kmcquade

• To list all dependencies:

go list std | tr -d "\[|\]" | tr " " "\n" | sort -u > std-library
go list -f {{.Deps}} | tr -d "\[|\]" | tr " " "\n" | sort -u > all-dependencies
sort std-library std-library all-dependencies | uniq -u

Others:

kmcquade

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventSelfManagedImages",
      "Action": [
            "ecr:BatchDeleteImage",
            "ecr:CompleteLayerUpload",
            "ecr:Create*",
            "ecr:Delete*",

kmcquade

#!/usr/bin/env bash

for sub in `az account list | jq -r '.[].id'`; do \
    for rg in `az group list --subscription $sub | jq -r '.[].name'`; do \
        az group delete --name ${rg} --subscription $sub --no-wait --yes; \
    done; done;

kmcquade

resource "null_resource" "nuke" {
  # Because we set this to timestamp, it *always* runs :D
  triggers = {
    party_like_its_jan_1_1970 = timestamp()
  }

  provisioner "local-exec" {
    # Pseudocode for some bash magic that:
    # 1. gets a list of all subscriptions
    # 2. For each subscription, list the resource groups

kmcquade

mode: crud
name: 'ServerlessAppDeployAutomationUser'
# Specify resource ARNs
read:
- 'arn:aws:execute-api:*:*:*/*/*/*'
- 'arn:aws:lambda:*:*:function:cloudsplaining-*'
- 'arn:aws:s3:::cloudsplaining-serverless-*/*'
- 'arn:aws:cloudfront::*:distribution/mydistributionid'
write:
- 'arn:aws:execute-api:*:*:*/*/*/*'

kmcquade

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceApprovedImageOwners",
      "Action": [
        "ec2:RunInstances"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:ec2:*::image/ami-*",

kmcquade

# add this class 
class DatetimeEncoder(json.JSONEncoder):
    def default(self, obj):
        try:
            return super().default(obj)
        except TypeError:
 return str(obj)

kmcquade

I think we should target the "task list" concept for the user. So, instead of "IAM Principals", "IAM Roles", and "IAM Groups" at the bottom as cards - we should really have it be a list of the policies themselves that are failing. I am not quite sure the best way to represent this. I have an idea, but let me express these as JSON.

• Data Exfiltration (collapsible and show count)
  • AWS Managed Policies (collapsible and show count)
  • Customer Managed Policies (collapsible and show count)
  • Inline Policies (collapsible and show count)
• ... etc.

{

kmcquade

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PreventMarketplaceImages",
            "Action": [
                "ec2:RunInstances"
            ],
            "Effect": "Deny",
            "Resource": "arn:aws:ec2:*::image/ami-*",

kmcquade

Traceback (most recent call last):
  File "/apps/consoleme/env/lib64/python3.7/site-packages/urllib3/connection.py", line 160, in _new_conn
    (self._dns_host, self.port), self.timeout, **extra_kw
  File "/apps/consoleme/env/lib64/python3.7/site-packages/urllib3/util/connection.py", line 84, in create_connection
    raise err
  File "/apps/consoleme/env/lib64/python3.7/site-packages/urllib3/util/connection.py", line 74, in create_connection
    sock.connect(sa)
ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred: