awssecurity

Documentation

Overview

Package awssecurity implements the AWS security data collector. It collects S3, IAM, root account, and EC2 security group data for use by the security rule engine.

Canonical data types (S3Bucket, SecurityGroupRule, IAMUser, RootAccountInfo, SecurityData) are defined in internal/models/security.go so they are shared across the engine, rules, and provider layers without circular imports.

Index

• type CollectOptions
• type DefaultSecurityCollector
  • func NewDefaultSecurityCollector() *DefaultSecurityCollector
  • func NewDefaultSecurityCollectorWithFactory(f secClientFactory) *DefaultSecurityCollector
  • func (c *DefaultSecurityCollector) CollectAll(ctx context.Context, profile *common.ProfileConfig, ...) (*models.AWSSecurityData, error)
• type SecurityCollector

Types

type CollectOptions

type CollectOptions struct {
	Region    string
	AccountID string
	Profile   string
}

CollectOptions configures a per-region security collection call. It is used internally by the security collector.

type DefaultSecurityCollector

type DefaultSecurityCollector struct {
	// contains filtered or unexported fields
}

DefaultSecurityCollector is the production SecurityCollector. It collects S3, IAM, root account, and CloudTrail data from us-east-1 (global AWS services) and aggregates EC2 security group rules, GuardDuty status, and AWS Config status across all audited regions.

func NewDefaultSecurityCollector

func NewDefaultSecurityCollector() *DefaultSecurityCollector

NewDefaultSecurityCollector returns a DefaultSecurityCollector wired to production AWS SDK clients.

func NewDefaultSecurityCollectorWithFactory

func NewDefaultSecurityCollectorWithFactory(f secClientFactory) *DefaultSecurityCollector

NewDefaultSecurityCollectorWithFactory returns a DefaultSecurityCollector that uses the supplied factory, allowing tests to inject fake clients.

func (*DefaultSecurityCollector) CollectAll

func (c *DefaultSecurityCollector) CollectAll(
	ctx context.Context,
	profile *common.ProfileConfig,
	provider common.AWSClientProvider,
	regions []string,
) (*models.AWSSecurityData, error)

CollectAll gathers account-level security data for the given profile and regions. Global resources (S3, IAM, root, CloudTrail) are collected once using a us-east-1 config. Security group rules, GuardDuty detector status, and AWS Config recorder status are collected per region and aggregated. All collection failures are silently skipped (non-fatal).

type SecurityCollector

type SecurityCollector interface {
	CollectAll(
		ctx context.Context,
		profile *common.ProfileConfig,
		provider common.AWSClientProvider,
		regions []string,
	) (*models.AWSSecurityData, error)
}

SecurityCollector collects raw security posture data from an AWS account. The returned SecurityData is account-level (aggregated across all audited regions). It is passed to the security rule engine for evaluation.

Implementations must never apply business logic or produce findings. Non-fatal collection failures (e.g. a single region's SGs unreachable) must be silently skipped so the rest of the audit can complete.