Skip to content

Add support for AWS GovCloud region #500

@sam-delap

Description

@sam-delap

Similar to #192, there is no support for the GovCloud partition (aws-us-gov). This is especially true for things like IAM enumeration, where the regex matches for user/role identities (pacu/modules/iam__enum_permissions/main.py) look for:

re.match(r"arn:aws:sts::\d{12}:assumed-role/", identity["Arn"]) is not None

Suggestion:

Parse partition of current identity using a call to sts.get_caller_identity() and string splitting based on ARN format, then use partition in other functions that parse ARN resources

    identity = boto3.client("sts").get_caller_identity()
    arn = identity["Arn"]
    partition = arn.split(":")[1]  # "aws" or "aws-us-gov" or "aws-cn"

Metadata

Metadata

Assignees

No one assigned

    Labels

    waitingWaiting on response

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions