Ajinkya kubernetes prevention #128

ajinkya1986 · 2024-07-31T05:13:55Z

No description provided.

mpurusottamc · 2024-07-31T05:14:40Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_awsvpc_networking_enabled.mdx

+4. **Check the network mode of each task definition:**
+
+```python
+for task_definition in response['taskDefinitionArns']:


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:42Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_awsvpc_networking_enabled_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:44Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_cluster_container_insights_enable.mdx

+        settings=[
+            {
+                'name': 'containerInsights',
+                'value': 'enabled'


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:45Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_cluster_container_insights_enable.mdx

+    ```
+
+4. **Check if Container Insights is enabled:**
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:47Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_cluster_container_insights_enable_remediation.mdx

+# Create a session using your AWS credentials
+session = boto3.Session(
+    aws_access_key_id='YOUR_AWS_ACCESS_KEY',
+    aws_secret_access_key='YOUR_AWS_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:48Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_cluster_container_insights_enable_remediation.mdx

+
+    session = boto3.Session(
+        aws_access_key_id='YOUR_ACCESS_KEY',
+        aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:50Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_task_definition_nonroot_user.mdx

+        task_def = ecs_client.describe_task_definition(taskDefinition=task['taskDefinitionArn'])
+        if 'user' in task_def['taskDefinition']['containerDefinitions'][0] and task_def['taskDefinition']['containerDefinitions'][0]['user'] == 'root':
+            print(f"Task {task['taskArn']} is running as root")
+```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:52Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_task_definition_nonroot_user_remediation.mdx

+import boto3
+
+aws_access_key_id = 'YOUR_ACCESS_KEY'
+aws_secret_access_key = 'YOUR_SECRET_KEY'


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:54Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_task_definition_user_for_host_mode.mdx

+)
+kubernetes_client = KubernetesClient(credentials, 'YOUR_SUBSCRIPTION_ID')
+
+def check_pod_permissions():


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:55Z

docs/aws/audit/kubernetesmonitoring/rules/ecs_task_definition_user_for_host_mode.mdx

+        if pod.spec.host_network:
+            # Check permissions here
+```
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:57Z

.../aws/audit/kubernetesmonitoring/rules/ecs_task_definition_user_for_host_mode_remediation.mdx

+
+```python
+session = boto3.Session(aws_access_key_id='YOUR_ACCESS_KEY',
+                        aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:14:59Z

.../aws/audit/kubernetesmonitoring/rules/ecs_task_definition_user_for_host_mode_remediation.mdx

+```python
+credentials = ServicePrincipalCredentials(
+    client_id='YOUR_CLIENT_ID',
+    secret='YOUR_SECRET',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:00Z

docs/aws/audit/kubernetesmonitoring/rules/efs_access_point_enforce_root_directory.mdx

+            print(f"Access point {ap['AccessPointId']} in file system {fs['FileSystemId']} does not enforce root directory.")
+```
+
+This script will print out the IDs of all access points that do not enforce the root directory.


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:02Z

...aws/audit/kubernetesmonitoring/rules/efs_access_point_enforce_root_directory_remediation.mdx

+
+session = boto3.Session(
+    aws_access_key_id='YOUR_ACCESS_KEY',
+    aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:04Z

docs/aws/audit/kubernetesmonitoring/rules/is_ecr_lifecycle_policy_attached.mdx

+   ```
+
+4. Interpret the results: The script will print out the names of all repositories and whether they have a lifecycle policy. If a repository does not have a lifecycle policy, the script will raise a `LifecyclePolicyNotFoundException`, which we catch and print a message. This way, you can easily see which repositories are misconfigured.
+</Accordion>


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:05Z

docs/aws/audit/kubernetesmonitoring/rules/is_ecr_lifecycle_policy_attached_remediation.mdx

+
+   session = boto3.Session(
+       aws_access_key_id='YOUR_ACCESS_KEY',
+       aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:07Z

docs/aws/audit/kubernetesmonitoring/rules/is_ecr_vuln_scan_enabled.mdx

+        print(f"Enabled image scanning for repository: {repo_name}")
+
+if __name__ == "__main__":
+    enable_image_scanning()


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:09Z

docs/aws/audit/kubernetesmonitoring/rules/is_ecr_vuln_scan_enabled_remediation.mdx

+    # Create a session using your AWS credentials
+    session = boto3.Session(
+        aws_access_key_id='YOUR_AWS_ACCESS_KEY',
+        aws_secret_access_key='YOUR_AWS_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:11Z

docs/aws/audit/kubernetesmonitoring/rules/is_k8s_logging_enabled.mdx

+   if __name__ == '__main__':
+       check_eks_logging()
+   ```
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:12Z

docs/aws/audit/kubernetesmonitoring/rules/is_k8s_logging_enabled_remediation.mdx

+
+   ```bash
+   export AWS_ACCESS_KEY_ID='your_access_key'
+   export AWS_SECRET_ACCESS_KEY='your_secret_key'


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:14Z

docs/aws/audit/kubernetesmonitoring/rules/is_version_recent.mdx

+       cluster_info = eks.describe_cluster(name=cluster)['cluster']
+       if cluster_info['version'] < latest_stable_version:
+           print(f"Cluster: {cluster} is not using the latest stable version of Kubernetes")
+   ```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:16Z

docs/aws/audit/kubernetesmonitoring/rules/is_version_recent_remediation.mdx

+   import boto3
+   session = boto3.Session(
+       aws_access_key_id='YOUR_ACCESS_KEY',
+       aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:17Z

docs/aws/audit/kubernetesmonitoring/rules/sg_secure_only.mdx

+           # If there is any rule that allows traffic on a port other than 443, print a warning
+           if permission['FromPort'] != 443 or permission['ToPort'] != 443:
+               print(f'Security group {sg_id} allows traffic on port {permission["FromPort"]}-{permission["ToPort"]}')
+   ```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-31T05:15:19Z

docs/aws/audit/kubernetesmonitoring/rules/sg_secure_only_remediation.mdx

+   # Create a session using your AWS credentials
+   session = boto3.Session(
+       aws_access_key_id='YOUR_ACCESS_KEY',
+       aws_secret_access_key='YOUR_SECRET_KEY',


Secret: Secret Keyword

Click here for more details

ajinkyajawalkar added 2 commits May 16, 2024 13:13

Added cause for kubernetes

ea3192e

Added prevention for kubernetes

4223c66

ajinkya1986 requested a review from mpurusottamc July 31, 2024 05:13

mpurusottamc reviewed Jul 31, 2024

View reviewed changes

Ajinkya kubernetes prevention #128

Are you sure you want to change the base?

Ajinkya kubernetes prevention #128

Uh oh!

Conversation

ajinkya1986 commented Jul 31, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants