https://github.com/mikhailadvani/aws-security-test
https://github.com/mikhailadvani/aws-security-test
aws boto3 ci ec2 iam logging monitoring networking security
Last synced: 3 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/mikhailadvani/aws-security-test
- Owner: mikhailadvani
- License: apache-2.0
- Created: 2016-11-02T10:03:04.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2017-08-21T18:32:03.000Z (almost 9 years ago)
- Last Synced: 2026-01-02T15:22:48.693Z (6 months ago)
- Topics: aws, boto3, ci, ec2, iam, logging, monitoring, networking, security
- Language: Python
- Size: 93.8 KB
- Stars: 15
- Watchers: 5
- Forks: 8
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Runtime
#### Requirements
- **Python**: 2.7.12
- **Boto3**: 1.4.1
#### Configuring Tests
##### Credentials
Credentials need to be setup as described in [Boto3 Documentation](http://boto3.readthedocs.io/en/latest/guide/configuration.html).
Access needed by the users' API keys configured:
- AmazonEC2ReadOnlyAccess
- IAMReadOnlyAccess
- AWSCloudTrailReadOnlyAccess
- AmazonS3ReadOnlyAccess
- CloudWatchLogsReadOnlyAccess
- CloudWatchReadOnlyAccess
- AmazonSNSReadOnlyAccess
- *KMSReadOnlyPolicy* - There is no pre-defined AWS Policy with the necessary privileges. The custom policy can defined as mentioned in the [documentation](https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-read-only-console)
##### Tests to run
Setup a config file similar to [default.yml](https://github.com/mikhailadvani/aws-security-test/blob/master/config/default.yml) to execute desired tests. Value for each test should be `True` or `False`.
#### Execution Steps
##### Run as script
`python aws_security_test.py -c config/default.yml` - Will use the credentials from the environment variables if found or will fall back to the default profile in `~/.aws/config`
`python aws_security_test.py -c config/default.yml -p profile_name` - Will use the credentials from the corresponding profile defined in `~/.aws/config`
#### Artifacts
Certain artifacts will be created at the end of every execution for additional verification. The will be in the artifacts directory
`root_login.txt` : Will be useful in monitoring root account access in case CloudWatch is not used.
`sns_subscribers.csv` : Lists subscribers for each SNS topic. Can be used to ensure notifications are being sent to the right audience.
`internet_open_security_groups.csv` : Lists security groups with access open to the Internet. This list might contain rules where access open from the Internet is desired, but can also be used to check for misconfigurations.
# License
Apache License 2.0