acumenix

## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

acumenix

#!/usr/bin/env ruby

# Audits your reserved instances vs your running instances, and reports back. 
# If you want to run this from an AWS instance, its IAM Role must be granted at least the following:
#
#{
# "Statement": [
# {
# "Action": [
# "ec2:DescribeInstances",

acumenix

AbortDocumentVersionUpload
AbortEnvironmentUpdate
AbortMultipartUpload
AbortVaultLock
AcceptAccountMapping
AcceptCertificateTransfer
AcceptDelegate
AcceptDirectConnectGatewayAssociationProposal
AcceptFxPaymentCurrencyTermsAndConditions
AcceptHandshake

acumenix

Python AWS CloudTrail parser

A Python parser class for CloudTrail event archives, previously dumped to an S3 bucket. Class provides an iterator which will:

• Scan a given directory for archive files matching the required pattern.
• Decompress each archive in memory.
• Parse JSON payload and return each event in turn.

Parser contained in cloudtrailparser.py, with timezone.py used as a simple datetime.tzinfo concrete class implement to provide UTC timezone.

Example

acumenix

import boto3

required_keys = [ "key01", "key02", "key03", "key04" ]
ses_source = 'source@maildomain.com'
ses_destination = ['somebody@domain.com']

def lambda_handler(event, context):

    if 'detail' in event and 'instance-id' in event['detail']:
        ec2_instance_id = event['detail']['instance-id']

acumenix

var aws  = require('aws-sdk');
var zlib = require('zlib');
var async = require('async');

var EVENT_SOURCE_TO_TRACK = /route53.amazonaws.com/;  
var EVENT_NAME_TO_TRACK   = /CreateHostedZone/; 

var s3 = new aws.S3();
var route53 = new aws.Route53();

acumenix

## IPv6 Tests
http://[::ffff:169.254.169.254]
http://[0:0:0:0:0:ffff:169.254.169.254]

## AWS 
# Amazon Web Services (No Header Required)
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]

acumenix

#!/usr/bin/env python
import boto3
import argparse


def lookup_by_id(sgid):
    sg = ec2.get_all_security_groups(group_ids=sgid)
    return sg[0].name

acumenix

#!/usr/bin/env python

import os
import boto3
import argparse
import json
# `pip install -U PTable` will get you the right fork of PrettyTable
from prettytable import PrettyTable

from botocore.exceptions import ClientError

acumenix

#!/usr/bin/env python3                                                                                                                                                                                                                        
#  -*- coding: utf-8 -*-                                                                                                                                                                                                                      

import argparse, sys, boto3
from colorama import Fore, Style

def count(my_list, my_key):
    if my_key not in my_list:
        return '0'
    else: