aws_recon 0.2.34 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9097aec2d8a54e8604fd3859277dddfb4c124d4ff5e2637896f07300e8453a69
-  data.tar.gz: af2804e4ef46dce207506e3bae4123b4a6fe5279e5ede5751427e0b3cd12db64
+  metadata.gz: 4cbcf69491befc3f3fb506855f5f11597ac6f7325e697f9e77161e80eeceea08
+  data.tar.gz: 00d9aaa7ca5c58f1ad05c892d50f90b8468d37b4b7b20396a19c09a84d408b30
 SHA512:
-  metadata.gz: 51d6793e2bf680f0915f4edec1b9741c147d6e393a3ecb08b3bc8b01e0a664bd6a4bfb55644f7bff94b83cca8c1315bccbeffa417a392bd958e93000135ffda7
-  data.tar.gz: e8df00ba291a752e0573892e6aaf513ec72176416fdef2fb4553e09fa13af6f12684034b3198e5a9529f8a2baf06ea658b4bb92961eadd6163aef46390b9d344
+  metadata.gz: 8e60879ad2fd773f359d5b75fdac5f846cb9c1708d223396f28c448f4a47b79e683b43135e2700171e5cbc68eefef43f75d9ff3e1a1885076fbd24e97b605c54
+  data.tar.gz: c58078ba779cb25cfa5600549c31381e533ae8bcbc1479581d49c5c3462e9354e0df3714d796ca0d678c8fdc2059a041c08d953c99d4ed04e6f3ee1744d2fc89

data/lib/aws_recon/collectors/ec2.rb

@@ -29,6 +29,7 @@ class EC2 < Mapper
         struct = OpenStruct.new
         struct.attributes = response.account_attributes.map(&:to_h)
         struct.type = 'account'
+        struct.arn = "arn:aws::#{@account}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/emr.rb

@@ -18,6 +18,7 @@ class EMR < Mapper
 
       struct = OpenStruct.new(response.block_public_access_configuration.to_h)
       struct.type = 'configuration'
+      struct.arn = "arn:aws:emr:#{@region}:#{@account}/block_public_access_configuration"
 
       resources.push(struct.to_h)
     end

data/lib/aws_recon/collectors/guardduty.rb

@@ -28,14 +28,20 @@ class GuardDuty < Mapper
         struct.findings_statistics = @client.get_findings_statistics({
                                                                        detector_id: detector,
                                                                        finding_statistic_types: ['COUNT_BY_SEVERITY'],
-                                                                       finding_criteria: {
-                                                                         criterion: {
-                                                                           'service.archived': {
-                                                                             eq: ['false']
-                                                                           }
-                                                                         }
-                                                                       }
+                                                                       finding_criteria: finding_criteria
                                                                      }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 7 days)
+        struct.findings_statistics_aged_short = @client.get_findings_statistics({
+                                                                                  detector_id: detector,
+                                                                                  finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                  finding_criteria: finding_criteria(7)
+                                                                                }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 30 days)
+        struct.findings_statistics_aged_long = @client.get_findings_statistics({
+                                                                                 detector_id: detector,
+                                                                                 finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                 finding_criteria: finding_criteria(30)
+                                                                               }).finding_statistics.to_h
 
         # get_master_account
         struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
@@ -46,4 +52,27 @@ class GuardDuty < Mapper
 
     resources
   end
+
+  private
+
+  def finding_criteria(days = 1)
+    criteria = {
+      criterion: {
+        'service.archived': { eq: ['false'] }
+      }
+    }
+
+    if days > 1
+      days_ago = (Time.now.to_f * 1000).to_i - (60 * 60 * 24 * 1000 * days) # with miliseconds
+
+      criteria = {
+        criterion: {
+          'service.archived': { eq: ['false'] },
+          'updatedAt': { less_than: days_ago }
+        }
+      }
+    end
+
+    criteria
+  end
 end

data/lib/aws_recon/collectors/iam.rb

@@ -91,6 +91,28 @@ class IAM < Mapper
       end
     end
 
+    #
+    # list_instance_profiles
+    #
+    @client.list_instance_profiles.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      # instance_profiles
+      response.instance_profiles.each do |profile|
+        struct = OpenStruct.new(profile.to_h)
+        struct.type = 'instance_profile'
+        struct.arn = profile.arn
+        struct.roles = []
+
+        profile.roles&.each do |role|
+          role.assume_role_policy_document = role.assume_role_policy_document.parse_policy
+          struct.roles.push(role.to_h)
+        end
+
+        resources.push(struct.to_h)
+      end
+    end
+
     #
     # get_account_password_policy
     #

