IBM Cloud ToolKit

A collection of scripts for enumeration of IBM Cloud resources and identification of weak security settings.

Why was this project created?

This toolkit is intended to automate the enumeration of resources and security settings during penetration testing engagements on IBM Cloud accounts. Manual enumeration is time consuming, repetitive, tedious and prone to human error, especially when dealing with complex cloud environments. This collection of scripts aims to improve efficiency, and ensure more accurate coverage of IBM Cloud assets and configurations.

While there are several well-established open-source tools for major cloud providers like AWS and Azure, there are very few similar initiatives focused on IBM Cloud. This project was created to help fill that gap and provide the IBM Cloud community with tools for security assessments and resource inventory.

Contributions and community feedback are welcome! If you find these scripts useful, have suggestions for improvements, feature requests, or want to contribute in any way, feel free to open an issue or submit a PR.

Prerequisites

• Permissions

Required permissions may vary depending on the services being audited. At minimum, reader/viewer privileges should be assigned to the user as illustrated in the exemple below:

• IBM Cloud CLI
• The jq utility - lightweight command-line JSON processor
• Authenticated session via ibmcloud login

To install the IBM Cloud CLI, you can use the provided script:

./install_ibmcloud_cli.sh

Or follow the instructions at IBM Cloud CLI Installation Guide.

Quick Start

IBM Cloud ToolKit is modular and you can run any script individually. The script ibm_cloud_enum.sh executes all the modules with default options.

Usage

Each script has its own Usage instructions documented in the code and that can be verified through the -h option. Example for get_api_keys.sh:

$ ./get_api_keys.sh -h
Usage: ./get_api_keys.sh [-h] [-o OUTPUT_DIR] [-f OUTPUT_FILE]

Options:
  -h              Show this help message
  -o OUTPUT_DIR   Specify the output folder for results (default: 'output')
  -f OUTPUT_FILE  Specify the output file name (default: 'api_keys.txt')
  -d ROTATION_DAYS  Set the rotation threshold in days (default: 90)

This script retrieves all API keys in the IBM Cloud account.

Scripts

- ibm_cloud_enum.sh

Executes all enumeration scripts against the IBM Cloud Account.

- get_custom_roles.sh

Enumerates custom IAM roles to be verified for excessive privileges granted to users.

- get_users.sh

Enumerates existing users and identifies any with state different than ACTIVE.

- get_user_policies.sh

Identifies users with access policies assigned directly (not via groups) in the IBM Cloud account. Outputs user_id and policies in jq-formatted JSON for each such user.

- get_api_keys.sh

Enumerates existing API Keys and identifies those not rotated within a configurable period (default: 90 days).

- get_mfa.sh

Retrieves the IBM Cloud account identity settings and determines the MFA requirement status.

- get_regions.sh

Enumerates enabled regions on the IBM Cloud account.

- install_ibmcloud_cli.sh

Automates the installation of the IBM Cloud CLI for macOS and Linux.

- get_floating_IPs.sh

Enumerates all floating IPs in each enabled IBM Cloud region.

- get_VSIs.sh

Enumerates all VSIs (IBM Cloud VMs) in each enabled IBM Cloud region. Also generates a separate file for VSIs with metadata enabled.

- get_buckets.sh

Enumerates all IBM Cloud Object Storage buckets in the account and outputs them as a JSON array.

- get_buckets_files.sh

Lists all files in existing IBM Cloud Object Storage buckets. For each bucket, outputs a section with the bucket name and a list of files it contains. Note: This script is now disabled for automatic execution in ibm_cloud_enum.sh and must be run manually. This is due to potentially long execution times for accounts with thousands of files in COS buckets.

- get_schematics.sh

Enumerates all IBM Cloud Schematics workspaces in each enabled region and outputs their configuration as a JSON array. The output can be reviewed manually or with tools like TruffleHog or detect-secrets to identify secrets (such as API keys, SSH keys, or passwords) stored in variables and not flagged as sensitive.

- get_clusters.sh

Enumerates all IBM Cloud Kubernetes/Openshift clusters using the IBM Cloud REST API. Also generates a separate file for clusters with public endpoint enabled.

- get_databases.sh

Enumerates all IBM Cloud Databases. Also generates a separate file for databases with public endpoint enabled.

- get_security_groups.sh

Enumerates all IBM Cloud VPC security groups and identify overly permissive inbound rules.

- get_code_engine.sh

Enumerates all IBM Cloud Code Engine projects using the IBM Cloud REST API. For each project, it retrieves Applications, including environment variables and public endpoint status, Functions, ConfigMaps, and Secrets

Recent Changes

Version 1.2

• CLI-Based Authentication: Removed IBMCLOUD_API_KEY environment variable requirement. Access tokens are now retrieved directly from authenticated IBM Cloud CLI sessions (ibmcloud login), supporting environments where API key creation is restricted.
• Kubernetes Clusters: Added ingress subdomain retrieval.
• Debug Mode: Added two-level debug modes across enumeration scripts, safe -v flag for commands and progress visibility with token-redacted output, and -d for full debug.
• Parallel Processing: Performance improvements via parallel API requests in some scripts.
• Resource Statistics: Display totals and statistics for all resources (e.g., total users, buckets, VSIs).
• JSON Validation: Validate all API responses and graceful error handling.
• Enhanced Output: List resources on stdout with organized formatting while detailed results are saved to output files.

Version 1.1

This release introduces the following enhancements:

• IBM Account Identity Settings: Retrieves IBM Cloud account identity settings.
• MFA Requirement: Verifies whether MFA is enforced at the account level and detects any user-specific MFA configurations that could potentially bypass the account-wide requirement.
• DB2 Database: Adds support for identifying IBM Cloud DB2 database instances.
• Code Engine: Enumerates IBM Cloud Code Engine projects - serverless applications, functions, secrets, ConfigMaps, environment variables, and public endpoints.
• Security Groups: Enumerates security groups and flags overly permissive rules that allow unrestricted inbound connections from the Internet.
• Execution Change for ibm_cloud_enum.sh: get_buckets_files.sh is now disabled in ibm_cloud_enum.sh and must be executed manually due to potentially very long execution times for accounts with thousands of files in COS buckets.

TODO

• Support for handling multiple IBM Cloud accounts in batch mode across all enumeration scripts.
• Implement pagination support in all modules as in get_user_policies.sh
• Support Cloudant DBs
• Retrieve public endpoints (hostname:port) of public DBs
• Enumerate Load Balancer resources

Author

Heber Blain Gonçalves

• linkedin.com/hebergoncalves/
• github.com/manotux

License

This project is licensed under the MIT License. See the LICENSE file for details.

Disclaimer

This project is a personal and community-driven initiative and is not affiliated with, endorsed by, or supported by IBM or IBM Cloud. IBM and IBM Cloud are not responsible for this project or any outcomes resulting from its use.

This software is provided as-is, with no guarantees. Use it at your own risk. The author and contributors are not responsible for any problems, data loss, or damage that may happen.