Cloudsplaining - AWS IAM Security Assessment Tool
Tags: cloud, aws, security, opensource
Published: 2022-06-03 14:06:17

<!-- wp:paragraph -->
<p>Security is everyone's responsibility. In all the phases of the software lifecycle, security is inevitable. If your application or service is built on cloud-native, then security is responsible between you and the cloud providers. This shared model is often known as the <strong>Shared Responsibility Model </strong>in the <a href="https://aws.amazon.com/compliance/shared-responsibility-model/" target="_blank" rel="noreferrer noopener nofollow">AWS ecosystem</a>, <a href="https://services.google.com/fh/files/misc/gcp_pci_srm__apr_2019.pdf" target="_blank" rel="noreferrer noopener nofollow">Shared Responsibility Matrix</a> in Google Cloud Platform, and Azure's <a href="https://docs.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility" target="_blank" rel="noreferrer noopener nofollow">Shared responsibility in the cloud</a>. Cloudsplaining is a utility for AWS IAM where it assesses the IAM policies and generates an HTML report for further actions. It is an open source initiative from Salesforce. In this blog post, we will deep-dive into Cloudsplaining, how to get started, generate an HTML report, and more.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"158e6819"} -->
<h2 class="gb-headline gb-headline-158e6819 gb-headline-text">What is Cloudsplaining?</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Cloudsplaining is a Python based utility to assess the AWS IAM policies and identifies violations of the least privileges. It generates a simple HTML report once the scanning is performed along with a triage sheet.  </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It supports scanning all the policies in a single AWS account, a single policy in an AWS account, or you could scan multiple AWS accounts.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It is an <a href="https://github.com/salesforce/cloudsplaining/" target="_blank" rel="noreferrer noopener">open source contribution from Salesforce</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"dda8eb6c"} -->
<h2 class="gb-headline gb-headline-dda8eb6c gb-headline-text">How to install Cloudsplaining?</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>The only prerequisite to installing Cloudsplaining is to have the latest version of Python. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To install Cloudsplaining on Mac:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>brew tap salesforce/cloudsplaining https://github.com/salesforce/cloudsplaining
brew install cloudsplaining
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>To install Cloudsplaining on Windows or Linux, leverage <code>pip</code>:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>pip3 install --user cloudsplaining
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>To validate the installation, enter:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>cloudsplaining --version</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>If you are getting <code>command not found</code>, make sure you add the cloudsplaining path to <code>PATH</code> variable using <code>export PATH=$PATH:/home/&lt;user_name&gt;/.local/bin</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For auto complete in bash, add the below line to <code>.bashrc</code></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>eval "$(_CLOUDSPLAINING_COMPLETE=source cloudsplaining)"</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>For auto complete in zsh, add the below line to <code>.zshrc</code></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>eval "$(_CLOUDSPLAINING_COMPLETE=source_zsh cloudsplaining)"</code></pre>
<!-- /wp:code -->

<!-- wp:generateblocks/headline {"uniqueId":"b29d6af7"} -->
<h2 class="gb-headline gb-headline-b29d6af7 gb-headline-text">Getting Started with Cloudsplaining</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Before using Cloudsplaining utility, make sure you have the following AWS setup. Cloudsplaining leverages <code>get-account-authorization-details</code> AWS API to scan the IAM policies to identify the potential issues.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>You must have AWS credentials configured. Check <a href="https://docs.aws.amazon.com/cli/latest/userguide/getting-started-prereqs.html" target="_blank" rel="noreferrer noopener">AWS CLI v2</a> for more details.</li><li>Privileges to run <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountAuthorizationDetails.html" target="_blank" rel="noreferrer noopener">GetAccountAuthorizationDetails</a></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>To begin scanning, the first step is to download the account authorization details using <code>cloudsplaining download</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The above command downloads the account details in the format of JSON and keeps them in the present directory.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9464,"sizeSlug":"full","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-full"><a href="https://qainsights.com/wp-content/uploads/2022/06/image.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image.png" alt="Cloudsplaining - AWS IAM Security Assessment Tool" class="wp-image-9464"/></a><figcaption>Cloudsplaining -&nbsp;AWS IAM Security Assessment Tool</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>If you open the JSON using your favorite editor, you can find all the IAM policies, ARN, path, role name, role ID, and more.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>After downloading the account details, it is time to perform our first scan. As most of us will have only one AWS account, let us see how to scan a single AWS account. But cloudsplaining supports scanning multiple AWS accounts. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Create an empty directory to store the HTML report output using the below command.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>mkdir report</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Then, issue the below command.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>cloudsplaining scan --input-file default.json --output report</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Once the scan is successful, you could find the below artifacts inside <code>report</code> folder.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9465,"sizeSlug":"full","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-full"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-1.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-1.png" alt="Cloudsplaining Report" class="wp-image-9465"/></a><figcaption>Cloudsplaining Report</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Open the HTML report in your favorite browser.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9466,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-2.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-2-1024x458.png" alt="HTML Report" class="wp-image-9466"/></a><figcaption>HTML Report</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Here is the <a href="https://opensource.salesforce.com/cloudsplaining/#/" target="_blank" rel="noreferrer noopener">sample report</a> for your analysis.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Generating reports is easy and simple. But understanding the report takes experience and time. Let us try to understand the high level context of the report.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"f9cb3623"} -->
<h2 class="gb-headline gb-headline-f9cb3623 gb-headline-text">Understanding the Cloudsplaining Report</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>The home page of Cloudsplaining report will have an executive summary which often lists out the risks in IAM policies such as </p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>Privilege Escalation</li><li>Resource Exposure</li><li>Infrastructure Modification</li><li>Data Exfiltration</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>It also displays the graphical view and the classification with severity, risk, and instances. The below table helps to identify potential threats and reduces the vulnerability radius.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9467,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-3.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-3-1024x369.png" alt="IAM Risks" class="wp-image-9467"/></a><figcaption>IAM Risks</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>At the top of the report, you can find links to the following:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>Customer Policies</li><li>Inline Policies</li><li>AWS Policies</li><li>IAM Principals</li><li>Guidance</li><li>Appendices</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The <strong>Customer Policies</strong> page displays the list of the policies which you or your team created either manually or via automation. It will also display the policy document, scan findings such as Privilege Escalation, Resource Exposure, Infrastructure Modification, Data Exfiltration, and more for each policy, how to fix it, false positives and more.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9470,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-4.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-4-1024x372.png" alt="Customer Policies" class="wp-image-9470"/></a><figcaption>Customer Policies</figcaption></figure>
<!-- /wp:image -->

