Alvaro Del Valle
3cce1fa61f
Read-only cloud discovery of the Scrivas AWS Organization (o-qfj0pvhhv7) to inform a proposal. - scripts/: boto3 org assessment, member-account assessment, fast discovery - findings/: self-contained HTML dashboards, written report, summary JSON, and the rendered Prowler benchmark report - docs/full_discovery_plan.md: phased full-discovery plan - index.html: landing page linking all reports - Pipfile/.python-version: reproducible pipenv env (Python 3.12.11) Large raw scans (OCSF JSON, CSV, compliance/) are git-ignored.
260 lines
13 KiB
HTML
260 lines
13 KiB
HTML
<title>Scrivas — AWS Organizations Assessment</title>
|
|
<style>
|
|
:root {
|
|
--bg: #eef0f3;
|
|
--panel: #ffffff;
|
|
--panel-2: #f7f8fa;
|
|
--ink: #171d27;
|
|
--ink-soft: #4a5563;
|
|
--ink-faint: #79828f;
|
|
--line: #dde1e7;
|
|
--line-soft: #e8ebef;
|
|
--accent: #0d6e78; /* considered teal — technical, not AWS-orange */
|
|
--accent-ink:#0a565e;
|
|
--good: #2f8657;
|
|
--warn: #b5832a;
|
|
--crit: #bd463b;
|
|
--crit-bg: #fbeceb;
|
|
--good-bg: #eaf4ee;
|
|
--warn-bg: #f8f1e2;
|
|
--mono: ui-monospace, "SF Mono", "SFMono-Regular", Menlo, Consolas, monospace;
|
|
--sans: ui-sans-serif, system-ui, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
|
|
--shadow: 0 1px 2px rgba(20,26,38,.04), 0 6px 20px -12px rgba(20,26,38,.18);
|
|
}
|
|
@media (prefers-color-scheme: dark) {
|
|
:root {
|
|
--bg:#0d1117; --panel:#161c26; --panel-2:#1b222e; --ink:#e8ecf1;
|
|
--ink-soft:#aab3c0; --ink-faint:#7c8695; --line:#28303c; --line-soft:#212934;
|
|
--accent:#3bb4bf; --accent-ink:#8fdfe6;
|
|
--good:#54b681; --warn:#d6a94a; --crit:#e26b60;
|
|
--crit-bg:#2a1917; --good-bg:#132419; --warn-bg:#251d10;
|
|
--shadow: 0 1px 2px rgba(0,0,0,.3), 0 8px 24px -14px rgba(0,0,0,.6);
|
|
}
|
|
}
|
|
:root[data-theme="dark"] {
|
|
--bg:#0d1117; --panel:#161c26; --panel-2:#1b222e; --ink:#e8ecf1;
|
|
--ink-soft:#aab3c0; --ink-faint:#7c8695; --line:#28303c; --line-soft:#212934;
|
|
--accent:#3bb4bf; --accent-ink:#8fdfe6;
|
|
--good:#54b681; --warn:#d6a94a; --crit:#e26b60;
|
|
--crit-bg:#2a1917; --good-bg:#132419; --warn-bg:#251d10;
|
|
--shadow: 0 1px 2px rgba(0,0,0,.3), 0 8px 24px -14px rgba(0,0,0,.6);
|
|
}
|
|
:root[data-theme="light"] {
|
|
--bg:#eef0f3; --panel:#ffffff; --panel-2:#f7f8fa; --ink:#171d27;
|
|
--ink-soft:#4a5563; --ink-faint:#79828f; --line:#dde1e7; --line-soft:#e8ebef;
|
|
--accent:#0d6e78; --accent-ink:#0a565e; --good:#2f8657; --warn:#b5832a; --crit:#bd463b;
|
|
--crit-bg:#fbeceb; --good-bg:#eaf4ee; --warn-bg:#f8f1e2;
|
|
--shadow: 0 1px 2px rgba(20,26,38,.04), 0 6px 20px -12px rgba(20,26,38,.18);
|
|
}
|
|
|
|
* { box-sizing: border-box; }
|
|
body {
|
|
margin:0; background:var(--bg); color:var(--ink);
|
|
font-family:var(--sans); line-height:1.5;
|
|
-webkit-font-smoothing:antialiased;
|
|
}
|
|
.wrap { max-width:1080px; margin:0 auto; padding:32px 24px 64px; }
|
|
|
|
/* Header */
|
|
header { display:flex; flex-wrap:wrap; align-items:flex-end; justify-content:space-between; gap:16px; padding-bottom:20px; border-bottom:2px solid var(--ink); }
|
|
.eyebrow { font-size:11px; letter-spacing:.16em; text-transform:uppercase; color:var(--accent); font-weight:700; }
|
|
h1 { font-size:clamp(24px,4vw,34px); margin:6px 0 4px; letter-spacing:-.02em; text-wrap:balance; font-weight:750; }
|
