Skip to content

Commit 06b0210

Browse files
kmcquadekmcquade
authored
Refactor/vue migration (#89)
* Added files. Configuring webpack and such * Added files. Configuring webpack and such * Got webpack working. Need to modify Cloudsplaining so it pumps the results into the html report * Bundle works. Polished things up with the Policy ID. Removed policy ID collisons. Other improvements. Looking good so far * Make pylint happy * Update the javascript documentation * Show the SHA-256 hash ID for Inline Policies * Fixed group membership entry * Fixed group membership presentation. Also fixed issue where npm serve would not work after refresh * Fixed the preload issue * Preload issues are not perfect but it works for now * Report is good to go * Report is finalized. Fixed ID issues with Inline policies. Ready for merge
1 parent c2a500f commit 06b0210

File tree

103 files changed

+54109
-14668
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

103 files changed

+54109
-14668
lines changed

‎.editorconfig

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ indent_size = 2
3636

3737
# Web Files
3838
[*.{htm,html,js,jsm,ts,tsx,css,sass,scss,less,svg,vue}]
39-
indent_size = 2
39+
indent_size = 4
4040
end_of_line = lf
4141

4242
# Bash Files

‎.env.development

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VUE_APP_TITLE=Cloudsplaining (development)
2+
NODE_ENV=development

‎.env.production

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VUE_APP_TITLE=Cloudsplaining
2+
NODE_ENV=production

‎.github/workflows/nodejs-test.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# .github/workflows/nodejs-test.yml
2+
3+
name: Node.js CI
4+
5+
on: [push, pull_request]
6+
7+
jobs:
8+
build:
9+
10+
runs-on: ubuntu-latest
11+
12+
strategy:
13+
matrix:
14+
node-version: [12.x, 14.x]
15+
16+
steps:
17+
- uses: actions/checkout@v2
18+
- name: Use Node.js ${{ matrix.node-version }}
19+
uses: actions/setup-node@v1
20+
with:
21+
node-version: ${{ matrix.node-version }}
22+
- run: npm install
23+
- run: npm run build --if-present
24+
- run: npm test
25+
env:
26+
CI: true

‎.gitignore

+31-1
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,10 @@ default-iam-report.csv
99
private/default-iam-results.json
1010
default-results-summary.csv
1111
iam-new-principal-policy-mapping-example.json
12+
iam-findings-example.json
1213
private/*
1314
current.json
15+
TODO.md
1416

1517
venv
1618
Pipfile.lock
@@ -28,6 +30,34 @@ fake.html
2830
## ReadTheDocs
2931
site/
3032

33+
.DS_Store
34+
node_modules
35+
venv/*
36+
37+
private.html
38+
39+
*.js.map
40+
41+
# local env files
42+
.env.local
43+
.env.*.local
44+
45+
# Log files
46+
npm-debug.log*
47+
yarn-debug.log*
48+
yarn-error.log*
49+
pnpm-debug.log*
50+
51+
# Editor directories and files
52+
.idea
53+
.vscode
54+
*.suo
55+
*.ntvs*
56+
*.njsproj
57+
*.sln
58+
*.sw?
59+
60+
3161
##### HashiCorp #####
3262
#### Terraform
3363
# Local .terraform directories
@@ -116,7 +146,7 @@ __pycache__/
116146
.Python
117147
build/
118148
develop-eggs/
119-
dist/
149+
/dist/
120150
downloads/
121151
eggs/
122152
.eggs/

‎MANIFEST.in

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
recursive-include cloudsplaining/shared *.yml
22
recursive-include cloudsplaining/output *.html
3+
recursive-include cloudsplaining/output *.js
4+
recursive-include cloudsplaining/output *.vue
5+
recursive-include cloudsplaining/output *.png
36
recursive-include cloudsplaining/output *.md

‎README.md

+23-25
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,29 @@ pip3 install --user cloudsplaining
9494

9595
* Now you should be able to execute `cloudsplaining` from command line by running `cloudsplaining --help`.
9696

