Possible Broken Dashboard

[ghost]

I setup this tool to run locally using docker. I setup ReadOnlyAccess Policy for AWS:

I now have the final report and I noticed the following sections don't open:

Scout2
IP Audit
AWS Trust Advisor

Any idea why?

I also noticed this during the scan might have something to do with it:

For the other reports to work I have to right click and open in new tab.

[shivankar-madaan]

Hi @x1337x-sec
Thanks for reaching out. As per the current screenshot it looks like the security token is invalid. Maybe it was a temporary token which got invalidated during the scan.

For the IP Audit to run, you have to provide the ec2 instance IP, along with ssh key so it can login and run the scan.
AWS Trust Advisor output can be seen when you also add the Support Read Only role to the keys.

Hope it helps. Let me know if I can be of further help.

[ghost]

Where do you place the ec2 instance IP and how would you scan all instances?

Is the Security Token separate to the secret key and secret ID

[shivankar-madaan]

Currently you can scan only one IP
You can watch this here
https://www.youtube.com/watch?v=2eW-0bS0Hq8

I guess security token is when you have temporary access like session token?? Not exactly. Are you still facing the same error of token invalid

[ghost]

Yes it is a session toke I defined it in the creds file as

[default]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXX
aws_session_token= XXXXXXXXXXXXXXXXXXXXX

I now get the following two errors / warnings

/usr/local/lib/python2.7/site-packages/requests/init.py:80: RequestsDependencyWarning: urllib3 (1.25.10) or chardet (3.0.4) doesn't match a supported version!
RequestsDependencyWarning)
Warning: Unable to determine STS token expiration; later API calls may fail.

Note we use AWS SSO with Okta

I am still seeing errors for example:

(UnrecognizedClientException) when calling the DescribeTrails operation: The security token included in the request is invalid

Also do you have the ARN for read-only support role.

[shivankar-madaan]

Ok I think it's just a warning, which should be fine

for the other exception arn:aws:iam::aws:policy/ReadOnlyAccess this should suffice
and add Support Role if you need Trusted Advisor checks

[ghost]

Do you have the support role ARN?

[shivankar-madaan]

No but I know it is AWS managed policy
SupportReadOnly I guess