@infrascan/aws-route53-scanner
Version:
Infrascan scanner definition for AWS Route53
340 lines (335 loc) • 10.3 kB
JavaScript
// src/generated/client.ts
import { Route53Client } from "@aws-sdk/client-route-53";
import debug from "debug";
var clientDebug = debug("route-53:client");
function getClient(credentials, context, retryStrategy) {
clientDebug("Creating instance with context", context);
return new Route53Client({
credentials,
region: context.region,
retryStrategy
});
}
// src/generated/getters.ts
import { resolveFunctionCallParameters } from "@infrascan/core";
import {
Route53ServiceException,
ListHostedZonesByNameCommand,
ListResourceRecordSetsCommand
} from "@aws-sdk/client-route-53";
import debug2 from "debug";
async function ListHostedZonesByName(client, stateConnector, context) {
const getterDebug = debug2("route-53:ListHostedZonesByName");
const state = [];
getterDebug("ListHostedZonesByName");
const preparedParams = {};
try {
const cmd = new ListHostedZonesByNameCommand(preparedParams);
const result = await client.send(cmd);
state.push({
_metadata: {
account: context.account,
region: context.region,
timestamp: Date.now()
},
_parameters: preparedParams,
_result: result
});
} catch (err) {
if (err instanceof Route53ServiceException) {
if (err?.$retryable) {
console.log("Encountered retryable error", err);
} else {
console.log("Encountered unretryable error", err);
}
} else {
console.log("Encountered unexpected error", err);
}
}
getterDebug("Recording state");
await stateConnector.onServiceScanCompleteCallback(
context.account,
context.region,
"Route53",
"ListHostedZonesByName",
state
);
}
async function ListResourceRecordSets(client, stateConnector, context) {
const getterDebug = debug2("route-53:ListResourceRecordSets");
const state = [];
getterDebug("Fetching state");
const resolvers = [
{
Key: "HostedZoneId",
Selector: "Route53|ListHostedZonesByName|[]._result.HostedZones[].Id"
}
];
const parameterQueue = await resolveFunctionCallParameters(
context.account,
context.region,
resolvers,
stateConnector
);
for (const parameters of parameterQueue) {
const preparedParams = parameters;
try {
const cmd = new ListResourceRecordSetsCommand(preparedParams);
const result = await client.send(
cmd
);
state.push({
_metadata: {
account: context.account,
region: context.region,
timestamp: Date.now()
},
_parameters: preparedParams,
_result: result
});
} catch (err) {
if (err instanceof Route53ServiceException) {
if (err?.$retryable) {
console.log("Encountered retryable error", err);
} else {
console.log("Encountered unretryable error", err);
}
} else {
console.log("Encountered unexpected error", err);
}
}
}
getterDebug("Recording state");
await stateConnector.onServiceScanCompleteCallback(
context.account,
context.region,
"Route53",
"ListResourceRecordSets",
state
);
}
// src/edges.ts
import {
evaluateSelectorGlobally,
formatEdge,
formatS3NodeId
} from "@infrascan/core";
import { minimatch } from "minimatch";
async function aggregateRoute53RecordsByConnectedService(route53Records) {
const aliasRecords = route53Records.filter(
({ Type, AliasTarget }) => Type === "A" && Boolean(AliasTarget)
);
const aliasRecordsByService = {
cloudfront: [],
s3: [],
apiGateway: [],
elb: []
};
return aliasRecords.reduce((aliasRecordsMap, currentRecord) => {
const domain = currentRecord.AliasTarget?.DNSName;
if (domain?.includes(".cloudfront.net.")) {
aliasRecordsMap.cloudfront.push(currentRecord);
} else if (domain?.includes(".elb.amazonaws.com.")) {
aliasRecordsMap.elb.push(currentRecord);
} else if (domain && minimatch(domain, ".execute-api.*.amazonaws.com.")) {
aliasRecordsMap.apiGateway.push(currentRecord);
} else if (domain && minimatch(domain, "s3-website-*.amazonaws.com.")) {
aliasRecordsMap.s3.push(currentRecord);
}
return aliasRecordsMap;
}, aliasRecordsByService);
}
async function resolveCloudfrontEdges(cloudfrontConnectedDomains, stateConnector) {
const cloudfrontState = await evaluateSelectorGlobally(
"CloudFront|ListDistributions|[]",
stateConnector
);
const cloudfrontRecords = cloudfrontState.flatMap(({ _result }) => _result?.DistributionList?.Items).filter(
(distributionSummary) => distributionSummary != null
);
return cloudfrontConnectedDomains.map(({ Name, AliasTarget }) => {
const target = cloudfrontRecords.find(
({ DomainName }) => `${DomainName}.` === AliasTarget?.DNSName
);
if (target?.ARN && Name) {
return formatEdge(Name, { name: Name, target: target.ARN });
}
return null;
}).filter((edge) => edge != null);
}
async function resolveS3Edges(s3ConnectedDomains, stateConnector) {
