Information
-
ARN: {{value_or_none CertificateArn}}
+
ARN: {{value_or_none arn}}
Domain Name: {{value_or_none DomainName}}
Subject: {{value_or_none Subject}}
diff --git a/ScoutSuite/output/data/html/partials/aws/services.cloudtrail.regions.id.trails.html b/ScoutSuite/output/data/html/partials/aws/services.cloudtrail.regions.id.trails.html
index f01e5c340..6869b3520 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.cloudtrail.regions.id.trails.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.cloudtrail.regions.id.trails.html
@@ -7,6 +7,7 @@
{{name}}
Information
+ - ARN: {{arn}}
- Region: {{region}}
{{#if scout_link}}
multi-region trail
diff --git a/ScoutSuite/output/data/html/partials/aws/services.config.regions.id.recorders.html b/ScoutSuite/output/data/html/partials/aws/services.config.regions.id.recorders.html
index 6173551b3..37beb8cc6 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.config.regions.id.recorders.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.config.regions.id.recorders.html
@@ -8,7 +8,7 @@
Information
- Enabled: {{enabled}}
- Region: {{region}}
- - Role arn: {{role_ARN}}
+ - Role ARN: {{role_ARN}}
- Last Status: {{last_status}}
- Last Start Time: {{last_start_time}}
- Last Status Change Time: {{last_status_change_time}}
diff --git a/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.snapshots.html b/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.snapshots.html
index 3f9f5f9d6..eb5244ad4 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.snapshots.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.snapshots.html
@@ -1,21 +1,22 @@
-
+
+
@@ -23,3 +24,12 @@ Information
Handlebars.registerPartial("services.ec2.regions.id.snapshots", $("#services\\.ec2\\.regions\\.id\\.snapshots\\.partial").html());
+
+
+
+
+
diff --git a/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.vpcs.id.instances.html
index b5ef8561c..e02ee2857 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.vpcs.id.instances.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.ec2.regions.id.vpcs.id.instances.html
@@ -9,6 +9,7 @@ Information
- ARN: {{arn}}
- ID: {{id}}
- Region: {{region}}
+ - Availability Zone: {{availability_zone}}
- VPC: {{getValueAt 'services.ec2.regions' region 'vpcs' vpc 'name'}} ({{vpc}})
- Reservation ID: {{reservation_id}}
- IAM role: {{value_or_none iam_role}}
diff --git a/ScoutSuite/output/data/html/partials/aws/services.iam.credential_reports.html b/ScoutSuite/output/data/html/partials/aws/services.iam.credential_reports.html
index 270d5e72a..00e9b9968 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.iam.credential_reports.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.iam.credential_reports.html
@@ -10,15 +10,15 @@ Credentials Report
Last Used Date: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'last_used')}}
Password Enabled: {{getValueAt 'services' 'iam' 'credential_reports' @key 'password_enabled'}}
Password Last Used: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'password_last_used')}}
- Password Last Changed: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'password_last_changed')}}
+ Password Last Changed: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'password_last_changed')}}
MFA Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'mfa_active'}}
Hardware MFA Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'mfa_active_hardware'}}
Access Key 1 Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_1_active'}}
- Access Key 1 Last Used: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_1_last_used_date')}}
- Access Key 1 Last Rotated: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_1_last_rotated')}}
+ Access Key 1 Last Used: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_1_last_used_date')}}
+ Access Key 1 Last Rotated: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_1_last_rotated')}}
