github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/cmd/defsec/aws.go (about)

     1  package main
     2  
     3  import (
     4  	"context"
     5  	"io"
     6  
     7  	"github.com/khulnasoft-lab/defsec/pkg/framework"
     8  
     9  	"github.com/khulnasoft-lab/defsec/pkg/scanners/cloud/aws"
    10  
    11  	"github.com/spf13/cobra"
    12  
    13  	"github.com/khulnasoft-lab/defsec/pkg/scanners/options"
    14  )
    15  
    16  func init() {
    17  	awsCmd := &cobra.Command{
    18  		Use:   "aws",
    19  		Short: "Scan an AWS account for misconfigurations",
    20  		Args:  cobra.ExactArgs(0),
    21  		RunE: func(cmd *cobra.Command, args []string) error {
    22  			cmd.SilenceUsage = true
    23  			cmd.SilenceErrors = true
    24  			return scanAWS(cmd.OutOrStdout(), cmd.ErrOrStderr())
    25  		},
    26  	}
    27  	awsCmd.Flags().StringVarP(&flagFramework, "framework", "k", flagFramework, "framework to use (default, all, cis-aws-1.2, cis-aws-1.4)")
    28  	awsCmd.Flags().StringVarP(&flagAWSRegion, "region", "r", flagAWSRegion, "AWS region to scan")
    29  	awsCmd.Flags().StringSliceVarP(&flagAWSServices, "services", "s", flagAWSServices, "AWS services to scan")
    30  	rootCmd.AddCommand(awsCmd)
    31  }
    32  
    33  var (
    34  	flagAWSRegion   = "us-east-1"
    35  	flagAWSServices []string
    36  	flagFramework   = string(framework.Default)
    37  )
    38  
    39  func scanAWS(stdout, stderr io.Writer) error {
    40  
    41  	opts := []options.ScannerOption{
    42  		options.ScannerWithEmbeddedPolicies(true),
    43  		options.ScannerWithEmbeddedLibraries(true),
    44  	}
    45  
    46  	if flagDebug {
    47  		opts = append(opts, options.ScannerWithDebug(stderr))
    48  	}
    49  
    50  	if flagAWSRegion != "" {
    51  		opts = append(opts, aws.ScannerWithAWSRegion(flagAWSRegion))
    52  	}
    53  
    54  	if len(flagAWSServices) > 0 {
    55  		opts = append(opts, aws.ScannerWithAWSServices(flagAWSServices...))
    56  	}
    57  
    58  	opts = append(opts, options.ScannerWithFrameworks(framework.Framework(flagFramework)))
    59  
    60  	scanner := aws.New(opts...)
    61  
    62  	st, err := scanner.CreateState(context.TODO())
    63  	if err != nil {
    64  		return err
    65  	}
    66  
    67  	// Execute the filesystem based scanners
    68  	results, err := scanner.Scan(context.TODO(), st)
    69  	if err != nil {
    70  		return err
    71  	}
    72  
    73  	return outputResults(stdout, ".", results)
    74  }