cloudglass 0.2.0__tar.gz

cloudglass-0.2.0/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: cloudglass
+Version: 0.2.0
+Summary: See through your cloud's security posture — open-source cloud misconfiguration scanner.
+License: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: boto3>=1.34
+Requires-Dist: click>=8.1
+Requires-Dist: rich>=13.7
+Requires-Dist: PyYAML>=6.0
+
+# CloudGlass
+
+See through your cloud's security posture. An open-source CLI scanner that
+checks your AWS account for common misconfigurations — public S3 buckets,
+missing MFA, permissive security groups, unencrypted RDS, disabled CloudTrail,
+KMS rotation, and Lambda function URL exposure.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+## Usage
+
+```bash
+cloudglass scan --profile your-aws-profile --region us-east-1
+```
+
+### Common flags
+
+| Flag | Default | Description |
+|---|---|---|
+| `--profile` | (default chain) | AWS named profile |
+| `--region` | `us-east-1` | Primary region |
+| `--all-regions` | off | Scan every enabled region |
+| `--output` | `table` | `table`, `json`, or `sarif` |
+| `--fail-on` | `HIGH` | Exit 1 when severity ≥ this (`CRITICAL`/`HIGH`/`MEDIUM`/`LOW`/`NONE`) |
+| `--severity` | all | Comma-separated filter e.g. `HIGH,CRITICAL` |
+| `--service` | all | Comma-separated service filter e.g. `s3,rds` |
+| `--rule-id` | all | Specific rule IDs e.g. `CG-S3-001` |
+| `--rules-file` | none | Path to YAML custom rules file |
+| `--compliance` | off | Show CIS/SOC2/PCI-DSS tags in table output |
+
+## What it checks (v0.2)
+
+| Rule ID | Check | Severity | CIS | SOC2 | PCI-DSS |
+|---|---|---|---|---|---|
+| CG-S3-001 | S3 bucket is publicly accessible | CRITICAL | 2.1.5 | CC6.1 | 1.3 |
+| CG-S3-002 | S3 bucket missing default encryption | MEDIUM | 2.1.1 | CC6.7 | 3.4 |
+| CG-IAM-001 | IAM user has no MFA device | HIGH | 1.10 | CC6.1 | 8.3 |
+| CG-IAM-002 | Root account has no MFA | CRITICAL | 1.5 | CC6.1 | 8.3 |
+| CG-IAM-003 | Root account has active access keys | CRITICAL | 1.4 | CC6.3 | 7.1 |
+| CG-EC2-001 | Security group open to 0.0.0.0/0 or ::/0 | HIGH | 5.2 | CC6.6 | 1.2 |
+| CG-RDS-001 | RDS instance is publicly accessible | CRITICAL | 2.3.2 | CC6.1 | 1.3 |
+| CG-RDS-002 | RDS instance storage not encrypted | HIGH | 2.3.1 | CC6.7 | 3.4 |
+| CG-CT-001 | CloudTrail not enabled in region | HIGH | 3.1 | CC7.2 | 10.1 |
+| CG-CT-002 | No multi-region CloudTrail trail | MEDIUM | 3.1 | CC7.2 | — |
+| CG-KMS-001 | KMS CMK rotation disabled | MEDIUM | 3.7 | CC6.7 | 3.6 |
+| CG-LAMBDA-001 | Lambda function URL with no auth | HIGH | — | CC6.1 | 8.3 |
+
+> **Note:** Compliance tags are indicative starting points, not certified mappings.
+
+## Custom rules (YAML)
+
+Create a YAML file and pass it with `--rules-file`:
+
+```yaml
+- id: MY-S3-001
+  title: S3 bucket is not encrypted
+  severity: HIGH
+  resource_type: storage_bucket
+  conditions:
+    - field: encrypted
+      op: is_false
+  remediation: Enable SSE-KMS encryption on all buckets.
+  compliance:
+    - "CIS 2.1.1"
+```
+
+Supported `op` values: `equals`, `not_equals`, `contains`, `is_true`, `is_false`, `exists`.
+Use `field: metadata.<key>` to access nested metadata fields.
