This repository contains Splunk input scripts to collect assets from cloud providers:
- Aliyun
- AWS (only Amazon Route 53)
- Cloudflare
I focus on gathering information about assets that are accessable from Internet. Аny information about vulnerabilities interests me as well.
List of API functions used to collect data from cloud providers.
Aliyun:
DescribeCloudCenterInstancesDescribeGroupedContainerInstancesDescribeDomainListDescribeDomainDetailDescribeExposedInstanceListDescribeAllEntityDescribeVulList
AWS (only Amazon Route 53):
ListHostedZonesListResourceRecordSets
Cloudflare:
ListZonesListDNSRecords
As already mentioned, the scripts are designed primarily as Splunk data inputs.
Bash wrappers are used to activate Python environment and pass parameters to the startup. Wrappers with parameters are set in Splunk when creating a new local script input.
But nothing prevents you from using scripts separately from Splunk.
Init
Replace these lines in Python scripts with secrets for accessing cloud accounts:
<ALI_ID><ALI_SECRET><AWS_ID><AWS_KEY><CF_EMAIL><CF_TOKEN>