon/collectors/iam.rb +12 -6
- data/lib/aws_recon/collectors/organizations.rb +21 -7
- data/lib/aws_recon/collectors/redshift.rb +1 -0
- data/lib/aws_recon/collectors/secretsmanager.rb +26 -0
- data/lib/aws_recon/collectors/securityhub.rb +37 -0
- data/lib/aws_recon/collectors/support.rb +1 -0
- data/lib/aws_recon/services.yaml +13 -0
- data/lib/aws_recon/version.rb +1 -1
- data/readme.md +5 -1
- metadata +6 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: '091d2a7a27fb6c37494ec2bbddfc029c73e915925ea93e4011dbaaf6fbf637e5'
|
4
|
+
data.tar.gz: a6f2cfb73e6a667f3d3faff70956d26e065d3f83a6dedcdbdf0cd8eb82102385
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: b488755dd29b5d262e2b6775a9de1830f024975874a4f617f0cd01f80a621e2a18e1955b4a590418aa0d1efc203b2427221129ae069c01a038d1ed35bdc0b500
|
7
|
+
data.tar.gz: 8997f3f3350fc9c8a6ded6fbd437816005d5a17a7b6db76c2e3e646b9076af210c4b803a68e2b568bff8ea277950bfb99031c6baa767b23138db5da9869c41c0
|
@@ -0,0 +1,25 @@
|
|
1
|
+
class Backup < Mapper
|
2
|
+
#
|
3
|
+
# Returns an array of resources.
|
4
|
+
#
|
5
|
+
def collect
|
6
|
+
resources = []
|
7
|
+
|
8
|
+
#
|
9
|
+
# list_backup_plans
|
10
|
+
#
|
11
|
+
@client.list_protected_resources.each_with_index do |response, page|
|
12
|
+
log(response.context.operation_name, page)
|
13
|
+
|
14
|
+
response.results.each do |resource|
|
15
|
+
struct = OpenStruct.new(resource.to_h)
|
16
|
+
struct.type = 'protected_resource'
|
17
|
+
struct.arn = resource.resource_arn
|
18
|
+
|
19
|
+
resources.push(struct.to_h)
|
20
|
+
end
|
21
|
+
end
|
22
|
+
|
23
|
+
resources
|
24
|
+
end
|
25
|
+
end
|
@@ -14,7 +14,7 @@ class DatabaseMigrationService < Mapper
|
|
14
14
|
response.replication_instances.each do |instance|
|
15
15
|
struct = OpenStruct.new(instance.to_h)
|
16
16
|
struct.type = 'replication_instance'
|
17
|
-
struct.
|
17
|
+
struct.arn = "arn:aws:#{@service}:#{@region}::replication_instance/#{instance.replication_instance_identifier}"
|
18
18
|
|
19
19
|
resources.push(struct.to_h)
|
20
20
|
end
|
@@ -29,6 +29,7 @@ class DynamoDB < Mapper
|
|
29
29
|
struct = OpenStruct.new(@client.describe_table({ table_name: table_name }).table.to_h)
|
30
30
|
struct.type = 'table'
|
31
31
|
struct.arn = struct.table_arn
|
32
|
+
struct.continuous_backups_description = @client.describe_continuous_backups({ table_name: table_name }).continuous_backups_description.to_h
|
32
33
|
|
33
34
|
resources.push(struct.to_h)
|
34
35
|
end
|
@@ -16,7 +16,7 @@ class ECR < Mapper
|
|
16
16
|
struct.type = 'repository'
|
17
17
|
struct.arn = repo.repository_arn
|
18
18
|
struct.policy = @client
|
19
|
-
.get_repository_policy({ repository_name: repo.repository_name }).
|
19
|
+
.get_repository_policy({ repository_name: repo.repository_name }).policy_text.parse_policy
|
20
20
|
|
21
21
|
rescue Aws::ECR::Errors::ServiceError => e
|
22
22
|
raise e unless suppressed_errors.include?(e.code)
|
@@ -0,0 +1,39 @@
|
|
1
|
+
class EMR < Mapper
|
2
|
+
#
|
3
|
+
# Returns an array of resources.
|
4
|
+
#
|
5
|
+
def collect
|
6
|
+
resources = []
|
7
|
+
|
8
|
+
#
|
9
|
+
# get_block_public_access_configuration
|
10
|
+
#
|
11
|
+
@client.get_block_public_access_configuration.each do |response|
|
12
|
+
log(response.context.operation_name)
|
13
|
+
|
14
|
+
struct = OpenStruct.new(response.block_public_access_configuration.to_h)
|
15
|
+
struct.type = 'configuration'
|
16
|
+
|
17
|
+
resources.push(struct.to_h)
|
18
|
+
end
|
19
|
+
|
20
|
+
#
|
21
|
+
# list_clusters
|
22
|
+
#
|
23
|
+
@client.list_clusters.each_with_index do |response, page|
|
24
|
+
log(response.context.operation_name, page)
|
25
|
+
|
26
|
+
response.clusters.each do |cluster|
|
27
|
+
log(response.context.operation_name, cluster.id)
|
28
|
+
|
29
|
+
struct = OpenStruct.new(@client.describe_cluster({ cluster_id: cluster.id }).cluster.to_h)
|
30
|
+
struct.type = 'cluster'
|
31
|
+
struct.arn = cluster.cluster_arn
|
32
|
+
|
33
|
+
resources.push(struct.to_h)
|
34
|
+
end
|
35
|
+
end
|
36
|
+
|
37
|
+
resources
|
38
|
+
end
|
39
|
+
end
|
@@ -21,8 +21,21 @@ class GuardDuty < Mapper
|
|
21
21
|
struct.type = 'detector'
|
22
22
|
struct.arn = "arn:aws:guardduty:#{@region}:detector/#{detector}"
|
23
23
|
|
24
|
+
# get_findings_statistics (only active findings)
|
25
|
+
struct.findings_statistics = @client.get_findings_statistics({
|
26
|
+
detector_id: detector,
|
27
|
+
finding_statistic_types: ['COUNT_BY_SEVERITY'],
|
28
|
+
finding_criteria: {
|
29
|
+
criterion: {
|
30
|
+
'service.archived': {
|
31
|
+
eq: ['false']
|
32
|
+
}
|
33
|
+
}
|
34
|
+
}
|
35
|
+
}).finding_statistics.to_h
|
36
|
+
|
24
37
|
# get_master_account
|
25
|
-
struct.master_account = @client.get_master_account({ detector_id: detector }).to_h
|
38
|
+
struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
|
26
39
|
|
27
40
|
resources.push(struct.to_h)
|
28
41
|
end
|
@@ -89,14 +89,19 @@ class IAM < Mapper
|
|
89
89
|
#
|
90
90
|
# get_account_password_policy
|
91
91
|
#
|
92
|
-
|
93
|
-
|
92
|
+
begin
|
93
|
+
@client.get_account_password_policy.each do |response|
|
94
|
+
log(response.context.operation_name)
|
94
95
|
|
95
|
-
|
96
|
-
|
97
|
-
|
96
|
+
struct = OpenStruct.new(response.password_policy.to_h)
|
97
|
+
struct.type = 'password_policy'
|
98
|
+
struct.arn = "arn:aws:iam::#{@account}:account_password_policy/global"
|
98
99
|
|
99
|
-
|
100
|
+
resources.push(struct.to_h)
|
101
|
+
end
|
102
|
+
rescue Aws::IAM::Errors::ServiceError => e
|
103
|
+
log_error(e.code)
|
104
|
+
raise e unless suppressed_errors.include?(e.code)
|
100
105
|
end
|
101
106
|
|
102
107
|
#
|
@@ -190,6 +195,7 @@ class IAM < Mapper
|
|
190
195
|
def suppressed_errors
|
191
196
|
%w[
|
192
197
|
ReportNotPresent
|
198
|
+
NoSuchEntity
|
193
199
|
]
|
194
200
|
end
|
195
201
|
end
|
@@ -34,18 +34,32 @@ class Organizations < Mapper
|
|
34
34
|
#
|
35
35
|
# list_policies
|
36
36
|
#
|
37
|
-
|
38
|
-
|
37
|
+
begin
|
38
|
+
@client.list_policies({ filter: 'SERVICE_CONTROL_POLICY' }).each_with_index do |response, page|
|
39
|
+
log(response.context.operation_name, page)
|
39
40
|
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
41
|
+
response.policies.each do |policy|
|
42
|
+
struct = OpenStruct.new(policy.to_h)
|
43
|
+
struct.type = 'service_control_policy'
|
44
|
+
struct.content = @client.describe_policy({ policy_id: policy.id }).policy.content.parse_policy
|
44
45
|
|
45
|
-
|
46
|
+
resources.push(struct.to_h)
|
47
|
+
end
|
46
48
|
end
|
49
|
+
rescue Aws::Organizations::Errors::ServiceError => e
|
50
|
+
log_error(e.code)
|
51
|
+
raise e unless suppressed_errors.include?(e.code)
|
47
52
|
end
|
48
53
|
|
49
54
|
resources
|
50
55
|
end
|
56
|
+
|
57
|
+
private
|
58
|
+
|
59
|
+
# not an error
|
60
|
+
def suppressed_errors
|
61
|
+
%w[
|
62
|
+
AccessDeniedException
|
63
|
+
]
|
64
|
+
end
|
51
65
|
end
|
@@ -15,6 +15,7 @@ class Redshift < Mapper
|
|
15
15
|
struct = OpenStruct.new(cluster.to_h)
|
16
16
|
struct.type = 'cluster'
|
17
17
|
struct.arn = cluster.cluster_identifier
|
18
|
+
struct.logging_status = @client.describe_logging_status({ cluster_identifier: cluster.cluster_identifier }).to_h
|
18
19
|
|
19
20
|
resources.push(struct.to_h)
|
20
21
|
end
|
@@ -0,0 +1,26 @@
|
|
1
|
+
class SecretsManager < Mapper
|
2
|
+
#
|
3
|
+
# Returns an array of resources.
|
4
|
+
#
|
5
|
+
def collect
|
6
|
+
resources = []
|
7
|
+
|
8
|
+
#
|
9
|
+
# describe_auto_scaling_groups
|
10
|
+
#
|
11
|
+
@client.list_secrets.each_with_index do |response, page|
|
12
|
+
log(response.context.operation_name, page)
|
13
|
+
|
14
|
+
response.secret_list.each_with_index do |secret, i|
|
15
|
+
log(response.context.operation_name, i)
|
16
|
+
|
17
|
+
struct = OpenStruct.new(secret.to_h)
|
18
|
+
struct.type = 'secret'
|
19
|
+
|
20
|
+
resources.push(struct.to_h)
|
21
|
+
end
|
22
|
+
end
|
23
|
+
|
24
|
+
resources
|
25
|
+
end
|
26
|
+
end
|
@@ -0,0 +1,37 @@
|
|
1
|
+
class SecurityHub < Mapper
|
2
|
+
#
|
3
|
+
# Returns an array of resources.
|
4
|
+
#
|
5
|
+
def collect
|
6
|
+
resources = []
|
7
|
+
|
8
|
+
#
|
9
|
+
# describe_hub
|
10
|
+
#
|
11
|
+
begin
|
12
|
+
@client.describe_hub.each do |response|
|
13
|
+
log(response.context.operation_name)
|
14
|
+
|
15
|
+
struct = OpenStruct.new(response.to_h)
|
16
|
+
struct.type = 'hub'
|
17
|
+
struct.arn = response.hub_arn
|
18
|
+
|
19
|
+
resources.push(struct.to_h)
|
20
|
+
end
|
21
|
+
rescue Aws::SecurityHub::Errors::ServiceError => e
|
22
|
+
log_error(e.code)
|
23
|
+
raise e unless suppressed_errors.include?(e.code)
|
24
|
+
end
|
25
|
+
|
26
|
+
resources
|
27
|
+
end
|
28
|
+
|
29
|
+
private
|
30
|
+
|
31
|
+
# not an error
|
32
|
+
def suppressed_errors
|
33
|
+
%w[
|
34
|
+
InvalidAccessException
|
35
|
+
]
|
36
|
+
end
|
37
|
+
end
|
data/lib/aws_recon/services.yaml
CHANGED
@@ -6,6 +6,8 @@
|
|
6
6
|
alias: aa
|
7
7
|
- name: ApplicationAutoScaling
|
8
8
|
alias: aas
|
9
|
+
- name: Backup
|
10
|
+
alias: backup
|
9
11
|
- name: ConfigService
|
10
12
|
alias: config
|
11
13
|
- name: CodeBuild
|
@@ -37,6 +39,13 @@
|
|
37
39
|
- ap-southeast-1
|
38
40
|
- name: ElastiCache
|
39
41
|
alias: elasticache
|
42
|
+
- name: EMR
|
43
|
+
alias: emr
|
44
|
+
excluded_regions:
|
45
|
+
- ap-east-1
|
46
|
+
- af-south-1
|
47
|
+
- eu-south-1
|
48
|
+
- me-south-1
|
40
49
|
- name: IAM
|
41
50
|
global: true
|
42
51
|
alias: iam
|
@@ -91,6 +100,10 @@
|
|
91
100
|
alias: cloudwatchlogs
|
92
101
|
- name: Kafka
|
93
102
|
alias: kafka
|
103
|
+
- name: SecretsManager
|
104
|
+
alias: sm
|
105
|
+
- name: SecurityHub
|
106
|
+
alias: sh
|
94
107
|
- name: Support
|
95
108
|
global: true
|
96
109
|
alias: support
|
data/lib/aws_recon/version.rb
CHANGED
data/readme.md
CHANGED
@@ -226,6 +226,7 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
|
|
226
226
|
- [x] AdvancedShield
|
227
227
|
- [x] ApplicationAutoScaling
|
228
228
|
- [x] Athena
|
229
|
+
- [x] Backup
|
229
230
|
- [x] GuardDuty
|
230
231
|
- [ ] Macie
|
231
232
|
- [x] Systems Manager
|
@@ -249,8 +250,9 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
|
|
249
250
|
- [x] ECR
|
250
251
|
- [x] ECS
|
251
252
|
- [x] EFS
|
252
|
-
- [x] ELB
|
253
253
|
- [x] EKS
|
254
|
+
- [x] ELB
|
255
|
+
- [x] EMR
|
254
256
|
- [x] Elasticsearch
|
255
257
|
- [x] ElastiCache
|
256
258
|
- [x] Firehose
|
@@ -270,6 +272,8 @@ AWS Recon aims to collect all resources and metadata that are relevant in determ
|
|
270
272
|
- [x] S3
|
271
273
|
- [x] SageMaker
|
272
274
|
- [x] SES
|
275
|
+
- [x] SecretsManager
|
276
|
+
- [x] SecurityHub
|
273
277
|
- [x] ServiceQuotas
|
274
278
|
- [x] Shield
|
275
279
|
- [x] SNS
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: aws_recon
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.24
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Josh Larsen
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2020-
|
12
|
+
date: 2020-12-05 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: aws-sdk
|
@@ -187,6 +187,7 @@ files:
|
|
187
187
|
- lib/aws_recon/collectors/applicationautoscaling.rb
|
188
188
|
- lib/aws_recon/collectors/athena.rb
|
189
189
|
- lib/aws_recon/collectors/autoscaling.rb
|
190
|
+
- lib/aws_recon/collectors/backup.rb
|
190
191
|
- lib/aws_recon/collectors/cloudformation.rb
|
191
192
|
- lib/aws_recon/collectors/cloudfront.rb
|
192
193
|
- lib/aws_recon/collectors/cloudtrail.rb
|
@@ -208,6 +209,7 @@ files:
|
|
208
209
|
- lib/aws_recon/collectors/elasticloadbalancing.rb
|
209
210
|
- lib/aws_recon/collectors/elasticloadbalancingv2.rb
|
210
211
|
- lib/aws_recon/collectors/elasticsearch.rb
|
212
|
+
- lib/aws_recon/collectors/emr.rb
|
211
213
|
- lib/aws_recon/collectors/firehose.rb
|
212
214
|
- lib/aws_recon/collectors/guardduty.rb
|
213
215
|
- lib/aws_recon/collectors/iam.rb
|
@@ -223,6 +225,8 @@ files:
|
|
223
225
|
- lib/aws_recon/collectors/route53domains.rb
|
224
226
|
- lib/aws_recon/collectors/s3.rb
|
225
227
|
- lib/aws_recon/collectors/sagemaker.rb
|
228
|
+
- lib/aws_recon/collectors/secretsmanager.rb
|
229
|
+
- lib/aws_recon/collectors/securityhub.rb
|
226
230
|
- lib/aws_recon/collectors/servicequotas.rb
|
227
231
|
- lib/aws_recon/collectors/ses.rb
|
228
232
|
- lib/aws_recon/collectors/shield.rb
|