ScoutSuite: Multi-cloud security auditing tool

Re:ScoutSuite: Multi-cloud security auditing tool by zten on Thursday May 21, 2020 @06:43PM (#23266423)

I find it disruptive as a developer in an organization that used to run it very frequently. It aggressively crawls your infrastructure and blows up AWS API calls with low rate limits, like the EMR cluster description operations.

[ Parent | on HN ]

Re:ScoutSuite: Multi-cloud security auditing tool by xga2 on Friday May 22, 2020 @07:36AM (#23270997)

note - I'm the project's maintainer

Have a look at the `--max-workers` and `--max-rate` arguments, which allow controlling the rate of API calls made against the cloud environment. You can use these to tweak executions against environments and ensure you don't hit API caps.

Note that this isn't a Scout Suite issue per se, but the consequence of how AWS implements rate limiting (i.e. it's account-wide, not per-principal). Any AWS tool will face the same limitations / hurdles.

[ Parent | on HN ]

Re:ScoutSuite: Multi-cloud security auditing tool by zten on Friday May 22, 2020 @04:26PM (#23276543)

I apologize for the uncharitable description. It was more of an organizational issue. They could have picked any other tool to execute a self-inflicted DoS and I would have been upset with that instead.

[ Parent | on HN ]

Re:ScoutSuite: Multi-cloud security auditing tool by xga2 on Saturday May 23, 2020 @05:03AM (#23281343)

;-)

[ Parent | on HN ]