audit-labs/audit-tools

  1"""
  2AWS audit CLI.
  3
  4Runs all collectors against the account reachable with the active AWS
  5credentials and writes a timestamped audit package to an output directory.
  6
  7Credentials come from the standard AWS chain (environment variables, shared
  8config/credentials, SSO profiles, instance roles) — no access keys are passed
  9to this tool.
 10
 11Usage:
 12    export AWS_PROFILE=my-profile          # optional
 13    export AWS_DEFAULT_REGION=us-east-1    # optional
 14
 15    python audit.py
 16    python audit.py --profile my-profile --region us-east-1
 17    python audit.py --account my-account --out ./output
 18
 19Output:
 20    <out>/aws_audit_<profile>_<date>/
 21        iam_users.csv
 22        password_policy.csv
 23        s3_public_access.csv
 24        sso_assignments.csv
 25        summary.txt
 26"""
 27
 28import argparse
 29import os
 30import sys
 31from datetime import date
 32
 33import config
 34from collectors import iam, monitoring, s3, security_groups, sso
 35from reporters import csv_reporter
 36
 37
 38def parse_args():
 39    parser = argparse.ArgumentParser(
 40        description="Generate an AWS audit package for the current account."
 41    )
 42    parser.add_argument(
 43        "--profile", help="AWS named profile. Overrides AWS_PROFILE env var."
 44    )
 45    parser.add_argument(
 46        "--region", help="AWS region. Overrides AWS_DEFAULT_REGION env var."
 47    )
 48    parser.add_argument(
 49        "--account",
 50        help="Account name for the SSO assignments check. "
 51        "Overrides AWS_AUDIT_ACCOUNT. Defaults to the current account.",
 52    )
 53    parser.add_argument(
 54        "--out",
 55        default="./output",
 56        help="Directory to write the audit package into. Default: ./output",
 57    )
 58    return parser.parse_args()
 59
 60
 61def run():
 62    args = parse_args()
 63    cfg = config.load(args.profile, args.region, args.account)
 64    subject = cfg.get("profile") or "default"
 65
 66    output_dir = os.path.join(
 67        args.out, f"aws_audit_{subject}_{date.today().isoformat()}"
 68    )
 69
 70    print(f"AWS Audit — profile: {subject}")
 71    print(f"Output directory: {output_dir}")
 72    print()
 73
 74    sections = []
 75
 76    def collect(label, fn, filename):
 77        print(f"Collecting: {label}...")
 78        try:
 79            rows = fn(cfg)
 80        except Exception as e:
 81            print(f"  Error: {e}", file=sys.stderr)
 82            rows = []
 83        csv_reporter.write(output_dir, filename, rows)
 84        sections.append((label, len(rows)))
 85        return rows
 86
 87    collect("IAM users", iam.iam_users, "iam_users.csv")
 88    collect("Password policy", iam.password_policy, "password_policy.csv")
 89    collect("Account security", iam.account_security, "account_security.csv")
 90    collect("S3 public access", s3.s3_public_access, "s3_public_access.csv")
 91    collect(
 92        "Open security groups",
 93        security_groups.security_groups,
 94        "open_security_groups.csv",
 95    )
 96    collect("CloudTrail", monitoring.cloudtrail, "cloudtrail.csv")
 97    collect("AWS Config recorders", monitoring.config_recorders, "config_recorders.csv")
 98    collect("SSO assignments", sso.sso_assignments, "sso_assignments.csv")
 99
100    print()
101    csv_reporter.write_summary(output_dir, subject, sections)
102    print()
103    print("Done.")
104
105
106if __name__ == "__main__":
107    run()