Comments (7)
The v1.0.0-dev
branch pulls a list of regions to check with the following line of code (/principalmapper/graphing/lambda_edges.py).
lambda_regions = self.session.get_available_regions('lambda')
I expected that the returned list would exclude disabled regions. I'll have to add an extra few lines of code instead. Should be fixed by 1.0.0 release.
The master
branch has a hardcoded list of regions (which is not a good solution, but it prevented this issue ironically).
from pmapper.
Oooh, this smells like the issue in ScoutSuite/botocore surrounding the ap-east-1
region and regions that are disabled. I'll dig in more tonight.
from pmapper.
Could be! I haven't enabled any of the new regions on this account.
from pmapper.
I was able to reproduce with the following test script what is happening in lambda_edges.py
.
import botocore.session
session = botocore.session.Session(profile='personal')
client = session.create_client('lambda', region_name='ap-east-1')
client.list_functions()
Error stack:
File "", line 1, in
File "/REDACTED_HOMEDIR/Library/Python/3.7/lib/python/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/REDACTED_HOMEDIR/Library/Python/3.7/lib/python/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (UnrecognizedClientException) when calling the ListFunctions operation: The security token included in the request is invalid.
from pmapper.
One more comment... A bit ago I was POCing an AWS Organizations SCP that would deny any API call outside of US regions. That wouldn't explicitly disable them (which only seems to work on regions launched after March 20, 2019), but API calls would still fail.
from pmapper.
Just pushed 6046c00 to fix this in v1.0.0-dev
.
from pmapper.
Works great - thank you!
from pmapper.
Related Issues (20)
- PMapper 1.1.5 builds edges that include role/AWSServiceRoleForSupport when performing authorization checks HOT 10
- Terraform Plans HOT 2
- Graph Deletion HOT 1
- Local user who can assume an admin role not in graph HOT 6
- Stuck at Generating Edges based on lambda data HOT 1
- MFA requirements in roles can lead to misleading results
- can_privesc() method only returns one edge_list ?
- Traceback when doing connected query for role that does not exist
- FileNotFoundError in graph_cli
- Exception When Policy is Only Used as Permission Boundary HOT 1
- Permission boundaries not considered when querying
- Python 3.10 fails to run HOT 1
- Does not run in 3.11 due to mapping import error HOT 1
- iam:ListAccessKeys denied exception in gathering.py
- Stack trace on incorrect PMAPPER_STORAGE environment variable
- Stack trace on missing credentials
- Crash while scanning principals that use deprecated permission policies HOT 3
- Performance issues scanning large accounts HOT 8
- AWS Policy with minimal permissions
- Collections Module issue in Python 3.10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pmapper.