|
.sub { color:var(--ink-soft); font-size:14px; }
|
|
.idcard { font-family:var(--mono); font-size:12px; color:var(--ink-soft); text-align:right; line-height:1.7; }
|
|
.idcard b { color:var(--ink); }
|
|
|
|
/* KPI row */
|
|
.kpis { display:grid; grid-template-columns:repeat(4,1fr); gap:14px; margin:22px 0 30px; }
|
|
@media (max-width:720px){ .kpis{ grid-template-columns:repeat(2,1fr);} }
|
|
.kpi { background:var(--panel); border:1px solid var(--line); border-radius:12px; padding:16px 16px 14px; box-shadow:var(--shadow); position:relative; overflow:hidden; }
|
|
.kpi::before { content:""; position:absolute; left:0; top:0; bottom:0; width:3px; background:var(--accent); }
|
|
.kpi.crit::before { background:var(--crit); }
|
|
.kpi.good::before { background:var(--good); }
|
|
.kpi .n { font-size:30px; font-weight:750; letter-spacing:-.02em; font-variant-numeric:tabular-nums; }
|
|
.kpi.crit .n { color:var(--crit); }
|
|
.kpi .lbl { font-size:12px; color:var(--ink-faint); margin-top:2px; }
|
|
.kpi .meta { font-size:11px; color:var(--ink-soft); margin-top:8px; }
|
|
|
|
/* Panels */
|
|
section { background:var(--panel); border:1px solid var(--line); border-radius:14px; padding:22px 24px; margin-bottom:18px; box-shadow:var(--shadow); }
|
|
.sec-head { display:flex; align-items:baseline; gap:10px; margin-bottom:16px; }
|
|
.sec-head .tag { font-family:var(--mono); font-size:12px; color:var(--accent); font-weight:700; }
|
|
.sec-head h2 { font-size:17px; margin:0; letter-spacing:-.01em; }
|
|
.sec-head .note { margin-left:auto; font-size:12px; color:var(--ink-faint); }
|
|
|
|
.chips { display:flex; flex-wrap:wrap; gap:8px; }
|
|
.chip { font-family:var(--mono); font-size:12px; padding:5px 10px; border-radius:999px; background:var(--panel-2); border:1px solid var(--line); color:var(--ink-soft); }
|
|
.chip.on { border-color:var(--accent); color:var(--accent-ink); background:color-mix(in srgb, var(--accent) 8%, var(--panel)); }
|
|
|
|
.pill { display:inline-flex; align-items:center; gap:6px; font-size:11px; font-weight:700; padding:3px 9px; border-radius:999px; letter-spacing:.02em; }
|
|
.pill.crit { background:var(--crit-bg); color:var(--crit); }
|
|
.pill.good { background:var(--good-bg); color:var(--good); }
|
|
.pill.warn { background:var(--warn-bg); color:var(--warn); }
|
|
.dot { width:7px; height:7px; border-radius:50%; background:currentColor; }
|
|
|
|
.callout { display:flex; gap:14px; align-items:flex-start; background:var(--crit-bg); border:1px solid color-mix(in srgb, var(--crit) 35%, transparent); border-radius:10px; padding:14px 16px; }
|
|
.callout .big { font-size:26px; font-weight:750; color:var(--crit); line-height:1; font-variant-numeric:tabular-nums; }
|
|
.callout p { margin:0; font-size:13.5px; color:var(--ink-soft); }
|
|
.callout b { color:var(--ink); }
|
|
|
|
/* trust rows */
|
|
.trust { display:flex; flex-direction:column; gap:10px; }
|
|
.trow { display:flex; flex-wrap:wrap; align-items:center; gap:10px; padding:12px 14px; border:1px solid var(--line); border-radius:10px; background:var(--panel-2); }
|
|
.trow .rn { font-family:var(--mono); font-size:13px; font-weight:600; }
|
|
.trow .arw { color:var(--ink-faint); }
|
|
.trow .acct { font-family:var(--mono); font-size:12.5px; color:var(--ink-soft); }
|
|
.trow .vend { margin-left:auto; font-size:12px; color:var(--ink-soft); }
|
|
|
|
/* findings table */
|
|
.tbl-wrap { overflow-x:auto; }
|
|
table { width:100%; border-collapse:collapse; font-size:13.5px; min-width:520px; }
|
|
th { text-align:left; font-size:11px; letter-spacing:.08em; text-transform:uppercase; color:var(--ink-faint); font-weight:700; padding:0 12px 10px; border-bottom:1px solid var(--line); }
|
|
td { padding:13px 12px; border-bottom:1px solid var(--line-soft); vertical-align:top; color:var(--ink-soft); }
|
|
td b { color:var(--ink); font-weight:600; }
|
|
tr:last-child td { border-bottom:none; }
|
|
.sev { white-space:nowrap; }
|
|
|
|
footer { margin-top:24px; font-size:12px; color:var(--ink-faint); display:flex; flex-wrap:wrap; gap:6px 16px; }
|
|
footer code { font-family:var(--mono); color:var(--ink-soft); }
|
|
a { color:var(--accent-ink); }
|
|
</style>
|
|
|
|
<div class="wrap">
|
|
<header>
|
|
<div>
|
|
<div class="eyebrow">Dasnuve · Cloud Discovery</div>
|
|
<h1>Scrivas — AWS Organizations Assessment</h1>
|
|
<div class="sub">Delegated administration, trust policies & trusted access · read-only enumeration</div>
|
|
</div>
|
|
<div class="idcard">
|
|
org <b>o-qfj0pvhhv7</b><br>
|
|
mgmt <b>716468089330</b><br>
|
|
as <b>iam/louis</b> · 2026-08-19
|
|
</div>
|
|
</header>
|
|
|
|
<div class="kpis">
|
|
<div class="kpi good">
|
|
<div class="n">2</div><div class="lbl">Accounts in org</div>
|
|
<div class="meta">Scrivas Admin · Lazka — no OUs (flat)</div>
|
|
</div>
|
|
<div class="kpi good">
|
|
<div class="n">6</div><div class="lbl">Trusted access services</div>
|
|
<div class="meta">CloudTrail, GuardDuty, SecurityHub, Inspector…</div>
|
|
</div>
|
|
<div class="kpi crit">
|
|
<div class="n">0</div><div class="lbl">Delegated administrators</div>
|
|
<div class="meta">Security ops run from the mgmt account</div>
|
|
</div>
|
|
<div class="kpi">
|
|
<div class="n">2</div><div class="lbl">Third-party cross-account trusts</div>
|
|
<div class="meta">Intruder.io · Secureframe (both ExternalId-gated)</div>
|
|
</div>
|
|
</div>
|
|
|
|
<section>
|
|
<div class="sec-head"><span class="tag">01</span><h2>Trusted access services</h2>
|
|
<span class="note">org-enabled service principals</span></div>
|
|
<div class="chips">
|
|
<span class="chip on">cloudtrail</span>
|
|
<span class="chip on">securityhub</span>
|
|
<span class="chip on">guardduty</span>
|
|
<span class="chip on">malware-protection.guardduty</span>
|
|
<span class="chip on">inspector2</span>
|
|
<span class="chip on">notifications</span>
|
|
</div>
|
|
<p class="sub" style="margin:14px 0 0">Org-wide security tooling has trusted access enabled — Scrivas has begun
|
|
centralizing security. <span class="pill good"><span class="dot"></span>on track</span></p>
|
|
</section>
|
|
|
|
<section>
|
|
<div class="sec-head"><span class="tag">02</span><h2>Delegated administrators</h2>
|
|
<span class="note">list_delegated_administrators</span></div>
|
|
<div class="callout">
|
|
<div class="big">0</div>
|
|
<p><b>No delegated administrator is set</b> despite trusted access being enabled for GuardDuty,
|
|
Security Hub and Inspector. These services are therefore administered directly from the
|
|
<b>management account</b>. Best practice is to delegate them to a dedicated security/audit
|
|
account and keep the management account minimal.
|
|
<span class="pill crit" style="margin-top:8px"><span class="dot"></span>headline gap</span></p>
|
|
</div>
|
|
</section>
|
|
|
|
<section>
|
|
<div class="sec-head"><span class="tag">03</span><h2>Trust policies</h2>
|
|
<span class="note">org resource policy + IAM role trust relationships</span></div>
|
|
<p class="sub" style="margin:0 0 14px">Organization resource policy: <b>none set</b>. Of 44 IAM roles in the
|
|
management account, all but three are AWS service / service-linked roles. Notable external & federated trusts:</p>
|
|
<div class="trust">
|
|
<div class="trow">
|
|
<span class="rn">IntruderReadOnlyRole</span><span class="arw">→</span>
|
|
<span class="acct">123311413059:root</span>
|
|
<span class="pill good"><span class="dot"></span>ExternalId</span>
|
|
<span class="vend">Intruder.io — vulnerability scanning</span>
|
|
</div>
|
|
<div class="trow">
|
|
<span class="rn">SecureframeRole-f983f1e89008</span><span class="arw">→</span>
|
|
<span class="acct">728997465891:root</span>
|
|
<span class="pill good"><span class="dot"></span>ExternalId</span>
|
|
<span class="vend">Secureframe — SOC 2 / compliance</span>
|
|
</div>
|
|
<div class="trow">
|
|
<span class="rn">AmazonEKS_EBS_CSI_DriverRole</span><span class="arw">→</span>
|
|
<span class="acct">oidc.eks.us-east-2</span>
|
|
<span class="pill warn"><span class="dot"></span>federated</span>
|
|
<span class="vend">EKS OIDC (IRSA)</span>
|
|
</div>
|
|
</div>
|
|
<p class="sub" style="margin:14px 0 0"><b>Lazka</b> member account (6 roles): only default service-linked roles +
|
|
<span class="chip" style="padding:2px 8px">OrganizationAccountAccessRole</span> — <b>no</b> GuardDuty/SecurityHub/Inspector
|
|
roles, so org security services are not deployed into the member account.</p>
|
|
</section>
|
|
|
|
<section>
|
|
<div class="sec-head"><span class="tag">04</span><h2>Governance signals for the proposal</h2></div>
|
|
<div class="tbl-wrap">
|
|
<table>
|
|
<thead><tr><th>Severity</th><th>Observation</th><th>Why it matters</th></tr></thead>
|
|
<tbody>
|
|
<tr>
|
|
<td class="sev"><span class="pill crit"><span class="dot"></span>High</span></td>
|
|
<td><b>No delegated administrators</b> despite trusted access</td>
|
|
<td>Security ops run from the mgmt account; violates multi-account best practice</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="sev"><span class="pill crit"><span class="dot"></span>High</span></td>
|
|
<td><b>Workloads in the management account</b> — EKS, EC2, RDS, VPC flow logs</td>
|
|
<td>Blast-radius & separation-of-duties risk; mgmt account should be minimal</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="sev"><span class="pill warn"><span class="dot"></span>Medium</span></td>
|
|
<td><b>Member account not monitored</b> — Lazka lacks security SLRs</td>
|
|
<td>Coverage gap; trusted access enabled but not delivered to members</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="sev"><span class="pill warn"><span class="dot"></span>Medium</span></td>
|
|
<td><b>Flat org, no OUs</b> — SCPs enabled but unused for targeting</td>
|
|
<td>No policy boundaries; governance won't scale as accounts are added</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="sev"><span class="pill good"><span class="dot"></span>Signal</span></td>
|
|
<td>Compliance stack present — Intruder, Secureframe, Macie, Config, Access Analyzer</td>
|
|
<td>Client is actively pursuing compliance — receptive to a landing-zone engagement</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</section>
|
|
|
|
<footer>
|
|
<span>Read-only · boto3 via <code>dasnuve-scrivas-louis-impersonation</code></span>
|
|
<span>Reproduce: <code>scripts/org_assessment.py</code> · <code>scripts/assess_member_account.py</code></span>
|
|
<span>Raw: <code>findings/*.json</code></span>
|
|
</footer>
|
|
</div>
|
|
|
|
<script>
|
|
// keep tabular figures aligned; no external deps
|
|
document.documentElement.setAttribute('data-render','ready');
|
|
</script>
|