From 8cc7331e75af6568777b41ce05bbcc1526a1bd11 Mon Sep 17 00:00:00 2001 From: cktricky Date: Wed, 25 Apr 2018 00:00:00 -0400 Subject: [PATCH 1/5] working thru this but still testing --- libs/config.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libs/config.py b/libs/config.py index 22356bc..b7d3de4 100644 --- a/libs/config.py +++ b/libs/config.py @@ -26,7 +26,7 @@ def describe_configuration_recorders(region): client = boto3.client("config", region_name=region) response = client.describe_configuration_recorders() - # print response + print(response) except botocore.exceptions.ClientError as e: if e.response['Error']['Code'] == 'InvalidClientTokenId': sys.exit("The AWS KEY IS INVALID. Exiting") @@ -54,7 +54,7 @@ def describe_configuration_rules(region): client = boto3.client("config", region_name=region) response = client.describe_config_rules() - # print response + print(response) except botocore.exceptions.ClientError as e: if e.response['Error']['Code'] == 'InvalidClientTokenId': sys.exit("The AWS KEY IS INVALID. Exiting") @@ -74,3 +74,6 @@ def describe_configuration_rules(region): print("CTRL-C received, exiting...") return response + +def list_all_config_rules(): + describe_configuration_rules('us-east-1') From 4e7891e668634bb001811b5411c8488aaf0bed12 Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 26 Apr 2018 10:53:59 -0400 Subject: [PATCH 2/5] creating two separate functions --- libs/config.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libs/config.py b/libs/config.py index b7d3de4..c38963d 100644 --- a/libs/config.py +++ b/libs/config.py @@ -77,3 +77,6 @@ def describe_configuration_rules(region): def list_all_config_rules(): describe_configuration_rules('us-east-1') + +def list_all_config_recorders(): + describe_configuration_recorders('us-east-1') From 56d01a0aaa55bc132aeedf4cc7359884d91c5f0e Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 26 Apr 2018 11:46:05 -0400 Subject: [PATCH 3/5] this is printing much prettier than before --- libs/config.py | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/libs/config.py b/libs/config.py index c38963d..179de3c 100644 --- a/libs/config.py +++ b/libs/config.py @@ -26,7 +26,16 @@ def describe_configuration_recorders(region): client = boto3.client("config", region_name=region) response = client.describe_configuration_recorders() - print(response) + region_name = "Region: %s\n" % region + print(region_name) + print("=" * len(region_name)) + if not response['ConfigurationRecorders']: + print("No Rules Found") + else: + for r in response['ConfigurationRecorders']: + for k,v in r.items(): + print("%s: %s" % (k,v)) + print("\n") except botocore.exceptions.ClientError as e: if e.response['Error']['Code'] == 'InvalidClientTokenId': sys.exit("The AWS KEY IS INVALID. Exiting") @@ -54,7 +63,16 @@ def describe_configuration_rules(region): client = boto3.client("config", region_name=region) response = client.describe_config_rules() - print(response) + region_name = "Region: %s" % region + print(region_name) + print("=" * len(region_name)) + if not response['ConfigRules']: + print("No Rules Found") + else: + for r in response['ConfigRules']: + for k,v in r.items(): + print("%s: %s" % (k,v)) + print("\n") except botocore.exceptions.ClientError as e: if e.response['Error']['Code'] == 'InvalidClientTokenId': sys.exit("The AWS KEY IS INVALID. Exiting") @@ -75,8 +93,11 @@ def describe_configuration_rules(region): return response + def list_all_config_rules(): - describe_configuration_rules('us-east-1') + for region in regions: + describe_configuration_rules(region) def list_all_config_recorders(): - describe_configuration_recorders('us-east-1') + for region in regions: + describe_configuration_recorders(region) From f0a3ea9fe0fb273196c144339d30e1c6d625748b Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 26 Apr 2018 12:53:49 -0400 Subject: [PATCH 4/5] added the ability to delete recorders and rules from Config service --- libs/config.py | 61 ++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 7 deletions(-) diff --git a/libs/config.py b/libs/config.py index 179de3c..8be2966 100644 --- a/libs/config.py +++ b/libs/config.py @@ -21,7 +21,6 @@ AWS_ACCESS_KEY_ID = credentials.access_key def describe_configuration_recorders(region): - response = [] try: client = boto3.client("config", region_name=region) @@ -30,7 +29,7 @@ def describe_configuration_recorders(region): print(region_name) print("=" * len(region_name)) if not response['ConfigurationRecorders']: - print("No Rules Found") + print("No Recordings Found\n") else: for r in response['ConfigurationRecorders']: for k,v in