Alright.
In the previous clip, we created a vulnerable AWS environment.
If you already had one, that's what we're now going to use.
If you just created one, then we'll use that.
Now what we need to do is download Scout Suite itself.
So we'll use git clone and paste the URL to the GitHub repo.
Scout Suite just got downloaded, and as you can see,
a ScoutSuite directory was created.
Now if we tried to run it with python3 scout.py,
it would fail because it's missing a dependency.
Now in the previous slides, I hid a link to all the different dependencies,
but what I'm going to do is start by installing python3‑pip,
which is a package manager for Python, and python‑dateutil,
which I know we're going to need.
Once these are installed,
I'm going to use pip3 to install a bunch of other dependencies. So I'll use
pip3 install and specify all those different dependencies.
Again, these are available in dependencies.txt in the course files.
There it is.
So we'll try to run Scout Suite again.
Alright, it is running, but it's saying we need to input a provider.
For those of you that did install sadcloud with Terraform in the previous clip,
you actually already have the right privileges to do that.
So you could run scout.py with the aws command to simply run all
the default checks against Amazon Web Services.
It is using very high privileges, though,
because we were essentially logged in as root to Amazon to do that.
While it is working,
that's not what you'd want to do if you're scanning a real cloud
environment because you don't want to have to tell your customers to
give you full read/write access to everything in their cloud
environment, you need to be more specific.
So I'll let this run in the background,
but I'll open up a web browser where we can go and configure
AWS IAM roles specific to Scout Suite.
On the Scout Suite wiki,
there is a Minimal Privileges Policy found that is available.
We'll copy that JSON and we'll go create a policy
specifically for that so we can be sure that Scout Suite is
using exactly what it needs and no more.
I'm going to switch to the Amazon Web Services console right now.
Okay, once I'm logged in, I'm going to go to the IAM service,
which you can find from the Services tab right here if you
don't have it in your recently used services.
Already you can see that there is root access keys and that multi‑factor
authentication is not enabled on the root account,
which are pretty bad things.
What we'll do now is go into Policies,
and I'll create a policy and I'll go to the JSON field right ahead,
and I'll simply paste what was in that wiki page.
Then I'll review the policy, and I'm going to give it a name.
I'm going to call it ScoutSuite_Minimal.
And as you can see, it gives a lot of permissions on many different services,
but these permissions consist of listing and reading.
Scout Suite does not need to be able to write anything as it will
not go and change your different configurations.
So I'll create the policy.
And now that it's been created, I'm going to create a new user.
I'll add a user, I'll simply call it scout.
It will be for programmatic access.
This won't be using the console.
This is really to create keys for Scout Suite to be executed,
and I'll attach a policy directly to it.
In the Search field,
I'll just type scout so I can find it and I'll check that little box here.
Then we're asked if we want add tags,
which are optional. I don't need any of those.
And then we're going to review.
So the permission summary is that the ScoutSuite_Minimal
permission will be linked to this user.
So I'm going to create that user, scout.
Now scout exists, and we have an access key and a secret access key.
So what we'll do is we're going to copy the access key,
we're going to go back to our Linux environment,
and we're going to export the AWS_ACCESS_KEY_ID and paste that in.
Now we also need the secret key, which is hidden by default,
so we're going to show that and copy it,
and then we are going to export the
AWS_SECRET_ACCESS_KEY, and we're going to paste that in.
Now if you didn't create this environment with sadcloud,
you'll also need to export the AWS default region, and specify a
region where you actually have some services in use.
So if you created the environment with sadcloud in the previous clip,
just use us‑east‑1.
Now again,
I'm going to clear so those secrets are going to go away
and I don't need to keep learning them.
And I'm going to run scout for aws.
And as I run this,
it's not authenticating with the bare minimal read permissions that it needs.
So that policy that we just pasted is what you should be sending your
customers if you were doing an audit of their environment.
This should take about a minute to 2 minutes to run,
unless it's a very large Amazon environment.