AWS analyze

edition enterprise only aws analyze shows the iam identity behind a discovered aws key, the identity based permissions attached to it, and related revocation metadata, so you can triage the finding overview leverage aws analyze when you want to enrich aws secret detections with iam context trufflehog uses a privileged aws identity you provide to run read only permission checks against the detected secret after the integration is healthy, aws secrets detected from that point are analyzed with those credentials you must create that privileged identity in aws before you can add the integration the calls are read only how it works a privileged aws identity does the analysis you give trufflehog credentials for an iam user, or for an iam role assumed through iam roles anywhere trufflehog uses that identity to make read only iam and sts calls for the principal behind a discovered key setup is validated on save adding the integration runs a credential self check healthy means the required permissions are in place unhealthy means the self check failed opening the status shows what went wrong analysis runs on newly detected aws secrets a scanner that finds a live aws credential after the integration is healthy uses those credentials to analyze it two authentication methods access keys on an iam user, or a client certificate via iam roles anywhere with access keys, you can optionally assume a role for the analysis prerequisites requirement detail aws account permission to create an iam user, or to create a private ca, iam role, trust anchor, and profile for roles anywhere trufflehog analyze aws analyze is a cloud analyze integration in trufflehog enterprise privileged identity an iam user or roles anywhere role with the permissions below attach a customer managed policy with these permissions if you set a role arn on the access key integration, the identity also needs sts\ assumerole on arn\ aws\ iam role/ permission resource sts\ getcalleridentity iam\ getuser arn\ aws\ iam user/ iam\ listgroupsforuser arn\ aws\ iam user/ iam\ listattacheduserpolicies arn\ aws\ iam user/ iam\ listuserpolicies arn\ aws\ iam user/ iam\ getuserpolicy arn\ aws\ iam user/ iam\ listattachedgrouppolicies arn\ aws\ iam group/ iam\ listgrouppolicies arn\ aws\ iam group/ iam\ getgrouppolicy arn\ aws\ iam group/ iam\ listroles iam\ listattachedrolepolicies arn\ aws\ iam role/ iam\ listrolepolicies arn\ aws\ iam role/ iam\ getrolepolicy arn\ aws\ iam role/ iam\ getpolicy arn\ aws\ iam policy/ , arn\ aws\ iam aws\ policy/ iam\ getpolicyversion arn\ aws\ iam policy/ , arn\ aws\ iam aws\ policy/ iam\ listaccountaliases iam\ getaccesskeylastused arn\ aws\ iam user/ { "version" "2012 10 17", "statement" \[ { "sid" "trufflehoganalyzeaccount", "effect" "allow", "action" \[ "sts\ getcalleridentity", "iam\ listroles", "iam\ listaccountaliases" ], "resource" " " }, { "sid" "trufflehoganalyzeusers", "effect" "allow", "action" \[ "iam\ getuser", "iam\ listgroupsforuser", "iam\ listattacheduserpolicies", "iam\ listuserpolicies", "iam\ getuserpolicy", "iam\ getaccesskeylastused" ], "resource" "arn\ aws\ iam user/ " }, { "sid" "trufflehoganalyzegroups", "effect" "allow", "action" \[ "iam\ listattachedgrouppolicies", "iam\ listgrouppolicies", "iam\ getgrouppolicy" ], "resource" "arn\ aws\ iam group/ " }, { "sid" "trufflehoganalyzeroles", "effect" "allow", "action" \[ "iam\ listattachedrolepolicies", "iam\ listrolepolicies", "iam\ getrolepolicy" ], "resource" "arn\ aws\ iam role/ " }, { "sid" "trufflehoganalyzepolicies", "effect" "allow", "action" \[ "iam\ getpolicy", "iam\ getpolicyversion" ], "resource" \[ "arn\ aws\ iam policy/ ", "arn\ aws\ iam aws\ policy/ " ] } ] } create an iam user and access keys use this method unless your organization requires short lived credentials in the aws console, go to iam , then users click create user and enter a name, such as trufflehog aws analyze attach a customer managed policy with the permissions in prerequisites save the user on the user's detail view, click create access key select third party service , then click next enter a description and click create access key copy the access key id and the secret access key aws does not show the secret access key again store it before you leave the wizard you now have an access key id and secret access key to paste into trufflehog enterprise set up iam roles anywhere use this method when you cannot issue long lived access keys trufflehog presents a client certificate to iam roles anywhere https //docs aws amazon com/rolesanywhere/latest/userguide/introduction html and receives temporary credentials an aws administrator creates the infrastructure once per account repeat the certificate steps when you rotate or add a credential create the aws infrastructure private ca trufflehog authenticates through aws private ca https //docs aws amazon com/privateca/latest/userguide/pcawelcome html if you already have an acm pca registered ca, skip to the iam role creating a root ca bills as a private ca a subordinate ca under an existing organization ca avoids a second monthly charge aws acm pca create certificate authority \\ \ certificate authority type root \\ \ certificate authority configuration \\ "keyalgorithm=rsa 2048,signingalgorithm=sha256withrsa,subject={commonname=trufflehoganalyzeca}" \\ \ region us east 1 activate a new root ca by self signing it aws acm pca get certificate authority csr \\ \ certificate authority arn $ca arn \\ \ output text region us east 1 > ca csr pem aws acm pca issue certificate \\ \ certificate authority arn $ca arn \\ \ csr fileb //ca csr pem \\ \ signing algorithm sha256withrsa \\ \ template arn arn\ aws\ acm pca template/rootcacertificate/v1 \\ \ validity value=3650,type=days \\ \ region us east 1 aws acm pca get certificate \\ \ certificate authority arn $ca arn \\ \ certificate arn $root cert arn \\ \ query 'certificate' output text region us east 1 > ca cert pem aws acm pca import certificate