Function
Command
Install awscli
pip3 install awscli --upgrade --user
Configuring awscli
aws configure
UTILS - List all instances aws ec2 describe-instances \
UTILS - List specific fields of all instances aws ec2 describe-instances \
--query "Reservations[].Instances[].[InstanceId, PublicIpAddress, Tags[?Key=='Name']|[0].Value]"
UTILS - List all instances of a product aws ec2 describe-instances \
--filter "Name=tag:Name,Values=latch*" \
--query "Reservations[].Instances[].[InstanceId, PublicIpAddress, Tags[?Key=='Name']|[0].Value]"
UTILS - List all stopped instances aws ec2 describe-instances \
--filters Name=instance-state-name,Values=stopped
UTILS - List all stopped instances with ElasticIP aws ec2 describe-instances \
--query "Reservations[*].Instances[*].PublicIpAddress" \
--filters Name=instance-state-name,Values=stopped
UTILS - List all snapshots in the date specified aws ec2 describe-snapshots \
--filters Name=start-time,Values=2019-01-05*
SEC - List all snapshots without encryption aws ec2 describe-snapshots \
--filters "Name=encrypted,Values=false"
SEC - List SecurityGroups with SSH open to Internet aws ec2 describe-security-groups \
--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0' \
--query 'SecurityGroups[*].{Name:GroupName}' \
--output table
Function
Command
List all server certificates
aws iam list-server-certificates
List all policies
aws iam list-policies
List all groups
aws iam list-groups
List all policies for a given group
aws iam list-attached-group-policies --group-name ec2-Users
Get users for a specified for a given group
aws iam get-group --group-name ec2-users
List groups for a given user
aws iam list-groups-for-user --user-name aws-admin2
Function
Command
Rotate Keys. Created date of an AccessKey
aws iam list-access-keys --user-name aws-admin2 --query 'AccessKeyMetadata[?Status==Active].[CreateDate]' --output text
Check if user has MFA enabled
if [[ $(aws iam list-mfa-devices --user-name root --output text) ]]; then echo "MFA Enabled"; else echo "MFA Disabled";fi
Function
Command
List all s3 buckets
aws s3 ls
Function
Command
Check for public READ s3 buckets
`aws s3api list-buckets --query 'Buckets[*].[Name]' --output text
Check for public WRITE s3 buckets
`aws s3api list-buckets --query 'Buckets[*].[Name]' --output text
Check for public FULL_CONTROL s3 buckets
`aws s3api list-buckets --query 'Buckets[*].[Name]' --output text
Function
Command
List Databases without DeletionProtection enabled
`aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier]' --output text
List Public Databases
aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible==true].[DBInstanceIdentifier,Endpoint.Address]'`
