google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
454 stars 88 forks source link

Include additional details from AWS EBS Volumes #299

Open hiddenillusion opened 3 years ago

hiddenillusion commented 3 years ago

It would be helpful if the data returned within EBS.ListVolumes() was either unfiltered or included additional details (e.g. Tags, CreationTime, Size etc.) . Most modules filter ListVolumes() output but this module only returns limited details (volume_id, aws_account, availability_zone, device_name, encrypted, name, region etc.)

Tags Currently, ListVolumes() only looks for the "Name" tag for an AWS EBS storage volume.

It would be helpful if all of a volume's tags were also returned - for some use cases, we may want to filter for volumes with specific tags and discovering what those tags are/their values would be required.

CreationTime / Size These are self-explanatory, but can be required details for tasks down the pipeline.