data/lib/aws_recon/collectors/rds.rb

@@ -88,18 +88,18 @@ class RDS < Mapper
     #
     # describe_db_engine_versions
     #
-    unless @options.skip_slow
-      @client.describe_db_engine_versions.each_with_index do |response, page|
-        log(response.context.operation_name, page)
-
-        response.db_engine_versions.each do |version|
-          struct = OpenStruct.new(version.to_h)
-          struct.type = 'db_engine_version'
-
-          resources.push(struct.to_h)
-        end
-      end
-    end
+    ### unless @options.skip_slow
+    ###   @client.describe_db_engine_versions.each_with_index do |response, page|
+    ###     log(response.context.operation_name, page)
+
+    ###     response.db_engine_versions.each do |version|
+    ###       struct = OpenStruct.new(version.to_h)
+    ###       struct.type = 'db_engine_version'
+
+    ###       resources.push(struct.to_h)
+    ###     end
+    ###   end
+    ### end
 
     resources
   end

data/lib/aws_recon/collectors/route53.rb

@@ -19,7 +19,7 @@ class Route53 < Mapper
       response.hosted_zones.each do |zone|
         struct = OpenStruct.new(zone.to_h)
         struct.type = 'zone'
-        struct.arn = zone.id
+        struct.arn = "aws:route53:#{@region}:#{@account}:zone/#{zone.name}"
         struct.logging_config = @client
                                 .list_query_logging_configs({ hosted_zone_id: zone.id })
                                 .query_logging_configs.first.to_h

data/lib/aws_recon/collectors/ses.rb

@@ -19,7 +19,7 @@ class SES < Mapper
       response.identities.each do |identity|
         struct = OpenStruct.new
         struct.type = 'identity'
-        struct.arn = "aws:ses:#{@region}:#{@account}:identity/#{identity}"
+        struct.arn = "arn:aws:ses:#{@region}:#{@account}:identity/#{identity}"
 
         # get_identity_dkim_attributes
         struct.dkim_attributes = @client.get_identity_dkim_attributes({ identities: [identity] }).dkim_attributes[identity].to_h

data/lib/aws_recon/collectors/ssm.rb

@@ -35,7 +35,7 @@ class SSM < Mapper
         struct = OpenStruct.new(parameter.to_h)
         struct.string_type = parameter.type
         struct.type = 'parameter'
-        struct.arn = "arn:aws:#{@service}:#{@region}::parameter:#{parameter.name}"
+        struct.arn = "arn:aws:#{@service}:#{@region}:#{@account}:parameter:#{parameter.name}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/wafv2.rb

@@ -34,14 +34,14 @@ class WAFV2 < Mapper
           }
 
           # get_web_acl
-          @client.get_web_acl(params).each do |response|
-            struct.arn = response.web_acl.arn
-            struct.details = response.web_acl
+          @client.get_web_acl(params).each do |r|
+            struct.arn = r.web_acl.arn
+            struct.details = r.web_acl
           end
 
           # list_resources_for_web_acl
-          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |response|
-            struct.resources = response.resource_arns.map(&:to_h)
+          @client.list_resources_for_web_acl({ web_acl_arn: 'ResourceArn' }).each do |r|
+            struct.resources = r.resource_arns.map(&:to_h)
           end
 
           resources.push(struct.to_h)

data/lib/aws_recon/collectors/xray.rb

@@ -16,6 +16,7 @@ class XRay < Mapper
     struct = OpenStruct.new
     struct.config = @client.get_encryption_config.encryption_config.to_h
     struct.type = 'config'
+    struct.arn = "arn:aws:xray:#{@region}:#{@account}/config"
 
     resources.push(struct.to_h)
 

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.34"
+  VERSION = "0.3.2"
 end

data/readme.md

@@ -54,13 +54,13 @@ To run locally, first install the gem:
 
 ```
 $ gem install aws_recon
-Fetching aws_recon-0.2.28.gem
+Fetching aws_recon-0.3.0.gem
 Fetching aws-sdk-3.0.1.gem
 Fetching parallel-1.20.1.gem
 ...
 Successfully installed aws-sdk-3.0.1
 Successfully installed parallel-1.20.1
-Successfully installed aws_recon-0.2.28
+Successfully installed aws_recon-0.3.0
 ```
 
 Or add it to your Gemfile using `bundle`:
@@ -72,7 +72,7 @@ Resolving dependencies...
 ...
 Using aws-sdk 3.0.1
 Using parallel-1.20.1
-Using aws_recon 0.2.28
+Using aws_recon 0.3.0
 ```
 
 ## Usage
@@ -225,7 +225,7 @@ Most users will want to limit collection to relevant services and regions. Runni
 ```
 $ aws_recon -h
 
-AWS Recon - AWS Inventory Collector (0.2.28)
+AWS Recon - AWS Inventory Collector (0.3.0)
 
 Usage: aws_recon [options]
     -r, --regions [REGIONS]          Regions to scan, separated by comma (default: all)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.34
+  version: 0.3.2
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-02 00:00:00.000000000 Z
+date: 2021-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk