If you already ran this before with the root credentials it's just
going to ask if you want to override the file.
I'm going to say yes to all of them.
There we are, an HTML report has been created.
If you were running this directly on your laptop you
can now go and open this HTML report.
And if you were connected to a remote server running
Scout Suite you can then download it.
Make sure you grab the entire directory.
If I open the report on my own computer,
as you can see we have many different failures and
findings on different services.
Some of them are related to CloudTrail, AWS Config, EC2, IAM, S3, SES, and VPC.
Now there're many different sections of this report that are useful.
First of all, you can click on a specific service,
like let's say IAM, and we can see the specific policies.
For example, the root account does not have multi‑factor authentication,
the minimum password length is too short,
there's no password expiration, password reuse is not prevented,
and the root account has active keys and was used recently.
These are all issues that could cause problems and attacks that
would leverage the attack techniques T1078.004,
valid accounts for cloud accounts, or even T1538.
The cloud service dashboard could be attacked.
If we go back and we look at EC2 we'll see that there're a
bunch of ports that are open to everyone.
And when you click on a specific failure you'll see the exact object.
So in this case,
we see that there's an ingress rule allowing ports 1‑65535 from any IP address
to the EC2 security group sadcloud‑ec2‑all_ports_to_self,
which is very bad.
You would never want to have every single TCP port exposed to the internet.
Now the Scout Suite report allows you to see information in many different ways.
For example, everything that relates to EC2,
Lambda is located in the Compute tab.
If we look at the EC2 summary, for example,
we can see we have many different problems,
ports being open, DNS being open, database servers being open,
Remote Desktop being open, Telnet being open.
It just doesn't end.
Hopefully if you're not using sadcloud and you're running this against
your real environment the results are not as bad.
But it could happen.
So for example, why is Telnet open?
Well, if we click on it we'll get the details.
And it's coming from this rule right here on this security group,
which allows ingress on ports 21 and 23,
21 being FTP and 23 being Telnet.
This could lead to issues like data being exposed unencrypted, like passwords.
And it could lead to attacks using the T1021 technique, Remote Services.
So what we'll do now is we'll go back to the home page and we're
just going to look at the amount of findings.
So we had 146 for EC2 and 22 for IAM.
Now,
if you use sadcloud a lot of the IAM things you can't fix right
now because you'll need to run Terraform to destroy everything
that was executed with sadcloud.
But if we look at EC2 at 146 we can probably do something about that.
So I'm going to open the AWS VPC console.
And in the AWS console, we can see we have 16 security groups.
So if we look at those we'll see those bad security groups that were
created, opens_port_to_all, opens_plaintext_port.
These are just some of the ones that we saw as being vulnerabilities.
So I'm going to check the opens_plaintext_port one and the
opens_port_to_all. And I am simply going to delete them.
Of course in a real environment you want to be sure that whatever
you just did is not going to break production.
Now that I've done that I'm just going to delete
the scoutsuite‑report directory,
and I am going to run Scout Suite again with the same command as before.
Now that the report has been run again I'm going to open
it in my browser. And as you can see,
we now have only 138 different findings with EC2.
Now,
if we're looking at the different techniques we were
concerned with at the beginning, which were valid accounts,
cloud dashboard, and storage, let's look specifically at IAM and S3.
So if I look at IAM, there's a lot about different inline role
policies and the lack of multi‑factor authentication.
I don't want to change the multi‑factor authentication right now
because I'm using sadcloud and I just want to be sure I can delete
everything with the same Terraform command.
But I can certainly set the minimum password length, the expiration, and the
password reuse right away. So that would be three rules.
So if I go back to my AWS Management Console I'm going to go to IAM.
As you can see, there's already a password policy,
but it's just not sufficient. We'll change the password policy.
I think a minimum length of 6 characters is really bad so I'm going
to set that to 20. I'm going to enable a lot of the complexity. A
password expiration every 90 days. Which,
by the way, I'm not a big fan of password expirations.
I'm a much bigger fun of using two‑factor authentication
probably. And we will prevent password reuse for five passwords.
I'm going to save this, and here we go.
That should take care of our valid accounts.
Now if we look at S3 specifically,
there are some buckets where the logging is disabled,
HTTP is allowed, and encryption is not enabled.
So what I'll do is I'll check this one right here.
This bucket right here seems to be problematic.
So I'm going to go back to the console and this time
I'm going to go to the S3 service.
Now we have many different buckets that were created.
The one we were looking at is this one specifically. It is empty,
but block public access is off.
If I wanted this to be private I would want to block public access.
So I'm going to edit this and I'll block all public access and save.
Then I'm going to look at my access control list and there's
only permissions for the bucket owner, and all the permissions
for everyone have been removed.
Now if I go to Properties, if we look at Default encryption,
as you can see it is disabled.
So I'll click on Default encryption and I'll set it to AES‑256. And
I'm going to save. There it is. So again, we can rerun Scout Suite
with the exact same command. Again,
we're just going to override our existing report and it will produce a new one,
which I'm going to download and refresh in my browser. As you can see,
the amount of failures in IAM and S3 has dropped,
but we still have some buckets with the default encryption disabled.
We have two of them. So let's go find them out.
This is the first one. I'll go in there.
I'll go to Properties.
Make sure the default encryption is set to AES‑256. I'm going to save. Go back.
Look at which one was the second one. There it is.
Properties, Default encryption, AES‑256.
Now, if I run Scout Suite again that shouldn't be a problem anymore.
And if we go to S3,
as you can see default encryption not being enabled is not a finding anymore.
And if I even search here, Bucket without default encryption enabled is green.
So we fixed that problem.
So,
in reality I hope you don't have so many findings to deal with in a
real environment, but if you do there's no secret other than to tackle
them one by one until you've got them all.