aquasecurity / aquasecurity/cloudsploit

It seems that does not try to scan my Azure environment.

Open
#1,287 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

I'm trying to scan my azure environment, but it seems it tries to scan only AWS environment even if I don't specify my AWS credentials on config.js. Here come my config.js and credential.json.

```
// CloudSploit config file

module.exports = {
credentials: {
azure: {
credential_file: '/Users/hyamaguc/cloudsploit/credential.json'
},
azure_remediate: {
credential_file: '/Users/hyamaguc/cloudsploit/credential.json'
}
};
```

```
{
"ApplicationID": "xxxx",
"KeyValue": "xxxx",
"DirectoryID": "xxxx",
"SubscriptionID": "xxxx"
}
```

Here comes the output of ./index.js
```
./index.js --cloud azure

_____ _ _ _____ _ _ _
/ ____| | | |/ ____| | | (_) |
| | | | ___ _ _ __| | (___ _ __ | | ___ _| |_
| | | |/ _ \| | | |/ _` |\___ \| '_ \| |/ _ \| | __|
| |____| | (_) | |_| | (_| |____) | |_) | | (_) | | |_
\_____|_|\___/ \__,_|\__,_|_____/| .__/|_|\___/|_|\__|
| |
|_|

CloudSploit by Aqua Security, Ltd.
Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub

INFO: No config file provided, using default AWS credential chain.
INFO: Skipping AWS pagination mode
INFO: Determining API calls to make...
INFO: Found 297 API calls to make for aws plugins
INFO: Collecting metadata. This may take several minutes...
[INFO][REGIONS] Could not load all regions from EC2: {"message":"Missing region in config","code":"ConfigError","time":"2022-06-07T01:00:14.011Z"}
```

Contributor guide

Open the contributing guide

Research direction

Start with config.js, credential.json, and the index.js entry point. Reproduce ./index.js --cloud azure and trace how the cloud selection and credential configuration are loaded; compare the observed AWS API calls with the expected Azure scan. Done means the command uses the supplied Azure credentials and discovers Azure API calls instead of AWS calls.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.