aws_recon 0.2.33 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '049b5ee7040e057fade76bdfaa07078ad216d95b134049ca5d0575bb540f5547'
-  data.tar.gz: f4e8d67b732aa5b15252bf2acbf1a2f31aa7cc2341d058c9ad9ffe51290d532e
+  metadata.gz: 3f7ece5998d62559623442fbd5435c0a6949abb140c00a72007ab28b19cefa0a
+  data.tar.gz: b7ebfdc20a895b60a29435b4f70456c73c99d99ae1a642e06bbab9a86f70fd5a
 SHA512:
-  metadata.gz: 9ee4a95c41437dc33a6b9e7089ab76be8caf0055b06a50f60347258bbc1f487ddae10574c6b1b5f744a58ad91776af4555c3e67e8753cda7b59e6a27a4757665
-  data.tar.gz: 7bff1e16da379ec100973e0928c56b861c8c0fbf48705add34fe00e52e30da37655b93133516df78ac4c6b9fbcae3612ceb86c7baa5fa0ce5a2448e474d5cff3
+  metadata.gz: 027ee08ba24948e23d96988410aea58b95803dbf3f6e54b496c6da20f36a6913b1e590ca434a0301bf19900cc540989759c38ea96cc4986270d239183effbcdb
+  data.tar.gz: c714d6d005d95806a89fe9ff1b82ec4d5dfc12a05ace708505849a84acc594576a9b53b8843cd6b36cc9a0d49a7dc0ca2830a5ae48f0faa9ae21c2cd8cf63cd2

data/lib/aws_recon/collectors/ec2.rb

@@ -29,6 +29,7 @@ class EC2 < Mapper
         struct = OpenStruct.new
         struct.attributes = response.account_attributes.map(&:to_h)
         struct.type = 'account'
+        struct.arn = "arn:aws::#{@account}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/emr.rb

@@ -18,6 +18,7 @@ class EMR < Mapper
 
       struct = OpenStruct.new(response.block_public_access_configuration.to_h)
       struct.type = 'configuration'
+      struct.arn = "arn:aws:emr:#{@region}:#{@account}/block_public_access_configuration"
 
       resources.push(struct.to_h)
     end

data/lib/aws_recon/collectors/guardduty.rb

@@ -22,20 +22,26 @@ class GuardDuty < Mapper
         # get_detector
         struct = OpenStruct.new(@client.get_detector({ detector_id: detector }).to_h)
         struct.type = 'detector'
-        struct.arn = "arn:aws:guardduty:#{@region}:detector/#{detector}"
+        struct.arn = "arn:aws:guardduty:#{@region}:#{@account}:detector/#{detector}"
 
         # get_findings_statistics (only active findings)
         struct.findings_statistics = @client.get_findings_statistics({
                                                                        detector_id: detector,
                                                                        finding_statistic_types: ['COUNT_BY_SEVERITY'],
-                                                                       finding_criteria: {
-                                                                         criterion: {
-                                                                           'service.archived': {
-                                                                             eq: ['false']
-                                                                           }
-                                                                         }
-                                                                       }
+                                                                       finding_criteria: finding_criteria
                                                                      }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 7 days)
+        struct.findings_statistics_aged_short = @client.get_findings_statistics({
+                                                                                  detector_id: detector,
+                                                                                  finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                  finding_criteria: finding_criteria(7)
+                                                                                }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 30 days)
+        struct.findings_statistics_aged_long = @client.get_findings_statistics({
+                                                                                 detector_id: detector,
+                                                                                 finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                 finding_criteria: finding_criteria(30)
+                                                                               }).finding_statistics.to_h
 
         # get_master_account
         struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
@@ -46,4 +52,27 @@ class GuardDuty < Mapper
 
     resources
   end
+
+  private
+
+  def finding_criteria(days = 1)
+    criteria = {
+      criterion: {
+        'service.archived': { eq: ['false'] }
+      }
+    }
+
+    if days > 1
+      days_ago = (Time.now.to_f * 1000).to_i - (60 * 60 * 24 * 1000 * days) # with miliseconds
+
+      criteria = {
+        criterion: {
+          'service.archived': { eq: ['false'] },
+          'updatedAt': { less_than: days_ago }
+        }
+      }
+    end
+
+    criteria
+  end
 end

data/lib/aws_recon/collectors/rds.rb

@@ -88,18 +88,18 @@ class RDS < Mapper
     #
     # describe_db_engine_versions
     #
-    unless @options.skip_slow
-      @client.describe_db_engine_versions.each_with_index do |response, page|
-        log(response.context.operation_name, page)
-
-        response.db_engine_versions.each do |version|
-          struct = OpenStruct.new(version.to_h)
-          struct.type = 'db_engine_version'
-
-          resources.push(struct.to_h)
-        end
-      end
-    end
+    ### unless @options.skip_slow
+    ###   @client.describe_db_engine_versions.each_with_index do |response, page|
+    ###     log(response.context.operation_name, page)
+
+    ###     response.db_engine_versions.each do |version|
+    ###       struct = OpenStruct.new(version.to_h)
+    ###       struct.type = 'db_engine_version'
+
+    ###       resources.push(struct.to_h)
+    ###     end
+    ###   end
+    ### end
 
     resources
   end

data/lib/aws_recon/collectors/route53.rb

@@ -19,7 +19,7 @@ class Route53 < Mapper
       response.hosted_zones.each do |zone|
         struct = OpenStruct.new(zone.to_h)
         struct.type = 'zone'
-        struct.arn = zone.id
+        struct.arn = "aws:route53:#{@region}:#{@account}:zone/#{zone.name}"
         struct.logging_config = @client
                                 .list_query_logging_configs({ hosted_zone_id: zone.id })
                                 .query_logging_configs.first.to_h

data/lib/aws_recon/collectors/ses.rb

@@ -19,7 +19,7 @@ class SES < Mapper
       response.identities.each do |identity|
         struct = OpenStruct.new
         struct.type = 'identity'
-        struct.arn = "aws:ses:#{@region}::identity/#{identity}"
+        struct.arn = "arn:aws:ses:#{@region}:#{@account}:identity/#{identity}"
 
         # get_identity_dkim_attributes
         struct.dkim_attributes = @client.get_identity_dkim_attributes({ identities: [identity] }).dkim_attributes[identity].to_h

data/lib/aws_recon/collectors/ssm.rb

@@ -35,7 +35,7 @@ class SSM < Mapper
         struct = OpenStruct.new(parameter.to_h)
         struct.string_type = parameter.type
         struct.type = 'parameter'
-        struct.arn = "arn:aws:#{@service}:#{@region}::parameter:#{parameter.name}"
+        struct.arn = "arn:aws:#{@service}:#{@region}:#{@account}:parameter:#{parameter.name}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/wafv2.rb

@@ -34,14 +34,14 @@ class WAFV2 < Mapper
           }
 
           # get_web_acl
-          @client.get_web_acl(params).each do |response|
-            struct.arn = response.web_acl.arn
-            struct.details = response.web_acl
+          @client.get_web_acl(params).each do |r|
+            struct.arn = r.web_acl.arn
+            struct.details = r.web_acl
           end
 
           # list_resources_for_web_acl
-          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |response|
-            struct.resources = response.resource_arns.map(&:to_h)
+          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |r|
+            struct.resources = r.resource_arns.map(&:to_h)
           end
 
           resources.push(struct.to_h)

data/lib/aws_recon/collectors/xray.rb

@@ -16,6 +16,7 @@ class XRay < Mapper
     struct = OpenStruct.new
     struct.config = @client.get_encryption_config.encryption_config.to_h
     struct.type = 'config'
+    struct.arn = "arn:aws:xray:#{@region}:#{@account}/config"
 
     resources.push(struct.to_h)
 

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.33"
+  VERSION = "0.3.1"
 end

data/readme.md

@@ -54,13 +54,13 @@ To run locally, first install the gem:
 
 ```
 $ gem install aws_recon
-Fetching aws_recon-0.2.28.gem
+Fetching aws_recon-0.3.0.gem
 Fetching aws-sdk-3.0.1.gem
 Fetching parallel-1.20.1.gem
 ...
 Successfully installed aws-sdk-3.0.1
 Successfully installed parallel-1.20.1
-Successfully installed aws_recon-0.2.28
+Successfully installed aws_recon-0.3.0
 ```
 
 Or add it to your Gemfile using `bundle`:
@@ -72,7 +72,7 @@ Resolving dependencies...
 ...
 Using aws-sdk 3.0.1
 Using parallel-1.20.1
-Using aws_recon 0.2.28
+Using aws_recon 0.3.0
 ```
 
 ## Usage
@@ -225,7 +225,7 @@ Most users will want to limit collection to relevant services and regions. Runni
 ```
 $ aws_recon -h
 
-AWS Recon - AWS Inventory Collector (0.2.28)
+AWS Recon - AWS Inventory Collector (0.3.0)
 
 Usage: aws_recon [options]
     -r, --regions [REGIONS]          Regions to scan, separated by comma (default: all)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.33
+  version: 0.3.1
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-31 00:00:00.000000000 Z
+date: 2021-02-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk