feat(aws): new AWS cloud-containment integration
EC2 + IAM + STS via AWS Query protocol (Signature V4), 9 commands: describe instances/security-groups, authorize/revoke security-group ingress, modify instance security groups (isolate), stop instances, list/update IAM access keys (deactivate compromised key), STS caller identity. Stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,126 @@
|
||||
id: aws
|
||||
name: AWS
|
||||
version: 1.0.0
|
||||
description: "Amazon Web Services (EC2, IAM, STS) — cloud containment: describe instances and security groups, authorize/revoke security-group ingress rules, change an instance's security groups (isolate), stop instances, and deactivate a compromised IAM access key. AWS Signature V4 authentication; stdlib-only, no extra Python dependencies."
|
||||
changelog: "1.0.0 — Initial release: EC2 describe instances/security-groups, authorize/revoke ingress, modify instance security groups, stop instances; IAM list/update access keys; STS caller identity."
|
||||
category: cloud
|
||||
|
||||
# Per-instance configuration. Requests are signed with AWS Signature V4.
|
||||
# Use an IAM user/role access key with EC2 + IAM permissions. session_token is
|
||||
# only needed for temporary (STS) credentials.
|
||||
config_schema:
|
||||
properties:
|
||||
access_key_id:
|
||||
type: string
|
||||
description: "AWS access key ID"
|
||||
secret_access_key:
|
||||
type: string
|
||||
description: "AWS secret access key"
|
||||
x-soar-sensitive: true
|
||||
region:
|
||||
type: string
|
||||
description: "Default AWS region (e.g. eu-west-1)"
|
||||
default: "us-east-1"
|
||||
session_token:
|
||||
type: string
|
||||
description: "Optional STS session token (for temporary credentials)"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- access_key_id
|
||||
- secret_access_key
|
||||
|
||||
commands:
|
||||
- id: describe_instances
|
||||
name: aws-describe-instances
|
||||
description: "Describe EC2 instances (optionally a single instance by ID)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
instance_id: { type: string, description: "Optional instance ID to fetch a single instance" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: describe_security_groups
|
||||
name: aws-describe-security-groups
|
||||
description: "Describe EC2 security groups (optionally a single group by ID)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_id: { type: string, description: "Optional security group ID" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: authorize_security_group_ingress
|
||||
name: aws-authorize-security-group-ingress
|
||||
description: "Add an inbound rule to a security group."
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_id: { type: string, description: "Security group ID" }
|
||||
protocol: { type: string, description: "IP protocol (tcp, udp, icmp, or -1 for all)" }
|
||||
from_port: { type: number, description: "Start port" }
|
||||
to_port: { type: number, description: "End port" }
|
||||
cidr: { type: string, description: "Source CIDR (e.g. 203.0.113.0/24)" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: [group_id, protocol, cidr]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: revoke_security_group_ingress
|
||||
name: aws-revoke-security-group-ingress
|
||||
description: "Remove an inbound rule from a security group (containment)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_id: { type: string, description: "Security group ID" }
|
||||
protocol: { type: string, description: "IP protocol (tcp, udp, icmp, or -1 for all)" }
|
||||
from_port: { type: number, description: "Start port" }
|
||||
to_port: { type: number, description: "End port" }
|
||||
cidr: { type: string, description: "Source CIDR to revoke" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: [group_id, protocol, cidr]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: modify_instance_security_groups
|
||||
name: aws-modify-instance-security-groups
|
||||
description: "Replace the security groups attached to an instance (e.g. move it to an isolation group)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
instance_id: { type: string, description: "Instance ID" }
|
||||
group_ids: { type: string, description: "Comma-separated security group IDs to set" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: [instance_id, group_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: stop_instances
|
||||
name: aws-stop-instances
|
||||
description: "Stop one or more EC2 instances."
|
||||
inputs_schema:
|
||||
properties:
|
||||
instance_ids: { type: string, description: "Comma-separated instance IDs" }
|
||||
force: { type: boolean, description: "Force stop (default false)" }
|
||||
region: { type: string, description: "Region override" }
|
||||
required: [instance_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_access_keys
|
||||
name: aws-list-access-keys
|
||||
description: "List a user's IAM access keys."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
user_name: { type: string, description: "IAM user name (omit to use the calling user)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_access_key
|
||||
name: aws-update-access-key
|
||||
description: "Activate or deactivate an IAM access key (deactivate to contain a compromised key)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
access_key_id: { type: string, description: "The access key ID to update" }
|
||||
status: { type: string, description: "Active or Inactive" }
|
||||
user_name: { type: string, description: "IAM user name (omit to use the calling user)" }
|
||||
required: [access_key_id, status]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: aws-test-connection
|
||||
description: "Verify credentials via STS GetCallerIdentity (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user