AWS CloudSaga - Simulate security events in AWS

Overview

AWS CloudSaga - Simulate security events in AWS

AWS CloudSaga is for customers to test security controls and alerts within their Amazon Web Services (AWS) environment, using generated alerts based on security events seen by the AWS Customer Incident Response Team (CIRT).

Use Case

Security controls and best practices are published for securing AWS accounts, however, customers look for mechanisms to test security and incident response within their AWS environments, in order to protect themselves against known security events.

AWS CloudSaga is for customers who want to test their environment against documented security events from the AWS CIRT. Using AWS CloudSaga, simple scenarios that mimic actual security events can be run against a customer's environment, testing the customer's response plans and defenses when these events occur, and improve defenses of their AWS environment from the results.

Usage

cloudsaga



     ___   ____    __    ____   _______.          
    /   \  \   \  /  \  /   /  /       |         
   /  ^  \  \   \/    \/   /  |   (----`       
  /  /_\  \  \            /    \   \         
 /  _____  \  \    /\    / .----)   |      
/__/     \__\  \__/  \__/  |_______/       

  ______  __        ______    __    __   _______       _______.     ___       _______      ___
 /      ||  |      /  __  \  |  |  |  | |       \     /       |    /   \     /  _____|    /   \ 
|  ,----'|  |     |  |  |  | |  |  |  | |  .--.  |   |   (----`   /  ^  \   |  |  __     /  ^  \ 
|  |     |  |     |  |  |  | |  |  |  | |  |  |  |    \   \      /  /_\  \  |  | |_ |   /  /_\  \ 
|  `----.|  `----.|  `--'  | |  `--'  | |  '--'  |.----)   |    /  _____  \ |  |__| |  /  _____  \  
 \______||_______| \______/   \______/  |_______/ |_______/    /__/     \__\ \______| /__/     \__\ 
                                                                                                                                               


            Joshua "DozerCat" McKiddy - Team DragonCat - AWS
            Type -h for help.

    usage: cloudsaga [-h] [--scenario SCENARIO] [--chapters] [--about ABOUT]

    CloudSaga - Simulate security events based on previous Ziplines

    optional arguments:
    -h, --help           show this help message and exit
    --scenario SCENARIO  Perform the scenario you want to run against your AWS
                        environment.
    --chapters           List the available scenarios within CloudSaga. Use the
                        --about flag to read details about a specific scenario.
    --about ABOUT        Read about a specific scenario (e.g. --about
                        <scenario>. For a list of available scenarios, use the
                        --chapters flag.

Prerequesites

Permissions

The following permissions are needed within AWS IAM for CloudSaga to run:

  • For imds-reveal:
"ec2:DescribeInstances"
  • For network-changes:
"ec2:DescribeInstances",
"ec2:RunInstances",
"ec2:CreateVpc",
"ec2:DescribeVpcs",
"ec2:CreateSecurityGroup"
  • For mining-bitcoin:
"ec2:DescribeInstances",
"ec2:RunInstances"
  • For iam-credentials:
"iam:GenerateCredentialReport",
"iam:GetCredentialReport"
  • For public-resources:
"rds:DescribeDBInstances",
"rds:CreateDBInstance",
"rds:DeleteDBInstance",
"s3:ListBuckets",
"s3:CreateBucket",
"s3:PutPublicAccessBlock",
"s3:DeletePublicAccessBlock"

Specific Scenario Details

IMDS Reveal Scenario:
This scenario is based on a server-side request forgery attack. 
EC2 instances using IMDS version 1 are more likely to be subject to this 
kind of software flaw, and if EC2 Role credentials are present, those 
credentials can be used in AWS.
Bitcoin Mining Scenario:
This scenario simulates the creation of Bitcoin mining instances.
Attackers attempt to create Bitcoin mining instances using Amazon EC2,
in order to leverage legitimate AWS customer's resources for their own purposes.
Network Changes Scenario:
This scenario simulates the creation and modification of network resources within
AWS. This includes creating Amazon VPCs, as well as modifications to Security Groups,
for the purposes of compromising resources within the AWS account.
IAM Credentials Scenario:
This scenario attempts to grab the IAM credential report within the AWS account.
Publicly Accessible Resources Scenario:
This scenario is for creating then checking for publicly accessible resources within an AWS account.

Running the Code

The code in it's current form can be ran inside the following:

  • AWS CloudShell (preferred)
  • Locally (with IAM credentials, not preferred)

Prerequisites

The following prerequisites are required to use AWS CloudSaga

  • Python 3.7 or later
  • boto3 1.21.7 or later
  • pip3 (for installation of AWS CloudSaga)

Installing the code

Installation of the code is done via pip3:

pip3 install cloudsaga

Step-by-Step Instructions (for running in AWS CloudShell)

  1. Log into the AWS Console of the account you want to run AWS CloudSaga.
  2. Click on the icon for AWS Cloudshell next to the search bar.
    • Ensure that you're in a region where AWS CloudShell is currently available.
  3. Once the session begins, install AWS CloudSaga via pip3:
pip3 install cloudsaga
  1. Once installed, run the following command to review the help page for AWS CloudSaga.
cloudsaga -h
  1. Review the scenarios, select the one that you want to run for generating your security event for testing.

Logging

A log file containing the detailed output of actions will be placed in the root directory of AWS CloudSaga. The format of the file will be cloudsaga_timestamp_here.log

Sample output within the log file:

2022-02-22 01:20:47,826 - INFO - --Checking instances in AWS region me-south-1--
2022-02-22 01:20:47,826 - INFO - DescribeInstances API Call in AWS region me-south-1--
2022-02-22 01:20:48,712 - INFO - You cannot perform lookup of IMDS versions in this region. Error message below:
2022-02-22 01:20:48,712 - ERROR - An error occurred (AuthFailure) when calling the DescribeInstances operation: AWS was not able to validate the provided access credentials
2022-02-22 01:20:48,713 - INFO - --Checking instances in AWS region sa-east-1--
2022-02-22 01:20:48,713 - INFO - DescribeInstances API Call in AWS region sa-east-1--
2022-02-22 01:20:49,525 - INFO - --Checking instances in AWS region us-east-1--
2022-02-22 01:20:49,525 - INFO - DescribeInstances API Call in AWS region us-east-1--
2022-02-22 01:20:49,876 - INFO - --Checking instances in AWS region us-east-2--
2022-02-22 01:20:49,876 - INFO - DescribeInstances API Call in AWS region us-east-2--
2022-02-22 01:20:50,192 - INFO - --Checking instances in AWS region us-west-1--
2022-02-22 01:20:50,192 - INFO - DescribeInstances API Call in AWS region us-west-1--
2022-02-22 01:20:50,444 - INFO - --Checking instances in AWS region us-west-2--
2022-02-22 01:20:50,445 - INFO - DescribeInstances API Call in AWS region us-west-2--
2022-02-22 01:20:50,610 - INFO - Instance ID i-99999999999999999 is using IMDSv1, where no authentication header is required to access the IMDS service.

Cleaning Up

Once the logs have been enabled, you can safely remove any of the downloaded files from AWS CloudShell.

  • Note: The log file containing the detailed output of actions will be in the root directory of AWS CloudSaga. If you want to retain this, please download this to a safe place, either locally or to an Amazon S3 bucket, for your records. For information on how to download files from AWS CloudShell sessions, refer to the following link.

Feedback

Please use the Issues section to submit any feedback, such as features or recommendations, as well as any bugs that are encountered.

Security

See CONTRIBUTING for more information.

License

This project is licensed under the Apache-2.0 License.

Comments
  • Feature request: formal package and entrypoint

    Feature request: formal package and entrypoint

    The current workflow dictates that a user clone this repository and interact with the cloudsaga.py directly.

    I propose transitioning to a pyproject.toml driven workflow using poetry to handle virtual environments, package management, and publishing activities (to pypi). This pyproject.toml will define an entrypoint cloudsaga.cloudsaga:main and restructure the repo to conform to a python package layout.

    enhancement 
    opened by mbeacom 2
  • 1.0.1

    1.0.1

    Issue #, if available: https://github.com/awslabs/aws-cloudsaga/issues/2 Description of changes:

    • Changed
      • Converted to a Python package downloadable by pip3

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    documentation enhancement 
    opened by hackersifu 1
  • Update iam_credentials.py

    Update iam_credentials.py

    Issue #, if available:

    Description of changes:

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    opened by cydneystude 0
  • Update the readme to reflect new entrypoint usage

    Update the readme to reflect new entrypoint usage

    Issue #, if available: N/A

    Description of changes: The goal of this PR is to update the README.md to reflect the updated entrypoint usage (cloudsaga vs cloudsaga.py)

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    documentation 
    opened by mbeacom 0
  • Enable automatic release to PyPi on tag

    Enable automatic release to PyPi on tag

    Issue #, if available: N/A

    Description of changes: The purpose of this PR is to introduce a new GitHub Action to publish f.reshly tagged packages to PyPi

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    documentation enhancement 
    opened by mbeacom 0
  • Adjust project structure and introduce pyproject.toml

    Adjust project structure and introduce pyproject.toml

    Issue #, if available: #2

    Description of changes: The goal of this PR is to format the project to conform to a standard python package and add a toplevel pyproject.toml to handle package/dep management, venv management, and publishing while also conforming to a versioning python package structure.

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    enhancement 
    opened by mbeacom 0
  • Update README.md

    Update README.md

    Recommending language change associated with IMDSv1.

    Issue #, if available:

    Description of changes:

    By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

    opened by kihakuni 0
  • Issue executing CloudSaga

    Issue executing CloudSaga

    Hi,

    I have a problem executing CloudSaga.

    I executed it in CloudShell and I have administrator access to the AWS account.

    I am getting this error:

    2022-09-23 07:49:50,878 - INFO - CreateVpc API Call 2022-09-23 07:49:51,775 - ERROR - An error occurred (DryRunOperation) when calling the CreateVpc operation: Request would have succeeded, but DryRun flag is set. 2022-09-23 07:49:51,785 - INFO - Creating rogue Amazon VPC in region ap-southeast-2... 2022-09-23 07:49:51,785 - INFO - CreateVpc API Call 2022-09-23 07:49:52,844 - ERROR - An error occurred (DryRunOperation) when calling the CreateVpc operation: Request would have succeeded, but DryRun flag is set. 2022-09-23 07:49:52,854 - INFO - Creating rogue Amazon VPC in region us-west-2... 2022-09-23 07:49:52,855 - INFO - CreateVpc API Call 2022-09-23 07:49:53,576 - ERROR - An error occurred (DryRunOperation) when calling the CreateVpc operation: Request would have succeeded, but DryRun flag is set. 2022-09-23 07:49:53,620 - INFO - Creating rogue Amazon VPC in region ca-central-1... 2022-09-23 07:49:53,620 - INFO - CreateVpc API Call 2022-09-23 07:49:54,050 - ERROR - An error occurred (DryRunOperation) when calling the CreateVpc operation: Request would have succeeded, but DryRun flag is set. 2022-09-23 07:49:54,058 - INFO - Looking for existing VPCs to run DryRun security events in region eu-central-1... 2022-09-23 07:49:54,059 - INFO - DescribeVpcs API Call 2022-09-23 07:49:54,211 - INFO - Creating Security Group in existing VPC (DryRun)... 2022-09-23 07:49:54,353 - ERROR - An error occurred (DryRunOperation) when calling the CreateSecurityGroup operation: Request would have succeeded, but DryRun flag is set. 2022-09-23 07:49:54,362 - INFO - Looking for existing VPCs to run DryRun security events in region eu-central-1... 2022-09-23 07:49:54,362 - INFO - DescribeVpcs API Call 2022-09-23 07:49:54,423 - INFO - Creating Security Group in existing VPC (DryRun)... 2022-09-23 07:49:54,558 - ERROR - An error occurred (DryRunOperation) when calling the CreateSecurityGroup operation: Request would have succeeded, but DryRun flag is set.

    2022-09-23 07:22:29,268 - INFO - Spinning up Bitcoin Miners (DryRun) in region ap-northeast-3... 2022-09-23 07:22:29,268 - INFO - RunInstances API Call 2022-09-23 07:22:30,334 - ERROR - An error occurred (UnsupportedOperation) when calling the RunInstances operation: Tagging an elastic gpu on create is not yet supported in this region. 2022-09-23 07:22:30,344 - INFO - Spinning up Bitcoin Miners (DryRun) in region us-west-2... 2022-09-23 07:22:30,344 - INFO - RunInstances API Call 2022-09-23 07:22:31,635 - ERROR - An error occurred (DryRunOperation) when calling the RunInstances operation: Request would have succeeded, but DryRun flag is set.

    An error occurred (DryRunOperation) when calling the RunInstances operation: Request would have succeeded, but DryRun flag is set An error occurred (UnsupportedOperation) when calling the RunInstances operation: Tagging an elastic gpu on create is not yet supported in this region An error occurred (DryRunOperation) when calling the CreateSecurityGroup operation: Request would have succeeded, but DryRun flag is set

    opened by Ameurdx 2
Releases(v1.0.1)
  • v1.0.1(Feb 25, 2022)

    Changed

    • README file to reflect new installation instructions
      • AWS CloudSaga is used via pip3 installer

    Credit to Mark Beacom @mbeacom for this release.

    Source code(tar.gz)
    Source code(zip)
  • v1.0.0(Feb 22, 2022)

    Introducing AWS CloudSaga, an open source tool for simulating security events in AWS.

    AWS CloudSaga is for customers to test security controls and alerts within their Amazon Web Services (AWS) environment, using generated alerts based on security events seen by the AWS Customer Incident Response Team (CIRT).

    Security controls and best practices are published for securing AWS accounts, however, customers look for mechanisms to test security and incident response within their AWS environments, in order to protect themselves against known security events.

    AWS CloudSaga is for customers who want to test their environment against documented security events from the AWS CIRT. Using AWS CloudSaga, simple scenarios that mimic actual security events can be run against a customer's environment, testing the customer's response plans and defenses when these events occur, and improve defenses of their AWS environment from the results.

    Source code(tar.gz)
    Source code(zip)
Owner
Amazon Web Services - Labs
AWS Labs
Amazon Web Services - Labs
A management system designed for the employees of MIRAS (Art Gallery). It is used to sell/cancel tickets, book/cancel events and keeps track of all upcoming events.

Art-Galleria-Management-System Its a management system designed for the employees of MIRAS (Art Gallery). Backend : Python Frontend : Django Database

Areesha Tahir 8 Nov 30, 2022
Access Undenied parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable remediation steps. Open-sourced by Ermetic.

Access Undenied on AWS Access Undenied parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable fixes. Access U

Ermetic 204 Jan 2, 2023
Automated AWS account hardening with AWS Control Tower and AWS Step Functions

Automate activities in Control Tower provisioned AWS accounts Table of contents Introduction Architecture Prerequisites Tools and services Usage Clean

AWS Samples 20 Dec 7, 2022
Implement backup and recovery with AWS Backup across your AWS Organizations using a CI/CD pipeline (AWS CodePipeline).

Backup and Recovery with AWS Backup This repository provides you with a management and deployment solution for implementing Backup and Recovery with A

AWS Samples 8 Nov 22, 2022
DevSecOps pipeline for Python based web app using Jenkins, Ansible, AWS, and open-source security tools and checks.

DevSecOps pipeline for Python Web App A Jenkins end-to-end DevSecOps pipeline for Python web application, hosted on AWS Ubuntu 20.04 Note: This projec

Devanshu Vashishtha 4 Aug 15, 2022
Receive GitHub webhook events and send to Telegram chats with AIOHTTP through Telegram Bot API

GitHub Webhook to Telegram Receive GitHub webhook events and send to Telegram chats with AIOHTTP through Telegram Bot API What this project do is very

Dash Eclipse 33 Jan 3, 2023
IACR Events Scraper

IACR Events Scraper This scrapes https://iacr.org/events/ and exports it as a calendar file. I host a version of this for myself under https://arrrr.c

Karolin Varner 6 May 28, 2022
a harbinger of events or things.

Herald: Intrusion Detection System using IR and ML Herald - noun; a harbinger of events or things. Overview Herald is an intrusion detection system us

Muhammad Muzzammil 4 Jun 7, 2021
Custom bot I've made to host events on my personal Discord server.

discord_events Custom bot I've made to host events on my personal Discord server. You can try the bot out in my personal server here: https://discord.

AlexFlipnote 5 Mar 16, 2022
📅 Calendar file generator for triathlonlive.tv upcoming events

Triathlon Live Calendar Calendar file generator for triathlonlive.tv upcoming events. Install Requires Python 3.9.4 and Poetry. $ poetry install Runni

Eduardo Cuducos 4 Sep 2, 2022
An implementation of webhook used to notify GitHub repository events to DingTalk.

GitHub to DingTask An implementation of webhook used to notify GitHub repository events to DingTalk.

Prodesire 5 Oct 2, 2022
A simple python bot that serves to send some notifications about GitHub events to Slack.

github alerts slack bot ?? What is it? ?? This is a simple bot that serves to send some notifications about GitHub events to Slack channels. These are

Jackson Alves 10 Dec 10, 2022
Simple Discord bot which logs several events in your server

logging-bot Simple Discord bot which logs several events in your server, including: Message Edits Message Deletes Role Adds Role Removes Member joins

null 1 Feb 14, 2022
Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance frameworks.

aws-allowlister Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance fr

Salesforce 189 Dec 8, 2022
SSH-Restricted deploys an SSH compliance rule (AWS Config) with auto-remediation via AWS Lambda if SSH access is public.

SSH-Restricted SSH-Restricted deploys an SSH compliance rule with auto-remediation via AWS Lambda if SSH access is public. SSH-Auto-Restricted checks

Adrian Hornsby 30 Nov 8, 2022
AWS Auto Inventory allows you to quickly and easily generate inventory reports of your AWS resources.

Photo by Denny Müller on Unsplash AWS Automated Inventory ( aws-auto-inventory ) Automates creation of detailed inventories from AWS resources. Table

AWS Samples 123 Dec 26, 2022
A suite of utilities for AWS Lambda Functions that makes tracing with AWS X-Ray, structured logging and creating custom metrics asynchronously easier

A suite of utilities for AWS Lambda Functions that makes tracing with AWS X-Ray, structured logging and creating custom metrics asynchronously easier

Amazon Web Services - Labs 1.9k Jan 7, 2023
aws-lambda-scheduler lets you call any existing AWS Lambda Function you have in a future time.

aws-lambda-scheduler aws-lambda-scheduler lets you call any existing AWS Lambda Function you have in the future. This functionality is achieved by dyn

Oğuzhan Yılmaz 57 Dec 17, 2022