SAAS-3999: GCP Remediation for Ingress All Traffic Disabled Plugin

README.md

@@ -39,7 +39,7 @@ $ docker run -e AWS_ACCESS_KEY_ID=XX -e AWS_SECRET_ACCESS_KEY=YY cloudsploit:0.0
   + [CloudSploit Config File](#cloudsploit-config-file)
   + [Credential Files](#credential-files)
     + [AWS](#aws)
-    + [Azure](#azur)
+    + [Azure](#azure)
     + [GCP](#gcp)
     + [Oracle OCI](#oracle-oci)
   + [Environment Variables](#environment-variables)

collectors/aws/accessanalyzer/listFindings.js

@@ -0,0 +1,49 @@
+var AWS = require('aws-sdk');
+var async = require('async');
+var helpers = require(__dirname + '/../../../helpers/aws');
+
+module.exports = function(AWSConfig, collection, retries, callback) {
+    var accessanalyzer = new AWS.AccessAnalyzer(AWSConfig);
+    async.eachLimit(collection.accessanalyzer.listAnalyzers[AWSConfig.region].data, 15, function(analyzer, cb) {
+        collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn] = {};
+        var params = {
+            analyzerArn: analyzer.arn
+        };
+
+        var paginating = false;
+        var paginateCb = function(err, data) {
+            if (err) collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].err = err;
+
+            if (!data) return cb();
+
+            if (paginating && data.findings && data.findings.length &&
+                collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data.findings &&
+                collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data.findings.length) {
+                collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data.findings = collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data.findings.concat(data.findings);
+            } else {
+                collection.accessanalyzer.listFindings[AWSConfig.region][analyzer.arn].data = data;
+            }
+
+            if (data.nextToken && data.nextToken.length) {
+                paginating = true;
+                return execute(data.nextToken);
+            }
+
+            cb();
+        };
+
+        function execute(nextToken) { // eslint-disable-line no-inner-declarations
+            var localParams = JSON.parse(JSON.stringify(params || {}));
+            if (nextToken) localParams['nextToken'] = nextToken;
+            if (nextToken) {
+                helpers.makeCustomCollectorCall(accessanalyzer, 'listFindings', localParams, retries, null, null, null, paginateCb);
+            } else {
+                helpers.makeCustomCollectorCall(accessanalyzer, 'listFindings', params, retries, null, null, null, paginateCb);
+            }
+        }
+
+        execute();
+    }, function(){
+        callback();
+    });
+};

collectors/aws/apigateway/getIntegration.js

@@ -0,0 +1,52 @@
+var AWS = require('aws-sdk');
+var async = require('async');
+var helpers = require(__dirname + '/../../../helpers/aws');
+
+module.exports = function(AWSConfig, collection, retries, callback) {
+    var apigateway = new AWS.APIGateway(AWSConfig);
+
+    async.eachLimit(collection.apigateway.getRestApis[AWSConfig.region].data, 5, function(api, cb){
+        if (!collection.apigateway.getResources ||
+            !collection.apigateway.getResources[AWSConfig.region] ||
+            !collection.apigateway.getResources[AWSConfig.region][api.id] ||
+            !collection.apigateway.getResources[AWSConfig.region][api.id].data ||
+            !collection.apigateway.getResources[AWSConfig.region][api.id].data.items) {
+            return cb();
+        }
+
+        collection.apigateway.getIntegration[AWSConfig.region][api.id] = {};
+        async.eachLimit(collection.apigateway.getResources[AWSConfig.region][api.id].data.items, 3, function(resource, pCb){
+
+            collection.apigateway.getIntegration[AWSConfig.region][api.id][resource.id] = {};
+
+            async.eachOfLimit(resource.resourceMethods, 3, function(methodVal,methodKey, mCb){
+
+                collection.apigateway.getIntegration[AWSConfig.region][api.id][resource.id][methodKey] = {};
+
+                let params = {
+                    resourceId: resource.id,
+                    httpMethod: methodKey,
+                    restApiId : api.id,
+                };
+
+                helpers.makeCustomCollectorCall(apigateway, 'getIntegration', params, retries, null, null, null, function(err, data) {
+                    if (err) {
+                        collection.apigateway.getIntegration[AWSConfig.region][api.id][resource.id][methodKey].err = err;
+                        return mCb();
+                    }
+
+                    collection.apigateway.getIntegration[AWSConfig.region][api.id][resource.id][methodKey].data = data;
+                    mCb();
+                });
+            }, function(){
+                pCb();
+            });
+
+        }, function(){
+            cb();
+        });
+
+    }, function(){
+        callback();
+    });
+};

collectors/aws/appmesh/describeVirtualGateway.js

@@ -0,0 +1,42 @@
+var AWS = require('aws-sdk');
+var async = require('async');
+var helpers = require(__dirname + '/../../../helpers/aws');
+
+module.exports = function(AWSConfig, collection, retries, callback) {
+    var appmesh = new AWS.AppMesh(AWSConfig);
+
+    if (!collection.appmesh ||
+        !collection.appmesh.listMeshes ||
+        !collection.appmesh.listMeshes[AWSConfig.region] ||
+        !collection.appmesh.listMeshes[AWSConfig.region].data) return callback();
+    async.eachLimit(collection.appmesh.listMeshes[AWSConfig.region].data, 5, function(mesh, cb){
+
+        if (!mesh.meshName || !collection.appmesh ||
+            !collection.appmesh.listVirtualGateways ||
+            !collection.appmesh.listVirtualGateways[AWSConfig.region] ||
+            !collection.appmesh.listVirtualGateways[AWSConfig.region][mesh.meshName] ||
+            !collection.appmesh.listVirtualGateways[AWSConfig.region][mesh.meshName].data ||
+            !collection.appmesh.listVirtualGateways[AWSConfig.region][mesh.meshName].data.virtualGateways ||
+            !collection.appmesh.listVirtualGateways[AWSConfig.region][mesh.meshName].data.virtualGateways.length) {
+            return cb();
+        }
+
+        async.eachLimit(collection.appmesh.listVirtualGateways[AWSConfig.region][mesh.meshName].data.virtualGateways, 3, function(gateway, pCb){
+            collection.appmesh.describeVirtualGateway[AWSConfig.region][gateway.virtualGatewayName] = {};
+
+            helpers.makeCustomCollectorCall(appmesh, 'describeVirtualGateway', {virtualGatewayName: gateway.virtualGatewayName,meshName: mesh.meshName}, retries, null, null, null, function(err, data) {
+                if (err) {
+                    collection.appmesh.describeVirtualGateway[AWSConfig.region][gateway.virtualGatewayName].err = err;
+                }
+
+                collection.appmesh.describeVirtualGateway[AWSConfig.region][gateway.virtualGatewayName].data = data;
+                pCb();
+            });
+
+        }, function() {
+            cb();
+        });
+    }, function(){
+        callback();
+    });
+};