Access Key 2 Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_2_active'}}
- Access Key 2 Last Used: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_2_last_used_date')}}
- Access Key 2 Last Rotated: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_2_last_rotated')}}
+ Access Key 2 Last Used: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_2_last_used_date')}}
+ Access Key 2 Last Rotated: {{ format_date (getValueAt 'services' 'iam' 'credential_reports' @key 'access_key_2_last_rotated')}}
Signing Cert 1 Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'cert_1_active'}}
Signing Cert 2 Active: {{getValueAt 'services' 'iam' 'credential_reports' @key 'cert_2_active'}}
diff --git a/ScoutSuite/output/data/html/partials/aws/services.iam.groups.html b/ScoutSuite/output/data/html/partials/aws/services.iam.groups.html
index 33cffce72..d8acb6fae 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.iam.groups.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.iam.groups.html
@@ -6,7 +6,8 @@
{{name}}
Information
-
Creation date: {{CreateDate}}
+
Arn: {{value_or_none arn}}
+
Creation date: {{CreateDate}}
Members
diff --git a/ScoutSuite/output/data/html/partials/aws/services.iam.users.html b/ScoutSuite/output/data/html/partials/aws/services.iam.users.html
index 5a4ccffd9..61aaf04b4 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.iam.users.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.iam.users.html
@@ -6,6 +6,7 @@ {{name}}
Information
+
Arn: {{value_or_none arn}}
Creation date: {{format_date CreateDate}}
diff --git a/ScoutSuite/output/data/html/partials/aws/services.rds.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/partials/aws/services.rds.regions.id.vpcs.id.instances.html
index 2ec695bfd..95f56a5e8 100755
--- a/ScoutSuite/output/data/html/partials/aws/services.rds.regions.id.vpcs.id.instances.html
+++ b/ScoutSuite/output/data/html/partials/aws/services.rds.regions.id.vpcs.id.instances.html
@@ -20,7 +20,6 @@
Information
Enhanced Monitoring:
{{convert_bool_to_enabled EnhancedMonitoringResourceArn}}
-
Encrypted Storage: {{convert_bool_to_enabled StorageEncrypted}}
CA Certificate: {{CACertificateIdentifier}}
diff --git a/ScoutSuite/providers/aws/facade/ec2.py b/ScoutSuite/providers/aws/facade/ec2.py
index a5a78fb90..d50fb9835 100755
--- a/ScoutSuite/providers/aws/facade/ec2.py
+++ b/ScoutSuite/providers/aws/facade/ec2.py
@@ -34,17 +34,21 @@ async def get_instance_user_data(self, region: str, instance_id: str):
else:
try:
return await self._decode_user_data(user_data_response['UserData']['Value'])
- except base64.binascii.Error as e:
- return await self._decode_user_data(base64.b64decode(user_data_response['UserData']['Value'] + "==="))
except Exception as e:
print_exception(f'Unable to decode EC2 instance user data: {e}')
async def _decode_user_data(self, user_data):
- value = base64.b64decode(user_data)
+ try:
+ value = base64.b64decode(user_data)
+ except base64.binascii.Error as e:
+ value = base64.b64decode(f'{user_data}===')
if value[0:2] == b'\x1f\x8b': # GZIP magic number
return zlib.decompress(value, zlib.MAX_WBITS | 32).decode('utf-8')
else:
- return value.decode('utf-8')
+ try:
+ return value.decode('utf-8')
+ except UnicodeDecodeError:
+ return value.decode('latin-1')
async def get_instances(self, region: str, vpc: str):
filters = [{'Name': 'vpc-id', 'Values': [vpc]}]
diff --git a/ScoutSuite/providers/aws/facade/s3.py b/ScoutSuite/providers/aws/facade/s3.py
index 924e513e8..be2359e6f 100755
--- a/ScoutSuite/providers/aws/facade/s3.py
+++ b/ScoutSuite/providers/aws/facade/s3.py
@@ -16,7 +16,7 @@ async def get_buckets(self):
# This is required in case there's an IAM policy that denies access to APIs on a regional basis,
# as per https://github.com/nccgroup/ScoutSuite/issues/727
buckets = []
