From 151010813e2ba68da8acb05fd77233e5c1773b8b Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Sun, 13 Oct 2024 09:18:19 -0400 Subject: [PATCH 1/5] fix: regions problem --- commands/collect.py | 10 ++-------- shared/common.py | 23 +++++++++++++++++++---- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/commands/collect.py b/commands/collect.py index 073914f4e..6dd020e28 100644 --- a/commands/collect.py +++ b/commands/collect.py @@ -11,7 +11,7 @@ import pyjq import urllib.parse from botocore.exceptions import ClientError, EndpointConnectionError, NoCredentialsError -from shared.common import get_account, custom_serializer +from shared.common import custom_serializer, get_account, get_default_region from botocore.config import Config __description__ = "Run AWS API calls to collect data from the account" @@ -223,13 +223,7 @@ def collect(arguments): make_directory("account-data/{}".format(account_dir)) # Identify the default region used by global services such as IAM - default_region = os.environ.get("AWS_REGION", "us-east-1") - if "gov-" in default_region: - default_region = "us-gov-west-1" - elif "cn-" in default_region: - default_region = "cn-north-1" - else: - default_region = "us-east-1" + default_region = get_default_region() regions_filter = None if len(arguments.regions_filter) > 0: diff --git a/shared/common.py b/shared/common.py index f10338361..5715baf96 100644 --- a/shared/common.py +++ b/shared/common.py @@ -1,11 +1,12 @@ from __future__ import print_function +from netaddr import IPNetwork import argparse -import json import datetime +import json +import os import pyjq -import yaml import sys -from netaddr import IPNetwork +import yaml from shared.nodes import Account, Region from shared.query import query_aws, get_parameter_file @@ -152,11 +153,25 @@ def is_unblockable_cidr(cidr): return False +def get_default_region(): + default_region = os.environ.get("AWS_REGION", "us-east-1") + if "gov-" in default_region: + return "us-gov-west-1" + elif "cn-" in default_region: + return "cn-north-1" + else: + return "us-east-1" + + def get_regions(account, outputfilter={}): # aws ec2 describe-regions region_data = query_aws(account, "describe-regions") + + # Fallback to default region if no region data is found if not region_data: - raise InvalidAccountData("region data not found for {}".format(account.name)) + default_region = get_default_region() + log_warning(f"No region data found for account {account.name}. Falling back to default region: {default_region}") + return [{"RegionName": default_region}] region_filter = "" if "regions" in outputfilter: From 87fba8ff8d047af3fad4b754f8b450e2109aad07 Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Sun, 13 Oct 2024 09:22:17 -0400 Subject: [PATCH 2/5] chore: debug logging --- shared/common.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shared/common.py b/shared/common.py index 5715baf96..a40572701 100644 --- a/shared/common.py +++ b/shared/common.py @@ -388,6 +388,8 @@ def get_access_advisor_active_counts(account, max_age=90): json_account_auth_details = query_aws( region.account, "iam-get-account-authorization-details", region ) + log_debug(f"Retrieved account authorization details for {region.account.name} in {region.name}") + log_debug(f"json_account_auth_details: {json_account_auth_details}") account_stats = { "users": {"active": 0, "inactive": 0}, From d95b2dcb926152847d5ccb0a7408b84c3260a2c9 Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Sun, 13 Oct 2024 09:24:06 -0400 Subject: [PATCH 3/5] chore: debug logging --- commands/iam_report.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/commands/iam_report.py b/commands/iam_report.py index 0edd5c3aa..b7b6bcd48 100644 --- a/commands/iam_report.py +++ b/commands/iam_report.py @@ -403,6 +403,8 @@ def iam_report(accounts, config, args): json_account_auth_details = query_aws( region.account, "iam-get-account-authorization-details", region ) + print(f"[IAM] Retrieved account authorization details for {region.account.name} in {region.name}") + print(f"[IAM] json_account_auth_details: {json_account_auth_details}") get_access_advisor(region, principal_stats, json_account_auth_details, args) users = [] From f02083bf3e87853c35807e7968f0d5cf621e15fd Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Sun, 13 Oct 2024 10:16:28 -0400 Subject: [PATCH 4/5] chore: removed logging --- commands/iam_report.py | 2 -- shared/common.py | 2 -- 2 files changed, 4 deletions(-) diff --git a/commands/iam_report.py b/commands/iam_report.py index b7b6bcd48..0edd5c3aa 100644 --- a/commands/iam_report.py +++ b/commands/iam_report.py @@ -403,8 +403,6 @@ def iam_report(accounts, config, args): json_account_auth_details = query_aws( region.account, "iam-get-account-authorization-details", region ) - print(f"[IAM] Retrieved account authorization details for {region.account.name} in {region.name}") - print(f"[IAM] json_account_auth_details: {json_account_auth_details}") get_access_advisor(region, principal_stats, json_account_auth_details, args) users = [] diff --git a/shared/common.py b/shared/common.py index a40572701..5715baf96 100644 --- a/shared/common.py +++ b/shared/common.py @@ -388,8 +388,6 @@ def get_access_advisor_active_counts(account, max_age=90): json_account_auth_details = query_aws( region.account, "iam-get-account-authorization-details", region ) - log_debug(f"Retrieved account authorization details for {region.account.name} in {region.name}") - log_debug(f"json_account_auth_details: {json_account_auth_details}") account_stats = { "users": {"active": 0, "inactive": 0}, From 260789a6776ffcad96a429fc51b65a4c12c2d9a3 Mon Sep 17 00:00:00 2001 From: Aaron Meese Date: Sun, 13 Oct 2024 10:18:30 -0400 Subject: [PATCH 5/5] chore: error handling for SAML --- commands/weboftrust.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/commands/weboftrust.py b/commands/weboftrust.py index d5391803f..49ad7c92c 100644 --- a/commands/weboftrust.py +++ b/commands/weboftrust.py @@ -198,6 +198,7 @@ def get_iam_trusts(account, nodes, connections, connections_to_get): # Validate that the federated principal and the SAML provider is coming from known accounts. # WoT will show us the direction of that trust for further inspection. # this enables cross_account_admin_sts (STS between accounts) + saml_provider_arn = "" for saml in saml_providers: if saml["Arn"] == federated_principal: saml_provider_arn = saml["Arn"] @@ -296,7 +297,7 @@ def get_iam_trusts(account, nodes, connections, connections_to_get): } ) continue - else: + elif saml_provider_arn != "": raise Exception( "Unknown federation provider: {}".format( saml_provider_arn.lower()