Bugfix/1621 Improve AWS unused credential issue flagging #1622
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It seems to work but there are issues with the display; see "TKTK" comments in .../services.ec2.regions.id.regional_settings.html. Still needs tests.
ScoutSuite previously did not flag key vaults for which the API returned enable_soft_delete = null. Such key vaults have neither soft-delete nor purge protecton enabled and are also not recoverable. The check would only flag key vaults for which enable_soft_delete = false.
…ot-recoverable Fixes 'Key Vault Not Recoverable' check
Apparently ScoutSuite makes the implicit assumption that all settings are associated with resources, rather than directly to the region + service. So we move the regional EBS settings into a fake resource. This means that paths now need to include an ID for the "resource".
Feature/1584 aws ebs encryption
|
Closed due to wrong base branch. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR partly fixes #1621
With the changes, ScoutSuite ignores inactive / disabled credentials for the "Credentials Unused for 90 Days or Greater Are Not Disabled" rule in ScoutSuite. The change does not address point 3 of the issue, namely:
I don't believe this last point can feasibly be addressed, as the HTML frontend would need to know about the configurable argument to the rule.
Type of change
Select the relevant option(s):
Checklist: