Re:ScoutSuite: Multi-cloud security auditing tool
by xga2 on Saturday May 23, 2020 @11:31AM
(#23283722)
note - I'm the project's maintainer
You're correct about the API calls & potential CloudTrail costs.
Regarding making calls to non-existent resources that doesn't tend to be an issue. Typically we start by making a call to whatever endpoint lists resources, and then fetch additional information for these resources.
You're correct about the API calls & potential CloudTrail costs.
Regarding making calls to non-existent resources that doesn't tend to be an issue. Typically we start by making a call to whatever endpoint lists resources, and then fetch additional information for these resources.
As for permissions the wiki (https://github.com/nccgroup/ScoutSuite/wiki) has guidance towards the required privileges (including a minimal policy for AWS - https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Priv...)