#! /usr/bin/python

# Original Example code to output account security config

# __author__ = 'Greg Roth', from aws conference.

#

# Refactored code into functional components.

# Modified to scan multiple regions, and be easily run as a cron job.

# Can Emails diffs to SNS topic.

#

# Example Usage as a Cron:

# 0,15,30,45 * * * * cd <yourdir>;python SecAudit.py -o log.txt --sns <your topic>

#

# Run the above every 15 mins or as desired and you will recieve a diff if your

# security profile ever changes.

#

# Tech Notes:

# Stores reports in logs/

# If you give -o log.txt, the filename will have a timestamp pre-pended to it, e.g.

# 2015-03-08_055740_log.txt. This is necessary to compare the most recent logs.

#

# 0,15,30,45 * * * * cd /home/ec2-user;python /home/ec2-user/SecAudit.py --sns arn:aws:sns:us-west-2:nono:nono -o logs.tx

__author__ = 'Brian Fleming'

from os import mkdir

import sys

import boto

import urllib

import hashlib

import argparse

import re

from datetime import datetime

import difflib

from os import listdir

from os.path import isfile, join

import boto.sns

import boto.sqs

import boto.ec2

import time

LOGDIR = "logs/"

REGIONS = ['us-east-1', 'us-west-2', 'us-west-2', 'ap-northeast-1']

def _reduce_to_date(fname):

return datetime.today() # Default to today if a timestamp in the file isn't found.

def diff_recent_logs():

print "It's fine"

def debug(str):

if args.debug:

print str

def verbose(str):

if args.verbose or args.debug:

print str

def sha256(m):

return hashlib.sha256(m).hexdigest()

def config_line(header, name, detail, data):

return header + ", " + name + ", " + detail + ", " + data

def config_line_policy(header, name, detail, data):

return config_line(header, name, detail, sha256(data))

def output_lines(lines):

print line

def get_iam_summary():

return [config_line("iam:accountsummary", "AccountMFAEnabled", "", str(summary["AccountMFAEnabled"]))]

def get_iam_user_info():

return sorted(user_info)

def get_iam_groups():

return sorted(group_policy)

def get_iam_roles():

return sorted(role_policy)

def get_s3_bucket_policy(region):

return sorted(bucket_info)

def get_sqs_policy(region):

return sorted(queue_info)

def get_sns_topics(region):

return sorted(topic_info)

def get_security_groups(region):

return sorted(sg_info)

# Requires EC2 Role or creds in your ~/.boto file that allows

# access to get these things.

def gen_report():

return [str(c) + '\n' for c in report]

# Return the n'th most recent file. Requires the filename prefix be

# have a time stamp. e.g. 2015-03-08_055740_log.txt

def get_last_tstamp_file(ldir, lastn=1):

return []

def save_report(report, filename):

f.close()

def gen_and_diff(logdir="."):

return None

if __name__ == "__main__":

parser = argparse.ArgumentParser(description='outputs security configuration of an AWS account')

parser.add_argument('-a', '--access_key_id', required=False, help='access key id. Overrides ~/.boto')

parser.add_argument('-k', '--secret_access_key', required=False, help='secret access key. \

Overrides ~/.boto')

# Not tested

parser.add_argument('-t', '--security_token', help='security token (for use with temporary security credentials)')

parser.add_argument('-r', '--role', help='arn of role to assume')

parser.add_argument('-s', '--sns', type=str, help='Send diff report to this arn::sns topic. \

Assumes us-west-2 region.')

parser.add_argument('-v', '--verbose', action="store_true", help='enable verbose mode')

parser.add_argument('-d', '--debug', action="store_true", help='enable debug mode')

parser.add_argument('-o', '--outfile', type=str, default="", help='Timestamp will be prefixed automatically')

parser.add_argument('-p', '--printo', type=str, default="", help='Print report only')

args = parser.parse_args()

if args.access_key_id and args.secret_access_key:

# access_key_id = args.access_key_id

# secret_access_key = args.secret_access_key

# assumed_role = sts.assume_role(args.role, "SecAudit")

boto.config.set('Credentials', 'aws_access_key_id', value=args.access_key_id)

boto.config.set('Credentials', 'aws_secret_access_key', value=args.secret_access_key)

security_token = args.security_token

try:

mkdir(LOGDIR)

except:

pass

if args.outfile:

args.outfile = LOGDIR + time.strftime("%Y-%m-%d_%H%M%S") + "_" + args.outfile

if args.role:

sts = boto.connect_sts()

assumed_role = sts.assume_role(args.role, "SecAudit")

boto.config.set('Credentials', 'aws_access_key_id', value=assumed_role.credentials.access_key)

boto.config.set('Credentials', 'aws_secret_access_key', value=assumed_role.credentials.secret_key)

# This one needs to be checked, I am only guessing it is aws_security_token

boto.config.set('Credentials', 'aws_security_token', value=assumed_role.credentials.session_token)

# security_token = args.security_token

if args.printo:

print gen_report()

# Let's go!

gen_and_diff(logdir=LOGDIR)