Skip to content

Commit aadfb18

Browse files
mwunderlmwunderl
committed
Add security tutorials (batch 12)
1 parent 49f07d9 commit aadfb18

5 files changed

Lines changed: 114 additions & 0 deletions

File tree

‎tuts/128-aws-waf-gs/aws-waf-gs.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/waf-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}
5+
[ -z "$REGION" ] && echo "ERROR: No region" && exit 1
6+
export AWS_DEFAULT_REGION="$REGION"
7+
echo "Region: $REGION"
8+
RANDOM_ID=$(openssl rand -hex 4)
9+
ACL_NAME="tut-acl-${RANDOM_ID}"
10+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
11+
trap 'handle_error $LINENO' ERR
12+
cleanup() { echo ""; echo "Cleaning up..."; if [ -n "$ACL_ID" ]; then LOCK=$(aws wafv2 get-web-acl --name "$ACL_NAME" --scope REGIONAL --id "$ACL_ID" --query 'LockToken' --output text 2>/dev/null); aws wafv2 delete-web-acl --name "$ACL_NAME" --scope REGIONAL --id "$ACL_ID" --lock-token "$LOCK" 2>/dev/null && echo " Deleted web ACL"; fi; rm -rf "$WORK_DIR"; echo "Done."; }
13+
echo "Step 1: Creating web ACL: $ACL_NAME"
14+
ACL_ID=$(aws wafv2 create-web-acl --name "$ACL_NAME" --scope REGIONAL \
15+
--default-action '{"Allow":{}}' \
16+
--visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"tutorialACL"}' \
17+
--rules '[{"Name":"RateLimit","Priority":1,"Statement":{"RateBasedStatement":{"Limit":1000,"AggregateKeyType":"IP"}},"Action":{"Block":{}},"VisibilityConfig":{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"RateLimit"}}]' \
18+
--query 'Summary.Id' --output text)
19+
echo " ACL ID: $ACL_ID"
20+
echo "Step 2: Describing web ACL"
21+
aws wafv2 get-web-acl --name "$ACL_NAME" --scope REGIONAL --id "$ACL_ID" --query 'WebACL.{Name:Name,Id:Id,Rules:Rules|length(@),DefaultAction:DefaultAction}' --output table
22+
echo "Step 3: Listing available managed rule groups"
23+
aws wafv2 list-available-managed-rule-groups --scope REGIONAL --query 'ManagedRuleGroups[:5].{Vendor:VendorName,Name:Name}' --output table
24+
echo "Step 4: Listing web ACLs"
25+
aws wafv2 list-web-acls --scope REGIONAL --query 'WebACLs[?starts_with(Name, `tut-`)].{Name:Name,Id:Id}' --output table
26+
echo ""
27+
echo "Tutorial complete."
28+
echo "Do you want to clean up? (y/n): "
29+
read -r CHOICE
30+
[[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup || echo "Manual: aws wafv2 delete-web-acl (requires lock-token)"

‎tuts/129-amazon-macie-gs/amazon-macie-gs.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/macie-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}
5+
[ -z "$REGION" ] && echo "ERROR: No region" && exit 1
6+
export AWS_DEFAULT_REGION="$REGION"
7+
echo "Region: $REGION"
8+
PREEXISTING=false
9+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
10+
trap 'handle_error $LINENO' ERR
11+
cleanup() { echo ""; echo "Cleaning up..."; [ "$PREEXISTING" != true ] && aws macie2 disable-macie 2>/dev/null && echo " Disabled Macie" || echo " Macie was pre-existing — not disabling"; rm -rf "$WORK_DIR"; echo "Done."; }
12+
echo "Step 1: Enabling Macie"
13+
STATUS=$(aws macie2 get-macie-session --query 'status' --output text 2>/dev/null || echo "DISABLED")
14+
if [ "$STATUS" = "ENABLED" ]; then echo " Already enabled"; PREEXISTING=true; else aws macie2 enable-macie 2>/dev/null; echo " Macie enabled"; fi
15+
echo "Step 2: Getting session details"
16+
aws macie2 get-macie-session --query '{Status:status,Created:createdAt,Updated:updatedAt}' --output table
17+
echo "Step 3: Listing S3 buckets"
18+
aws macie2 describe-buckets --query 'buckets[:5].{Name:bucketName,Encryption:serverSideEncryption.type,Public:publicAccess.effectivePermission}' --output table 2>/dev/null || echo " Bucket inventory not ready yet"
19+
echo "Step 4: Getting usage statistics"
20+
aws macie2 get-usage-totals --query 'usageTotals[].{Type:type,Amount:estimatedCost}' --output table 2>/dev/null || echo " No usage data yet"
21+
echo ""
22+
echo "Tutorial complete."
23+
[ "$PREEXISTING" = true ] && echo "Macie was already enabled — not disabling." || { echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup; }

‎tuts/130-amazon-detective-gs/amazon-detective-gs.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/detective-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
5+
PREEXISTING=false
6+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }; trap 'handle_error $LINENO' ERR
7+
cleanup() { echo ""; echo "Cleaning up..."; [ "$PREEXISTING" != true ] && [ -n "$GRAPH_ARN" ] && aws detective delete-graph --graph-arn "$GRAPH_ARN" 2>/dev/null && echo " Deleted graph" || echo " Pre-existing — not deleting"; rm -rf "$WORK_DIR"; echo "Done."; }
8+
echo "Step 1: Enabling Detective"
9+
GRAPHS=$(aws detective list-graphs --query 'GraphList[0].Arn' --output text 2>/dev/null)
10+
if [ -n "$GRAPHS" ] && [ "$GRAPHS" != "None" ]; then echo " Already enabled"; GRAPH_ARN="$GRAPHS"; PREEXISTING=true; else GRAPH_ARN=$(aws detective create-graph --query 'GraphArn' --output text); echo " Graph: $GRAPH_ARN"; fi
11+
echo "Step 2: Listing graphs"
12+
aws detective list-graphs --query 'GraphList[].{Arn:Arn,Created:CreatedTime}' --output table
13+
echo "Step 3: Listing members"
14+
aws detective list-members --graph-arn "$GRAPH_ARN" --query 'MemberDetails[:5].{Account:AccountId,Status:Status}' --output table 2>/dev/null || echo " No members"
15+
echo ""; echo "Tutorial complete."
16+
[ "$PREEXISTING" = true ] && echo "Detective was already enabled." || { echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup; }

‎tuts/131-amazon-verifiedpermissions-gs/amazon-verifiedpermissions-gs.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/avp-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
5+
RANDOM_ID=$(openssl rand -hex 4)
6+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }; trap 'handle_error $LINENO' ERR
7+
cleanup() { echo ""; echo "Cleaning up..."; [ -n "$STORE_ID" ] && aws verifiedpermissions delete-policy-store --policy-store-id "$STORE_ID" 2>/dev/null && echo " Deleted policy store"; rm -rf "$WORK_DIR"; echo "Done."; }
8+
echo "Step 1: Creating policy store"
9+
STORE_ID=$(aws verifiedpermissions create-policy-store --validation-settings '{"mode":"OFF"}' --query 'policyStoreId' --output text)
10+
echo " Store ID: $STORE_ID"
11+
echo "Step 2: Creating a static policy"
12+
POLICY_ID=$(aws verifiedpermissions create-policy --policy-store-id "$STORE_ID" --definition '{"static":{"statement":"permit(principal, action == Action::\"view\", resource);"}}' --query 'policyId' --output text)
13+
echo " Policy ID: $POLICY_ID"
14+
echo "Step 3: Testing authorization"
15+
aws verifiedpermissions is-authorized --policy-store-id "$STORE_ID" --principal '{"entityType":"User","entityId":"alice"}' --action '{"actionType":"Action","actionId":"view"}' --resource '{"entityType":"Document","entityId":"doc-1"}' --query '{Decision:decision}' --output table
16+
echo "Step 4: Testing denied action"
17+
aws verifiedpermissions is-authorized --policy-store-id "$STORE_ID" --principal '{"entityType":"User","entityId":"alice"}' --action '{"actionType":"Action","actionId":"delete"}' --resource '{"entityType":"Document","entityId":"doc-1"}' --query '{Decision:decision}' --output table
18+
echo "Step 5: Listing policies"
19+
aws verifiedpermissions list-policies --policy-store-id "$STORE_ID" --query 'policies[].{Id:policyId,Type:policyType}' --output table
20+
echo ""; echo "Tutorial complete."
21+
echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup

‎tuts/154-iam-policies/iam-policies.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/iam-policies.log") 2>&1
3+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
4+
RANDOM_ID=$(openssl rand -hex 4); POLICY_NAME="tut-policy-${RANDOM_ID}"; ROLE_NAME="tut-iam-role-${RANDOM_ID}"
5+
ACCOUNT=$(aws sts get-caller-identity --query 'Account' --output text)
6+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }; trap 'handle_error $LINENO' ERR
7+
cleanup() { echo ""; echo "Cleaning up..."; aws iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "arn:aws:iam::${ACCOUNT}:policy/$POLICY_NAME" 2>/dev/null; aws iam delete-role --role-name "$ROLE_NAME" 2>/dev/null && echo " Deleted role"; aws iam delete-policy --policy-arn "arn:aws:iam::${ACCOUNT}:policy/$POLICY_NAME" 2>/dev/null && echo " Deleted policy"; rm -rf "$WORK_DIR"; echo "Done."; }
8+
echo "Step 1: Creating a custom policy"
9+
POLICY_ARN=$(aws iam create-policy --policy-name "$POLICY_NAME" --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket","arn:aws:s3:::example-bucket/*"]},{"Effect":"Deny","Action":"s3:DeleteObject","Resource":"*"}]}' --query 'Policy.Arn' --output text)
10+
echo " Policy ARN: $POLICY_ARN"
11+
echo "Step 2: Getting policy details"
12+
aws iam get-policy --policy-arn "$POLICY_ARN" --query 'Policy.{Name:PolicyName,Arn:Arn,Versions:AttachmentCount}' --output table
13+
echo "Step 3: Getting policy version (the actual document)"
14+
aws iam get-policy-version --policy-arn "$POLICY_ARN" --version-id v1 --query 'PolicyVersion.Document' --output json | python3 -m json.tool
15+
echo "Step 4: Creating a role and attaching the policy"
16+
aws iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' > /dev/null
17+
aws iam attach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
18+
echo " Attached $POLICY_NAME to $ROLE_NAME"
19+
echo "Step 5: Listing attached policies"
20+
aws iam list-attached-role-policies --role-name "$ROLE_NAME" --query 'AttachedPolicies[].{Name:PolicyName,Arn:PolicyArn}' --output table
21+
echo "Step 6: Simulating policy"
22+
aws iam simulate-principal-policy --policy-source-arn "arn:aws:iam::${ACCOUNT}:role/$ROLE_NAME" --action-names s3:GetObject s3:DeleteObject --resource-arns "arn:aws:s3:::example-bucket/file.txt" --query 'EvaluationResults[].{Action:EvalActionName,Decision:EvalDecision}' --output table
23+
echo ""; echo "Tutorial complete."
24+
echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup

0 commit comments

Comments
 (0)