Now, an interesting thing with Scout Sweet is that the
checks are actually really easy to edit.
If we navigate to the subfolder
ScoutSuite/providers/aws/rules and rulesets, as you can see,
there's different JSON files for different types of rules.
So cis would be to run the CIS benchmarks against your Amazon environment,
and default was what we were running.
So if we look at default, this JSON file is the default one with the
default checks for Amazon. You can edit this to change different
severity levels, as well as disable some checks.
However,
I highly recommend that you copy this file to a new
file before you make any change.
So we'll do that to disable the check for password exploration.
So I'm going to copy the default.json into custom.json.
I'm going to edit it with nano, and in there I'll find expiration,
not certificates.
Iam‑password‑policy‑expiration‑threshold.
So here I could change the value, but instead, I'll simply disabled it.
I just don't believe in password expiration,
and I'm going to save it. Now that it has been saved, I'll navigate to my
Scout Suite directory again, and I'll execute python3 scout.py aws, but
I'll specify that the ruleset I should use is custom.json. Again, I
override the report, and I refresh it.
And now if we look at IAM, there is no more failure related to that check.