jtroberts83

#!/bin/bash
SALACTUS_REDIS='your-redis-server-arn-redis.yfyfyfyfy.0001.use1.cache.amazonaws.com'

export AWS_DEFAULT_REGION='us-east-1'


echo "export AWS_DEFAULT_REGION='us-east-1'" >> /root/.bash_profile
echo "export SALACTUS_REDIS="$SALACTUS_REDIS"" >> /root/.bash_profile
echo "source /root/cloud-custodian/bin/activate" >> /root/.bash_profile

jtroberts83

{
  "object-reporting": {"access-denied-owner": false, "bucket": "our-salactus-s3-logs", "prefix": "objects/acl"},
  "visitors": [
    {
      "allow-log": true,
      "type": "object-acl",
      "report-only": true,
      "whitelist-accounts": ["*"]
    }
  ],

jtroberts83

import boto3
from botocore.client import Config
from datetime import datetime, timedelta
import json


bucket = 'yours3bucket'
KeyArnKey = 'MyKMSArns.csv'

KMSClient = boto3.client('kms')

jtroberts83

import boto3
from botocore.client import Config
import json


bucket = 'your-s3-bucket'
bucketregion = 'us-east-1'
KeyArnKey = 'MyKMSArns.csv'
AccountsS3Key = 'AWSAccountNumbers.csv'  # A CSV containing all the AWS Accounts you want to run this script against.
roleNameToAssume = 'Cloud_Custodian_Role'

jtroberts83

Try
{
    $VPCs = $null
    $VPCs = Get-EC2Vpc -Filter @{Name="isDefault"; Values="true"} -Region $Region -AccessKey $AccessKey -SecretKey $SecretAccessKey -SessionToken $SessionToken -ErrorAction Stop
     $Script:TotalAPICalls ++
     ##Write-Host "Successfully gathered VPCs in account $Account" -ForegroundColor Green
}
Catch
{
      Write-Host " ERROR gathered VPCs in account $Account - $_" -ForegroundColor Red

jtroberts83

policies:

- name: ec2-subnet-terminate-realtime
  resource: ec2
  mode:
      type: cloudtrail
      events:
        - RunInstances
  description: |
      Triggered on new EC2 instances that are created and if the

jtroberts83

$AWSServicesArray = @("account","acm-certificate","alarm","ami","app-elb","app-elb-target-group","asg","backup-plan","batch-compute","batch-definition","cache-cluster","cache-snapshot","cache-subnet-group","cfn","cloud-directory","cloudhsm-cluster","cloudsearch","cloudtrail","codebuild","codecommit","codepipeline","config-rule","customer-gateway","datapipeline","dax","directconnect","directory","distribution","dlm-policy","dms-endpoint","dms-instance","dynamodb-backup","dynamodb-stream","dynamodb-table","ebs","ebs-snapshot","ec2","ec2-reserved","ecr","ecs","ecs-container-instance","ecs-service","ecs-task","ecs-task-definition","efs","efs-mount-target","eks","elasticbeanstalk","elasticbeanstalk-environment","elasticsearch","elb","emr","eni","event-rule","event-rule-target","firehose","fsx","fsx-backup","gamelift-build","gamelift-fleet","glacier","glue-connection","glue-dev-endpoint","health-event","healthcheck","hostedzone","hsm","hsm-client","hsm-hapg","iam-certificate","iam-group","iam-policy","iam-profile",

jtroberts83

AWSServicesArray = ["account","acm-certificate","alarm","ami","app-elb","app-elb-target-group","asg","backup-plan","batch-compute","batch-definition","cache-cluster","cache-snapshot","cache-subnet-group","cfn","cloud-directory","cloudhsm-cluster","cloudsearch","cloudtrail","codebuild","codecommit","codepipeline","config-rule","customer-gateway","datapipeline","dax","directconnect","directory","distribution","dlm-policy","dms-endpoint","dms-instance","dynamodb-backup","dynamodb-stream","dynamodb-table","ebs","ebs-snapshot","ec2","ec2-reserved","ecr","ecs","ecs-container-instance","ecs-service","ecs-task","ecs-task-definition","efs","efs-mount-target","eks","elasticbeanstalk","elasticbeanstalk-environment","elasticsearch","elb","emr","eni","event-rule","event-rule-target","firehose","fsx","fsx-backup","gamelift-build","gamelift-fleet","glacier","glue-connection","glue-dev-endpoint","health-event","healthcheck","hostedzone","hsm","hsm-client","hsm-hapg","iam-certificate","iam-group","iam-policy","iam-profile","

jtroberts83

policies:

- name: ec2-mark-stopped-instance-realtime
  resource: ec2
  mode:
     type: cloudtrail
     events:
        - source: ec2.amazonaws.com
          event: StopInstances
          ids: "responseElements.instancesSet.items[].instanceId"

jtroberts83

policies:

###################################################
###  First Tag the Creator of the IAM User    #####
###################################################

- name: iam-auto-tag-user
  resource: iam-user
  mode:
    packages: [boto3, botocore, urllib3]