kmcquade

#!/usr/bin/python2.7
import ConfigParser
import os
import sys
from os.path import expanduser

config = ConfigParser.RawConfigParser()

# credentials_file: The file where this script will grab the temp creds
credentials_file = '/.aws/credentials'

kmcquade

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventSelfManagedImages",
      "Action": [
            "ecr:BatchDeleteImage",
            "ecr:CompleteLayerUpload",
            "ecr:Create*",
            "ecr:Delete*",

kmcquade

#!/bin/bash

# Clone the Firing Range Repository
git clone https://github.com/google/firing-range.git

# Change to 'firing-range' directory
cd firing-range

# Download the AppEngine SDK
wget https://storage.googleapis.com/appengine-sdks/featured/appengine-java-sdk-1.9.23.zip

kmcquade

--- # OWASP ZAP automation configuration file, for more details see https://www.zaproxy.com/docs/(TBA)
env:                                      # The environment, mandatory
  contexts:                               # List of 1 or more contexts, mandatory
    - name: context 1                     # Name to be used to refer to this context in other jobs, mandatory
      url: http://demo.testfire.net/             # The top level url, mandatory, everything under this will be included
      includePaths:  # TBA: An optional list of regexes to include
      excludePaths:  # TBA: An optional list of regexes to exclude
      authentication:                     # TBA: In time to cover all auth configs
  parameters:
    failOnError: true                  # If set exit on an error

kmcquade

### 
# Format is below
#
# risk-name:
#   target-name:  # AND logic
#     - service:actionName
#     - service:act* 
#
####
# List of high priority resource exposure actions here: https://gist.github.com/kmcquade/3161a6737285dc0508a9fa3446e22090

kmcquade

IAM Actions that can expose resources via Resource Based Policies

ACM Private CAs:

• acm-pca:PutPolicy: Puts a policy on an ACM Private CA.
• acm-pca:DeletePolicy: Deletes the policy for an ACM Private CA.

CloudWatch Logs:

• logs:PutResourcePolicy: Creates or updates a resource policy allowing other AWS services to put log events to this account
• logs:DeleteResourcePolicy: Deletes a resource policy from this account. This revokes the access of the identities in that policy to put log events to this account.

kmcquade

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:*::image/ami-*",
            "Condition": {
                "StringNotEquals": {

kmcquade

{
  "Statement": [
    {
      "Action": [
        "appsync:ListApiKeys",
        "chatbot:*",
        "codecommit:GetFile",
        "codecommit:GetCommit",
        "codecommit:GetDifferences",
        "codepipeline:PollForJobs",

kmcquade

Files are below.

For VSCode, paste it here: https://snippet-generator.app/

kmcquade

python_terraform==0.10.1