aws_recon 0.2.32 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a38b9447d93b385f4baa0c125bffad8b671eebac31f7cfff780ed0101c8e8c1c
-  data.tar.gz: 1cb26df32d2afee35ed0cbd8f4ce5eb3552a702f9e52806e2ecdb6c0278548ab
+  metadata.gz: 9a7f479006111ba869fcdccea5264ffb5a3cc4c0536e0b2cf4a6b3581ff65146
+  data.tar.gz: dfa1191aea8a07fcd9a54be418f913b777f0bd43cf5cf9cbdfb0b8f8707dc8aa
 SHA512:
-  metadata.gz: e4a8304dc4ea439685262c8a34cb0861a58a7eee3c741f11fabd4de2bcf8d36a4d1ce1b2ca45746e0a5625f35a80c21d710d5c1bdc2e6cf77ac3e23f9406cd9f
-  data.tar.gz: ed1bdeed23d927ce54aaca5d7b795c03a3b7931870aa82fd14a9017cbab1a21aa23d736d3fcd915c446bbce4fcd36b07e11735c5b2aa75784926e97eb0943be7
+  metadata.gz: 8f5a65342608fd58234383c704ddb416333e1439ca024e8e09bb0b3e96cfe2df0d53b5489ad040317b7b47b0f523c4c8252753af81e018866f081ef2c06cf414
+  data.tar.gz: '0867e52a15899ff2e63f141ab376b2992f968c4b19a0a64b57b1506d1cc036a8724b289c231a8a15dd4118bad65eff6945b891629150d8fe6bf9afb284bca0dd'

data/lib/aws_recon/collectors/emr.rb

@@ -18,6 +18,7 @@ class EMR < Mapper
 
       struct = OpenStruct.new(response.block_public_access_configuration.to_h)
       struct.type = 'configuration'
+      struct.arn = "arn:aws:emr:#{@region}:#{@account}/block_public_access_configuration"
 
       resources.push(struct.to_h)
     end

data/lib/aws_recon/collectors/guardduty.rb

@@ -22,20 +22,26 @@ class GuardDuty < Mapper
         # get_detector
         struct = OpenStruct.new(@client.get_detector({ detector_id: detector }).to_h)
         struct.type = 'detector'
-        struct.arn = "arn:aws:guardduty:#{@region}:detector/#{detector}"
+        struct.arn = "arn:aws:guardduty:#{@region}:#{@account}:detector/#{detector}"
 
         # get_findings_statistics (only active findings)
         struct.findings_statistics = @client.get_findings_statistics({
                                                                        detector_id: detector,
                                                                        finding_statistic_types: ['COUNT_BY_SEVERITY'],
-                                                                       finding_criteria: {
-                                                                         criterion: {
-                                                                           'service.archived': {
-                                                                             eq: ['false']
-                                                                           }
-                                                                         }
-                                                                       }
+                                                                       finding_criteria: finding_criteria
                                                                      }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 7 days)
+        struct.findings_statistics_aged_short = @client.get_findings_statistics({
+                                                                                  detector_id: detector,
+                                                                                  finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                  finding_criteria: finding_criteria(7)
+                                                                                }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 30 days)
+        struct.findings_statistics_aged_long = @client.get_findings_statistics({
+                                                                                 detector_id: detector,
+                                                                                 finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                 finding_criteria: finding_criteria(30)
+                                                                               }).finding_statistics.to_h
 
         # get_master_account
         struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
@@ -46,4 +52,27 @@ class GuardDuty < Mapper
 
     resources
   end
+
+  private
+
+  def finding_criteria(days = 1)
+    criteria = {
+      criterion: {
+        'service.archived': { eq: ['false'] }
+      }
+    }
+
+    if days > 1
+      days_ago = (Time.now.to_f * 1000).to_i - (60 * 60 * 24 * 1000 * days) # with miliseconds
+
+      criteria = {
+        criterion: {
+          'service.archived': { eq: ['false'] },
+          'updatedAt': { less_than: days_ago }
+        }
+      }
+    end
+
+    criteria
+  end
 end

data/lib/aws_recon/collectors/rds.rb

@@ -68,21 +68,39 @@ class RDS < Mapper
     end
 
     #
-    # describe_db_engine_versions
+    # describe_db_cluster_snapshots
     #
-    unless @options.skip_slow
-      @client.describe_db_engine_versions.each_with_index do |response, page|
-        log(response.context.operation_name, page)
+    @client.describe_db_cluster_snapshots.each_with_index do |response, page|
+      log(response.context.operation_name, page)
 
-        response.db_engine_versions.each do |version|
-          struct = OpenStruct.new(version.to_h)
-          struct.type = 'db_engine_version'
+      response.db_cluster_snapshots.each do |snapshot|
+        log(response.context.operation_name, snapshot.db_cluster_snapshot_identifier)
 
-          resources.push(struct.to_h)
-        end
+        struct = OpenStruct.new(snapshot.to_h)
+        struct.type = 'db_cluster_snapshot'
+        struct.arn = snapshot.db_cluster_snapshot_arn
+        struct.parent_id = snapshot.db_cluster_identifier
+
+        resources.push(struct.to_h)
       end
     end
 
+    #
+    # describe_db_engine_versions
+    #
+    ### unless @options.skip_slow
+    ###   @client.describe_db_engine_versions.each_with_index do |response, page|
+    ###     log(response.context.operation_name, page)
+
+    ###     response.db_engine_versions.each do |version|
+    ###       struct = OpenStruct.new(version.to_h)
+    ###       struct.type = 'db_engine_version'
+
+    ###       resources.push(struct.to_h)
+    ###     end
+    ###   end
+    ### end
+
     resources
   end
 end

data/lib/aws_recon/collectors/route53.rb

@@ -19,7 +19,7 @@ class Route53 < Mapper
       response.hosted_zones.each do |zone|
         struct = OpenStruct.new(zone.to_h)
         struct.type = 'zone'
-        struct.arn = zone.id
+        struct.arn = "aws:route53:#{@region}:#{@account}:zone/#{zone.name}"
         struct.logging_config = @client
                                 .list_query_logging_configs({ hosted_zone_id: zone.id })
                                 .query_logging_configs.first.to_h

data/lib/aws_recon/collectors/ses.rb

@@ -19,7 +19,7 @@ class SES < Mapper
       response.identities.each do |identity|
         struct = OpenStruct.new
         struct.type = 'identity'
-        struct.arn = "aws:ses:#{@region}::identity/#{identity}"
+        struct.arn = "arn:aws:ses:#{@region}:#{@account}:identity/#{identity}"
 
         # get_identity_dkim_attributes
         struct.dkim_attributes = @client.get_identity_dkim_attributes({ identities: [identity] }).dkim_attributes[identity].to_h

data/lib/aws_recon/collectors/ssm.rb

@@ -35,7 +35,7 @@ class SSM < Mapper
         struct = OpenStruct.new(parameter.to_h)
         struct.string_type = parameter.type
         struct.type = 'parameter'
-        struct.arn = "arn:aws:#{@service}:#{@region}::parameter:#{parameter.name}"
+        struct.arn = "arn:aws:#{@service}:#{@region}:#{@account}:parameter:#{parameter.name}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/wafv2.rb

@@ -34,14 +34,14 @@ class WAFV2 < Mapper
           }
 
           # get_web_acl
-          @client.get_web_acl(params).each do |response|
-            struct.arn = response.web_acl.arn
-            struct.details = response.web_acl
+          @client.get_web_acl(params).each do |r|
+            struct.arn = r.web_acl.arn
+            struct.details = r.web_acl
           end
 
           # list_resources_for_web_acl
-          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |response|
-            struct.resources = response.resource_arns.map(&:to_h)
+          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |r|
+            struct.resources = r.resource_arns.map(&:to_h)
           end
 
           resources.push(struct.to_h)

data/lib/aws_recon/collectors/xray.rb

@@ -16,6 +16,7 @@ class XRay < Mapper
     struct = OpenStruct.new
     struct.config = @client.get_encryption_config.encryption_config.to_h
     struct.type = 'config'
+    struct.arn = "arn:aws:xray:#{@region}:#{@account}/config"
 
     resources.push(struct.to_h)
 

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.32"
+  VERSION = "0.3.0"
 end

data/readme.md

@@ -54,13 +54,13 @@ To run locally, first install the gem:
 
 ```
 $ gem install aws_recon
-Fetching aws_recon-0.2.28.gem
+Fetching aws_recon-0.3.0.gem
 Fetching aws-sdk-3.0.1.gem
 Fetching parallel-1.20.1.gem
 ...
 Successfully installed aws-sdk-3.0.1
 Successfully installed parallel-1.20.1
-Successfully installed aws_recon-0.2.28
+Successfully installed aws_recon-0.3.0
 ```
 
 Or add it to your Gemfile using `bundle`:
@@ -72,7 +72,7 @@ Resolving dependencies...
 ...
 Using aws-sdk 3.0.1
 Using parallel-1.20.1
-Using aws_recon 0.2.28
+Using aws_recon 0.3.0
 ```
 
 ## Usage
@@ -225,7 +225,7 @@ Most users will want to limit collection to relevant services and regions. Runni
 ```
 $ aws_recon -h
 
-AWS Recon - AWS Inventory Collector (0.2.28)
+AWS Recon - AWS Inventory Collector (0.3.0)
 
 Usage: aws_recon [options]
     -r, --regions [REGIONS]          Regions to scan, separated by comma (default: all)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.32
+  version: 0.3.0
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-29 00:00:00.000000000 Z
+date: 2021-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk