oscp/Necronomicon/Cloud/AWS/AWS CLI.md

• Using credentials with AWS CLI involves a file at ~/.aws/credentials, with the following example format:

[<profile_name>]
aws_access_key_id = <key>
aws_secret_access_key = <secret>
aws_session_token = <session_token>

- Add `--profile demo` to use the above with AWS CLI commands

• List accounts belonging to organization
  • aws organizations list-accounts
• Get information about IAM role
  • aws iam get-role --role-name <role_name> --profile <profile_name>
• List details on instances
  • aws ec2 describe-instances --region=<region> --profile <profile_filename>
• List details on container repositories
  • aws ecr describe-repositories --region=<region> --profile gretsch1
• Get user information
  • aws iam get-user --profile <profile_name>
  • aws iam list-attached-user-policies --user-name=<username> --profile <profile_name>
• Get information on policy
  • aws iam get-policy --policy-arn mxrads-self-manage --profile kevin
  • Version
    • aws iam iam get-policy --policy-arn <policy_arn> --profile <profile_name>
  • Get Content
    • aws iam iam get-policy-version --policy-arn <policy_arn> --version <version> --profile <profile_name>
• List users and groups affiliated with default Administrator policy
  • aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
• List current access keys for user (there can only be 2, so anything less allows you to add one)
  • aws iam list-access-keys --user b.daniella | jq ".AccessKeyMetadata[].AccessKeyId"
• Create access key for user
  • aws iam create-access-key --user b.daniella
• Change role policy
  • aws iam update-assume-role-policy --role-name lambda-dmp-sync --policy-document file://new_policy.json
• Find roles capable of assume-role calls for lambda.amazonaws.com
  • aws iam list-roles | jq -r '.Roles[] | .RoleName + ", " + .AssumeRolePolicyDocument.Statement[].Principal.Service' | grep "lambda.amazonaws.com"
• Check IAM policies for role
  • aws iam list-attached-role-policies --role <role_name> --profile <profile_name>
  • Look for roles with high permissions like IAMFullAccess and which lack write permissions to CloudWatch
• Inspect security groups
  • aws ec2 describe-security-groups --group-ids <id_1> <id_2>
• Assume role
  • aws sts assume-role --role-arn arn:aws:iam::886371554408:user/lambda-dmp-sync --role-session-name AWSCLI-Session --duration-seconds 43200
• List existing lambda functions
  • aws iam lambda list-functions -region=<region>
• Get information on Lambda function
  • aws lambda get-function --function-name <lambda_func_name> --region <region> --profile <profile_name>
• Get information on Kubernetes cluster
  • aws eks describe-cluster --name <cluster_name> --profile <profile_filename> --region=<region>
• Get information from Resource Groups Tagging API
  • aws resourcegroupstaggingapi get-resources --region <region> --profile <profile_name>
• List secrets
  • aws secretsmanager list-secrets --region <region> --profile <profile_name>
• Download secret
  • aws secretsmanager get-secret-value --secret-id '<ID>' --region=eu-west-1 --profile it-role | jq -r .SecretString | base64 -d
• List buckets accessible with these credentials/this role:
  • aws s3api listbuckets --profile <profile_name>
  • List buckets and show bucket names only
    • aws s3api list-buckets --profile <profile_name> --query "Buckets[].Name"
• Sync bucket
  • mounted locally
    • aws s3 sync s3://<bucket_name> <filesystem_mount_point>
  • With another bucket
    • aws s3 sync s3://source-bucket/ s3://destination-bucket
• List keys inside a single bucket
  1. aws s3api list-objects-v2 --profile <profile_name> --bucket <bucket_name> > list_objects_dl.txt
  2. grep '"Key"' list_objects_dl | sed 's/[",]//g' > list_keys_dl.txt
• Check for S3 bucket logging
  • aws s3api get-bucket-logging --profile <profile_name> --bucket <bucket_name>
• Check bucket policy
  • aws s3api get-bucket-policy --bucket <bucket_name>
• Get account ID
  • aws sts get-caller-identity --profile <profile_name>
• Create a new bucket:
  • aws s3api create-bucket --bucket <bucket_name> --region=<aws_region> --create-bucket-configuration LocationConstraint=<aws_region>
• Upload file to bucket:
  • aws s3api put-object --bucket <bucket_name> --key <key_name> --body <filename>
• Change file permissions in bucket:
  • aws s3api put-bucket-policy --bucket <bucket_name> --policy file://<local_policy_file>
• Exchange service account token for IAM keys (only for proper service account tokens with OpenID info in AWS)
  1. AWS_ROLE_ARN="<role_name>"
     • e.g. AWS_ROLE_ARN="arn:aws:iam::886477354405:role/api-core.ec2"
  2. TOKEN ="<token>"
  3. aws sts assume-role-with-web-identity --role-arn $AWS_ROLE_ARN --role-session-name sessionID --web-identity-token $TOKEN --duration-seconds 43200
• Exchange IAM key for Kubernetes token
  • aws eks get-token --cluster-name <cluster_name> --profile <profile_name>
• Create kubectl config
  • aws eks update-kubeconfig --name <cluster_name> --profile <profile_name>
• Get all instances that match a specific tag
  • while read p; do instanceID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=*$p*" --query 'Reservations[0].Instances[].InstanceId' --region=eu-west-1 --output=text; echo $instanceID > list_ids.txt; done <services.txt
• Get user data from instance IDs in a file
  • while read p; do userData=$(aws ec2 describe-instance-attribute --instance-id $p --attribute userData --region=eu-west-1 | jq -r .UserData.Value | base64 -d) echo $userData > $p.txt done
• Get launch configurations
  • aws autoscaling describe-launch-configurations
  • aws ec2 describe-launch-templates
• Start instance with user data script that runs on startup:
  • aws ec2 run-instances --image-id ami-<id> --count 1 --instance-type m3.medium --iam-instance-profile <profile_name> --subnet-id subnet-<id> --security-group-ids sg-<id> --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=spark-worker-5739ecea19a4}]' --user-data file://<startup_script> --profile <profile_name> --region <region>
• Redshift
  • Get info on clusters
    • aws redshift describe-clusters
  • Get credentials for cluster
    • aws get-cluster-credentials --db-user root --db-name <database_name> --cluster-identifier <cluster_id> --duration-seconds 3600
• Check monitoring
  • Access Analyzer
    • aws accessanalyzer list-analyzers --region=<region>
  • CloudTrail
    • aws cloudtrail describe-trails --region=<region>
  • GuardDuty
    • aws guardduty list-detectors --region=<region>
• Extract info from CloudTrail
  • aws logs describe-log-groups --region=<region> --profile <profile_name>
  • Filter for activity referring to a specific account
    • aws logs filter-log-events --log-group-name "CloudTrail/DefaultLogGroup" --filter-pattern "<account_ID>" --max-items 10 --profile <profile_name> --region <region> | jq ".events[].message" | sed 's/\\//g'