r.items(): @@ -54,11 +53,8 @@ def describe_configuration_recorders(region): except KeyboardInterrupt: print("CTRL-C received, exiting...") - return response - def describe_configuration_rules(region): - response = [] try: client = boto3.client("config", region_name=region) @@ -67,7 +63,7 @@ def describe_configuration_rules(region): print(region_name) print("=" * len(region_name)) if not response['ConfigRules']: - print("No Rules Found") + print("No Rules Found\n") else: for r in response['ConfigRules']: for k,v in r.items(): @@ -91,8 +87,51 @@ def describe_configuration_rules(region): except KeyboardInterrupt: print("CTRL-C received, exiting...") - return response +def delete_rule(rule_name, region): + try: + client = boto3.client("config", region_name=region) + client.delete_config_rule(ConfigRuleName=rule_name) + print("Successfully deleted %s from %s!" % (rule_name, region)) + except botocore.exceptions.ClientError as e: + if e.response['Error']['Code'] == 'InvalidClientTokenId': + sys.exit("The AWS KEY IS INVALID. Exiting") + elif e.response['Error']['Code'] == 'UnrecognizedClientException': + sys.exit("The AWS KEY IS INVALID. Exiting") + elif e.response['Error']['Code'] == 'AccessDenied': + print('[-] {} : does not have config access. Did you check first?' .format(AWS_ACCESS_KEY_ID)) + pass + elif e.response['Error']['Code'] == 'AccessDeniedException': + print('[-] {} : does not have config access. Did you check first?' .format(AWS_ACCESS_KEY_ID)) + pass + elif e.response['Error']['Code'] == 'SubscriptionRequiredException': + print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID)) + else: + print("Unexpected error: {}" .format(e)) + except KeyboardInterrupt: + print("CTRL-C received, exiting...") +def delete_recorder(recorder_name, region): + try: + client = boto3.client("config", region_name=region) + client.delete_configuration_recorder(ConfigurationRecorderName=recorder_name) + print("Successfully deleted %s from %s!" % (recorder_name, region)) + except botocore.exceptions.ClientError as e: + if e.response['Error']['Code'] == 'InvalidClientTokenId': + sys.exit("The AWS KEY IS INVALID. Exiting") + elif e.response['Error']['Code'] == 'UnrecognizedClientException': + sys.exit("The AWS KEY IS INVALID. Exiting") + elif e.response['Error']['Code'] == 'AccessDenied': + print('[-] {} : does not have config access. Did you check first?' .format(AWS_ACCESS_KEY_ID)) + pass + elif e.response['Error']['Code'] == 'AccessDeniedException': + print('[-] {} : does not have config access. Did you check first?' .format(AWS_ACCESS_KEY_ID)) + pass + elif e.response['Error']['Code'] == 'SubscriptionRequiredException': + print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID)) + else: + print("Unexpected error: {}" .format(e)) + except KeyboardInterrupt: + print("CTRL-C received, exiting...") def list_all_config_rules(): for region in regions: @@ -101,3 +140,11 @@ def list_all_config_rules(): def list_all_config_recorders(): for region in regions: describe_configuration_recorders(region) + +def delete_config_rule(rule_name, region): + if rule_name: + delete_rule(rule_name, region) + +def delete_config_recorder(recorder_name, region): + if recorder_name: + delete_recorder(recorder_name, region) From c5dd215323932b85ba538b87b7d397459716ca2e Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 26 Apr 2018 12:59:32 -0400 Subject: [PATCH 5/5] we can no longer ignore config.py because it is necessary --- .gitignore | 2 +- modules/config.py | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 modules/config.py diff --git a/.gitignore b/.gitignore index 5ee9a1d..43e60a8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,5 @@ #let's attempt not to check in config.py with keys -config.py +#config.py #weirdAAL.db *.db diff --git a/modules/config.py b/modules/config.py new file mode 100644 index 0000000..892f341 --- /dev/null +++ b/modules/config.py @@ -0,0 +1,25 @@ +''' +Module for interacting with the config service +''' + +from libs.config import * + +def module_config_list_all_rules(): + list_all_config_rules() + +def module_config_list_all_recorders(): + list_all_config_recorders() + +def module_config_delete_rule(*args): + try: + if args[0][0] and args[0][1]: + delete_config_rule(args[0][0], args[0][1]) + except IndexError: + print("You must provide the rule name and region name: -a someRuleName,us-east-1") + +def module_config_delete_recorder(*args): + try: + if args[0][0] and args[0][1]: + delete_config_recorder(args[0][0], args[0][1]) + except IndexError: + print("You must provide the recorder name and region name: -a someRecorderName,us-east-1")