duo-labs/cloudmapper

Manual audit for secrets

Open

#427 opened on Jun 7, 2019

View on GitHub
 (1 comment) (0 reactions) (0 assignees)JavaScript (5,670 stars) (789 forks)batch import
auditgood first issue

Description

Have a way to more easily check certain areas for secrets such as:

  • CloudFormation scripts
  • Environment variables for Lambda functions
  • userdata of EC2's

Automate some of this testing, such as scanning for access keys, see https://github.com/Yelp/detect-secrets

Contributor guide

Tech stack
pythonaws
Domain
securitycloud
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
AWS CloudFormation, Lambda, EC2Pythondetect secrets tool
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Start by reviewing the issue comments for any additional context. Examine CloudMapper's existing codebase to understand how it currently audits AWS resources (e.g., the `commands` directory). Research the detect secrets library and its API to see how it can be used to scan CloudFormation templates, Lambda environment variables, and EC2 userdata. Then design a new command or module that implements these checks, perhaps extending the existing 'audit' functionality.