[🦊 cloudfox v1.12.2 🦊 ] AWS Caller Identity: arn:aws:iam::XXXXXXXXXXXX:user/pentest-user-2023
[🦊 cloudfox v1.12.2 🦊 ] No cache data for XXXXXXXXXXXX. Error: unexpected EOF
[🦊 cloudfox v1.12.2 🦊 ] Account is not part of an Organization

❯ cat /Users/XXX/.cloudfox/cloudfox-error.log
time="2023-09-19T11:30:07+02:00" level=error msg="Could not decode the following file: /Users/XXX/.cloudfox/cached-data/aws/XXXXXXXXXXXX/XXXXXXXXXXXX-apigatewayv2-GetApis-ap-northeast-1.json"
time="2023-09-19T11:30:08+02:00" level=error msg="Failed to describe organization: operation error Organizations: DescribeOrganization, https response error StatusCode: 400, RequestID: 8b38ad4f-db5f-4404-809a-b4c232829860, AWSOrganizationsNotInUseException: Your account is not a member of an organization."

❯ cat /Users/XXX/.cloudfox/cached-data/aws/XXXXXXXXXXXX/XXXXXXXXXXXX-apigatewayv2-GetApis-ap-northeast-1.json
{
  "Value": null,
  "Exp": 0
}

$ ./cloudfox aws all-checks --profile  MY_PROFILE
(...snip...)
[inventory][(...MY_PROFILE...)] Enumerating selected services in all regions for account 36xxxxxxxxxx.
(...snip...)
[tags][(...MY_PROFILE...)] Enumerating tags for account 36xxxxxxxxxx.
(...snip...)
[instances][(...MY_PROFILE...)] Enumerating EC2 instances in all regions for account 36xxxxxxxxxx
(...snip...)
[lambda][(...MY_PROFILE...)] Enumerating lambdas for account 36xxxxxxxxxx.
(...snip...)
[route53][(...MY_PROFILE...)] Enumerating Route53 for account 36xxxxxxxxxx.
(...snip...)
[filesystems][(...MY_PROFILE...)] Enumerating filesystems for account 36xxxxxxxxxx.
(...snip...)
[endpoints][(...MY_PROFILE...)] Enumerating endpoints for account 36xxxxxxxxxx.
(...snip...)
[ecs-tasks][(...MY_PROFILE...)] Enumerating ECS tasks in all regions for account 36xxxxxxxxxx
(...snip...)
[eks][(...MY_PROFILE...)] Enumerating EKS clusters for account 36xxxxxxxxxx.
(...snip...)
[elastic-network-interfaces][(...MY_PROFILE...)] Enumerating elastic network interfaces in all regions for account 36xxxxxxxxxx
(...snip...)
[instances][(...MY_PROFILE...)] Enumerating EC2 instances in all regions for account 36xxxxxxxxxx
(...snip...)
[env-vars][(...MY_PROFILE...)] Enumerating environment variables in all regions for account 36xxxxxxxxxx.
(...snip...)
[cloudformation][(...MY_PROFILE...)] Enumerating cloudformation stacks for account 36xxxxxxxxxx.
(...snip...)
[buckets][(...MY_PROFILE...)] Enumerating buckets for account 36xxxxxxxxxx.
(...snip...)
[ecr][(...MY_PROFILE...)] Enumerating container repositories for account 36xxxxxxxxxx.
(...snip...)
[secrets][(...MY_PROFILE...)] Enumerating secrets for account 36xxxxxxxxxx.
(...snip...)
[ram][(...MY_PROFILE...)] Enumerating shared resources for account 36xxxxxxxxxx.
(...snip...)
[network-ports][(...MY_PROFILE...)] Enumerating potentially accessible network services for account 36xxxxxxxxxx.
(...snip...)
[principals][(...MY_PROFILE...)] Enumerating IAM Users and Roles for account 36xxxxxxxxxx.
(...snip...)
[permissions][(...MY_PROFILE...)] Enumerating IAM permissions for account 36xxxxxxxxxx.
(...snip...)
[access-keys][(...MY_PROFILE...)] Mapping user access keys for account: 36xxxxxxxxxx.
(...snip...)
[role-trusts][(...MY_PROFILE...)] Enumerating role trusts for account 36xxxxxxxxxx.
(...snip...)
[pmapper][(...MY_PROFILE...)] Looking for pmapper data for this account and building a PrivEsc graph in golang if it exists.
(...snip...)
[iam-simulator][(...MY_PROFILE...)] Running multiple iam-simulator queries for account 36xxxxxxxxxx. (This command can be pretty slow, FYI)
(...snip...)

[filesystems][prod/prod_admin] Supported Services: EFS, FSx
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x35a4485]

goroutine 6277 [running]:
github.com/BishopFox/cloudfox/aws.(*FilesystemsModule).getEFSfilesystemPermissions(...)
	/home/ccastrapel/localrepos/cloudfox/aws/filesystems.go:491
github.com/BishopFox/cloudfox/aws.(*FilesystemsModule).getEFSSharesPerRegion(0xc0027c5300, {0xc000a5f170, 0x9}, 0x6d4a8a?, 0x6f8d66?, 0xc0014c2a20?)
	/home/ccastrapel/localrepos/cloudfox/aws/filesystems.go:322 +0x885
created by github.com/BishopFox/cloudfox/aws.(*FilesystemsModule).executeChecks
	/home/ccastrapel/localrepos/cloudfox/aws/filesystems.go:193 +0x1ed

# Creating Amazon EFS File system
resource "aws_efs_file_system" "data_storage" {
  # Creating the AWS EFS lifecycle policy
  # Amazon EFS supports two lifecycle policies. Transition into IA and Transition out of IA
  # Transition into IA transition files into the file systems's Infrequent Access storage class
  # Transition files out of IA storage
  lifecycle_policy {
    transition_to_ia = "AFTER_7_DAYS"
  }
  kms_key_id = var.kms_key_id
  encrypted  = true
  tags       = var.tags
}

# Creating the EFS access point for AWS EFS File system
resource "aws_efs_access_point" "data_storage_access_point" {
  file_system_id = aws_efs_file_system.data_storage.id
  tags           = var.tags
}
# Creating the AWS EFS System policy to transition files into and out of the file system.
resource "aws_efs_file_system_policy" "policy" {
  file_system_id                     = aws_efs_file_system.data_storage.id
  bypass_policy_lockout_safety_check = true
  # The EFS System Policy allows clients to mount, read and perform
  # write operations on File system
  # The communication of client and EFS is set using aws:secureTransport Option
  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Id": "Policy01",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "Statement",
            "Effect": "Allow",
            "Principal": {
                "AWS": "${var.ecs_task_role_arn}"
            },
            "Resource": "${aws_efs_file_system.data_storage.arn}",
            "Action": [
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite"
            ]
        }
    ]
}
POLICY
}
# Creating the AWS EFS Mount point in a specified Subnet
# AWS EFS Mount point uses File system ID to launch.
resource "aws_efs_mount_target" "efs-mount-target" {
  file_system_id  = aws_efs_file_system.data_storage.id
  subnet_id       = var.subnet_ids[0]
  security_groups = [aws_security_group.efs-sg.id]
}

resource "aws_efs_mount_target" "efs-mount-target-2" {
  file_system_id  = aws_efs_file_system.data_storage.id
  subnet_id       = var.subnet_ids[1]
  security_groups = [aws_security_group.efs-sg.id]
}

resource "aws_security_group" "efs-sg" {
  name        = "${var.cluster_id}-efs-access-sg"
  description = "Allows access to EFS storage from the containers"
  vpc_id      = var.vpc_id

  ingress {
    description     = "NFS for container access to EFS storage"
    from_port       = 2049
    to_port         = 2049
    protocol        = "tcp"
    security_groups = var.ecs_security_group_id
  }

  egress {
    description = "Full egress access"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
  }

  tags = merge(
    var.tags,
    {
      Name = "allow_access_to_efs"
    }
  )
}

[profile client-cli-admin]
role_arn = arn:aws:iam::REDACTED:role/AdminRole
source_profile = client-cli-audit
mfa_serial = arn:aws:iam::REDACTED:mfa/6mile-mfa
region = ap-southeast-2

6mile Demo ~/projects/security-audits/client % cloudfox aws buckets --profile client-cli-admin
assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x20cc6e3]

goroutine 1 [running]:
github.com/BishopFox/cloudfox/internal.AWSConfigFileLoader({_, _}, {_, _})
	github.com/BishopFox/cloudfox/internal/aws.go:41 +0x303
github.com/BishopFox/cloudfox/internal.AWSWhoami({0x20ce2f997, 0xf}, {0x5ea277b, 0x6})
	github.com/BishopFox/cloudfox/internal/aws.go:53 +0x45
github.com/BishopFox/cloudfox/cli.awsPreRun(0xc0002eb900?, {0x5ea0272?, 0x4?, 0x5ea0276?})
	github.com/BishopFox/cloudfox/cli/aws.go:484 +0x188
github.com/spf13/cobra.(*Command).execute(0x81604e0, {0xc0006a7a60, 0x2, 0x2})
	github.com/spf13/[email protected]/command.go:929 +0x7d1
github.com/spf13/cobra.(*Command).ExecuteC(0x815fc40)
	github.com/spf13/[email protected]/command.go:1068 +0x3a5
github.com/spf13/cobra.(*Command).Execute(...)
	github.com/spf13/[email protected]/command.go:992
main.main()
	github.com/BishopFox/cloudfox/main.go:19 +0x51

6mile Demo ~/projects/security-audits/client % aws s3 ls --profile client-cli-admin
2021-09-14 13:47:02 REDACTED
2023-04-18 17:51:43 REDACTED
2022-07-22 11:30:21 REDACTED

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::012345678912:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/SOMEID"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-west-2.amazonaws.com/id/SOMEID:sub": [
                        "system:serviceaccount:some-system:some-controller",
                        "system:serviceaccount:myoperator-system:myoperator-controller-manager"
                    ]
                }
            }
        }
    ]
}

❯ ./cloudfox aws env-vars --profile reader-admin-hoge
[🦊 cloudfox v1.7.1 🦊 ] AWS Caller Identity: arn:aws:iam::364399834359:user/reader-admin
[env-vars] Enumerating environment variables in all regions for account 364399834359.
[env-vars] Supported Services: App Runner, Elastic Container Service, Lambda, Lightsail Containers, Sagemaker
[env-vars] Status: 0/105 tasks complete (0 errors -- For details check /Users/motikan2010/.cloudfox/cloudfox-error.log)
(...freeze..)

❯ git diff
diff --git a/cli/aws.go b/cli/aws.go
index 662485f..2a45ea7 100644
--- a/cli/aws.go
+++ b/cli/aws.go
@@ -480,6 +480,7 @@ var (
                                        Caller:          *caller,
                                        AWSRegions:      AWSRegions,
                                        AWSProfile:      profile,
+                                       Goroutines:      Goroutines,
                                        ECSClient:       ecs.NewFromConfig(AWSConfig),
                                        AppRunnerClient: apprunner.NewFromConfig(AWSConfig),
                                        LambdaClient:    lambda.NewFromConfig(AWSConfig),

$ go version
go version go1.17.6 darwin/amd64

[resource-trusts][666412488974-AIDAJBTEDJEDFGHJKLWJU] Supported Services: CodeBuild, ECR, EFS, Glue, Lambda, SecretsManager, S3, SNS, SQS
failed to get shared config profile, 116412344578-AIDAJBTEDJEDFGHJKLWJU
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x18 pc=0x101022724]

goroutine 9981 [running]:
github.com/BishopFox/cloudfox/internal.AWSConfigFileLoader({_, _}, {_, _}, {_, _})
	github.com/BishopFox/cloudfox/internal/aws.go:67 +0x3e4
github.com/BishopFox/cloudfox/aws.initCloudFoxS3Client({_, _, _, {_}, {}}, {_, _}, {_, _}, {_, ...})
	github.com/BishopFox/cloudfox/aws/client-initializers.go:48 +0x80
github.com/BishopFox/cloudfox/aws.(*ResourceTrustsModule).getS3Buckets(0x140011a4580, 0x100157644?, 0x14002196660, 0x140006733f0?)
	github.com/BishopFox/cloudfox/aws/resource-trusts.go:371 +0x114
created by github.com/BishopFox/cloudfox/aws.(*ResourceTrustsModule).PrintResources in goroutine 1
	github.com/BishopFox/cloudfox/aws/resource-trusts.go:94 +0x8c8

╭─────────┬───────────┬─────────────────────┬──────────────────────────────────────────────────────┬──────────────╮
│ Service │  Region   │    Resource Arn     │                         Role                         │ IsAdminRole? │
├─────────┼───────────┼─────────────────────┼──────────────────────────────────────────────────────┼──────────────┤
│ Lambda  │ us-east-1 │ FunctionName1       │ arn:aws:iam::[REDACTED]:role/[REDACTED]              │ No           │
│ Lambda  │ us-east-1 │ FunctionName2       │ arn:aws:iam::[REDACTED]:role/[REDACTED]              │ No           │
╰─────────┴───────────┴─────────────────────┴──────────────────────────────────────────────────────┴──────────────╯