github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/cmd/defsec/aws.go (about) 1 package main 2 3 import ( 4 "context" 5 "io" 6 7 "github.com/khulnasoft-lab/defsec/pkg/framework" 8 9 "github.com/khulnasoft-lab/defsec/pkg/scanners/cloud/aws" 10 11 "github.com/spf13/cobra" 12 13 "github.com/khulnasoft-lab/defsec/pkg/scanners/options" 14 ) 15 16 func init() { 17 awsCmd := &cobra.Command{ 18 Use: "aws", 19 Short: "Scan an AWS account for misconfigurations", 20 Args: cobra.ExactArgs(0), 21 RunE: func(cmd *cobra.Command, args []string) error { 22 cmd.SilenceUsage = true 23 cmd.SilenceErrors = true 24 return scanAWS(cmd.OutOrStdout(), cmd.ErrOrStderr()) 25 }, 26 } 27 awsCmd.Flags().StringVarP(&flagFramework, "framework", "k", flagFramework, "framework to use (default, all, cis-aws-1.2, cis-aws-1.4)") 28 awsCmd.Flags().StringVarP(&flagAWSRegion, "region", "r", flagAWSRegion, "AWS region to scan") 29 awsCmd.Flags().StringSliceVarP(&flagAWSServices, "services", "s", flagAWSServices, "AWS services to scan") 30 rootCmd.AddCommand(awsCmd) 31 } 32 33 var ( 34 flagAWSRegion = "us-east-1" 35 flagAWSServices []string 36 flagFramework = string(framework.Default) 37 ) 38 39 func scanAWS(stdout, stderr io.Writer) error { 40 41 opts := []options.ScannerOption{ 42 options.ScannerWithEmbeddedPolicies(true), 43 options.ScannerWithEmbeddedLibraries(true), 44 } 45 46 if flagDebug { 47 opts = append(opts, options.ScannerWithDebug(stderr)) 48 } 49 50 if flagAWSRegion != "" { 51 opts = append(opts, aws.ScannerWithAWSRegion(flagAWSRegion)) 52 } 53 54 if len(flagAWSServices) > 0 { 55 opts = append(opts, aws.ScannerWithAWSServices(flagAWSServices...)) 56 } 57 58 opts = append(opts, options.ScannerWithFrameworks(framework.Framework(flagFramework))) 59 60 scanner := aws.New(opts...) 61 62 st, err := scanner.CreateState(context.TODO()) 63 if err != nil { 64 return err 65 } 66 67 // Execute the filesystem based scanners 68 results, err := scanner.Scan(context.TODO(), st) 69 if err != nil { 70 return err 71 } 72 73 return outputResults(stdout, ".", results) 74 }