obijan42

sudo rm -rf "/Applications/Amazon WorkDocs Drive.app" "/Library/Application Support/com.Amazon.WorkDocs.DriveUpdater" "/Library/StagedExtensions/Library/Filesystems/AmazonWorkDocs.fs" "/Library/Filesystems/AmazonWorkDocs.fs" /Library/LaunchDaemons/com.Amazon.WorkDocs.DriveUpdater.plist

rm -rf ~/.config/Amazon/AWSWorkDocs*. ~/Library/*/*workdocs*  ~/Library/*/*WorkDocs*
sudo rm -r /Library/Filesystems/__MACOSX/AmazonWorkDocs.fs
sudo rm /Library/Application\ Support/JAMF/Receipts/AmazonWorkDocs* 

obijan42

#!/bin/bash

# Finding: CodeBuild.5 CodeBuild project environments should not have privileged mode enabled

# This script reviews CodeBuild project environments and ensures privileged mode is disabled.

# Get list of CodeBuild projects
projects=$(aws codebuild list-projects --query 'projects' --output text)

# Loop through each project

obijan42

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Create a Lambda function to add a security group to every EC2 instance and schedule it to run daily'

Resources:
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:

obijan42

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NoConsoleUsers",
      "Effect": "Deny",
      "Action": "iam:CreateLoginProfile",
      "Resource": "*"
    }
  ]

obijan42

#!/usr/bin/env bash

# Log to syslog if output streams not attached to a terminal (cron, launchd)
if ! test -t 1 && ! test -t 2; then
  exec 1> >(tee >(logger -t $(basename $0))) 2>&1
fi

# Assign the arguments to variables
# saner programming env: these switches turn some bugs into errors
set -eu -o errexit -o pipefail -o noclobber -o nounset

obijan42

Reference:
https://github.com/awslabs/aws-config-resource-schema/tree/master/config/properties/resource-types


-- List active cloudtrails
SELECT
  accountId,
  awsRegion,
  resourceId,
  configuration.s3BucketName,

obijan42

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:*AccessKey*",
                "iam:GetUser",
                "iam:*ServiceSpecificCredential*",
                "iam:*SigningCertificate*"

obijan42

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "NoRoot",
			"Effect": "Deny",
			"Action": "*",
			"Resource": "*",
			"Condition": {
				"StringLike": {

obijan42

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "organizations:Remove*",
                "organizations:Move*",
                "organizations:Create*",
                "organizations:Attach*",

obijan42

# Via CFT:
https://g.obijan.com/awsaccess

# For ssh:

curl https://github.com/obijan42.keys >> ~ec2-user/.ssh/authorized_keys