salesforce / cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.
https://cloudsplaining.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
1.99k stars 185 forks source link

Unhandled exception when running multi-account scan #299

Closed areifert closed 1 year ago

areifert commented 1 year ago

I've been using Cloudsplaining for some time now as part of an automated pipeline, it scans all of our AWS accounts nightly and generates a report. However, with the latest release of Cloudsplaining (0.6.0), I'm seeing the following error:

Traceback (most recent call last):
  File "/home/runner/.local/bin/cloudsplaining", line 8, in <module>
    sys.exit(main())
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/bin/cli.py", line 34, in main
    cloudsplaining()
  File "/usr/lib/python3/dist-packages/click/core.py", line 1128, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/click/core.py", line 1053, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3/dist-packages/click/core.py", line 1659, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/lib/python3/dist-packages/click/core.py", line 1395, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3/dist-packages/click/core.py", line 754, in invoke
    return __callback(*args, **kwargs)
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/command/scan_multi_account.py", line 77, in scan_multi_account
    scan_accounts(
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/command/scan_multi_account.py", line 105, in scan_accounts
    results = scan_account(
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/command/scan_multi_account.py", line 179, in scan_account
    results = authorization_details.results
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/authorization_details.py", line 150, in results
    "inline_policies": self.inline_policies,
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/authorization_details.py", line 106, in inline_policies
    results.update(self.role_detail_list.inline_policies_json)
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/role_details.py", line 117, in inline_policies_json
    results.update(role_detail.inline_policies_json)
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/role_details.py", line 309, in inline_policies_json
    policies = {
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/role_details.py", line 310, in <dictcomp>
    policy.policy_id: policy.json_large for policy in self.inline_policies
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/inline_policy.py", line 175, in json_large
    "links": self.getFindingLinks(
  File "/home/runner/.local/lib/python3.10/site-packages/cloudsplaining/scan/inline_policy.py", line 72, in getFindingLinks
    links[
TypeError: list indices must be integers or slices, not str

I'm running Cloudsplaining using a GitHub Actions workflow with the default ubuntu-latest runner, with the following command:

cloudsplaining scan-multi-account \
    --config multi-account-config.yml \
    --exclusions-file exclusions.yml \
    --output-directory results \
    --role-name cloudsplaining-role
ghost commented 1 year ago

@melaniap-codsec Looks like this error is happening because the links variable in inline_policy.getFindingLinks is declared as a list, but it's being treated like a dict.

I'm guessing it should in fact be declared as a dict, as in the equivalent function here: managed_policy_detail.getFindingLinks

(I also can't see where in the app these link collections are actually used... are they?)

ghost commented 1 year ago

I'm preparing a PR to fix issue 278; I believe it'll fix this issue, too.

ghost commented 1 year ago

@danjacobson-orbis thank you so much for the fixing.