这篇文章主要介绍s3tk是一款什么安全审计套件，文中介绍的非常详细，具有一定的参考价值，感兴趣的小伙伴们一定要看完！
s3tk是一款针对Amazon S3的安全审计套件，广大安全研究人员可以使用s3tk来对Amazon S3 Bucket进行安全测试。
广大研究人员可以使用pip来完成s3tk的安装：
pip install s3tk
研究人员可以使用AWS CLI命令行工具来配置AWS凭证：
pip install awscliaws configure
可扫描的Bucket组件如下：
1、公开ACL
2、公开策略
3、屏蔽的公开访问
4、启用的登录
5、版本修改
6、默认加密
s3tk scan
针对特定Bucket运行扫描：
计算
安全
数据库
网络和加速
企业服务
s3tk scan my-bucket my-bucket-2支持通配符：
s3tk scan "my-bucket*"跳过日志和默认加密：
s3tk scan --skip-logging --skip-versioning --skip-default-encryption获取邮件通知（通过SNS）：
s3tk scan --sns-topic arn:aws:sns:...枚举Bucket策略：
s3tk list-policy
针对特定Bucket运行扫描：
s3tk list-policy my-bucket my-bucket-2显示名称：
s3tk list-policy --named设置策略：
s3tk set-policy my-bucket --no-object-acl删除策略：
s3tk delete-policy my-bucket屏蔽公开访问：
s3tk block-public-access my-bucket my-bucket-2针对所有Bucket启用默认加密：
s3tk enable-default-encryption仅针对特定Bucket启用：
s3tk enable-default-encryption my-bucket my-bucket-2扫描目标Bucket中所有对象的ACL：
s3tk scan-object-acl my-bucket扫描特定对象：
s3tk scan-object-acl my-bucket --only "*.pdf"排除特定对象：
s3tk scan-object-acl my-bucket --except "*.jpg"s3tk scan-dns
用户凭证可以在“~/.aws/credentials”中或环境变量中设置，我们可以使用下列命令设置一个profile：
AWS_PROFILE=your-profile s3tk下面给出的是每一条命令所需的权限，用户只需要将相应权限在下列代码中声明即可：
{"Version": "2012-10-17","Statement": [
{"Sid": "Scan","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:GetBucketAcl","s3:GetBucketPolicy","s3:GetBucketPublicAccessBlock","s3:GetBucketLogging","s3:GetBucketVersioning","s3:GetEncryptionConfiguration"],"Resource": "*"},
{"Sid": "ScanDNS","Effect": "Allow","Action": ["s3:ListAllMyBuckets","route53:ListHostedZones","route53:ListResourceRecordSets"],"Resource": "*"},
{"Sid": "ListPolicy","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:GetBucketPolicy"],"Resource": "*"},
{"Sid": "SetPolicy","Effect": "Allow","Action": ["s3:PutBucketPolicy"],"Resource": "*"},
{"Sid": "DeletePolicy","Effect": "Allow","Action": ["s3:DeleteBucketPolicy"],"Resource": "*"},
{"Sid": "BlockPublicAccess","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:PutBucketPublicAccessBlock"],"Resource": "*"},
{"Sid": "EnableLogging","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:PutBucketLogging"],"Resource": "*"},
{"Sid": "EnableVersioning","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:PutBucketVersioning"],"Resource": "*"},
{"Sid": "EnableDefaultEncryption","Effect": "Allow","Action": ["s3:ListAllMyBuckets","s3:PutEncryptionConfiguration"],"Resource": "*"},
{"Sid": "ResetObjectAcl","Effect": "Allow","Action": ["s3:ListBucket","s3:GetObjectAcl","s3:PutObjectAcl"],"Resource": ["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]
},
{"Sid": "Encrypt","Effect": "Allow","Action": ["s3:ListBucket","s3:GetObject","s3:PutObject"],"Resource": ["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]
},
{"Sid": "DeleteUnencryptedVersions","Effect": "Allow","Action": ["s3:ListBucketVersions","s3:GetObjectVersion","s3:DeleteObjectVersion"],"Resource": ["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]
}
]
}Amazon Athena适用于查询S3日志，创建下列表：
CREATE EXTERNAL TABLE my_bucket (
bucket_owner string,
bucket string,time string,
remote_ip string,
requester string,
request_id string,
operation string,
key string,
request_verb string,
request_url string,
request_proto string,
status_code string,
error_code string,
bytes_sent string,
object_size string,
total_time string,
turn_around_time string,
referrer string,
user_agent string,
version_id string
)
ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'WITH SERDEPROPERTIES ('serialization.format' = '1','input.regex' = '([^ ]*) ([^ ]*) \\[(.*?)\\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) \\\"([^ ]*) ([^ ]*) (- |[^ ]*)\\\" (-|[0-9]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\"[^\"]*\\") ([^ ]*)$') LOCATION 's3://my-s3-logs/my-bucket/';修改最后一行代码，并指向你的日志Bucket：
SELECTdate_parse(time, '%d/%b/%Y:%H:%i:%S +0000') AS time,
request_url,
remote_ip,
user_agentFROMmy_bucketWHERErequester = '-'AND status_code LIKE '2%'AND request_url LIKE '/some-keys%'ORDER BY 1Amazon Athena同样可以用于查询CloudTrail日志，创建一个表：
CREATE EXTERNAL TABLE cloudtrail_logs (
eventversion STRING,
userIdentity STRUCT<type:STRING,
principalid:STRING,
arn:STRING,
accountid:STRING,
invokedby:STRING,
accesskeyid:STRING,
userName:String,
sessioncontext:STRUCT<attributes:STRUCT<mfaauthenticated:STRING,
creationdate:STRING>,
sessionIssuer:STRUCT<type:STRING,
principalId:STRING,
arn:STRING,
accountId:STRING,
userName:STRING>>>,
eventTime STRING,
eventSource STRING,
eventName STRING,
awsRegion STRING,
sourceIpAddress STRING,
userAgent STRING,
errorCode STRING,
errorMessage STRING,
requestId STRING,
eventId STRING,
resources ARRAY<STRUCT<ARN:STRING,
accountId:STRING,
type:STRING>>,
eventType STRING,
apiVersion STRING,
readOnly BOOLEAN,
recipientAccountId STRING,
sharedEventID STRING,
vpcEndpointId STRING,
requestParameters STRING,
responseElements STRING,
additionalEventData STRING,
serviceEventDetails STRING
)
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION 's3://my-cloudtrail-logs/'修改最后一行代码，并指向你的CloudTrail日志Bucket：
SELECTeventTime,
eventName,userIdentity.userName,
requestParametersFROMcloudtrail_logsWHEREeventName LIKE '%Bucket%'ORDER BY 1{"Version": "2012-10-17","Statement": [
{"Effect": "Deny","Principal": "*","Action": "s3:PutObjectAcl","Resource": "arn:aws:s3:::my-bucket/*"}
]
}运行下列命令：
pip install s3tk --upgrade使用Master，可运行下列命令：
pip install git+https://github.com/ankane/s3tk.git --upgrade
运行下列命令：
docker run -it ankane/s3tk aws configure
提交你的凭证：
docker commit $(docker ps -l -q) my-s3tk
接下来，运行下列命令：
docker run -it my-s3tk s3tk scan
以上是“s3tk是一款什么安全审计套件”这篇文章的所有内容，感谢各位的阅读！希望分享的内容对大家有帮助，更多相关知识，欢迎关注亿速云行业资讯频道！
亿速云「云服务器」，即开即用、新一代英特尔至强铂金CPU、三副本存储NVMe SSD云盘，价格低至29元/月。点击查看>>
免责声明：本站发布的内容（图片、视频和文字）以原创、转载和分享为主，文章观点不代表本网站立场，如果涉及侵权请联系站长邮箱：is@yisu.com进行举报，并提供相关证据，一经查实，将立刻删除涉嫌侵权内容。
原文链接：https://www.freebuf.com/articles/network/224931.html
