cloudsplaining 0.9.0__tar.gz → 0.9.1__tar.gz

{cloudsplaining-0.9.0 → cloudsplaining-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsplaining
-Version: 0.9.0
+Version: 0.9.1
 Summary: AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report
 Keywords: aws,iam,roles,policy,policies,privileges,security
 Author: Kinnaird McQuade
@@ -33,8 +33,6 @@ Project-URL: Red Team Report, https://opensource.salesforce.com/policy_sentry
 Project-URL: Twitter, https://twitter.com/kmcquade3
 Description-Content-Type: text/markdown
 
-## NOTE: This repo/project has been restored by Salesforce.
-
 Cloudsplaining
 --------------
 
@@ -62,13 +60,14 @@ For full documentation, please visit the [project on ReadTheDocs](https://clouds
 
 ## Overview
 
-Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report with a triage worksheet. It can scan all the policies in your AWS account or it can scan a single policy file.
+Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report. It can scan all the policies in your AWS account, across multiple AWS accounts, or it can scan a single policy file.
 
 It helps to identify IAM actions that do not leverage resource constraints. It also helps prioritize the remediation process by flagging IAM policies that present the following risks to the AWS account in question without restriction:
-* Data Exfiltration (`s3:GetObject`, `ssm:GetParameter`, `secretsmanager:GetSecretValue`)
-* Infrastructure Modification
-* Resource Exposure (the ability to modify resource-based policies)
-* Privilege Escalation (based on Rhino Security Labs research)
+* [Data Exfiltration](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/) (`s3:GetObject`, `ssm:GetParameter`, `secretsmanager:GetSecretValue`)
+* [Infrastructure Modification](https://cloudsplaining.readthedocs.io/en/latest/glossary/infrastructure-modification/)
+* [Resource Exposure](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/) (the ability to modify resource-based policies)
+* [Privilege Escalation](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/) (based on Pathfinding.cloud)
+* [Credentials Exposure](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)
 
 Cloudsplaining also identifies IAM Roles that can be assumed by AWS Compute Services (such as EC2, ECS, EKS, or Lambda), as they can present greater risk than user-defined roles - especially if the AWS Compute service is on an instance that is directly or indirectly exposed to the internet. Flagging these roles is particularly useful to penetration testers (or attackers) under certain scenarios. For example, if an attacker obtains privileges to execute [ssm:SendCommand](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) and there are privileged EC2 instances with the SSM agent installed, they can effectively have the privileges of those EC2 instances. Remote Code Execution via AWS Systems Manager Agent was already a known escalation/exploitation path, but Cloudsplaining can make the process of identifying theses cases easier. See the [sample report](https://opensource.salesforce.com/cloudsplaining/#executive-summary) for some examples.
 
@@ -115,7 +114,7 @@ Policy Sentry [makes it really easy to do this](https://github.com/salesforce/po
 
 That's why we wrote Cloudsplaining.
 
-Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report with a triage worksheet. It can scan all the policies in your AWS account or it can scan a single policy file.
+Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report. It can scan all the policies in your AWS account, across multiple AWS accounts, or it can scan a single policy file.
 
 ## Installation
 

{cloudsplaining-0.9.0 → cloudsplaining-0.9.1}/README.md

@@ -1,5 +1,3 @@
-## NOTE: This repo/project has been restored by Salesforce.
-
 Cloudsplaining
 --------------
 
@@ -27,13 +25,14 @@ For full documentation, please visit the [project on ReadTheDocs](https://clouds
 
 ## Overview
 
-Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report with a triage worksheet. It can scan all the policies in your AWS account or it can scan a single policy file.
+Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report. It can scan all the policies in your AWS account, across multiple AWS accounts, or it can scan a single policy file.
 
 It helps to identify IAM actions that do not leverage resource constraints. It also helps prioritize the remediation process by flagging IAM policies that present the following risks to the AWS account in question without restriction:
-* Data Exfiltration (`s3:GetObject`, `ssm:GetParameter`, `secretsmanager:GetSecretValue`)
-* Infrastructure Modification
-* Resource Exposure (the ability to modify resource-based policies)
-* Privilege Escalation (based on Rhino Security Labs research)
+* [Data Exfiltration](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/) (`s3:GetObject`, `ssm:GetParameter`, `secretsmanager:GetSecretValue`)
+* [Infrastructure Modification](https://cloudsplaining.readthedocs.io/en/latest/glossary/infrastructure-modification/)
+* [Resource Exposure](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/) (the ability to modify resource-based policies)
+* [Privilege Escalation](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/) (based on Pathfinding.cloud)
+* [Credentials Exposure](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)
 
 Cloudsplaining also identifies IAM Roles that can be assumed by AWS Compute Services (such as EC2, ECS, EKS, or Lambda), as they can present greater risk than user-defined roles - especially if the AWS Compute service is on an instance that is directly or indirectly exposed to the internet. Flagging these roles is particularly useful to penetration testers (or attackers) under certain scenarios. For example, if an attacker obtains privileges to execute [ssm:SendCommand](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) and there are privileged EC2 instances with the SSM agent installed, they can effectively have the privileges of those EC2 instances. Remote Code Execution via AWS Systems Manager Agent was already a known escalation/exploitation path, but Cloudsplaining can make the process of identifying theses cases easier. See the [sample report](https://opensource.salesforce.com/cloudsplaining/#executive-summary) for some examples.
 
@@ -80,7 +79,7 @@ Policy Sentry [makes it really easy to do this](https://github.com/salesforce/po
 
 That's why we wrote Cloudsplaining.
 
-Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report with a triage worksheet. It can scan all the policies in your AWS account or it can scan a single policy file.
+Cloudsplaining identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report. It can scan all the policies in your AWS account, across multiple AWS accounts, or it can scan a single policy file.
 
 ## Installation
 

{cloudsplaining-0.9.0 → cloudsplaining-0.9.1}/cloudsplaining/bin/cli.py

@@ -5,21 +5,28 @@
 # For full license text, see the LICENSE file in the repo root
 # or https://opensource.org/licenses/BSD-3-Clause
 """
-Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report with a triage worksheet.
+Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report.
 """
 
 import click
 
 from cloudsplaining import command
 from cloudsplaining.bin.version import __version__
+from cloudsplaining.shared.exclusions import set_exclusion_output
 
 
 @click.group()
 @click.version_option(version=__version__)
-def cloudsplaining() -> None:
+@click.pass_context
+def cloudsplaining(ctx: click.Context) -> None:
     """
-    Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report with a triage worksheet.
+    Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report.
     """
+    # Surface exclusion-match messages on stdout for the CLI (historical behavior), then
+    # restore the prior value when the Click context tears down so an in-process CLI run
+    # does not leak printing state into later library use.
+    previous = set_exclusion_output(True)
+    ctx.call_on_close(lambda: set_exclusion_output(previous))
 
 
 cloudsplaining.add_command(command.create_exclusions_file.create_exclusions_file)
@@ -32,7 +39,7 @@ cloudsplaining.add_command(command.download.download)
 
 
 def main() -> None:
-    """Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report with a triage worksheet."""
+    """Cloudsplaining is an AWS IAM Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report."""
     cloudsplaining()