rileydakota / cfn-sweeper

A CLI Tool to find resources in an AWS Account not actively managed by Cloudformation!

Welcome to Dakota Riley's GitHub Portfolio page!

• Intro
• Speaking
• Blogs
• Contributions
• Other Fun Stuff

I am a Security Engineer, Consultant, and Leader with skills in Cloud Security, Application Security, Detection Engineering, and Automation.

"I just want to do cool cloud security stuff with my friends" - me

I have worked at startups, large enterprises, FAANG, and the Federal Government, helping customers solve security engineering challenges, as both a consultant, and owner. I enjoy getting to solve large scale challenges with both code and strategy, and enabling engineering teams to move fast without having to worry about security. I deeply care about making the right thing as easy as possible, and the end user experience of security.

I prefer environments that reward creative thinking, strong ownership of problems, and data driven decision making.

While I enjoy going deep on technical problems, I love being able to step back and solve problems at the source vs bandaid fixes.

Speaking

CloudNativeSecurityCon 2024: Detection Engineering in Kubernetes Environments

📈 Slides

AWS Community Day Midwest: Exploring Amazon Lake

📹 YouTube
📈 Slides
📓 Jupyter Notebook

SANS CloudSecNext 2023: Detective Controls in Kubernetes Environments

📹 Youtube

The Security Engineers Guide To Infrastructure-As-Code

📈 Slides

Blogs

Exploring the GitHub Advisory Database for fun and (no) profit

In this blog, I downloaded the entire GitHub Advisory Database, and loaded it into Pandas to look for trends across Open Source Vulnerabilities.

Tactical Cloud Audit Log Analysis with DuckDB - AWS CloudTrail \

In this blog, I cover how to load, parse, and interact with AWS CloudTrail logs utilizing DuckDB, a tool that allows you to locally query and interact with larger than memory datasets that still fit on a single device. Its a great tool for needing to query when you don't have a SIEM available, and is faster than Athena with certain data sizes.

Taking the Secrets Manager Lambda Extension for a spin

This blog, I use the AWS Secrets Manager Lambda extension in different Lambda functions, and benchmark how it impacts performance compared to other methods.

Threat Detection on EKS - Comparing Falco and GuardDuty for EKS Protection

I partnered with co-worker and friend Dustin Whited [@dgwhited] to compare Falco and EKS GuardDuty as options for threat detection in EKS environments.

Using Semgrep to find security issues and misconfigurations in AWS Cloud Development Kit projects

In this blog, I combined my love of static code analysis and infrastructure-as-code to find problems in CDK projects in the actual CDK code itself.

Contributions and OSS

Stratus Red Team - added GCP Support and Initial GCP Technique, added an EKS specific technique that eventually made it into the codebase as well

Peirates - added support for detecting AWS as a Cloud Provider when IMDSv2 is in use

Semgrep - added rules for the static analysis of AWS Cloud Development Kit (CDK) projects

Panther-Analysis - added new detection rules for CodeBuild Public Projects on AWS and some initial K8s rules (WIP)

Matano - added a managed enrichment table for the Cybersecurity and Infrastructure Agency Known Exploited Vulnerabilities (AKA CISA KEV), allowing users to help enrich/prioritize vulnerability finding data sources with KEV status.

CfnSweeper - A CLI tool I built for finding AWS resources unmanaged by AWS Cloudformation, built to help engineers clean up AWS resources often left behind from CDK constructs that have removalPolicies that retain the resource by default.

cfn-sweeper's Issues

Add ASCII Banner to help message

Self explanatory :)

Add Security Checking

https://github.com/marketplace/actions/python-security-check-using-bandit

Make sure README.md matches reality before release

Because we used the README as more of a design doc (written before implementation) - we should reevaluate it at somepoint to make sure we are planning to incorporate features or remove them from the doc

Add the ability to scan all supported resource types

Currently the tool requires specifying particular cloudformation resource types (eg AWS::EC2::Instance). We should add a parameter that allows the tool to scan all supported resource types without specifying them (and notify the user what types were not checked)

Add support for customizable output options

Our CLI Tool should be able to output in the following methods:

• pretty
• yaml
• stdout literally just a list of non-managed resources seperated by a newline character
• json

In addition - we should abstract the logic for this out of the main.py (eg - have an output.py module that contains a class for the reportdata with different methods to output to the various output formats)

Add some form of integration/E2E testing for our CLI tool

https://realpython.com/python-cli-testing/
https://stackoverflow.com/questions/51736864/how-to-test-command-line-applications-in-python

If user submits --filter-types as lowercase, just capitalize it or don't check it against REGEX

C:\Users\Root\Documents\GitHub\cfn-sweeper>cfn_sweeper --region ca-central-1 --filter-types AWS::EC2::instance
'AWS::EC2::instance'
Sorry - AWS::EC2::instance isnt supported just yet!
{}

C:\Users\Root\Documents\GitHub\cfn-sweeper>cfn_sweeper --region ca-central-1 --filter-types AWS::EC2::Instance

Bug: Tool won't consider stacks that are create/update in progress

Tool will potentially show managed resources as unmanaged in the case that a particular stack is in any updating status.

Likely solution is to add logic to consider other stack states, and also emit a warning to the user, as running this tool on a changing stack could have unknown consequences

cfn-sweeper/cfn_sweeper/base/cfn_resources.py

Line 29 in 0f76aed

StackStatusFilter=['CREATE_COMPLETE', 'UPDATE_COMPLETE'])

Add GitHub Actions checks

On Pull Requests - we should run the following:

• pylint
• bandit
• pytest

some sort of code coverage tool would be ideal as well

Add a method of hiding known preset resources (eg - Default VPC)

Allow users a method of hiding resources that are known to not be managed by CloudFormation. Common examples are:

• The Default VPC and security groups
• AWS Managed CMKs which are created for you, and cannot be deleted or managed by CFN
  etc

Add a method for a user to list current supported resources via the CLI

Add what stack is managing the Cloudformation Resource

Add configurable logging

The user should be able to specify a "verbosity" setting that will change the amount of log information the tool emits. In addition - we should try to seperate this from the boto3 logging (turning our setting on shouldnt spew all the unneeded boto3 logs).

Bug: S3 Buckets in regions other then the region provided to the tool show as unmanaged

Steps to recreate:

1. Create a Cloudformation Stack in two seperate regions - that creates an AWS::S3::Bucket resource.
2. Run the tool on one of the two regions - the bucket that is in the region other then the tool will show as unmanaged

could use https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html in the resource provider to eliminate this?

Add validation of user provided parameters to prevent unexpected crashes

Ideally - we should check that user provided command line parameters are actually valid:

• Pattern checking for AWS Regions and AWS Cloudformation Resource Types
• strict checking for all other parameters