const s3State = await evaluateSelectorGlobally(
"S3|GetBucketWebsite|[]",
stateConnector
);
return s3ConnectedDomains.map(({ Name }) => {
const s3Bucket = s3State.find(
({ _parameters }) => `${_parameters?.Bucket}.` === Name
);
if (s3Bucket && Name && s3Bucket._parameters?.Bucket) {
const formattedS3Arn = formatS3NodeId(s3Bucket._parameters.Bucket);
return formatEdge(Name, { name: Name, target: formattedS3Arn });
}
return null;
}).filter((edge) => edge != null);
}
async function resolveElbEdges(elbConnectedDomains, stateConnector) {
const elbState = await evaluateSelectorGlobally(
"ElasticLoadBalancingV2|DescribeLoadBalancers|[]",
stateConnector
);
const elbs = elbState.flatMap(({ _result }) => _result.LoadBalancers).filter((lb) => Boolean(lb));
return elbConnectedDomains.map(({ Name, AliasTarget }) => {
const loadBalancer = elbs.find(
({ DNSName }) => AliasTarget?.DNSName?.endsWith(`${DNSName}.`)
);
if (loadBalancer?.LoadBalancerArn && Name) {
return formatEdge(Name, {
name: Name,
target: loadBalancer.LoadBalancerArn
});
}
return null;
}).filter((edge) => edge != null);
}
async function resolveSnsEdges(route53Records, stateConnector) {
const snsSubscriptionState = await evaluateSelectorGlobally(
"SNS|ListSubscriptionsByTopic|[]",
stateConnector
);
const snsSubscriptionInfo = snsSubscriptionState.flatMap(({ _result }) => _result.Subscriptions).filter((subscriptions) => Boolean(subscriptions));
const webhookSubscriptions = snsSubscriptionInfo.filter(
({ Protocol }) => Protocol?.startsWith("http")
);
return webhookSubscriptions.flatMap(({ Endpoint, TopicArn, SubscriptionArn }) => {
if (Endpoint && TopicArn) {
const parsedUrl = new URL(Endpoint);
const hostname = `${parsedUrl.host}.`;
const targetRecord = route53Records.find(
({ Name }) => Name === hostname
);
if (targetRecord?.Name && SubscriptionArn) {
return formatEdge(TopicArn, {
name: targetRecord.Name,
target: SubscriptionArn
});
}
}
return null;
}).filter((edge) => edge != null);
}
async function getEdges(stateConnector) {
const route53State = await evaluateSelectorGlobally(
"Route53|ListResourceRecordSets|[]",
stateConnector
);
const route53Records = route53State.flatMap(({ _result }) => _result.ResourceRecordSets).filter((recordSet) => recordSet != null);
const { cloudfront, s3, elb } = await aggregateRoute53RecordsByConnectedService(route53Records);
const cloudfrontEdges = await resolveCloudfrontEdges(
cloudfront,
stateConnector
);
const s3Edges = await resolveS3Edges(s3, stateConnector);
const elbEdges = await resolveElbEdges(elb, stateConnector);
const snsEdges = await resolveSnsEdges(route53Records, stateConnector);
return cloudfrontEdges.concat(s3Edges).concat(elbEdges).concat(snsEdges);
}
// src/graph.ts
import { evaluateSelector } from "@infrascan/core";
var Route53RecordEntity = {
version: "0.1.0",
debugLabel: "route53-record",
provider: "aws",
command: "ListResourceRecordSets",
category: "route53",
subcategory: "record",
nodeType: "route53-record",
selector: "Route53|ListResourceRecordSets|[]",
getState(state, context) {
return evaluateSelector(
context.account,
context.region,
Route53RecordEntity.selector,
state
);
},
translate(val) {
return (val._result.ResourceRecordSets ?? []).filter((record) => record.Type === "A").map(
(record) => Object.assign(record, {
$metadata: val._metadata,
$parameters: val._parameters
})
);
},
components: {
$metadata(val) {
return {
version: Route53RecordEntity.version,
timestamp: val.$metadata.timestamp
};
},
$graph(val) {
return {
id: val.Name,
label: val.Name,
nodeType: Route53RecordEntity.nodeType,
parent: val.$metadata.account
};
},
$source(val) {
return {
command: Route53RecordEntity.command,
parameters: val.$parameters
};
},
tenant(val) {
return {
tenantId: val.$metadata.account,
provider: Route53RecordEntity.provider,
partition: val.$metadata.partition
};
},
resource(val) {
return {
id: val.Name,
name: val.Name,
category: Route53RecordEntity.category,
subcategory: Route53RecordEntity.subcategory
};
},
dns(val) {
const domains = [];
if (val.Name) {
domains.push(val.Name);
}
return {
domains
};
},
route53(val) {
return {
ttl: val.TTL,
alias: {
hostedZoneId: val.AliasTarget?.HostedZoneId,
dnsName: val.AliasTarget?.DNSName,
evaluateTargetHealth: val.AliasTarget?.EvaluateTargetHealth
}
};
}
}
};
// src/index.ts
var Route53Scanner = {
provider: "aws",
service: "route-53",
key: "Route53",
getClient,
callPerRegion: false,
getters: [ListHostedZonesByName, ListResourceRecordSets],
getEdges,
entities: [Route53RecordEntity]
};
var index_default = Route53Scanner;
export {
index_default as default
};