aws_recon 0.2.36 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62093b7a66219dac2bd3ccc799808c28c1581b7e94ea3eebc3f86b7263e8e82c
-  data.tar.gz: 64f2ff5a86901e57fa5786c180251dd72ba0c8672ca38e1aba93f3eb65d5efec
+  metadata.gz: 24978de4c7cf85dc8ed7f4a177caca6f1746ed6de3a877d921c3169817fa036d
+  data.tar.gz: f60ebd2d5e072656dfac5e2514edffb95b4bc059f66ed9d540608abd6cad9322
 SHA512:
-  metadata.gz: 5611e7a73ebdab34a6b71079d7d59159d4f48317f96a811a91a7f3eef5720941b71f8c8c328a95aaea361c457d47f680dfa80afa79655a439afb8dd616b2d5a4
-  data.tar.gz: fa6cf46957c186d0808d7932280ce8fba1707fdb71ad68443ddb979f9d89d42cc05c2c54ce6acc4e4c187f74eb5ddd1d26c43e5ca832bbcaaa7087157878eb2e
+  metadata.gz: 07fb3311cae4325997aa6b66bf9dd150a8d5a4eccff8a444dceb5a22b6cbdddd597025082afc7c02e96e889e988e23f1939d1ef2bff5772c5b51975a4bc32fdf
+  data.tar.gz: d09fb6a88b9e0f8f6565a49c66c302e9725817295eeb2556f292423fda0c66a6fa5975a74444f6c6597ce6703cfe84b4aaf02c62a10e3854f20f73b70b740ee0

data/lib/aws_recon/aws_recon.rb

@@ -6,7 +6,7 @@ module AwsRecon
   class CLI
     def initialize
       # parse options
-      @options = Parser.parse ARGV.length < 1 ? %w[-h] : ARGV
+      @options = Parser.parse ARGV.empty? ? %w[-h] : ARGV
 
       # timing
       @starting = Process.clock_gettime(Process::CLOCK_MONOTONIC)
@@ -15,11 +15,11 @@ module AwsRecon
       @account_id = Aws::STS::Client.new.get_caller_identity.account
 
       # AWS services
-      @aws_services = YAML.load(File.read(SERVICES_CONFIG_FILE), symbolize_names: true)
+      @aws_services = YAML.safe_load(File.read(SERVICES_CONFIG_FILE), symbolize_names: true)
 
       # User config services
       if @options.config_file
-        user_config = YAML.load(File.read(@options.config_file), symbolize_names: true)
+        user_config = YAML.safe_load(File.read(@options.config_file), symbolize_names: true)
 
         @services = user_config[:services]
         @regions = user_config[:regions]
@@ -94,7 +94,7 @@ module AwsRecon
           next unless @regions.include?(region) && !skip_region
 
           # user included this service in the args
-          next unless @services.include?(service.name) || @services.include?(service.alias) # rubocop:disable Layout/LineLength
+          next unless @services.include?(service.name) || @services.include?(service.alias)
 
           collect(service, region)
         end

data/lib/aws_recon/collectors/ec2.rb

@@ -29,6 +29,7 @@ class EC2 < Mapper
         struct = OpenStruct.new
         struct.attributes = response.account_attributes.map(&:to_h)
         struct.type = 'account'
+        struct.arn = "arn:aws::#{@account}"
 
         resources.push(struct.to_h)
       end

data/lib/aws_recon/collectors/emr.rb

@@ -13,14 +13,20 @@ class EMR < Mapper
     #
     # get_block_public_access_configuration
     #
-    @client.get_block_public_access_configuration.each do |response|
-      log(response.context.operation_name)
+    begin
+      @client.get_block_public_access_configuration.each do |response|
+        log(response.context.operation_name)
 
-      struct = OpenStruct.new(response.block_public_access_configuration.to_h)
-      struct.type = 'configuration'
-      struct.arn = "arn:aws:emr:#{@region}:#{@account}/block_public_access_configuration"
+        struct = OpenStruct.new(response.block_public_access_configuration.to_h)
+        struct.type = 'configuration'
+        struct.arn = "arn:aws:emr:#{@region}:#{@account}/block_public_access_configuration"
 
-      resources.push(struct.to_h)
+        resources.push(struct.to_h)
+      end
+    rescue Aws::EMR::Errors::ServiceError => e
+      log_error(e.code)
+
+      raise e unless suppressed_errors.include?(e.code) && !@options.quit_on_exception
     end
 
     #
@@ -42,4 +48,12 @@ class EMR < Mapper
 
     resources
   end
+
+  private
+
+  def suppressed_errors
+    %w[
+      InvalidRequestException
+    ]
+  end
 end

data/lib/aws_recon/collectors/guardduty.rb

@@ -28,14 +28,20 @@ class GuardDuty < Mapper
         struct.findings_statistics = @client.get_findings_statistics({
                                                                        detector_id: detector,
                                                                        finding_statistic_types: ['COUNT_BY_SEVERITY'],
-                                                                       finding_criteria: {
-                                                                         criterion: {
-                                                                           'service.archived': {
-                                                                             eq: ['false']
-                                                                           }
-                                                                         }
-                                                                       }
+                                                                       finding_criteria: finding_criteria
                                                                      }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 7 days)
+        struct.findings_statistics_aged_short = @client.get_findings_statistics({
+                                                                                  detector_id: detector,
+                                                                                  finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                  finding_criteria: finding_criteria(7)
+                                                                                }).finding_statistics.to_h
+        # get_findings_statistics (only active findings older than 30 days)
+        struct.findings_statistics_aged_long = @client.get_findings_statistics({
+                                                                                 detector_id: detector,
+                                                                                 finding_statistic_types: ['COUNT_BY_SEVERITY'],
+                                                                                 finding_criteria: finding_criteria(30)
+                                                                               }).finding_statistics.to_h
 
         # get_master_account
         struct.master_account = @client.get_master_account({ detector_id: detector }).master.to_h
@@ -46,4 +52,27 @@ class GuardDuty < Mapper
 
     resources
   end
+
+  private
+
+  def finding_criteria(days = 1)
+    criteria = {
+      criterion: {
+        'service.archived': { eq: ['false'] }
+      }
+    }
+
+    if days > 1
+      days_ago = (Time.now.to_f * 1000).to_i - (60 * 60 * 24 * 1000 * days) # with miliseconds
+
+      criteria = {
+        criterion: {
+          'service.archived': { eq: ['false'] },
+          'updatedAt': { less_than: days_ago }
+        }
+      }
+    end
+
+    criteria
+  end
 end

data/lib/aws_recon/collectors/iam.rb

@@ -91,6 +91,28 @@ class IAM < Mapper
       end
     end
 
+    #
+    # list_instance_profiles
+    #
+    @client.list_instance_profiles.each_with_index do |response, page|
+      log(response.context.operation_name, page)
+
+      # instance_profiles
+      response.instance_profiles.each do |profile|
+        struct = OpenStruct.new(profile.to_h)
+        struct.type = 'instance_profile'
+        struct.arn = profile.arn
+        struct.roles = []
+
+        profile.roles&.each do |role|
+          role.assume_role_policy_document = role.assume_role_policy_document.parse_policy
+          struct.roles.push(role.to_h)
+        end
+
+        resources.push(struct.to_h)
+      end
+    end
+
     #
     # get_account_password_policy
     #

data/lib/aws_recon/collectors/rds.rb

@@ -88,18 +88,18 @@ class RDS < Mapper
     #
     # describe_db_engine_versions
     #
-    unless @options.skip_slow
-      @client.describe_db_engine_versions.each_with_index do |response, page|
-        log(response.context.operation_name, page)
-
-        response.db_engine_versions.each do |version|
-          struct = OpenStruct.new(version.to_h)
-          struct.type = 'db_engine_version'
-
-          resources.push(struct.to_h)
-        end
-      end
-    end
+    ### unless @options.skip_slow
+    ###   @client.describe_db_engine_versions.each_with_index do |response, page|
+    ###     log(response.context.operation_name, page)
+
+    ###     response.db_engine_versions.each do |version|
+    ###       struct = OpenStruct.new(version.to_h)
+    ###       struct.type = 'db_engine_version'
+
+    ###       resources.push(struct.to_h)
+    ###     end
+    ###   end
+    ### end
 
     resources
   end

data/lib/aws_recon/services.yaml

@@ -13,11 +13,12 @@
 - name: CodeBuild
   alias: codebuild
   excluded_regions:
-    - af-south-1
+    - ap-northeast-3
 - name: CodePipeline
   alias: codepipeline
   excluded_regions:
     - af-south-1
+    - ap-northeast-3
     - me-south-1
 - name: AutoScaling
   alias: autoscaling
@@ -40,17 +41,10 @@
     - ap-southeast-1
 - name: ElasticLoadBalancingV2
   alias: elbv2
-  excluded_regions:
-    - ap-southeast-1
 - name: ElastiCache
   alias: elasticache
 - name: EMR
   alias: emr
-  excluded_regions:
-    - ap-east-1
-    - af-south-1
-    - eu-south-1
-    - me-south-1
 - name: IAM
   global: true
   alias: iam
@@ -96,11 +90,9 @@
 - name: SES
   alias: ses
   excluded_regions:
-    - eu-north-1
-    - eu-west-3
-    - us-west-1
-    - ap-east-1
     - af-south-1
+    - ap-east-1
+    - ap-northeast-3
     - eu-south-1
 - name: CloudWatch
   alias: cloudwatch
@@ -110,65 +102,78 @@
   alias: kafka
   excluded_regions:
     - af-south-1
+    - ap-northeast-3
 - name: SecretsManager
   alias: sm
 - name: SecurityHub
   alias: sh
+  excluded_regions:
+    - ap-northeast-3
 - name: Support
   global: true
   alias: support
 - name: SSM
   alias: ssm
-  excluded_regions:
-    - ap-southeast-1
 - name: GuardDuty
   alias: guardduty
+  excluded_regions:
+    - ap-northeast-3
 - name: Athena
   alias: athena
+  excluded_regions:
+    - ap-northeast-3
 - name: EFS
   alias: efs
+  excluded_regions:
+    - ap-northeast-3
 - name: Firehose
   alias: firehose
 - name: Lightsail
   alias: lightsail
   excluded_regions:
-    - eu-north-1
-    - us-west-1
-    - sa-east-1
-    - ap-east-1
     - af-south-1
+    - ap-east-1
+    - ap-northeast-3
+    - eu-north-1
     - eu-south-1
     - me-south-1
+    - sa-east-1
+    - us-west-1
 - name: WorkSpaces
   alias: workspaces
   excluded_regions:
-    - eu-north-1
+    - af-south-1
+    - ap-east-1
+    - ap-northeast-3
     - ap-south-1
+    - eu-north-1
+    - eu-south-1
     - eu-west-3
+    - me-south-1
     - us-east-2
     - us-west-1
-    - ap-east-1
-    - af-south-1
-    - eu-south-1
-    - me-south-1
 - name: SageMaker
   alias: sagemaker
+  excluded_regions:
+    - ap-northeast-3
 - name: ServiceQuotas
   alias: servicequotas
 - name: Transfer
   alias: transfer
   excluded_regions:
-    - ap-east-1
-    - af-south-1
+    - ap-northeast-3
     - eu-south-1
-    - me-south-1
 - name: DirectConnect
   alias: dc
 - name: DirectoryService
   alias: ds
+  excluded_regions:
+    - ap-northeast-3
 - name: DatabaseMigrationService
   alias: dms
 - name: XRay
   alias: xray
 - name: WAFV2
   alias: wafv2
+  excluded_regions:
+    - ap-northeast-3

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.2.36"
+  VERSION = "0.3.4"
 end

data/readme.md

@@ -54,13 +54,13 @@ To run locally, first install the gem:
 
 ```
 $ gem install aws_recon
-Fetching aws_recon-0.2.28.gem
+Fetching aws_recon-0.3.0.gem
 Fetching aws-sdk-3.0.1.gem
 Fetching parallel-1.20.1.gem
 ...
 Successfully installed aws-sdk-3.0.1
 Successfully installed parallel-1.20.1
-Successfully installed aws_recon-0.2.28
+Successfully installed aws_recon-0.3.0
 ```
 
 Or add it to your Gemfile using `bundle`:
@@ -72,7 +72,7 @@ Resolving dependencies...
 ...
 Using aws-sdk 3.0.1
 Using parallel-1.20.1
-Using aws_recon 0.2.28
+Using aws_recon 0.3.0
 ```
 
 ## Usage
@@ -225,7 +225,7 @@ Most users will want to limit collection to relevant services and regions. Runni
 ```
 $ aws_recon -h
 
-AWS Recon - AWS Inventory Collector (0.2.28)
+AWS Recon - AWS Inventory Collector (0.3.0)
 
 Usage: aws_recon [options]
     -r, --regions [REGIONS]          Regions to scan, separated by comma (default: all)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.2.36
+  version: 0.3.4
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-03 00:00:00.000000000 Z
+date: 2021-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk