AWS Tower - scan

aws_tower_cli.scan.sh

$ ./aws_tower_cli.py scan my-aws-account-profile 
{
    "vpc-1234567980": {
        "main-vpc-intra": {},
        "main-vpc-private": {
            "EC2": [
                {
                    "Name": "patrowl-manager",
                    "PrivateIpAddress": "10.10.1.49",
                    "PubliclyAccessible": false,
                    "SecurityIssues": [
                        {
                            "severity": "low",
                            "title": "[sg-1234] Allow connection to specific port (or range) from private network (192.168.1.0/24=>22)"
                        }
                    ]
                }
                {
                    "Name": "sast",
                    "PrivateIpAddress": "10.10.1.60",
                    "PubliclyAccessible": false,
                    "SecurityIssues": [
                        {
                            "severity": "low",
                            "title": "[sg-5678] Allow connection to specific port (or range) from private network (192.168.1.0/24=>22)"
                        }
                    ]
                }
            ]
        },
        "main-vpc-private-lb": {
            "ELBV2": [
                {
                    "DNSName": "internal-patrowl-manager-lb-20201127.eu-west-1.elb.amazonaws.com",
                    "DnsRecord": "patrowl.my-private-domain.com.",
                    "PubliclyAccessible": false,
                    "SecurityIssues": [
                        {
                            "severity": "low",
                            "title": "[sg-9012] Allow connection to specific port (or range) from private network (192.168.1.0/24=>443)"
                        },
                        {
                            "severity": "medium",
                            "title": "DnsRecord: patrowl.my-private-domain.com."
                        }
                    ]
                }
            ]
        },
        "main-vpc-public": {
            "EC2": [
                {
                    "Name": "custom-nginx",
                    "PrivateIpAddress": "10.11.1.59",
                    "PublicIpAddress": "15.200.200.20",
                    "PubliclyAccessible": true,
                    "SecurityIssues": [
                        {
                            "severity": "high",
                            "title": "[sg-1245] Allow connection to specific port (or range) from public network (0.0.0.0/0=>80)"
                        },
                        {
                            "severity": "low",
                            "title": "[sg-1245] Allow connection to specific port (or range) from private network (192.168.0.254/32=>22)"
                        },
                        {
                            "severity": "low",
                            "title": "[sg-1245] Allow connection to specific port (or range) from private network (192.168.1.0/24=>22)"
                        },
                        {
                            "severity": "high",
                            "title": "[sg-1245] Allow connection to specific port (or range) from public network (89.9.9.9/32=>22)"
                        },
                        {
                            "severity": "high",
                            "title": "[sg-1245] Allow connection to specific port (or range) from public network (0.0.0.0/0=>9000)"
                        }
                    ]
                }
            ]
        },
        "main-vpc-public-lb": {}
    }
}