<!-- wp:image {"align":"center","id":9471,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-5.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-5-1024x555.png" alt="Privilege Escalation Methods" class="wp-image-9471"/></a><figcaption>Privilege Escalation Methods</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Inline Policy page displays the details about all the inline policies, scan findings as Customer Policies.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9473,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-6.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-6-1024x540.png" alt="Inline Policy" class="wp-image-9473"/></a><figcaption>Inline Policy</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>The AWS Policies page will display all the policies which are created by AWS and its scan findings.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The IAM Principles page will display all the roles, users, groups, associated policies, and the risks associated and other metadata.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9474,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/06/image-7.png"><img src="https://qainsights.com/wp-content/uploads/2022/06/image-7-1024x422.png" alt="IAM Principles" class="wp-image-9474"/></a><figcaption>IAM Principles</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>Guidance</strong> page will help you out with triaging and deep-dive into understanding the report.  Also, it will help you out with common false positive scenarios, remediation, and validation.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The <strong>Appendices </strong>page will list out all the glossary.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"9b1b1e1f"} -->
<h2 class="gb-headline gb-headline-9b1b1e1f gb-headline-text">Understanding the High Priority Tasks</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Now let us try to understand the high priority tasks from the report.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"2f54b66e","element":"h3"} -->
<h3 class="gb-headline gb-headline-2f54b66e gb-headline-text">Privilege Escalation</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Privilege Escalation is one of the common techniques for gaining access. The hackers might start with small and step-by-step they escalate themselves to high privilege access. More details <a href="https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#privilegeescalation-iam-anomalousbehavior" target="_blank" rel="noreferrer noopener">here</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"0675e6ae","element":"h3"} -->
<h3 class="gb-headline gb-headline-0675e6ae gb-headline-text">Resource Exposure</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>By leveraging resource based policies, the bad actor can expose AWS resources to the public. e.g. <code>s3:PutObjectAcl</code> allows the actors to modify the access control list for new or existing objects in S3.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"f4eb4bfa","element":"h3"} -->
<h3 class="gb-headline gb-headline-f4eb4bfa gb-headline-text">Infrastructure Modification</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>From the term itself, it is easy to guess. The IAM actions allow the resource to create, modify or delete. The bad actor can bring down the resources or spin up powerful EC2 instances for crypto mining purposes.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"b32c6444","element":"h3"} -->
<h3 class="gb-headline gb-headline-b32c6444 gb-headline-text">Data Exfiltration</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Data Exfiltration is a type of security breach where the bad actor transfers sensitive data from AWS to their premise. e.g. <code>s3:GetObject</code> without any resource constraint can lead to data exfiltration breach.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"a9236912","element":"h3"} -->
<h3 class="gb-headline gb-headline-a9236912 gb-headline-text">Service Wildcard</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p><code>*</code> wildcard is bad. * grants all the actions in IAM. Service wildcards will lead to high risks in your AWS account.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"c02bc8df","element":"h3"} -->
<h3 class="gb-headline gb-headline-c02bc8df gb-headline-text">Credentials Exposure</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Some actions such as <a href="https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForJobs.html">codepipeline:pollforjobs</a>, <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html">iam:createaccesskey</a>, <a href="https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html">sts:assumerole</a>, and more will expose the credentials in its response. Keep an eye on it to reduce the risks.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"a2538419","element":"h3"} -->
<h3 class="gb-headline gb-headline-a2538419 gb-headline-text">Roles Assumable by Compute Services</h3>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>IAM service roles can impose greater risk than user-defined roles, particularly when resources are exposed to the public.  </p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"ae450ff8"} -->
<h2 class="gb-headline gb-headline-ae450ff8 gb-headline-text">Conclusion</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Cloudsplaining is a great Python utility to identify the risks associated via IAM policies, roles, and more. Cloudsplaining triage worksheet helps to tune the policies, principals, roles by intuitive table along with IAM metadata. Also, it supports scanning multiple AWS accounts, exclusions to eliminate false positives, scanning single or multiple policies and more. It also supports Jira ticket <a href="https://github.com/salesforce/cloudsplaining/tree/master/examples/jira-tickets" target="_blank" rel="noreferrer noopener">automation, </a>and you can use it along with  Policy Sentry - a preventative tool to write secured IAM policies. </p>
<!-- /wp:paragraph -->