aws_recon 0.2.24 → 0.2.29

data/lib/aws_recon/collectors/iam.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect IAM resources
+#
 class IAM < Mapper
   #
   # Returns an array of resources.
@@ -101,7 +106,8 @@ class IAM < Mapper
       end
     rescue Aws::IAM::Errors::ServiceError => e
       log_error(e.code)
-      raise e unless suppressed_errors.include?(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     #
@@ -183,7 +189,8 @@ class IAM < Mapper
       end
     rescue Aws::IAM::Errors::ServiceError => e
       log_error(e.code)
-      raise e unless suppressed_errors.include?(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     resources

data/lib/aws_recon/collectors/kafka.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Kafka resources
+#
 class Kafka < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/kinesis.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Kinesis resources
+#
 class Kinesis < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/kms.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect KMS resources
+#
 class KMS < Mapper
   #
   # Returns an array of resources.
@@ -29,7 +34,8 @@ class KMS < Mapper
                                     .key_rotation_enabled
         rescue Aws::KMS::Errors::ServiceError => e
           log_error(e.code)
-          raise e unless suppressed_errors.include?(e.code)
+
+          raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
         end
 
         # list_grants

data/lib/aws_recon/collectors/lambda.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Lambda resources
+#
 class Lambda < Mapper
   def collect
     resources = []

data/lib/aws_recon/collectors/lightsail.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Lightsail resources
+#
 class Lightsail < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/organizations.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Org resources
+#
 class Organizations < Mapper
   #
   # Returns an array of resources.
@@ -48,7 +53,8 @@ class Organizations < Mapper
       end
     rescue Aws::Organizations::Errors::ServiceError => e
       log_error(e.code)
-      raise e unless suppressed_errors.include?(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     resources

data/lib/aws_recon/collectors/rds.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect RDS Resources
+#
 class RDS < Mapper
   #
   # Returns an array of resources.
@@ -38,6 +43,8 @@ class RDS < Mapper
         struct.arn = instance.db_instance_arn
         struct.parent_id = instance.db_cluster_identifier
 
+        # TODO: describe_db_snapshots here (with public flag)
+
         resources.push(struct.to_h)
       end
     end

data/lib/aws_recon/collectors/redshift.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Redshift resources
+#
 class Redshift < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/route53.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Route53 resources
+#
 class Route53 < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/route53domains.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Route53 Domain resources
+#
 class Route53Domains < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/s3.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect S3 Resources
+#
 class S3 < Mapper
   #
   # Returns an array of resources.
@@ -61,7 +66,9 @@ class S3 < Mapper
                            end
 
         rescue Aws::S3::Errors::ServiceError => e
-          raise e unless suppressed_errors.include?(e.code)
+          log_error(e.code)
+
+          raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
         end
 
         resources.push(struct.to_h)

data/lib/aws_recon/collectors/sagemaker.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect SageMaker Resources
+#
 class SageMaker < Mapper
   #
   # Returns an array of resources.
@@ -12,7 +17,9 @@ class SageMaker < Mapper
       log(response.context.operation_name, page)
 
       response.notebook_instances.each do |instance|
-        struct = OpenStruct.new(instance.to_h)
+        struct = OpenStruct.new(@client.describe_notebook_instance({
+                                                                     notebook_instance_name: instance.notebook_instance_name
+                                                                   }).to_h)
         struct.type = 'notebook_instance'
         struct.arn = instance.notebook_instance_arn
 
@@ -20,6 +27,23 @@ class SageMaker < Mapper
       end
     end
 
+    #
+    # list_endpoints
+    #
+    @client.list_endpoints.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      response.endpoints.each do |instance|
+        struct = OpenStruct.new(@client.describe_endpoint({
+                                                            endpoint_name: instance.endpoint_name
+                                                          }).to_h)
+        struct.type = 'endpoint'
+        struct.arn = instance.endpoint_arn
+
+        resources.push(struct.to_h)
+      end
+    end
+
     resources
   end
 end

data/lib/aws_recon/collectors/secretsmanager.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Secrets Manager resources
+#
 class SecretsManager < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/securityhub.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Security Hub resources
+#
 class SecurityHub < Mapper
   #
   # Returns an array of resources.
@@ -20,7 +25,8 @@ class SecurityHub < Mapper
       end
     rescue Aws::SecurityHub::Errors::ServiceError => e
       log_error(e.code)
-      raise e unless suppressed_errors.include?(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     resources

data/lib/aws_recon/collectors/servicequotas.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect ServiceQuota resources
+#
 class ServiceQuotas < Mapper
   #
   # Returns an array of resources.
@@ -27,7 +32,8 @@ class ServiceQuotas < Mapper
       end
     rescue Aws::ServiceQuotas::Errors::ServiceError => e
       log_error(e.code, service)
-      raise e unless suppressed_errors.include?(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     resources

data/lib/aws_recon/collectors/ses.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect SES resources
+#
 class SES < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/shield.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Shield resources
+#
 class Shield < Mapper
   #
   # Returns an array of resources.
@@ -27,7 +32,7 @@ class Shield < Mapper
       struct = OpenStruct.new
       struct.type = 'contact_list'
       struct.arn = "arn:aws:shield:#{@region}:#{@account}:contact_list"
-      struct.contacts = response.emergency_contact_list.map(&:to_h)
+      struct.contacts = response&.emergency_contact_list&.map(&:to_h)
 
       resources.push(struct.to_h)
     end
@@ -51,7 +56,8 @@ class Shield < Mapper
     resources
   rescue Aws::Shield::Errors::ServiceError => e
     log_error(e.code)
-    raise e unless suppressed_errors.include?(e.code)
+
+    raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
 
     [] # no access or service isn't enabled
   end

data/lib/aws_recon/collectors/sns.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect SNS resources
+#
 class SNS < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/sqs.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect SQS resources
+#
 class SQS < Mapper
   #
   # Returns an array of resources.
@@ -18,7 +23,7 @@ class SQS < Mapper
         struct = OpenStruct.new(@client.get_queue_attributes({ queue_url: queue, attribute_names: ['All'] }).attributes.to_h)
         struct.type = 'queue'
         struct.arn = struct.QueueArn
-        struct.policy = struct.delete_field('Policy').parse_policy
+        struct.policy = struct.Policy ? struct.delete_field('Policy').parse_policy : nil
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/ssm.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect SSM resources
+#
 class SSM < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/support.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Support resources
+#
 class Support < Mapper
   #
   # Returns an array of resources.
@@ -27,7 +32,8 @@ class Support < Mapper
     resources
   rescue Aws::Support::Errors::ServiceError => e
     log_error(e.code)
-    raise e unless suppressed_errors.include?(e.code)
+
+    raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
 
     [] # no Support subscription
   end

data/lib/aws_recon/collectors/transfer.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect Transfer resources
+#
 class Transfer < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/wafv2.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect WAFv2 resources
+#
 class WAFV2 < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/workspaces.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect WorkSpaces resources
+#
 class WorkSpaces < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/collectors/xray.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+
+#
+# Collect XRay resources
+#
 class XRay < Mapper
   #
   # Returns an array of resources.

data/lib/aws_recon/lib/mapper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 #
 # Generic wrapper for service clients.
 #
@@ -64,14 +66,14 @@ class Mapper
   end
 
   def log(*msg)
-    if @options.verbose
-      puts _msg(msg).map { |x| "\x1b[32m#{x}\x1b[0m" }.join("\x1b[35m.\x1b[0m")
-    end
+    return unless @options.verbose
+
+    puts _msg(msg).map { |x| "\x1b[32m#{x}\x1b[0m" }.join("\x1b[35m.\x1b[0m")
   end
 
   def log_error(*msg)
-    if @options.verbose
-      puts _msg(msg).map { |x| "\x1b[35m#{x}\x1b[0m" }.join("\x1b[32m.\x1b[0m")
-    end
+    return unless @options.verbose
+
+    puts _msg(msg).map { |x| "\x1b[35m#{x}\x1b[0m" }.join("\x1b[32m.\x1b[0m")
   end
 end

data/lib/aws_recon/lib/patch.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 #
 # Parse and unescape AWS policy document string
 #

data/lib/aws_recon/options.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+#
+# Command line options parser
+#
 class Parser
   DEFAULT_CONFIG_FILE = nil
   DEFAULT_OUTPUT_FILE = File.expand_path(File.join(Dir.pwd, 'output.json')).freeze
@@ -20,6 +23,7 @@ class Parser
     :skip_credential_report,
     :stream_output,
     :verbose,
+    :quit_on_exception,
     :debug
   )
 
@@ -47,6 +51,7 @@ class Parser
       false,
       false,
       false,
+      false,
       false
     )
 
@@ -95,16 +100,12 @@ class Parser
 
       # output format
       opts.on('-f', '--format [FORMAT]', 'Specify output format (default: aws)') do |file|
-        if %w[aws custom].include?(file.downcase)
-          args.output_format = file.downcase
-        end
+        args.output_format = file.downcase if %w[aws custom].include?(file.downcase)
       end
 
       # threads
       opts.on('-t', '--threads [THREADS]', "Specify max threads (default: #{Parser::DEFAULT_THREADS}, max: 128)") do |threads|
-        if (0..Parser::MAX_THREADS).include?(threads.to_i)
-          args.threads = threads.to_i
-        end
+        args.threads = threads.to_i if (0..Parser::MAX_THREADS).include?(threads.to_i)
       end
 
       # collect EC2 instance user data
@@ -135,6 +136,11 @@ class Parser
         args.verbose = true unless args.stream_output
       end
 
+      # re-raise exceptions
+      opts.on('-q', '--quit-on-exception', 'Stop collection if an API error is encountered (default: false)') do
+        args.quit_on_exception = true
+      end
+
       # debug
       opts.on('-d', '--debug', 'Output debug with wire trace info') do
         unless args.stream_output