Scoutsuite: Scout does not accept Region restriction in AWS IAM policy

[huiweiguozi]

https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy

Based on above, If we add below lines into the above policy file to constrain scout to only accessing resources in a specific region, scout won't work, reporting many errors like below:

"Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "us-east-1"
                }
 }

Errors:

2020-04-24 10:01:45 ip-172-31-16-60.us-west-2.compute.internal scout[7969] ERROR services.py L55: Could not fetch ses configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-24 10:01:45 ip-172-31-16-60.us-west-2.compute.internal scout[7969] ERROR services.py L55: Could not fetch sqs configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.

Looks like Scout can only work by --region option. but how can we guarantee minimal privilege if we want to restrict Scout to a specific region by IAM privileges?

[x4v13r64]

If you only give permissions to the principal to make API calls to a specific region, but then run Scout against all regions (by not leveraging the --regions option), then you'll get errors.

Isn't that what's expected?

[huiweiguozi]

Even if I choose explicitly in CLI by --region, still get the same errors and incorrect html.

[huiweiguozi]

Question:

Does Scout accept restrictions in IAM policy? or the one listed by https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy is minimum privilege?

[x4v13r64]

Even if I choose explicitly in CLI by --region, still get the same errors and incorrect html.

I'll have to test, but my gut feeling is that this might be the case because you're apparently running Scout on an EC2 instance in us-west-2 region.

Does Scout accept restrictions in IAM policy?

That's what "minimum privilege" means... You can lock down even more and Scout will still work - errors in the output don't translate into errors in the report. If Scout can't access something it will just be ignored by the rule engine.

[huiweiguozi]

I do run on EC2 in us-west-2, but it does work well (gets all regions data) with the privileges listed in https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy.

However if I add more constraints, the html output is incorrect. So I doubt " If Scout can't access something it will just be ignored by the rule engine."

What's wrong with running scout on one EC2 in us-west-2?

[huiweiguozi]

Actually there are bugs in https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy.

It misses below four privileges to get a good report:
"kms:ListGrants",
"kms:GetKeyPolicy",
"secretsmanager:ListSecrets",
"acm:ListCertificates"

[huiweiguozi]

Besides, if you accept even fewer privileges than https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy, perhaps you should change the title.. It's pretty confusing, and through test, I found fewer privileges won't work.

[ramimac]

Hi @huiweiguozi,

Just a couple clarifying questions/points:

First, thanks for pointing out that the Minimal Policy had fallen out of date. The four missing permissions all are necessary for the most recent services added, and had not properly been reflected in the Wiki. This has now been fixed!

"However if I add more constraints, the html output is incorrect"

Would it be possible for you to clarify this point? My expectation is that adding additional constraints would result in errors in the output where there are insufficient permissions, and resultant omissions from the report. Is the report incorrect in some other way?

My other interpretation of your issue would be that the regional condition to us-east-1 was throwing errors even for services that exist in us-east-1. If that's the case, as j4v said, it may be the result of running ScoutSuite in us-west-2 while targeting us-east-1, but I believe that would be a bug and not an expected limitation. (sidenote: could this be just a lingering issue that is solved in develop by https://github.com/nccgroup/ScoutSuite/pull/705)

Thanks!

[huiweiguozi]

Sorry if I havn't made it clear:

I restrict to us-west-2 in policy, and run in CLI by --region us-west-2 on an EC2 instance in us-west-2, still, I can't query out correct report, the errors are everywhere not just ses and sqs. EC2 has errors too. The generated report has 0 ec2 instances.

Can you have a test please?

[x4v13r64]

(sidenote: could this be just a lingering issue that is solved in develop by #705)

This is included in the latest release I think, so this specific situation should be handled. @huiweiguozi I assume you're running the latest version?

[huiweiguozi]

[root@ip-172-31-16-60 ScoutSuite]# python3 scout.py -v
Scout Suite 5.8.1

[x4v13r64]

@huiweiguozi (& @ramimac ) I cannot reproduce the issue per se:

• I've created a user
• I attached the https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy policy
• I also attached the following inline policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "denytest",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-west-2"
                    ]
                }
            }
        }
    ]
}

• Running against the us-west-2 region only returns a couple of IAM errors , because we aren't correctly setting the region for the clients (since it's the only non-regional service), but I'm not getting errors for any other service.

EDIT: the implementation in IAM doesn't have an error, the endpoint is global so you shouldn't be restricting API calls per region (see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-requested-region.html). When you create a client, you can see that its region is aws-global independently of the region you try to create it in.

[huiweiguozi]

[root@ip-172-31-16-60 ScoutSuite]# python3 scout.py aws --region us-west-2
2020-04-29 02:02:26 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Launching Scout
2020-04-29 02:02:26 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Authenticating to cloud provider
2020-04-29 02:02:27 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Gathering data from APIs
2020-04-29 02:02:27 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the ACM service
2020-04-29 02:02:28 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the Lambda service
2020-04-29 02:02:28 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the CloudFormation service
2020-04-29 02:02:29 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the CloudTrail service
2020-04-29 02:02:29 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the CloudWatch service
2020-04-29 02:02:29 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the Config service
2020-04-29 02:02:29 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the Direct Connect service
2020-04-29 02:02:30 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the EC2 service
2020-04-29 02:02:30 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the EFS service
2020-04-29 02:02:30 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the ElastiCache service
2020-04-29 02:02:31 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the ELB service
2020-04-29 02:02:31 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the ELBv2 service
2020-04-29 02:02:32 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the EMR service
2020-04-29 02:02:32 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the IAM service
2020-04-29 02:02:32 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the KMS service
2020-04-29 02:02:32 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the RDS service
2020-04-29 02:02:33 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the RedShift service
2020-04-29 02:02:33 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the Route53 service
2020-04-29 02:02:33 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the S3 service
2020-04-29 02:02:34 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the SES service
2020-04-29 02:02:34 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the SNS service
2020-04-29 02:02:34 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the SQS service
2020-04-29 02:02:35 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the VPC service
2020-04-29 02:02:35 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Fetching resources for the Secrets Manager service
2020-04-29 02:02:36 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch acm configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:37 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch awslambda configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch cloudformation configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR utils.py L58: Failed to get all pages from paginator for the iam service: An error occurred (AccessDenied) when calling the ListRoles operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::304349946642:role/ with an explicit deny
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch cloudtrail configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR iam.py L157: Failed to get account password policy: An error occurred (AccessDenied) when calling the GetAccountPasswordPolicy operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:GetAccountPasswordPolicy on resource: * with an explicit deny
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR iam.py L20: Failed to generate credential report: An error occurred (AccessDenied) when calling the GenerateCredentialReport operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:GenerateCredentialReport on resource: * with an explicit deny
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR utils.py L58: Failed to get all pages from paginator for the iam service: An error occurred (AccessDenied) when calling the ListGroups operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:ListGroups on resource: arn:aws:iam::304349946642:group/ with an explicit deny
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR utils.py L58: Failed to get all pages from paginator for the iam service: An error occurred (AccessDenied) when calling the ListPolicies operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:ListPolicies on resource: policy path / with an explicit deny
2020-04-29 02:02:38 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR utils.py L58: Failed to get all pages from paginator for the iam service: An error occurred (AccessDenied) when calling the ListUsers operation: User: arn:aws:iam::304349946642:user/Scout is not authorized to perform: iam:ListUsers on resource: arn:aws:iam::304349946642:user/ with an explicit deny
2020-04-29 02:02:39 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch cloudwatch configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:39 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch kms configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:40 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch config configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:41 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch directconnect configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:41 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch elasticache configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:42 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch elb configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:43 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch efs configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:43 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch ec2 configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:44 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch emr configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:44 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch elbv2 configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:45 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch rds configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:46 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch sns configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:46 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch redshift configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:47 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch route53 configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:47 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch ses configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:48 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch sqs configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:48 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch vpc configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:49 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR services.py L55: Could not fetch secretsmanager configuration: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for aws-athena-query-results-us-east-1-304349946642: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for aws-glue-scripts-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for aws-glue-temporary-304349946642-us-east-1: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:50 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for cf-templates-1pzxpsf4hdoir-us-east-1: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for cloudtrail-awslogs-304349946642-iufti3iz-isengard-do-not-delete: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for csv-cur-report: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for mybucket.yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:51 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for sesbouncemonitor-yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for sesmonitorrbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for sesnotification-yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for sesnotificationbucket-yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:52 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for tmak-backsplash-bucket-yhma: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L62: Failed to get logging configuration for testyuhong: An error occurred (AccessDenied) when calling the GetBucketLogging operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L76: Failed to get versioning configuration for testyuhong: An error occurred (AccessDenied) when calling the GetBucketVersioning operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L87: Failed to get web hosting configuration for testyuhong: An error occurred (AccessDenied) when calling the GetBucketWebsite operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L99: Failed to get encryption configuration for testyuhong: An error occurred (AccessDenied) when calling the GetBucketEncryption operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L145: Failed to get bucket policy for testyuhong: An error occurred (AccessDenied) when calling the GetBucketPolicy operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L157: Failed to get bucket tags for testyuhong: An error occurred (AccessDenied) when calling the GetBucketTagging operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR s3.py L119: Failed to get ACL configuration for testyuhong: An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Running rule engine
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR browser.py L96: 'DuplicatedGlobalServiceEvents'
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] ERROR browser.py L96: 'data_logging_trails_count'
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Applying display filters
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Saving data to scoutsuite-report/scoutsuite-results/scoutsuite_results_aws-304349946642.js
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Saving data to scoutsuite-report/scoutsuite-results/scoutsuite_exceptions_aws-304349946642.js
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Saving data to scoutsuite-report/scoutsuite-results/scoutsuite_errors_aws-304349946642.json
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Creating scoutsuite-report/aws-304349946642.html
2020-04-29 02:02:53 ip-172-31-16-60.us-west-2.compute.internal scout[1711] INFO Opening the HTML report

[huiweiguozi]

Tried with your policies, still won't work, above errors reported.

[huiweiguozi]

No EC2 in the html report.

[huiweiguozi]

Do you see any valid EC2 instances in the html report?

[x4v13r64]

above errors reported

I get the exact same errors as you, if I run it against a denied region. In my case (as above) I'm denying calls to us-west-2, so if I run with --regions eu-west-1 then I get your errors. But if I run against us-west-2, I only get IAM errors (which is normal, see edit https://github.com/nccgroup/ScoutSuite/issues/727#issuecomment-620782250).

In your first comment you mentioned us-east-1, and then us-west-2 - are you sure the policy restricting calls per-region doesn't have us-east-1 whitelisted?

[huiweiguozi]

Please kindly forget about us-east-1 or any region difference.

I used us-west-2 in both policy and CLI, errors as above and result doesn't show any valid EC2.

[huiweiguozi]

Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Scoutdenytest",
"Effect": "Deny",
"Action": "",
"Resource": "",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"us-west-2"
]
}
}
}
]
}

and the

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:GetStackPolicy",
"cloudformation:ListStacks",
"cloudformation:GetTemplate",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudwatch:DescribeAlarms",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:ListIdentityPool",
"cognito-idp:DescribeUserPool",
"cognito-idp:ListUserPools",
"config:DescribeConfigRules",
"config:DescribeConfigurationRecorderStatus",
"config:DescribeConfigurationRecorders",
"directconnect:DescribeConnections",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeTable",
"dynamodb:ListBackups",
"dynamodb:ListTables",
"ec2:DescribeCustomerGateways",
"ec2:DescribeFlowLogs",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeRegions",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRouteTables",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:DescribeImages",
"ecr:GetLifecyclePolicy",
"ecr:GetRepositoryPolicy",
"ecs:DescribeClusters",
"ecs:ListClusters",
"eks:DescribeCluster",
"eks:ListClusters",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeCacheParameterGroups",
"elasticache:DescribeCacheSecurityGroups",
"elasticache:DescribeCacheSubnetGroups",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeMountTargetSecurityGroups",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:DescribeTags",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeSSLPolicies",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:ListClusters",
"iam:GenerateCredentialReport",
"iam:GetAccountPasswordPolicy",
"iam:GetCredentialReport",
"iam:GetGroup",
"iam:GetGroupPolicy",
"iam:GetLoginProfile",
"iam:GetPolicyVersion",
"iam:GetRolePolicy",
"iam:GetUserPolicy",
"iam:ListAccessKeys",
"iam:ListEntitiesForPolicy",
"iam:ListGroupPolicies",
"iam:ListGroups",
"iam:ListGroupsForUser",
"iam:ListInstanceProfilesForRole",
"iam:ListMFADevices",
"iam:ListPolicies",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListUserPolicies",
"iam:ListUsers",
"kms:DescribeKey",
"kms:GetKeyRotationStatus",
"kms:ListAliases",
"kms:ListKeys",
"lambda:ListFunctions",
"rds:DescribeDBClusters",
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBParameters",
"rds:DescribeDBSecurityGroups",
"rds:DescribeDBSnapshotAttributes",
"rds:DescribeDBSnapshots",
"rds:DescribeDBSubnetGroups",
"rds:ListTagsForResource",
"redshift:DescribeClusterParameterGroups",
"redshift:DescribeClusterParameters",
"redshift:DescribeClusterSecurityGroups",
"redshift:DescribeClusters",
"route53:ListHostedZones",
"route53:ListResourceRecordSets",
"route53domains:ListDomains",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketPolicy",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetBucketTagging",
"s3:ListAllMyBuckets",
"ses:GetIdentityDkimAttributes",
"ses:GetIdentityPolicies",
"ses:ListIdentities",
"ses:ListIdentityPolicies",
"sns:GetTopicAttributes",
"sns:ListSubscriptions",
"sns:ListTopics",
"sqs:GetQueueAttributes",
"sqs:ListQueues",
"kms:ListGrants",
"kms:GetKeyPolicy",
"secretsmanager:ListSecrets",
"acm:ListCertificates"
],
"Resource": "*"
}
]
}

CLI:
python3 scout.py aws --region us-west-2

[root@ip-172-31-16-60 ScoutSuite]# aws configure
AWS Access Key ID [****5TW6]:
AWS Secret Access Key [****9kKP]:
Default region name [us-west-2]:
Default output format [table]:

[x4v13r64]

Can you try with a local user (not an EC2 box)? Because with the same configuration as what you're stating, I can't reproduce.

[huiweiguozi]

Can I run Scout on my Macbook?

[x4v13r64]

Can I run Scout on my Macbook?

If you can run python code, you can run Scout.

[huiweiguozi]

I created an IAM user, attached the above two policies, and used its AK/SK on the EC2.

[x4v13r64]

I'm afraid I cannot reproduce what you're raising. There's possibly something else at play in your AWS account, I don't know.

[huiweiguozi]

OK, Thanks, I'll try.

[riderl17]

Hi, i would like to know if scout accepts minimum privileges for ChangeMessageVisibility and DeleteMessage because it shows me as danger those fields

[ramimac]

@riderl17 would you mind rephrasing your question? Neither of those permissions is required for ScoutSuite to run, nor are they contained in the Minimal Policy. https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy

What do you mean by "accepts minimum privileges"?
What do you mean by "it shows me as danger those fields"?

[riderl17]

@ramimac it shows me as danger those fields

[riderl17]

create policy in another account and region and successfully pass