authority certificate \\ \ certificate authority arn $ca arn \\ \ certificate fileb //ca cert pem \\ \ region us east 1 iam role create a role that roles anywhere can assume, and attach the policy from prerequisites trust policy (trust policy json) { "version" "2012 10 17", "statement" \[ { "effect" "allow", "principal" { "service" "rolesanywhere amazonaws com" }, "action" \["sts\ assumerole", "sts\ setsourceidentity", "sts\ tagsession"] } ] } aws iam create role \\ \ role name trufflehoganalyze \\ \ assume role policy document file //trust policy json aws iam create policy \\ \ policy name trufflehoganalyzepolicy \\ \ policy document file //analyze policy json aws iam attach role policy \\ \ role name trufflehoganalyze \\ \ policy arn arn\ aws\ iam \<your account id>\ policy/trufflehoganalyzepolicy trust anchor this tells roles anywhere which ca to trust aws rolesanywhere create trust anchor \\ \ name trufflehoganalyzeanchor \\ \ source "sourcetype=aws acm pca,sourcedata={acmpcaarn=$ca arn}" \\ \ enabled \\ \ region us east 1 save the trustanchorarn from the output profile this links the trust anchor to the iam role the trust anchor and profile must be in the same region aws rolesanywhere create profile \\ \ name trufflehoganalyzeprofile \\ \ role arns arn\ aws\ iam \<your account id>\ role/trufflehoganalyze \\ \ enabled \\ \ region us east 1 save the profilearn from the output you should now have three arns the trust anchor, the profile, and arn\ aws\ iam \<your account id>\ role/trufflehoganalyze issue a client certificate repeat these steps to rotate a credential or create another one generate a key and a certificate signing request openssl genrsa out client key pem 2048 openssl req new key client key pem out client csr pem \\ subj "/cn=trufflehog analyze" the common name is for identification use any descriptive value issue an end entity certificate from your private ca set validity to a duration your organization accepts aws acm pca issue certificate \\ \ certificate authority arn $ca arn \\ \ csr fileb //client csr pem \\ \ signing algorithm sha256withrsa \\ \ template arn arn\ aws\ acm pca template/endentitycertificate/v1 \\ \ validity value=365,type=days \\ \ region us east 1 save the certificatearn from the output, then retrieve the certificate aws acm pca get certificate \\ \ certificate authority arn $ca arn \\ \ certificate arn $client cert arn \\ \ query 'certificate' output text \\ \ region us east 1 > client cert pem you now have client cert pem, client key pem, and the three arns to paste into trufflehog enterprise add an aws analyze integration go to integrations open the cloud analyze tab click add integration , then cloud analyze , then amazon web services (aws) select a hosted or self hosted scanner hosted scanner configuration access keys name the integration enter the access key id and secret access key from the iam user optionally enter a role arn to assume for analysis, and an aws region click add integration the integration runs a credential self check it is healthy when the required permissions are in place aws secrets detected from this point are analyzed with these credentials if you set a role arn, the iam user also needs sts\ assumerole on arn\ aws\ iam role/ certificate every field is required name the integration paste the trust anchor arn, profile arn, role arn, client certificate, and private key from set up iam roles anywhere click add integration the integration runs a credential self check it is healthy when the required permissions are in place aws secrets detected from this point are analyzed with these credentials self hosted scanner configuration in the scanner config yaml, set analyze aws using default credentials true set aws access key id and aws secret access key in the scanner process environment or , set aws auth cert to point to a complete cert file optional aws assume role arn for the assumed role notes analysis applies to aws secrets detected after the integration is healthy interpret aws analyze results aws analyze organizes results around the identity behind the key and the roles that identity may reach identity shows the aws account, principal arn, identity type, groups, tags, creation date, and permissions boundary when available all permissions combines the permission rows found during analysis select it or an individual role to populate the permissions table “no permissions found” before making a selection does not mean the key has no permissions direct roles can be assumed directly by the discovered identity assumable roles are reachable through one additional role assumption these paths can expand the key’s access beyond its original identity policies each permission row shows effect whether the source statement declares allow or deny action the aws api operation covered by the statement resource the arn or resource pattern to which it applies indicates broad scope policy the policy that produced the row limits conditions that may restrict when the statement applies policy labels describe the source of a policy managed an aws managed or customer managed policy attached to the identity or role inline a policy embedded directly in an iam user or role group managed / group inline a policy inherited through an iam group trust a role trust policy trust policies determine who may assume a role they do not grant the permissions available after assumption troubleshooting condition cause solution integration marked unhealthy the credential self check failed open the status for the failure edit the credential if a value you entered is wrong click refresh if the failure was on aws's side, then try again self check fails after you set a role arn the iam user cannot assume that role grant sts\ assumerole on the role, then edit the integration or click refresh secret access key is no longer in the aws console aws shows the secret access key only at creation create a new access key on the iam user and edit the integration