- exception = ''
+ exception = None
region_list = self.regions if self.regions else await run_concurrently(lambda: self.session.get_available_regions('s3'))
for region in region_list:
try:
@@ -25,6 +25,7 @@ async def get_buckets(self):
except Exception as e:
exception = e
else:
+ exception = None # Fix for https://github.com/nccgroup/ScoutSuite/issues/916#issuecomment-728783965
break
if not buckets:
if exception:
diff --git a/ScoutSuite/providers/aws/provider.py b/ScoutSuite/providers/aws/provider.py
index 994ed345b..5ce6ffe12 100755
--- a/ScoutSuite/providers/aws/provider.py
+++ b/ScoutSuite/providers/aws/provider.py
@@ -156,17 +156,23 @@ def check_security_group_rules(lb, index, traffic_type):
def _check_ec2_zone_distribution(self):
regions = self.services['ec2']['regions'].values()
- self.services['ec2']['number_of_regions_with_instances'] = sum(
- r['instances_count'] > 0 for r in regions)
+ self.services['ec2']['number_of_regions_with_instances'] = sum(r['instances_count'] > 0 for r in regions)
+
+ for regions in self.services['ec2']['regions'].values():
+ instances_availability_zones = set()
+ for vpcs in regions['vpcs'].values():
+ for instance in vpcs['instances'].values():
+ instances_availability_zones.add(instance.get('availability_zone'))
+ regions['instances_availability_zones'] = len(instances_availability_zones)
def _add_last_snapshot_date_to_ec2_volumes(self):
for region in self.services['ec2']['regions'].values():
for volumeId, volume in region.get('volumes').items():
completed_snapshots = [s for s in region['snapshots'].values() if
- s['VolumeId'] == volumeId and s['State'] == 'completed']
+ s['volume_id'] == volumeId and s['state'] == 'completed']
sorted_snapshots = sorted(
- completed_snapshots, key=lambda s: s['StartTime'], reverse=True)
- volume['LastSnapshotDate'] = sorted_snapshots[0]['StartTime'] if len(
+ completed_snapshots, key=lambda s: s['start_time'], reverse=True)
+ volume['LastSnapshotDate'] = sorted_snapshots[0]['start_time'] if len(
sorted_snapshots) > 0 else None
def add_security_group_name_to_ec2_grants_callback(self, current_config, path, current_path, ec2_grant,
diff --git a/ScoutSuite/providers/aws/resources/acm/certificates.py b/ScoutSuite/providers/aws/resources/acm/certificates.py
index 77532c1a2..2306ede61 100755
--- a/ScoutSuite/providers/aws/resources/acm/certificates.py
+++ b/ScoutSuite/providers/aws/resources/acm/certificates.py
@@ -18,5 +18,6 @@ async def fetch_all(self):
def _parse_certificate(self, raw_certificate):
raw_certificate['name'] = raw_certificate.get('DomainName')
raw_certificate['id'] = get_non_provider_id(raw_certificate['name'])
+ raw_certificate['arn'] = raw_certificate.get('DomainName')
return raw_certificate['id'], raw_certificate
diff --git a/ScoutSuite/providers/aws/resources/cloudtrail/trails.py b/ScoutSuite/providers/aws/resources/cloudtrail/trails.py
index 1cc863f35..5f4033bb1 100755
--- a/ScoutSuite/providers/aws/resources/cloudtrail/trails.py
+++ b/ScoutSuite/providers/aws/resources/cloudtrail/trails.py
@@ -19,6 +19,8 @@ async def fetch_all(self):
def _parse_trail(self, raw_trail):
trail = {'name': raw_trail.pop('Name')}
trail_id = get_non_provider_id(trail['name'])
+
+ trail['arn'] = raw_trail.get('TrailARN')
# Do not duplicate entries for multiregion trails
if 'IsMultiRegionTrail' in raw_trail and raw_trail['IsMultiRegionTrail'] and \
diff --git a/ScoutSuite/providers/aws/resources/ec2/instances.py b/ScoutSuite/providers/aws/resources/ec2/instances.py
index c0e385744..0e6070007 100755
--- a/ScoutSuite/providers/aws/resources/ec2/instances.py
+++ b/ScoutSuite/providers/aws/resources/ec2/instances.py
@@ -21,10 +21,11 @@ async def _parse_instance(self, raw_instance):
instance = {}
id = raw_instance['InstanceId']
instance['id'] = id
- instance['arn'] = 'arn:aws:ec2:{}.{}.instance/{}'.format(self.region,
- raw_instance['OwnerId'],
- raw_instance['InstanceId'])
+ instance['arn'] = 'arn:aws:ec2:{}:{}:instance/{}'.format(self.region,
+ raw_instance['OwnerId'],
+ raw_instance['InstanceId'])
instance['reservation_id'] = raw_instance['ReservationId']
+ instance['availability_zone'] = raw_instance.get('Placement', {}).get('AvailabilityZone')
instance['monitoring_enabled'] = raw_instance['Monitoring']['State'] == 'enabled'
instance['user_data'] = await self.facade.ec2.get_instance_user_data(self.region, id)
instance['user_data_secrets'] = self._identify_user_data_secrets(instance['user_data'])
@@ -43,8 +44,7 @@ async def _parse_instance(self, raw_instance):
get_keys(eni, nic, ['Association', 'Groups', 'PrivateIpAddresses', 'SubnetId', 'Ipv6Addresses'])
instance['network_interfaces'][eni['NetworkInterfaceId']] = nic
- instance['metadata_options'] = raw_instance['MetadataOptions']
-
+ instance['metadata_options'] = raw_instance.get('MetadataOptions', {})
if 'IamInstanceProfile' in raw_instance:
instance['iam_role'] = raw_instance['IamInstanceProfile']['Arn'].split('/')[-1]
diff --git a/ScoutSuite/providers/aws/resources/ec2/snapshots.py b/ScoutSuite/providers/aws/resources/ec2/snapshots.py
index b8d5ad3e0..7e768f4e2 100755
--- a/ScoutSuite/providers/aws/resources/ec2/snapshots.py
+++ b/ScoutSuite/providers/aws/resources/ec2/snapshots.py
@@ -15,13 +15,26 @@ async def fetch_all(self):
self[name] = resource
def _parse_snapshot(self, raw_snapshot):
- raw_snapshot['id'] = raw_snapshot.pop('SnapshotId')
- raw_snapshot['name'] = get_name(raw_snapshot, raw_snapshot, 'id')
- raw_snapshot['public'] = self._is_public(raw_snapshot)
- raw_snapshot['arn'] = 'arn:aws:ec2:{}:{}:snapshot/{}'.format(self.get('region'),
- raw_snapshot.get('OwnerId'),
- raw_snapshot.get('name'))
- return raw_snapshot['id'], raw_snapshot
+ snapshot_dict = {}
+ snapshot_dict['id'] = raw_snapshot.get('SnapshotId')
+ snapshot_dict['name'] = get_name(raw_snapshot, raw_snapshot, 'SnapshotId')
+ snapshot_dict['description'] = raw_snapshot.get('Description')
+ snapshot_dict['public'] = self._is_public(raw_snapshot)
+ snapshot_dict['encrypted'] = raw_snapshot.get('Encrypted')
+ snapshot_dict['kms_key_id'] = raw_snapshot.get('KmsKeyId')
+ snapshot_dict['owner_id'] = raw_snapshot.get('OwnerId')
+ snapshot_dict['progress'] = raw_snapshot.get('Progress')
+ snapshot_dict['start_time'] = raw_snapshot.get('StartTime')
+ snapshot_dict['state'] = raw_snapshot.get('State')
+ snapshot_dict['volume_id'] = raw_snapshot.get('VolumeId')
+ snapshot_dict['volume_size'] = raw_snapshot.get('VolumeSize')
+ snapshot_dict['create_volume_permissions'] = raw_snapshot.get('CreateVolumePermissions')
+
+ snapshot_dict['arn'] = 'arn:aws:ec2:{}:{}:snapshot/{}'.format(self.region,
+ raw_snapshot.get('OwnerId'),
+ raw_snapshot.get('SnapshotId'))
+
+ return snapshot_dict['id'], snapshot_dict
@staticmethod
def _is_public(snapshot):
diff --git a/ScoutSuite/providers/aws/resources/ec2/volumes.py b/ScoutSuite/providers/aws/resources/ec2/volumes.py
index d4cdc1168..d7499bb9a 100755
--- a/ScoutSuite/providers/aws/resources/ec2/volumes.py
+++ b/ScoutSuite/providers/aws/resources/ec2/volumes.py
@@ -18,6 +18,6 @@ def _parse_volume(self, raw_volume):
raw_volume['id'] = raw_volume.pop('VolumeId')
raw_volume['name'] = get_name(raw_volume, raw_volume, 'id')
raw_volume['arn'] = 'arn:aws:ec2:{}:{}:volume/{}'.format(self.region,
- self.facade.owner_id,
- raw_volume.get('name'))
+ self.facade.owner_id,
+ raw_volume.get('id'))
return raw_volume['id'], raw_volume
diff --git a/ScoutSuite/providers/aws/resources/iam/credentialreports.py b/ScoutSuite/providers/aws/resources/iam/credentialreports.py
index 216f14e24..966c0180c 100755
--- a/ScoutSuite/providers/aws/resources/iam/credentialreports.py
+++ b/ScoutSuite/providers/aws/resources/iam/credentialreports.py
@@ -53,7 +53,8 @@ async def _user_has_hardware_mfa_devices(self, username):
if username == '':
devices = await self.facade.iam.get_virtual_mfa_devices()
for device in devices:
- if device['User']['Arn'][-5:] == ':root':
+ # If no EnableDate the device has been disabled
+ if device.get('EnableDate') and device['User']['Arn'][-5:] == ':root':
return False
return True
else:
diff --git a/ScoutSuite/providers/aws/rules/findings/cloudtrail-no-encryption-with-kms.json b/ScoutSuite/providers/aws/rules/findings/cloudtrail-no-encryption-with-kms.json
index 4bb6734de..17b25b19f 100644
--- a/ScoutSuite/providers/aws/rules/findings/cloudtrail-no-encryption-with-kms.json
+++ b/ScoutSuite/providers/aws/rules/findings/cloudtrail-no-encryption-with-kms.json
@@ -1,5 +1,5 @@
{
- "description": "CloudTrail Logs Not Encrypted with KMS CMKs",
+ "description": "CloudTrail Logs Not Encrypted with KMS Customer Master Keys (CMKs)",
"rationale": "Not encrypting CloudTrail logs with SSE-KMS affects the confidentiality of the log data.",
"remediation": "Ensure each Trail is encrypted with a KMS key",
"compliance": [
@@ -26,24 +26,33 @@
"display_path": "cloudtrail.regions.id.trails.id",
"path": "cloudtrail.regions.id.trails.id",
"conditions": [
- "or",
+ "and",
[
"cloudtrail.regions.id.trails.id.",
"withoutKey",
- "KmsKeyId"
+ "scout_link"
],
[
- "and",
+ "or",
[
"cloudtrail.regions.id.trails.id.",
- "withKey",
+ "withoutKey",
"KmsKeyId"
],
[
- "cloudtrail.regions.id.trails.id.KmsKeyId",
- "null",
- ""
+ "and",
+ [
+ "cloudtrail.regions.id.trails.id.",
+ "withKey",
+ "KmsKeyId"
+ ],
+ [
+ "cloudtrail.regions.id.trails.id.KmsKeyId",
+ "null",
+ ""
+ ]
]
+
]
],
"id_suffix": "cloudtrail-kms-key-unused"
diff --git a/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-not-encrypted.json b/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-not-encrypted.json
index 2d445f191..28545f459 100755
--- a/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-not-encrypted.json
+++ b/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-not-encrypted.json
@@ -9,9 +9,10 @@
"conditions": [
"and",
[
- "Encrypted",
+ "encrypted",
"false",
""
]
- ]
+ ],
+ "id_suffix": "encrypted"
}
diff --git a/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-public.json b/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-public.json
index 31d79a162..740f84887 100755
--- a/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-public.json
+++ b/ScoutSuite/providers/aws/rules/findings/ec2-ebs-snapshot-public.json
@@ -13,5 +13,6 @@
"true",
""
]
- ]
+ ],
+ "id_suffix": "public"
}
diff --git a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-NotActions.json b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-NotActions.json
index ab756d63f..6f498d373 100755
--- a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-NotActions.json
+++ b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-NotActions.json
@@ -10,6 +10,11 @@
"path": "iam.policies.id.PolicyDocument.Statement.id",
"conditions": [
"and",
+ [
+ "iam.policies.id.arn",
+ "notContainString",
+ "arn:aws:iam::aws:policy/aws-service-role"
+ ],
[
"iam.policies.id.PolicyDocument.Statement.id.Effect",
"equal",
diff --git a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-full-privileges.json b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-full-privileges.json
index 3f336cc47..528443047 100644
--- a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-full-privileges.json
+++ b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-full-privileges.json
@@ -23,6 +23,11 @@
"path": "iam.policies.id.PolicyDocument.Statement.id",
"conditions": [
"and",
+ [
+ "iam.policies.id.arn",
+ "notContainString",
+ "arn:aws:iam::aws:policy/aws-service-role"
+ ],
[
"iam.policies.id.PolicyDocument.Statement.id.Effect",
"equal",
diff --git a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-non-sts-action.json b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-non-sts-action.json
index 02f6ae679..3c38203e7 100755
--- a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-non-sts-action.json
+++ b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-allows-non-sts-action.json
@@ -9,6 +9,11 @@
"path": "iam.policies.id.PolicyDocument.Statement.id",
"conditions": [
"and",
+ [
+ "iam.policies.id.arn",
+ "notContainString",
+ "arn:aws:iam::aws:policy/aws-service-role"
+ ],
[
"iam.policies.id.PolicyDocument.Statement.id.Effect",
"equal",
diff --git a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-for-role.json b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-for-role.json
index 3c3392d71..12d721242 100755
--- a/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-for-role.json
+++ b/ScoutSuite/providers/aws/rules/findings/iam-managed-policy-for-role.json
@@ -9,6 +9,11 @@
"path": "iam.policies.id.PolicyDocument.Statement.id",
"conditions": [
"and",
+ [
+ "iam.policies.id.arn",
+ "notContainString",
+ "arn:aws:iam::aws:policy/aws-service-role"
+ ],
[
"iam.policies.id.PolicyDocument.Statement.id.Effect",
"equal",
diff --git a/ScoutSuite/providers/aws/rules/findings/iam-unused-credentials-not-disabled.json b/ScoutSuite/providers/aws/rules/findings/iam-unused-credentials-not-disabled.json
index 60c63ee90..b97bde4bb 100644
--- a/ScoutSuite/providers/aws/rules/findings/iam-unused-credentials-not-disabled.json
+++ b/ScoutSuite/providers/aws/rules/findings/iam-unused-credentials-not-disabled.json
@@ -31,37 +31,18 @@
""
],
[
- "or",
+ "and",
[
- "and",
- [
- "iam.credential_reports.id.password_last_used",
- "notNull",
- ""
- ],
- [
- "iam.credential_reports.id.password_last_used",
- "olderThan",
- [
- "_ARG_0_",
- "days"
- ]
- ]
+ "iam.credential_reports.id.password_last_used",
+ "notNull",
+ ""
],
[
- "and",
- [
- "iam.credential_reports.id.password_last_changed",
- "notNull",
- ""
- ],
+ "iam.credential_reports.id.password_last_used",
+ "olderThan",
[
- "iam.credential_reports.id.password_last_changed",
- "olderThan",
- [
- "_ARG_0_",
- "days"
- ]
+ "_ARG_0_",
+ "days"
]
]
]
@@ -74,25 +55,14 @@
""
],
[
- "or",
+ "and",
[
- "and",
- [
- "iam.credential_reports.id.access_key_1_last_used_date",
- "notNull",
- ""
- ],
- [
- "iam.credential_reports.id.access_key_1_last_used_date",
- "olderThan",
- [
- "_ARG_0_",
- "days"
- ]
- ]
+ "iam.credential_reports.id.access_key_1_last_used_date",
+ "notNull",
+ ""
],
[
- "iam.credential_reports.id.access_key_1_last_rotated",
+ "iam.credential_reports.id.access_key_1_last_used_date",
"olderThan",
[
"_ARG_0_",
@@ -109,25 +79,14 @@
""
],
[
- "or",
+ "and",
[
- "and",
- [
- "iam.credential_reports.id.access_key_2_last_used_date",
- "notNull",
- ""
- ],
- [
- "iam.credential_reports.id.access_key_2_last_used_date",
- "olderThan",
- [
- "_ARG_0_",
- "days"
- ]
- ]
+ "iam.credential_reports.id.access_key_2_last_used_date",
+ "notNull",
+ ""
],
[
- "iam.credential_reports.id.access_key_2_last_rotated",
+ "iam.credential_reports.id.access_key_2_last_used_date",
"olderThan",
[
"_ARG_0_",
diff --git a/ScoutSuite/providers/aws/rules/findings/kms-cmk-rotation-disabled.json b/ScoutSuite/providers/aws/rules/findings/kms-cmk-rotation-disabled.json
index 601c1b4ca..f754079fa 100644
--- a/ScoutSuite/providers/aws/rules/findings/kms-cmk-rotation-disabled.json
+++ b/ScoutSuite/providers/aws/rules/findings/kms-cmk-rotation-disabled.json
@@ -1,7 +1,7 @@
{
- "description": "Customer Master Keys (CMKs) with Rotation Disabled",
+ "description": "KMS Customer Master Keys (CMKs) with Rotation Disabled",
"rationale": "Cryptographic best practices discourage extensive reuse of encryption keys. Consequently, Customer Master Keys (CMKs) should be rotated to prevent usage of compromised keys.
Note that AWS KMS supports optional automatic key rotation only for customer managed CMKs.",
- "remediation": "For every Customer-created Master Key (CMK) ensure that Rotate this key every year is enabled",
+ "remediation": "For every KMS Customer Master Keys (CMKs), ensure that Rotate this key every year is enabled",
"compliance": [
{
"name": "CIS Amazon Web Services Foundations",
diff --git a/ScoutSuite/providers/aws/rules/findings/route53-domain-transferlock-not-authorized.json b/ScoutSuite/providers/aws/rules/findings/route53-domain-transferlock-not-authorized.json
index 3ac02647e..9ce2d2530 100755
--- a/ScoutSuite/providers/aws/rules/findings/route53-domain-transferlock-not-authorized.json
+++ b/ScoutSuite/providers/aws/rules/findings/route53-domain-transferlock-not-authorized.json
@@ -12,14 +12,30 @@
"name",
"match",
[
- ".*\\.io",
+ ".*\\.fr",
+ ".*\\.qa",
".*\\.co.nz",
- ".*\\.jp",
+ ".*\\.nl",
+ ".*\\.fi",
+ ".*\\.es",
+ ".*\\.de",
+ ".*\\.se",
".*\\.co.uk",
- ".*\\.fr",
- ".*\\.it",
+ ".*\\.me.uk",
+ ".*\\.ru",
+ ".*\\.jp",
+ ".*\\.net.au",
+ ".*\\.ch",
+ ".*\\.co.za",
+ ".*\\.com.au",
+ ".*\\.com.ar",
+ ".*\\.cl",
".*\\.org.uk",
- ".*\\.uk"
+ ".*\\.it",
+ ".*\\.net.nz",
+ ".*\\.uk",
+ ".*\\.eu",
+ ".*\\.org.nz"
]
]
],
diff --git a/ScoutSuite/providers/azure/rules/findings/appservice-outdated-http-version.json b/ScoutSuite/providers/azure/rules/findings/appservice-outdated-http-version.json
deleted file mode 100755
index 9d6fe476c..000000000
--- a/ScoutSuite/providers/azure/rules/findings/appservice-outdated-http-version.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "description": "Web App Running an Outdated HTTP Version",
- "rationale": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.",
- "remediation": "Set HTTP version to latest version available under General settings of the management console",
- "compliance": [
- {
- "name": "CIS Microsoft Azure Foundations",
- "version": "1.1.0",
- "reference": "9.10"
- }
- ],
- "references": [
- "https://docs.microsoft.com/en-us/azure/app-service/web-sites-configure#general-settings"
- ],
- "dashboard_name": "Web Apps",
- "path": "appservice.subscriptions.id.web_apps.id",
- "conditions": [
- "and",
- [
- "appservice.subscriptions.id.web_apps.id.http_2_enabled",
- "false",
- ""
- ]
- ],
- "id_suffix": "http_2_enabled"
-}
diff --git a/ScoutSuite/providers/azure/rules/findings/appservice-tls-v1-supported.json b/ScoutSuite/providers/azure/rules/findings/appservice-tls-v1-supported.json
index 27c354ce8..24fb4c711 100755
--- a/ScoutSuite/providers/azure/rules/findings/appservice-tls-v1-supported.json
+++ b/ScoutSuite/providers/azure/rules/findings/appservice-tls-v1-supported.json
@@ -17,9 +17,9 @@
"conditions": [
"and",
[
- "appservice.subscriptions.id.web_apps.id.https_only",
- "false",
- ""
+ "appservice.subscriptions.id.web_apps.id.minimum_tls_version_supported",
+ "notEqual",
+ "1.2"
]
],
"id_suffix": "minimum_tls_supported"
diff --git a/ScoutSuite/providers/azure/rules/rulesets/cis-1.1.0.json b/ScoutSuite/providers/azure/rules/rulesets/cis-1.1.0.json
index e1f286685..392934dc4 100644
--- a/ScoutSuite/providers/azure/rules/rulesets/cis-1.1.0.json
+++ b/ScoutSuite/providers/azure/rules/rulesets/cis-1.1.0.json
@@ -1,12 +1,6 @@
{
"about": "This ruleset covers most of the recommendations from the CIS Microsoft Azure Foundation v1.1.0.",
"rules": {
- "appservice-outdated-http-version.json": [
- {
- "enabled": true,
- "level": "warning"
- }
- ],
"appservice-outdated-version-dotnet.json": [
{
"enabled": true,
diff --git a/ScoutSuite/providers/azure/rules/rulesets/default.json b/ScoutSuite/providers/azure/rules/rulesets/default.json
index 5e2e8464a..bcac9e514 100755
--- a/ScoutSuite/providers/azure/rules/rulesets/default.json
+++ b/ScoutSuite/providers/azure/rules/rulesets/default.json
@@ -37,12 +37,6 @@
"level": "warning"
}
],
- "appservice-outdated-http-version.json": [
- {
- "enabled": true,
- "level": "warning"
- }
- ],
"appservice-outdated-version-dotnet.json": [
{
"enabled": true,
diff --git a/ScoutSuite/providers/gcp/facade/base.py b/ScoutSuite/providers/gcp/facade/base.py
index e335bcf47..366a2a54a 100755
--- a/ScoutSuite/providers/gcp/facade/base.py
+++ b/ScoutSuite/providers/gcp/facade/base.py
@@ -1,3 +1,5 @@
+import json
+
from ScoutSuite.core.console import print_exception, print_info, print_debug, print_error
from ScoutSuite.providers.gcp.facade.basefacade import GCPBaseFacade
from ScoutSuite.providers.gcp.facade.cloudresourcemanager import CloudResourceManagerFacade
@@ -120,7 +122,12 @@ async def _get_projects_recursively(self, parent_type, parent_id):
'You may have specified a non-existing organization/folder/project?')
