aws_recon 0.4.3 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 80f767ac960548775c701684868aa2a58a2318e3c442a3c751feab370a40cee6
-  data.tar.gz: 413c1365dc007b9bc6917c7ee1ccd708305b70080d45caae662077d9859834e8
+  metadata.gz: 48ccf03d964fff678dc732fcf74d4dcd9c7c06293845bbb9a4f54e9e1ce61a24
+  data.tar.gz: 7c39747a7845fe497be052baae41af8ee45014166d97114abb797d5f6c06e5b9
 SHA512:
-  metadata.gz: '094fbf6a631b68c70eaae7982755b800a407f5efcf6a1ea3a0e64ec6221669a51ae78d2c386b61b4a36c54a90396c5312e759bb49783f28affe4034ef15709c2'
-  data.tar.gz: a40c2417c1cc26c6d4ddedfe860c7c10bec38dbd6c1a55f5d1e0da23a7fc1fef2f083778b8ae8048ff4cdd84ed5bdbf74e6beeee68e96618727561aa6603c8f5
+  metadata.gz: 3b6c26ff3b38dd58c63313b70a609e6b08fe6d16762afb9651bbc81d6cef21d7c46e8b11ad73d40caf0e6abbfd877ef5d5f2fde1536425b70a25afe82b7a4a78
+  data.tar.gz: a74af8ad1b868895d997110a4688bc88266536ad2187c235ba27a0720e3ccce0d18d6959981ab3e82e40bb738944d1402380761f9c3c65ce33cc1649bfddbc4e

data/lib/aws_recon/version.rb

@@ -1,3 +1,3 @@
 module AwsRecon
-  VERSION = "0.4.3"
+  VERSION = "0.4.4"
 end

data/utils/cloudformation/aws-recon-cfn-template.yml

@@ -0,0 +1,151 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: 'Deploys AWS Recon inventory collection resources, scheduled ECS task and corresponding IAM roles and policies.'
+Resources:
+  AWSReconVPC:
+    Type: AWS::EC2::VPC
+    Properties:
+      CidrBlock: '10.75.0.0/27'
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+  AWSReconSubnet:
+    Type: AWS::EC2::Subnet
+    Properties:
+      CidrBlock: '10.75.0.0/28'
+      VpcId: !Ref AWSReconVPC
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+    DependsOn: AWSReconVPC
+  AWSReconSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: AWS Recon collection egress
+      VpcId: !Ref AWSReconVPC
+      SecurityGroupEgress:
+        - IpProtocol: -1
+          FromPort: 0
+          ToPort: 0
+          CidrIp: 0.0.0.0/0
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+  AWSReconInternetGateway:
+    Type: AWS::EC2::InternetGateway
+    Properties:
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+  AWSReconInternetGatewayAttachment:
+    Type: AWS::EC2::VPCGatewayAttachment
+    Properties:
+      InternetGatewayId: !Ref AWSReconInternetGateway
+      VpcId: !Ref AWSReconVPC
+  AWSReconEgressRouteTable:
+    Type: AWS::EC2::RouteTable
+    Properties:
+      VpcId: !Ref AWSReconVPC
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+  AWSReconSubnetRouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Properties:
+      SubnetId: !Ref AWSReconSubnet
+      RouteTableId: !Ref AWSReconEgressRouteTable
+  AWSReconEgressRoute:
+    Type: AWS::EC2::Route
+    Properties:
+      DestinationCidrBlock: '0.0.0.0/0'
+      GatewayId: !Ref AWSReconInternetGateway
+      RouteTableId: !Ref AWSReconEgressRouteTable
+  AWSReconECSCluster:
+    Type: AWS::ECS::Cluster
+    Properties:
+      ClusterName: aws-recon-CFN
+      CapacityProviders:
+        - FARGATE
+      Tags:
+        - Key: Name
+          Value: aws-recon-CFN
+    DependsOn: AWSReconSubnet
+  AWSReconECSTask:
+    Type: AWS::ECS::TaskDefinition
+    Properties:
+      Family: aws-recon-CFN
+      RequiresCompatibilities:
+        - FARGATE
+      NetworkMode: awsvpc
+      Cpu: 1024
+      Memory: 2048
+      TaskRoleArn: !Ref AWSReconECSTaskRole
+      ExecutionRoleArn: !Ref AWSReconECSExecutionRole
+      ContainerDefinitions:
+        - Name: aws-recon-CFN
+          Image: 'darkbitio/aws_recon:latest'
+          EntryPoint:
+            - 'aws_recon'
+            - '--verbose'
+            - '--format'
+            - 'custom'
+  AWSReconECSTaskRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: aws-recon-ecs-task-role
+      ManagedPolicyArns:
+        - 'arn:aws:iam::aws:policy/ReadOnlyAccess'
+      Policies:
+        - PolicyName: AWSReconECSTaskRole
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action: 's3:PutObject'
+                Resource: 'arn:aws:s3:::CHANGEME/*'
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - ecs.amazonaws.com
+                - ecs-tasks.amazonaws.com
+            Action: 'sts:AssumeRole'
+  AWSReconECSExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: aws-recon-ecs-execution-role
+      Policies:
+        - PolicyName: AWSReconECSTaskExecutionPolicy
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action:
+                  - 'ecr:GetAuthorizationToken'
+                  - 'ecr:BatchCheckLayerAvailability'
+                  - 'ecr:GetDownloadUrlForLayer'
+                  - 'ecr:BatchGetImage'
+                  - 'logs:CreateLogStream'
+                  - 'logs:PutLogEvents'
+                Resource: '*'
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - ecs-tasks.amazonaws.com
+            Action: 'sts:AssumeRole'
+  AWSReconCloudWatchEventsRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: aws-recon-events-role
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - events.amazonaws.com
+            Action: 'sts:AssumeRole'

data/{terraform → utils/terraform}/vars.tf

@@ -41,6 +41,7 @@ variable "aws_regions" {
   ]
 }
 
+# must be one of: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365
 variable "retention_period" {
   type    = number
   default = 30

data/{terraform → utils/terraform}/vpc.tf

@@ -9,10 +9,9 @@ resource "aws_vpc" "vpc" {
 
 # Create subnet
 resource "aws_subnet" "subnet" {
-  vpc_id                  = aws_vpc.vpc.id
-  cidr_block              = local.subnet_cidr_block
-  availability_zone       = data.aws_availability_zones.available.names[0]
-  map_public_ip_on_launch = true
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = local.subnet_cidr_block
+  availability_zone = data.aws_availability_zones.available.names[0]
 
   tags = {
     Name = "${var.aws_recon_base_name}-${random_id.aws_recon.hex}-public"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws_recon
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.4.4
 platform: ruby
 authors:
 - Josh Larsen
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-02 00:00:00.000000000 Z
+date: 2021-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -244,15 +244,16 @@ files:
 - lib/aws_recon/services.yaml
 - lib/aws_recon/version.rb
 - readme.md
-- terraform/cloudwatch.tf
-- terraform/ecs.tf
-- terraform/iam.tf
-- terraform/main.tf
-- terraform/output.tf
-- terraform/readme.md
-- terraform/s3.tf
-- terraform/vars.tf
-- terraform/vpc.tf
+- utils/cloudformation/aws-recon-cfn-template.yml
+- utils/terraform/cloudwatch.tf
+- utils/terraform/ecs.tf
+- utils/terraform/iam.tf
+- utils/terraform/main.tf
+- utils/terraform/output.tf
+- utils/terraform/readme.md
+- utils/terraform/s3.tf
+- utils/terraform/vars.tf
+- utils/terraform/vpc.tf
 homepage: https://github.com/darkbitio/aws-recon
 licenses:
 - MIT