+
+## CI/CD integration
+
+```bash
+# Fail the pipeline if CRITICAL findings exist
+cloudglass scan --output json --fail-on CRITICAL | jq .
+
+# SARIF output for GitHub Code Scanning
+cloudglass scan --output sarif > results.sarif
+```
+
+## Required IAM permissions
+
+CloudGlass is **read-only**. Minimum managed policies:
+
+- `arn:aws:iam::aws:policy/SecurityAudit`
+- `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess`
+
+Never grant this tool write permissions.
+
+## Architecture
+
+```
+collectors/   → pull raw resources from AWS APIs, normalize into Resource objects
+models.py     → the shared Resource schema (provider-agnostic)
+rules/        → checks that run against normalized resources
+engine.py     → matches resources to applicable rules, produces findings
+cli.py        → entrypoint: scan, collect, run rules, print results
+```
+
+## Roadmap
+
+- [ ] Azure collector (App Registration / Reader role)
+- [ ] GCP collector (Workload Identity Federation)
+- [ ] Additional services: EKS, ECS, SNS, SQS, Secrets Manager
+
+## License
+
+MIT

cloudglass-0.2.0/README.md

@@ -0,0 +1,111 @@
+# CloudGlass
+
+See through your cloud's security posture. An open-source CLI scanner that
+checks your AWS account for common misconfigurations — public S3 buckets,
+missing MFA, permissive security groups, unencrypted RDS, disabled CloudTrail,
+KMS rotation, and Lambda function URL exposure.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+## Usage
+
+```bash
+cloudglass scan --profile your-aws-profile --region us-east-1
+```
+
+### Common flags
+
+| Flag | Default | Description |
+|---|---|---|
+| `--profile` | (default chain) | AWS named profile |
+| `--region` | `us-east-1` | Primary region |
+| `--all-regions` | off | Scan every enabled region |
+| `--output` | `table` | `table`, `json`, or `sarif` |
+| `--fail-on` | `HIGH` | Exit 1 when severity ≥ this (`CRITICAL`/`HIGH`/`MEDIUM`/`LOW`/`NONE`) |
+| `--severity` | all | Comma-separated filter e.g. `HIGH,CRITICAL` |
+| `--service` | all | Comma-separated service filter e.g. `s3,rds` |
+| `--rule-id` | all | Specific rule IDs e.g. `CG-S3-001` |
+| `--rules-file` | none | Path to YAML custom rules file |
+| `--compliance` | off | Show CIS/SOC2/PCI-DSS tags in table output |
+
+## What it checks (v0.2)
+
+| Rule ID | Check | Severity | CIS | SOC2 | PCI-DSS |
+|---|---|---|---|---|---|
+| CG-S3-001 | S3 bucket is publicly accessible | CRITICAL | 2.1.5 | CC6.1 | 1.3 |
+| CG-S3-002 | S3 bucket missing default encryption | MEDIUM | 2.1.1 | CC6.7 | 3.4 |
+| CG-IAM-001 | IAM user has no MFA device | HIGH | 1.10 | CC6.1 | 8.3 |
+| CG-IAM-002 | Root account has no MFA | CRITICAL | 1.5 | CC6.1 | 8.3 |
+| CG-IAM-003 | Root account has active access keys | CRITICAL | 1.4 | CC6.3 | 7.1 |
+| CG-EC2-001 | Security group open to 0.0.0.0/0 or ::/0 | HIGH | 5.2 | CC6.6 | 1.2 |
+| CG-RDS-001 | RDS instance is publicly accessible | CRITICAL | 2.3.2 | CC6.1 | 1.3 |
+| CG-RDS-002 | RDS instance storage not encrypted | HIGH | 2.3.1 | CC6.7 | 3.4 |
+| CG-CT-001 | CloudTrail not enabled in region | HIGH | 3.1 | CC7.2 | 10.1 |
+| CG-CT-002 | No multi-region CloudTrail trail | MEDIUM | 3.1 | CC7.2 | — |
+| CG-KMS-001 | KMS CMK rotation disabled | MEDIUM | 3.7 | CC6.7 | 3.6 |
+| CG-LAMBDA-001 | Lambda function URL with no auth | HIGH | — | CC6.1 | 8.3 |
+
+> **Note:** Compliance tags are indicative starting points, not certified mappings.
+
+## Custom rules (YAML)
+
+Create a YAML file and pass it with `--rules-file`:
+
+```yaml
+- id: MY-S3-001
+  title: S3 bucket is not encrypted
+  severity: HIGH
+  resource_type: storage_bucket
+  conditions:
+    - field: encrypted
+      op: is_false
+  remediation: Enable SSE-KMS encryption on all buckets.
+  compliance:
+    - "CIS 2.1.1"
+```
+
+Supported `op` values: `equals`, `not_equals`, `contains`, `is_true`, `is_false`, `exists`.
+Use `field: metadata.<key>` to access nested metadata fields.
+
+## CI/CD integration
+
+```bash
+# Fail the pipeline if CRITICAL findings exist
+cloudglass scan --output json --fail-on CRITICAL | jq .
+
+# SARIF output for GitHub Code Scanning
+cloudglass scan --output sarif > results.sarif
+```
+
+## Required IAM permissions
+
+CloudGlass is **read-only**. Minimum managed policies:
+
+- `arn:aws:iam::aws:policy/SecurityAudit`
+- `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess`
+
+Never grant this tool write permissions.
+
+## Architecture
+
+```
+collectors/   → pull raw resources from AWS APIs, normalize into Resource objects
+models.py     → the shared Resource schema (provider-agnostic)
+rules/        → checks that run against normalized resources
+engine.py     → matches resources to applicable rules, produces findings
+cli.py        → entrypoint: scan, collect, run rules, print results
+```
+
+## Roadmap
+
+- [ ] Azure collector (App Registration / Reader role)
+- [ ] GCP collector (Workload Identity Federation)
+- [ ] Additional services: EKS, ECS, SNS, SQS, Secrets Manager
+
+## License
+
+MIT

cloudglass-0.2.0/cloudglass/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

cloudglass-0.2.0/cloudglass/cli.py

@@ -0,0 +1,358 @@
+"""CloudGlass CLI — entrypoint for the cloud security scanner."""
+from __future__ import annotations
+
+import json
+import sys
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from pathlib import Path
+from typing import Optional
+
+import boto3
+import click
+from botocore.config import Config
+from botocore.exceptions import ClientError, NoCredentialsError
+from rich.columns import Columns
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from .collectors.cloudtrail import collect_cloudtrail
+from .collectors.ec2 import collect_security_groups
+from .collectors.iam import collect_iam_users, collect_root_account
+from .collectors.kms import collect_kms_keys
+from .collectors.lambda_ import collect_lambda_functions
+from .collectors.rds import collect_rds_instances
+from .collectors.s3 import collect_s3_buckets
+from .engine import Finding, load_yaml_rules, run_rules
+from .models import Resource
+from .rules.aws_rules import RULES
+
+console = Console(stderr=False)
+
+SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+SEVERITY_COLOR = {
+    "CRITICAL": "bold red",
+    "HIGH": "red",
+    "MEDIUM": "yellow",
+    "LOW": "cyan",
+}
+FAIL_ON_CHOICES = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "NONE"]
+
+BANNER = r"""
+  ██████╗██╗      ██████╗ ██╗   ██╗██████╗  ██████╗ ██╗      █████╗ ███████╗███████╗
+ ██╔════╝██║     ██╔═══██╗██║   ██║██╔══██╗██╔════╝ ██║     ██╔══██╗██╔════╝██╔════╝
+ ██║     ██║     ██║   ██║██║   ██║██║  ██║██║  ███╗██║     ███████║███████╗███████╗
+ ██║     ██║     ██║   ██║██║   ██║██║  ██║██║   ██║██║     ██╔══██║╚════██║╚════██║
+ ╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝╚██████╔╝███████╗██║  ██║███████║███████║
+  ╚═════╝╚══════╝ ╚═════╝  ╚═════╝ ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚══════╝╚══════╝"""
+
+
+def _boto_config() -> Config:
+    """Return a botocore Config with adaptive retries for throttle resilience."""
+    return Config(
+        retries={"mode": "adaptive", "max_attempts": 6},
+        connect_timeout=10,
+        read_timeout=30,
+    )
+
+
+def _print_banner() -> None:
+    """Print the CloudGlass ASCII banner with author credit."""
+    banner_text = Text(BANNER, style="bold cyan")
+    credit = Text("by shubham.cybersky", style="dim white")
+    console.print(banner_text)
+    # Right-align credit to match banner width (~88 chars)
+    console.print(credit, justify="right")
+    console.print()
+
+
+def _get_all_regions(session: boto3.Session) -> list[str]:
+    """Return all enabled AWS regions."""
+    ec2 = session.client("ec2", region_name="us-east-1", config=_boto_config())
+    try:
+        resp = ec2.describe_regions(Filters=[{"Name": "opt-in-status", "Values": ["opt-in-not-required", "opted-in"]}])
+        return [r["RegionName"] for r in resp["Regions"]]
+    except ClientError:
+        return ["us-east-1"]
+
+
+def _collect_all(
+    session: boto3.Session,
+    regions: list[str],
+) -> list[Resource]:
+    """
+    Concurrently collect resources from all collectors across all regions.
+    Global services (S3, IAM) are collected once; regional services are collected per-region.
+    """
+    resources: list[Resource] = []
+    futures = []
+
+    with ThreadPoolExecutor(max_workers=min(32, len(regions) * 4 + 2)) as pool:
+        # Global (region-independent)
+        futures.append(pool.submit(collect_s3_buckets, session))
+        futures.append(pool.submit(collect_iam_users, session))
+        futures.append(pool.submit(collect_root_account, session))
+
+        # Regional
+        for region in regions:
+            futures.append(pool.submit(collect_security_groups, session, region))
+            futures.append(pool.submit(collect_rds_instances, session, region))
+            futures.append(pool.submit(collect_cloudtrail, session, region))
+            futures.append(pool.submit(collect_kms_keys, session, region))
+            futures.append(pool.submit(collect_lambda_functions, session, region))
+
+        for future in as_completed(futures):
+            try:
+                result = future.result()
+                resources.extend(result)
+            except Exception as exc:
+                console.print(f"[red]Collector error: {exc}[/red]", stderr=True)
+
+    return resources
+
+
+def _build_table(findings: list[Finding], show_compliance: bool) -> Table:
+    """Build a Rich table of findings."""
+    table = Table(
+        title=f"CloudGlass Findings ({len(findings)})",
+        show_lines=False,
+        highlight=True,
+    )
+    table.add_column("Severity", no_wrap=True)
+    table.add_column("Rule", no_wrap=True)
+    table.add_column("Title")
+    table.add_column("Resource")
+    table.add_column("Region", no_wrap=True)
+    if show_compliance:
+        table.add_column("Compliance*")
+    table.add_column("Remediation")
+
+    for f in findings:
+        color = SEVERITY_COLOR.get(f.severity, "white")
+        row = [
+            f"[{color}]{f.severity}[/{color}]",
+            f.rule_id,
+            f.title,
+            f.resource_name,
+            f.region or "global",
+        ]
+        if show_compliance:
+            row.append(", ".join(f.compliance) if f.compliance else "")
+        row.append(f.remediation)
+        table.add_row(*row)
+    return table
+
+
+def _print_scorecard(findings: list[Finding]) -> None:
+    """Print a per-severity summary scorecard."""
+    counts = {sev: 0 for sev in SEVERITY_ORDER}
+    for f in findings:
+        if f.severity in counts:
+            counts[f.severity] += 1
+
+    cells = []
+    for sev in SEVERITY_ORDER:
+        color = SEVERITY_COLOR[sev]
+        count = counts[sev]
+        cells.append(Panel(f"[{color}][bold]{count}[/bold][/{color}]", title=f"[{color}]{sev}[/{color}]", width=16))
+    console.print()
+    console.print(Columns(cells))
+    console.print("  [dim]* Compliance tags are indicative starting points, not certified mappings.[/dim]\n")
+
+
+def _findings_to_json(findings: list[Finding]) -> str:
+    """Serialize findings to JSON."""
+    return json.dumps(
+        [
+            {
+                "rule_id": f.rule_id,
+                "title": f.title,
+                "severity": f.severity,
+                "resource_id": f.resource_id,
+                "resource_name": f.resource_name,
+                "region": f.region,
+                "remediation": f.remediation,
+                "compliance": f.compliance,
+            }
+            for f in findings
+        ],
+        indent=2,
+    )
+
+
+def _findings_to_sarif(findings: list[Finding]) -> str:
+    """Serialize findings to SARIF 2.1.0 format."""
+    rules = {}
+    for f in findings:
+        if f.rule_id not in rules:
+            rules[f.rule_id] = {
+                "id": f.rule_id,
+                "name": f.title,
+                "shortDescription": {"text": f.title},
+                "help": {"text": f.remediation},
+                "properties": {"tags": f.compliance},
+            }
+
+    severity_map = {"CRITICAL": "error", "HIGH": "error", "MEDIUM": "warning", "LOW": "note"}
+
+    results = [
+        {
+            "ruleId": f.rule_id,
+            "level": severity_map.get(f.severity, "warning"),
+            "message": {"text": f"{f.title} — {f.resource_name} ({f.region or 'global'})"},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": f"aws://{f.resource_id}"},
+                    }
+                }
+            ],
+        }
+        for f in findings
+    ]
+
+    sarif = {
+        "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "CloudGlass",
+                        "version": "0.2.0",
+                        "rules": list(rules.values()),
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return json.dumps(sarif, indent=2)
+
+
+def _exit_code(findings: list[Finding], fail_on: str) -> int:
+    """Compute exit code: 1 if any finding meets or exceeds the fail_on threshold, else 0."""
+    if fail_on == "NONE":
+        return 0
+    threshold_index = SEVERITY_ORDER.index(fail_on)
+    for f in findings:
+        try:
+            if SEVERITY_ORDER.index(f.severity) <= threshold_index:
+                return 1
+        except ValueError:
+            pass
+    return 0
+
+
+@click.group(epilog="""
+Examples:
+  # Scan default region using default credentials
+  cloudglass scan
+
+  # Scan a specific profile and region
+  cloudglass scan --profile prod --region us-west-2
+
+  # Scan all regions and output to JSON
+  cloudglass scan --all-regions --output json
+
+  # Fail pipeline on CRITICAL findings only
+  cloudglass scan --fail-on CRITICAL
+""")
+@click.version_option(version="0.2.0", message="%(prog)s %(version)s")
+def main():
+    """CloudGlass — see through your cloud's security posture."""
+
+
+@main.command()
+@click.option("--profile", default=None, help="AWS named profile to use.")
+@click.option("--region", default="us-east-1", show_default=True, help="Primary AWS region for regional services.")
+@click.option("--all-regions", is_flag=True, default=False, help="Scan all enabled AWS regions.")
+@click.option("--output", "output_fmt", default="table", show_default=True, type=click.Choice(["table", "json", "sarif"], case_sensitive=False), help="Output format.")
+@click.option("--fail-on", default="HIGH", show_default=True, type=click.Choice(FAIL_ON_CHOICES, case_sensitive=False), help="Exit 1 if any finding at this severity or above.")
+@click.option("--severity", default=None, help="Comma-separated severity filter, e.g. HIGH,CRITICAL.")
+@click.option("--service", default=None, help="Comma-separated service filter, e.g. s3,iam,rds.")
+@click.option("--rule-id", default=None, help="Comma-separated rule ID filter, e.g. CG-S3-001.")
+@click.option("--rules-file", default=None, type=click.Path(exists=True, path_type=Path), help="Path to a YAML file with custom rules.")
+@click.option("--compliance", is_flag=True, default=False, help="Show compliance framework tags in table output.")
+def scan(
+    profile: Optional[str],
+    region: str,
+    all_regions: bool,
+    output_fmt: str,
+    fail_on: str,
+    severity: Optional[str],
+    service: Optional[str],
+    rule_id: Optional[str],
+    rules_file: Optional[Path],
+    compliance: bool,
+) -> None:
+    """Scan an AWS account for security misconfigurations."""
+    _print_banner()
+
+    try:
+        session = boto3.Session(profile_name=profile, region_name=region)
+    except Exception as e:
+        console.print(f"[bold red]Failed to create AWS session:[/bold red] {e}")
+        sys.exit(2)
+
+    # Build rule list (built-ins + optional custom YAML rules)
+    rules = list(RULES)
+    if rules_file:
+        try:
+            custom = load_yaml_rules(rules_file)
+            rules.extend(custom)
+            console.print(f"Loaded [bold]{len(custom)}[/bold] custom rule(s) from [cyan]{rules_file}[/cyan].\n")
+        except Exception as e:
+            console.print(f"[bold red]Failed to load rules file:[/bold red] {e}")
+            sys.exit(2)
+
+    # Determine regions to scan
+    regions = _get_all_regions(session) if all_regions else [region]
+    region_label = "all regions" if all_regions else region
+    console.print(f"[bold]CloudGlass[/bold] — scanning AWS account across [cyan]{region_label}[/cyan]...\n")
+
+    # Parse filters
+    severity_filter = [s.strip().upper() for s in severity.split(",")] if severity else None
+    service_filter = [s.strip().lower() for s in service.split(",")] if service else None
+    rule_id_filter = [r.strip().upper() for r in rule_id.split(",")] if rule_id else None
+
+    # Collect (concurrent)
+    with console.status("Collecting resources (parallel)..."):
+        resources = _collect_all(session, regions)
+
+    console.print(f"Collected [bold]{len(resources)}[/bold] resources across [bold]{len(regions)}[/bold] region(s).\n")
+
+    # Run rules
+    findings = run_rules(
+        resources,
+        rules=rules,
+        severity_filter=severity_filter,
+        service_filter=service_filter,
+        rule_id_filter=rule_id_filter,
+    )
+
+    # Output
+    if output_fmt == "json":
+        print(_findings_to_json(findings))
+    elif output_fmt == "sarif":
+        print(_findings_to_sarif(findings))
+    else:
+        # Table
+        if not findings:
+            console.print("[bold green]✓ No findings. Nice.[/bold green]")
+            _print_scorecard(findings)
+            sys.exit(0)
+
+        findings_sorted = sorted(findings, key=lambda f: SEVERITY_ORDER.index(f.severity))
+        console.print(_build_table(findings_sorted, show_compliance=compliance))
+        _print_scorecard(findings_sorted)
+        if compliance:
+            console.print("  [dim italic]* Compliance tags are indicative starting points, not certified mappings.[/dim italic]\n")
+
+    code = _exit_code(findings, fail_on.upper())
+    sys.exit(code)
+
+
+if __name__ == "__main__":
+    main()

cloudglass-0.2.0/cloudglass/collectors/cloudtrail.py

@@ -0,0 +1,47 @@
+"""CloudTrail collector — checks trail status per region."""
+import boto3
+from botocore.exceptions import ClientError
+
+from ..models import Resource
+
+
+def collect_cloudtrail(session: boto3.Session, region: str) -> list[Resource]:
+    """
+    Returns a single synthetic 'cloudtrail_account' resource per region
+    capturing whether a trail is enabled and whether a multi-region trail exists.
+    """
+    client = session.client("cloudtrail", region_name=region)
+
+    trail_enabled = False
+    multi_region = False
+
+    try:
+        trails = client.describe_trails(includeShadowTrails=True).get("trailList", [])
+        for trail in trails:
+            status_resp = client.get_trail_status(Name=trail["TrailARN"])
+            if status_resp.get("IsLogging"):
+                trail_enabled = True
+                if trail.get("IsMultiRegionTrail"):
+                    multi_region = True
+    except ClientError as e:
+        code = e.response["Error"]["Code"]
+        if code in ("AccessDenied", "AccessDeniedException"):
+            print(f"[cloudglass] AccessDenied: cannot describe CloudTrail trails in {region}")
+            return []
+        else:
+            print(f"[cloudglass] Failed to describe CloudTrail in {region}: {e}")
+            return []
+
+    return [
+        Resource(
+            id=f"cloudtrail-{region}",
+            type="cloudtrail_account",
+            provider="aws",
+            name=f"cloudtrail-{region}",
+            region=region,
+            metadata={
+                "trail_enabled": trail_enabled,
+                "multi_region": multi_region,
+            },
+        )
+    ]