except Exception as e:
- print_exception(f'Unable to list accessible Projects: {e}')
+ try:
+ content = e.content.decode("utf-8")
+ content_dict = json.loads(content)
+ print_exception(f'Unable to list accessible Projects: {content_dict.get("error").get("message")}')
+ except Exception as e:
+ print_exception(f'Unable to list accessible Projects: {e}')
finally:
return projects
diff --git a/ScoutSuite/providers/gcp/resources/gce/instances.py b/ScoutSuite/providers/gcp/resources/gce/instances.py
index 8d9ea4251..9f76eb72f 100755
--- a/ScoutSuite/providers/gcp/resources/gce/instances.py
+++ b/ScoutSuite/providers/gcp/resources/gce/instances.py
@@ -40,8 +40,12 @@ def _parse_instance(self, raw_instance):
instance_dict['serial_port_enabled'] = self._is_serial_port_enabled(raw_instance)
instance_dict['disks'] = InstanceDisks(self.facade, raw_instance)
- instance_dict['service_account'] = raw_instance.get('serviceAccounts', [])[0].get('email')
- instance_dict['access_scopes'] = raw_instance.get('serviceAccounts', [])[0].get('scopes')
+ if 'serviceAccounts' in raw_instance and raw_instance.get('serviceAccounts'):
+ instance_dict['service_account'] = raw_instance.get('serviceAccounts')[0].get('email')
+ instance_dict['access_scopes'] = raw_instance.get('serviceAccounts')[0].get('scopes')
+ else:
+ instance_dict['service_account'] = None
+ instance_dict['access_scopes'] = None
return instance_dict['id'], instance_dict
diff --git a/docker/src/Dockerfile b/docker/Dockerfile
similarity index 100%
rename from docker/src/Dockerfile
rename to docker/Dockerfile
diff --git a/docker/src/build.sh b/docker/build.sh
similarity index 100%
rename from docker/src/build.sh
rename to docker/build.sh
diff --git a/docker/config/build.env b/docker/config/build.env
index e129158a3..e2175e243 100644
--- a/docker/config/build.env
+++ b/docker/config/build.env
@@ -1,6 +1,6 @@
VCS_REF=$(git rev-parse --short HEAD)
VCS_URL='https://github.com/nccgroup/ScoutSuite'
-VERSION='0.2.1'
+VERSION='0.2.2'
BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
VENDOR='nccgroup'
NAME='scoutsuite'
diff --git a/docker/docker-compose.yaml b/docker/docker-compose.yaml
index 626e5c1b5..cf79659e8 100644
--- a/docker/docker-compose.yaml
+++ b/docker/docker-compose.yaml
@@ -2,13 +2,11 @@ version: "3.7"
services:
ncc-scoutsuite:
image: scoutsuite:latest
- volumes:
- - ./bin:/root/bin
env_file:
- config/build.env
build:
context: .
- dockerfile: src/Dockerfile
+ dockerfile: Dockerfile
args:
- VCS_REF
- VCS_URL
diff --git a/requirements.txt b/requirements.txt
index 4ebe406d4..d4f1a8955 100755
--- a/requirements.txt
+++ b/requirements.txt
@@ -19,7 +19,7 @@ google-cloud-container>=2.1.0
google-cloud-core>=0.29.1
google-cloud-iam>=0.1.0
google-cloud-logging>=1.15.0
-google-cloud-monitoring>=0.36.0
+google-cloud-monitoring==1.1.0
google-cloud-resource-manager>=0.28.3
google-cloud-storage>=1.13.2
google-cloud-kms==1.3.0