ivision-research / scanamabob

Scanamabob

Scanamabob is a set of AWS-specific tools that aide in managing the security of AWS environments.

Scanamabob is currently in an alpha development state. As such, many expected features are missing or incomplete and there may be significant changes in the near future that may break any automations made around the current version.

Features

• Intelligent scanning of AWS environment for common security misconfigurations
• S3 auditor for identifying publicly exposed resources

Configuration

Scanamabob uses the boto3 library to consume the AWS API. As such, Scanamabob is configured via the aws cli commands.

$ aws configure
AWS Access Key ID [****************ZXIh]: dXJ5eWIgZ3VyZXIh
AWS Secret Access Key [****************dHRm]: didxIHRocmZmIGxiaCBuY2NlcnB2bmdyIHJuZmdyZSBydHRm
Default region name [us-east-1]: 
Default output format [json]: 

Basic operation

Runs like a standard python app, -h can help you find the small set of supported options.

Usage: scanamabob <command> [-h] [command-specific-arguments]

Scanamabob v0.0.2 - AWS Security Tooling

This tool is in a very early phase of development and is undergoing active development. Many desired features are currently missing and incomplete. Early release of this version through PyPI is intended to generate useful feedback from potential users.

  scan     -  Scan AWS environment for common security misconfigurations

Testing

The infrastructure for testing is brought up and down by Terraform. Make sure you have that installed before running the tests. Then do:

make infraup
make test
make infradown

scanamabob's Issues

Better textual finding output

Instead of printing out the data json, maybe find something that maps the tag to a text processor. Maybe mako templates?

Add command to find/describe publicly exposed resources

• s3 buckets
• EC2 instances
• API gateway
• etc

Scan user access key and password ages

Make the output of the scan command useful

At the moment the scan output simply dumps findings as dictionaries, would be good to have a good default output like markdown, with the option for a json output as well

Improve command line handling / usage generation

Current implementation uses fairly hacky manually built bits:

https://github.com/CarveSystems/scanamabob/blob/master/scripts/scanamabob
https://github.com/CarveSystems/scanamabob/blob/master/scanamabob/commands/scan.py

A better, more dynamic approach to this may provide better support for different terminal widths and require less manual effort to maintain in code

Complete dedicated S3 audit subcommand

The intention of this feature is to provide a breakdown of bucket and objects organized by their level of exposure. Initial design will likely be a markdown output that categorizes resources as public and non-public. Should support specifying a subset of buckets by name or maybe some pattern matching

Handle multiple AWS accounts

Scan RDS to verify backups enabled

Implement a scan context

holds creds, regions, sessions, etc

Generate AWS environment summary

Potential feature: rough cost estimation based on resource utilization

Scan S3 buckets for unencrypted http traffic

s3audit doesn't handle cases where there is no default region in profile

When running s3audit without a default region in the profiles, errors related to not specifying a region crop up.

Support scantype exclusion for scans

To support disabling a specific scan or suite, add support for something like !iam and !iam.mfa

Scan S3 buckets for permission concerns

Scan for weak account level password policies

Scan IAM policies for STS:AssumeRole and IAM:Passrole

Implement CI pipeline

Would be great to have automated CI in github

Scan DynamoDB for encryption

Scan Security groups for ports open to all

Fix PIP install

Current pip package doesn't properly install the services folder, making the installation unusable

Scan iam policies for usage of notallow

Scan for MFA on root level account

Support comparing scan runs

Generate a visual model of an environment

May not be feasible, but is a desirable post-beta feature

Improve STS support

It would be useful to support scanning via tokens generated by STS. This is becoming a more common access pattern, particular for users that manage their cloud resources through a governance tool.

Scan S3 for disabled access logs

Scan EC2 user data for secrets

shell completions

tab-completing scans and stuff

ec2 weird security group causes error

 - Running Scan "Scanning EC2 Security Groups"
...
  File "/home/aralls/projects/scanamabob/scanamabob/scans/ec2.py", line 81, in run
    toport = permission['ToPort']
KeyError: 'ToPort'

the weird group:

{'Description': 'all', 'GroupName': 'all2', 'IpPermissions': [{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0'}], 'PrefixListIds': [], 'UserIdGroupPairs': []}], 'OwnerId': '344987966180', 'GroupId': 'sg-0fcf14409db6e958f', 'IpPermissionsEgress': [{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0'}], 'PrefixListIds': [], 'UserIdGroupPairs': []}], 'VpcId': 'vpc-cb2cb4a3'}

this security groups is a few years old, so it's probably a legacy format that got grandfathered in or something

rds multiaz not working

I'm not sure if the test isn't working or if I'm misunderstanding something.

but when I add in debugging statements, the API really is returning MultiAZ=False for those instances.

could it be some confusion between clusters and instances?