97+
### Scanning a single IAM policy
98+
99+
You can also scan a single policy file to identify risks instead of an entire account.
100+
101+
```bash
102+
cloudsplaining scan-policy-file --input-file examples/policies/explicit-actions.json
103+
```
104+
105+
The output will include a finding description and a list of the IAM actions that do not leverage resource constraints.
106+
107+
The output will resemble the following:
108+
109+
```console
110+
Issue found: Data Exfiltration
111+
Actions: s3:GetObject
112+
113+
Issue found: Resource Exposure
114+
Actions: ecr:DeleteRepositoryPolicy, ecr:SetRepositoryPolicy, s3:BypassGovernanceRetention, s3:DeleteAccessPointPolicy, s3:DeleteBucketPolicy, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccessPointPolicy, s3:PutAccountPublicAccessBlock, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutObjectAcl, s3:PutObjectVersionAcl
115+
116+
Issue found: Unrestricted Infrastructure Modification
117+
Actions: ecr:BatchDeleteImage, ecr:CompleteLayerUpload, ecr:CreateRepository, ecr:DeleteLifecyclePolicy, ecr:DeleteRepository, ecr:DeleteRepositoryPolicy, ecr:InitiateLayerUpload, ecr:PutImage, ecr:PutImageScanningConfiguration, ecr:PutImageTagMutability, ecr:PutLifecyclePolicy, ecr:SetRepositoryPolicy, ecr:StartImageScan, ecr:StartLifecyclePolicyPreview, ecr:TagResource, ecr:UntagResource, ecr:UploadLayerPart, s3:AbortMultipartUpload, s3:BypassGovernanceRetention, s3:CreateAccessPoint, s3:CreateBucket, s3:DeleteAccessPoint, s3:DeleteAccessPointPolicy, s3:DeleteBucket, s3:DeleteBucketPolicy, s3:DeleteBucketWebsite, s3:DeleteObject, s3:DeleteObjectTagging, s3:DeleteObjectVersion, s3:DeleteObjectVersionTagging, s3:GetObject, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccelerateConfiguration, s3:PutAccessPointPolicy, s3:PutAnalyticsConfiguration, s3:PutBucketAcl, s3:PutBucketCORS, s3:PutBucketLogging, s3:PutBucketNotification, s3:PutBucketObjectLockConfiguration, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutBucketRequestPayment, s3:PutBucketTagging, s3:PutBucketVersioning, s3:PutBucketWebsite, s3:PutEncryptionConfiguration, s3:PutInventoryConfiguration, s3:PutLifecycleConfiguration, s3:PutMetricsConfiguration, s3:PutObject, s3:PutObjectAcl, s3:PutObjectLegalHold, s3:PutObjectRetention, s3:PutObjectTagging, s3:PutObjectVersionAcl, s3:PutObjectVersionTagging, s3:PutReplicationConfiguration, s3:ReplicateDelete, s3:ReplicateObject, s3:ReplicateTags, s3:RestoreObject, s3:UpdateJobPriority, s3:UpdateJobStatus
118+
119+
```
97120

98121
### Scanning an entire AWS Account
99122

@@ -242,31 +265,6 @@ cloudsplaining scan --exclusions-file exclusions.yml --input-file examples/files
242265
```
243266

244267

245-
### Scanning a single policy
246-
247-
You can also scan a single policy file to identify risks instead of an entire account.
248-
249-
```bash
250-
cloudsplaining scan-policy-file --input-file examples/policies/explicit-actions.json
251-
```
252-
253-
The output will include a finding description and a list of the IAM actions that do not leverage resource constraints.
254-
255-
The output will resemble the following:
256-
257-
```console
258-
Issue found: Data Exfiltration
259-
Actions: s3:GetObject
260-
261-
Issue found: Resource Exposure
262-
Actions: ecr:DeleteRepositoryPolicy, ecr:SetRepositoryPolicy, s3:BypassGovernanceRetention, s3:DeleteAccessPointPolicy, s3:DeleteBucketPolicy, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccessPointPolicy, s3:PutAccountPublicAccessBlock, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutObjectAcl, s3:PutObjectVersionAcl
263-
264-
Issue found: Unrestricted Infrastructure Modification
265-
Actions: ecr:BatchDeleteImage, ecr:CompleteLayerUpload, ecr:CreateRepository, ecr:DeleteLifecyclePolicy, ecr:DeleteRepository, ecr:DeleteRepositoryPolicy, ecr:InitiateLayerUpload, ecr:PutImage, ecr:PutImageScanningConfiguration, ecr:PutImageTagMutability, ecr:PutLifecyclePolicy, ecr:SetRepositoryPolicy, ecr:StartImageScan, ecr:StartLifecyclePolicyPreview, ecr:TagResource, ecr:UntagResource, ecr:UploadLayerPart, s3:AbortMultipartUpload, s3:BypassGovernanceRetention, s3:CreateAccessPoint, s3:CreateBucket, s3:DeleteAccessPoint, s3:DeleteAccessPointPolicy, s3:DeleteBucket, s3:DeleteBucketPolicy, s3:DeleteBucketWebsite, s3:DeleteObject, s3:DeleteObjectTagging, s3:DeleteObjectVersion, s3:DeleteObjectVersionTagging, s3:GetObject, s3:ObjectOwnerOverrideToBucketOwner, s3:PutAccelerateConfiguration, s3:PutAccessPointPolicy, s3:PutAnalyticsConfiguration, s3:PutBucketAcl, s3:PutBucketCORS, s3:PutBucketLogging, s3:PutBucketNotification, s3:PutBucketObjectLockConfiguration, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutBucketRequestPayment, s3:PutBucketTagging, s3:PutBucketVersioning, s3:PutBucketWebsite, s3:PutEncryptionConfiguration, s3:PutInventoryConfiguration, s3:PutLifecycleConfiguration, s3:PutMetricsConfiguration, s3:PutObject, s3:PutObjectAcl, s3:PutObjectLegalHold, s3:PutObjectRetention, s3:PutObjectTagging, s3:PutObjectVersionAcl, s3:PutObjectVersionTagging, s3:PutReplicationConfiguration, s3:ReplicateDelete, s3:ReplicateObject, s3:ReplicateTags, s3:RestoreObject, s3:UpdateJobPriority, s3:UpdateJobStatus
266-
267-
```
268-
269-
270268
## Cheatsheet
271269

272270
```bash

‎babel.config.js

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
module.exports = {
2+
presets: [
3+
'@vue/cli-plugin-babel/preset'
4+
]
5+
}

‎cloudsplaining/command/scan.py

+10-10
Original file line numberDiff line numberDiff line change
@@ -148,19 +148,20 @@ def scan_account_authorization_details(
148148
"resource constraints..."
149149
)
150150
check_authorization_details_schema(account_authorization_details_cfg)
151-
authorization_details = AuthorizationDetails(account_authorization_details_cfg)
152-
results = authorization_details.results(exclusions)
151+
authorization_details = AuthorizationDetails(account_authorization_details_cfg, exclusions)
152+
results = authorization_details.results
153+
153154
# Lazy method to get an account ID
154155
account_id = None
155156
for role in results.get("roles"):
156157
if "arn:aws:iam::aws:" not in results["roles"][role]["arn"]:
157158
account_id = get_account_from_arn(results["roles"][role]["arn"])
158159
break
160+
159161
html_report = HTMLReport(
160162
account_id=account_id,
161163
account_name=account_name,
162164
results=results,
163-
exclusions_cfg=exclusions,
164165
)
165166
rendered_report = html_report.get_html_report()
166167

@@ -169,14 +170,13 @@ def scan_account_authorization_details(
169170
if output_directory is None:
170171
output_directory = os.getcwd()
171172

172-
new_data = authorization_details.results(exclusions)
173-
new_raw_data_file = os.path.join(output_directory, f"iam-new-principal-policy-mapping-{account_name}.json")
174-
new_raw_data_filepath = write_results_data_file(new_data, new_raw_data_file)
175-
print(f"Raw data file saved: {str(new_raw_data_filepath)}")
173+
results_data_file = os.path.join(output_directory, f"iam-results-{account_name}.json")
174+
results_data_filepath = write_results_data_file(authorization_details.results, results_data_file)
175+
print(f"Results data saved: {str(results_data_filepath)}")
176176

177-
raw_data_file = os.path.join(output_directory, f"iam-results-{account_name}.json")
178-
raw_data_filepath = write_results_data_file(results, raw_data_file)
179-
print(f"Raw data file saved: {str(raw_data_filepath)}")
177+
findings_data_file = os.path.join(output_directory, f"iam-findings-{account_name}.json")
178+
findings_data_filepath = write_results_data_file(results, findings_data_file)
179+
print(f"Findings data file saved: {str(findings_data_filepath)}")
180180

181181
return rendered_report
182182

‎cloudsplaining/output/__init__.py

-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +0,0 @@
1-
# pylint: disable=missing-module-docstring
2-
import logging
3-
4-
logger = logging.getLogger(__name__)

‎cloudsplaining/output/dist/index.bundle.js

+2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cloudsplaining/output/dist/index.html

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Cloudsplaining report</title><link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css" integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-vue/2.16.0/bootstrap-vue.min.css" crossorigin="anonymous"/><script src="https://cdnjs.cloudflare.com/ajax/libs/vue/2.6.12/vue.min.js" crossorigin="anonymous"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-vue/2.16.0/bootstrap-vue.min.js" crossorigin="anonymous"></script><script src="https://code.jquery.com/jquery-3.3.1.min.js"></script><script>var isLocalExample = true;
2+
var account_id;
3+
var account_name;
4+
var report_generated_time;
5+
var cloudsplaining_version;
6+
var iam_data;</script></head><body><div id="app"></div><script src="js/chunk-vendors.js"></script><script src="index.bundle.js"></script></body><script src="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js" integrity="sha384-wfSDF2E50Y2D1uUdj0O3uMBJnjuUD4Ih7YwaYd1iqfktj0Uod8GCExl3Og8ifwB6" crossorigin="anonymous"></script></html>

0 commit comments

Comments
 (0)