AWS External Account Scanner
Xenos, is Greek for stranger.
AWSXenos will list all the trust relationships in all the IAM roles, and S3 buckets, in an AWS account and give you a breakdown of all the accounts that have trust relationships to your account.
This tool reports against the Trusted Relationship Technique of the ATT&CK Framework.
- For the "known" accounts list AWSXenos uses a modified version of known AWS Account IDs.
- For the Org accounts list AWSXenos query AWS Organizations.
- AWS Services are classified separately.
- Everything else falls under unknown account
Example
Why
Access Analyzer falls short because:
-
You need to enable it in every region.
-
Identified external entities might be known entities. E.g. a trusted third party vendor or a vendor you no longer trust. An Account number is seldom useful.
-
Zone of trust is a fixed set of the AWS organisation. You won’t know if a trust between sandbox->prod has been established.
-
Does not identify AWS Service principals. This is mainly important because of Wiz's AWSConfig, et al vulnverabilities
How to run
Cli
pip install AWSXenos
awsxenos --reporttype HTML -w report.html
awsxenos --reporttype JSON -w report.json
You will get an HTML and JSON report.
See example report
Library
from awsxenos.scan import Scan
from awsxenos.report import Report
s = Scan()
r = Report(s.findings, s.known_accounts_data)
json_summary = r.JSON_report()
html_summary = r.HTML_report()
IAM Permissions
Permissions required.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:ListRoles"
"organizations:ListAccounts",
"s3:ListAllMyBuckets",
"s3:GetBucketPolicy",
"s3:GetBucketAcl"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
Development
python3 -m env venv
source /env/bin/activate
pip install -r requirements.txt
I want to add more known accounts
Create a PR or raise an issue. Contributions are welcome.
Features
- IAM Roles
- S3 Bucket Policies and ACLs
- Use as library
- HTML and JSON output
- Supports AWS Services
TODO
- Add support for more resource policies services, e.g. SecretsManager, KSM, SNS, SQS, Lambda
- Add support for Cognito, RAM
- Add support for VPCE
1 Jun 27, 2022
1 Dec 29, 2021
1 Nov 27, 2021
3 Apr 28, 2022
3 Jan 30, 2022
1 Dec 5, 2021
57 Dec 18, 2022
222.5k Jan 2, 2023
1 Nov 3, 2021
1 Jun 08, 2022
3.5k Jan 03, 2023
4 Dec 23, 2021
3.4k Jan 01, 2023
1 Jan 01, 2022
1 Oct 23, 2021
50 Sep 08, 2022
7 Nov 12, 2022
3 Dec 31, 2021
5 Nov 09, 2022
44 Nov 12, 2022
35 Dec 23, 2022
1 Jan 30, 2022
6 Nov 27, 2022
11 Nov 01, 2022
2 Jan 05, 2022
1 Oct 11, 2021
72 Aug 22, 2022
3 Jun 24, 2022
89 Nov 23, 2022