lambda-security-scanner 1.0.0__py3-none-any.whl

lambda_security_scanner/checks/network_security.py

@@ -0,0 +1,207 @@
+"""Network security checks for Lambda functions (C.1-C.3)."""
+
+import logging
+from typing import Dict, List
+
+from botocore.exceptions import ClientError
+
+from .base import BaseChecker
+
+logger = logging.getLogger("lambda_security_scanner")
+
+
+class NetworkSecurityChecker(BaseChecker):
+    """Check network security configuration for Lambda functions.
+
+    Implements checks C.1 (VPC config), C.2 (multi-AZ),
+    and C.3 (security group egress).
+    """
+
+    def check_vpc_config(
+        self, function_config: Dict
+    ) -> Dict:
+        """C.1 - Check if function has VPC configuration.
+
+        Extracts VPC configuration from the function config dict.
+        No API call required.
+
+        Args:
+            function_config: Lambda function configuration dict.
+
+        Returns:
+            Dict with in_vpc, vpc_id, subnet_count,
+            subnet_ids, security_group_count,
+            security_group_ids.
+        """
+        vpc_config = function_config.get("VpcConfig", {})
+        subnet_ids = vpc_config.get("SubnetIds", [])
+        security_group_ids = vpc_config.get(
+            "SecurityGroupIds", []
+        )
+        vpc_id = vpc_config.get("VpcId")
+
+        in_vpc = bool(subnet_ids and security_group_ids)
+
+        return {
+            "in_vpc": in_vpc,
+            "vpc_id": vpc_id if in_vpc else None,
+            "subnet_count": len(subnet_ids),
+            "subnet_ids": subnet_ids,
+            "security_group_count": len(security_group_ids),
+            "security_group_ids": security_group_ids,
+        }
+
+    def check_multi_az(
+        self, vpc_result: Dict, region: str
+    ) -> Dict:
+        """C.2 - Check if VPC Lambda uses multiple AZs.
+
+        Only applicable if the function is in a VPC.
+
+        Args:
+            vpc_result: Result from check_vpc_config.
+            region: AWS region name.
+
+        Returns:
+            Dict with applicable, is_multi_az, az_count,
+            availability_zones.
+        """
+        if not vpc_result.get("in_vpc"):
+            return {
+                "applicable": False,
+                "is_multi_az": False,
+                "az_count": 0,
+                "availability_zones": [],
+            }
+
+        subnet_ids = vpc_result.get("subnet_ids", [])
+        if not subnet_ids:
+            return {
+                "applicable": True,
+                "is_multi_az": False,
+                "az_count": 0,
+                "availability_zones": [],
+            }
+
+        try:
+            ec2 = self.get_client("ec2", region)
+            response = ec2.describe_subnets(
+                SubnetIds=subnet_ids
+            )
+            azs = list(
+                {
+                    s["AvailabilityZone"]
+                    for s in response.get("Subnets", [])
+                }
+            )
+            return {
+                "applicable": True,
+                "is_multi_az": len(azs) > 1,
+                "az_count": len(azs),
+                "availability_zones": sorted(azs),
+            }
+        except ClientError as e:
+            return self.handle_client_error(
+                e,
+                {
+                    "applicable": True,
+                    "is_multi_az": False,
+                    "az_count": 0,
+                    "availability_zones": [],
+                },
+            )
+
+    def check_security_groups(
+        self, vpc_result: Dict, region: str
+    ) -> Dict:
+        """C.3 - Check for unrestricted security group egress.
+
+        Only applicable if the function is in a VPC.
+        Flags rules with IpProtocol="-1" and
+        CidrIp="0.0.0.0/0" or CidrIpv6="::/0".
+
+        Args:
+            vpc_result: Result from check_vpc_config.
+            region: AWS region name.
+
+        Returns:
+            Dict with applicable, unrestricted_egress,
+            security_groups.
+        """
+        if not vpc_result.get("in_vpc"):
+            return {
+                "applicable": False,
+                "unrestricted_egress": False,
+                "security_groups": [],
+            }
+
+        sg_ids = vpc_result.get("security_group_ids", [])
+        if not sg_ids:
+            return {
+                "applicable": True,
+                "unrestricted_egress": False,
+                "security_groups": [],
+            }
+
+        try:
+            ec2 = self.get_client("ec2", region)
+            response = ec2.describe_security_groups(
+                GroupIds=sg_ids
+            )
+        except ClientError as e:
+            return self.handle_client_error(
+                e,
+                {
+                    "applicable": True,
+                    "unrestricted_egress": False,
+                    "security_groups": [],
+                },
+            )
+
+        security_groups = []
+        unrestricted_egress = False
+
+        for sg in response.get("SecurityGroups", []):
+            sg_info = {
+                "group_id": sg.get("GroupId"),
+                "group_name": sg.get("GroupName"),
+                "unrestricted_egress_rules": [],
+            }
+
+            for rule in sg.get("IpPermissionsEgress", []):
+                if rule.get("IpProtocol") != "-1":
+                    continue
+
+                for ip_range in rule.get(
+                    "IpRanges", []
+                ):
+                    if (
+                        ip_range.get("CidrIp")
+                        == "0.0.0.0/0"
+                    ):
+                        sg_info[
+                            "unrestricted_egress_rules"
+                        ].append(rule)
+                        unrestricted_egress = True
+                        break
+
+                for ip_range in rule.get(
+                    "Ipv6Ranges", []
+                ):
+                    if (
+                        ip_range.get("CidrIpv6")
+                        == "::/0"
+                    ):
+                        sg_info[
+                            "unrestricted_egress_rules"
+                        ].append(rule)
+                        unrestricted_egress = True
+                        break
+
+            security_groups.append(sg_info)
+
+        return {
+            "applicable": True,
+            "unrestricted_egress": unrestricted_egress,
+            "security_groups": security_groups,
+        }

lambda_security_scanner/cli.py

@@ -0,0 +1,394 @@
+#!/usr/bin/env python3
+"""Command-line interface for Lambda Security Scanner."""
+
+import logging
+import sys
+import traceback
+
+import click
+from rich.console import Console
+
+from .scanner import LambdaSecurityScanner
+from . import __version__
+
+console = Console()
+
+BANNER = """[bold red]╔══════════════════════════════════════════════════════════╗
+║           Lambda Security Scanner                        ║
+║      Comprehensive Lambda Security Auditing              ║
+╚══════════════════════════════════════════════════════════╝[/bold red]"""
+
+
+def print_banner():
+    console.print(BANNER)
+    console.print(
+        f"[dim]  Version {__version__} | "
+        "https://github.com/TocConsulting/"
+        "lambda-security-scanner[/dim]\n"
+    )
+
+
+# Shared options decorators (same pattern as EC2)
+def shared_aws_options(f):
+    f = click.option(
+        "-r",
+        "--region",
+        default=None,
+        help=(
+            "AWS region "
+            "(default: AWS_DEFAULT_REGION or us-east-1)"
+        ),
+    )(f)
+    f = click.option(
+        "-p",
+        "--profile",
+        default=None,
+        help="AWS profile name",
+    )(f)
+    return f
+
+
+def shared_output_options(f):
+    f = click.option(
+        "-o",
+        "--output-dir",
+        default="./output",
+        help="Directory for output files (default: ./output)",
+    )(f)
+    f = click.option(
+        "-f",
+        "--output-format",
+        type=click.Choice(
+            ["json", "csv", "html", "all"],
+            case_sensitive=False,
+        ),
+        default="all",
+        help="Report format (default: all)",
+    )(f)
+    return f
+
+
+def shared_performance_options(f):
+    f = click.option(
+        "-w",
+        "--max-workers",
+        default=5,
+        type=int,
+        help="Worker threads (default: 5)",
+    )(f)
+    f = click.option(
+        "-q",
+        "--quiet",
+        is_flag=True,
+        help="Suppress console output except errors",
+    )(f)
+    f = click.option(
+        "-d",
+        "--debug",
+        is_flag=True,
+        help="Enable debug logging",
+    )(f)
+    return f
+
+
+def shared_options(f):
+    f = shared_aws_options(f)
+    f = shared_output_options(f)
+    f = shared_performance_options(f)
+    return f
+
+
+class CustomGroup(click.Group):
+    def format_help(self, ctx, formatter):
+        print_banner()
+        super().format_help(ctx, formatter)
+
+
+@click.group(
+    cls=CustomGroup,
+    context_settings=dict(
+        help_option_names=["-h", "--help"]
+    ),
+)
+@click.version_option(
+    version=__version__,
+    prog_name="Lambda Security Scanner",
+)
+def cli():
+    """
+    Comprehensive AWS Lambda security scanner for
+    vulnerability detection and multi-framework compliance
+    auditing.
+
+    \b
+    FRAMEWORKS
+    ═══════════════════════════════════════════════════════
+      AWS-FSBP, CIS, PCI DSS v4.0.1, HIPAA, SOC 2,
+      ISO 27001:2022, ISO 27017, ISO 27018, GDPR,
+      NIST 800-53
+
+    \b
+    QUICK START
+    ═══════════════════════════════════════════════════════
+      Scan all functions:
+        lambda-security-scanner security
+      Use AWS profile:
+        lambda-security-scanner security -p prod
+      Specific region:
+        lambda-security-scanner security -r eu-west-1
+      Specific functions:
+        lambda-security-scanner security -n my-func
+
+    \b
+    MORE INFO
+    ═══════════════════════════════════════════════════════
+      Run COMMAND --help for detailed options
+      Docs: https://github.com/TocConsulting/
+            lambda-security-scanner
+    """
+    pass
+
+
+@cli.command()
+@click.option(
+    "--function-name",
+    "-n",
+    multiple=True,
+    help="Specific function name(s) to scan",
+)
+@click.option(
+    "--exclude-function",
+    multiple=True,
+    help="Function name(s) to exclude from scanning",
+)
+@click.option(
+    "--compliance-only",
+    is_flag=True,
+    help="Generate compliance report only",
+)
+@shared_options
+def security(
+    function_name,
+    exclude_function,
+    compliance_only,
+    region,
+    profile,
+    output_dir,
+    output_format,
+    max_workers,
+    quiet,
+    debug,
+):
+    """
+    Scan Lambda functions for security vulnerabilities
+    and compliance issues.
+
+    \b
+    Runs 19 security checks across 5 categories and
+    evaluates compliance against 10 frameworks with
+    81 controls.
+
+    \b
+    EXAMPLES:
+      lambda-security-scanner security
+      lambda-security-scanner security -p prod -r us-west-2
+      lambda-security-scanner security -n my-func -n other
+      lambda-security-scanner security --compliance-only
+      lambda-security-scanner security -f html -o ./reports
+    """
+    import os as _os
+    if region is None:
+        region = _os.environ.get(
+            "AWS_DEFAULT_REGION", "us-east-1"
+        )
+
+    if debug:
+        logging.getLogger().setLevel(logging.DEBUG)
+        logging.getLogger(
+            "lambda_security_scanner"
+        ).setLevel(logging.DEBUG)
+    elif quiet:
+        logging.getLogger().setLevel(logging.ERROR)
+
+    if not quiet:
+        print_banner()
+        console.print(
+            "[bold cyan]Starting Lambda security "
+            "analysis...[/bold cyan]\n"
+        )
+
+    try:
+        scanner = LambdaSecurityScanner(
+            region=region,
+            profile=profile,
+            output_dir=output_dir,
+            max_workers=max_workers,
+            quiet=quiet,
+        )
+
+        # Get functions
+        all_functions = scanner.get_all_functions()
+
+        # Apply name filter
+        if function_name:
+            all_functions = [
+                f
+                for f in all_functions
+                if f["FunctionName"] in function_name
+            ]
+            if not all_functions:
+                console.print(
+                    "[red]None of the specified "
+                    "functions were found[/red]"
+                )
+                sys.exit(1)
+
+        # Apply exclusions
+        if exclude_function:
+            original = len(all_functions)
+            all_functions = [
+                f
+                for f in all_functions
+                if f["FunctionName"]
+                not in exclude_function
+            ]
+            excluded = original - len(all_functions)
+            if not quiet and excluded > 0:
+                console.print(
+                    f"[yellow]Excluded {excluded} "
+                    f"function(s)[/yellow]"
+                )
+
+        if not all_functions:
+            console.print(
+                "[red]No functions found to scan[/red]"
+            )
+            sys.exit(1)
+
+        if not quiet:
+            console.print(
+                f"[green]Scanning {len(all_functions)} "
+                f"function(s)...[/green]\n"
+            )
+
+        results = scanner.scan_all_functions(all_functions)
+
+        if not results:
+            console.print(
+                "[red]No results generated[/red]"
+            )
+            sys.exit(1)
+
+        report_files = scanner.generate_reports(
+            results, output_format
+        )
+
+        if not quiet:
+            scanner.print_summary(results)
+
+            console.print(
+                "\n[bold green]Reports "
+                "Generated:[/bold green]"
+            )
+            for report_type, file_path in (
+                report_files.items()
+            ):
+                console.print(
+                    f"  {report_type.upper()}: "
+                    f"{file_path}"
+                )
+
+            if compliance_only:
+                _print_compliance_detail(results)
+
+        console.print(
+            "\n[bold green]Security scan completed "
+            "successfully![/bold green]"
+        )
+        console.print(
+            f"[dim]Reports saved to: {output_dir}[/dim]"
+        )
+
+    except KeyboardInterrupt:
+        console.print(
+            "\n[yellow]Scan interrupted by user[/yellow]"
+        )
+        sys.exit(130)
+    except Exception as e:
+        console.print(f"\n[red]Error: {str(e)}[/red]")
+        if debug:
+            console.print(
+                f"[red]{traceback.format_exc()}[/red]"
+            )
+        sys.exit(1)
+
+
+def _print_compliance_detail(results):
+    from rich.table import Table
+
+    frameworks = [
+        "AWS-FSBP",
+        "CIS",
+        "PCI-DSS-v4.0.1",
+        "HIPAA",
+        "SOC2",
+        "ISO27001",
+        "ISO27017",
+        "ISO27018",
+        "GDPR",
+        "NIST-800-53",
+    ]
+    valid = [
+        r
+        for r in results
+        if not r.get("scan_error", False)
+    ]
+    for fw in frameworks:
+        all_failed = {}
+        for r in valid:
+            fw_status = r.get(
+                "compliance_status", {}
+            ).get(fw, {})
+            for ctrl in fw_status.get("failed", []):
+                ctrl_id = ctrl["control_id"]
+                if ctrl_id not in all_failed:
+                    all_failed[ctrl_id] = {
+                        "description": ctrl[
+                            "description"
+                        ],
+                        "severity": ctrl.get(
+                            "severity", "MEDIUM"
+                        ),
+                        "functions": [],
+                    }
+                all_failed[ctrl_id]["functions"].append(
+                    r.get("function_name", "")
+                )
+        if all_failed:
+            table = Table(
+                title=f"{fw} - Failed Controls"
+            )
+            table.add_column(
+                "Control", style="cyan", width=20
+            )
+            table.add_column("Description", width=40)
+            table.add_column("Severity", width=10)
+            table.add_column(
+                "Affected", justify="right", width=10
+            )
+            for ctrl_id, info in sorted(
+                all_failed.items()
+            ):
+                table.add_row(
+                    ctrl_id,
+                    info["description"],
+                    info["severity"],
+                    str(len(info["functions"])),
+                )
+            console.print(table)
+
+
+main = cli
+
+if __name__ == "__main__":
+    cli()