# Nuvola | Tool To Dump And Perform Automatic And Manual Security Analysis On Aws Environments Configurations And Services

**URL:** <https://onehack.st/t/nuvola-tool-to-dump-and-perform-automatic-and-manual-security-analysis-on-aws-environments-configurations-and-services/228538>\
**Category:** Tools & Scripts\
**Tags:** tools, freebies, cloud-storage\
**Created:** [November 17, 2022, 9:47pm UTC](https://onehack.st/t/nuvola-tool-to-dump-and-perform-automatic-and-manual-security-analysis-on-aws-environments-configurations-and-services/228538 "2022-11-17T21:47:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [November 17, 2022, 9:47pm UTC](https://onehack.st/t/nuvola-tool-to-dump-and-perform-automatic-and-manual-security-analysis-on-aws-environments-configurations-and-services/228538/1 "2022-11-17T21:47:01Z")

</div>

[![Run Gosec](https://github.com/primait/nuvola/actions/workflows/gosec.yml/badge.svg)](https://github.com/primait/nuvola/actions/workflows/gosec.yml) [![golangci-lint](https://github.com/primait/nuvola/actions/workflows/golanci-lint.yml/badge.svg)](https://github.com/primait/nuvola/actions/workflows/golanci-lint.yml)

[![](https://github.com/primait/nuvola/raw/master/assets/logo/nuvola-logo-big-light.png)](https://github.com/primait/nuvola/blob/master/assets/logo/nuvola-logo-big-light.png)

nuvola (with the lowercase n) is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax.

The general idea behind this project is to create an abstracted digital twin of a cloud platform. For a more concrete example: nuvola reflects the BloodHound traits used for Active Directory analysis but on cloud environments (at the moment only AWS).

The usage of a graph database also increases the possibility of finding different and innovative attack paths and can be used as an offline, centralised and lightweight digital twin.

## Quick Start

### Requirements

- `docker-compose` installed
- an AWS account configured to be used with `awscli` with full access to the cloud resources, better if in _ReadOnly_ mode (the policy `arn:aws:iam::aws:policy/ReadOnlyAccess` is fine)

### Setup

1. Clone the repository

git clone --depth=1 [https://github.com/primait/nuvola.git](https://github.com/primait/nuvola.git); cd nuvola

1. Create and edit, if required, the `.env` file to set your DB username/password/URL

cp .env\_example .env;

1. Start the Neo4j docker instance

make start

1. Build the tool

make build

### Usage

1. Firstly you need to dump all the supported AWS services configurations and load the data into the Neo4j database:

./nuvola dump -profile default\_RO -outputdir ~/DumpDumpFolder -format zip

1. To import a previously executed dump operation into the Neo4j database:

./nuvola assess -import ~/DumpDumpFolder/nuvola-default\_RO\_20220901.zip

1. To only perform static assessments on the data loaded into the Neo4j database using the [predefined ruleset](https://github.com/primait/nuvola/tree/master/assess/rules):

./nuvola assess

1. Or use [Neo4j Browser](https://neo4j.com/docs/operations-manual/current/installation/neo4j-browser/) to manually explore the digital twin.

[![Screenshot_20220904_185619](https://user-images.githubusercontent.com/6991986/188325663-d713d2bc-d522-4e9c-bc02-fc766f010374.png)](https://user-images.githubusercontent.com/6991986/188325663-d713d2bc-d522-4e9c-bc02-fc766f010374.png)

## About nuvola

To get started with nuvola and its database schema, check out the nuvola [Wiki](https://github.com/primait/nuvola/wiki).

No data is sent or shared with Prima Assicurazioni.

## How to contribute

- reporting bugs and issues
- reporting new improvements
- reviewing issues and pull requests
- fixing bugs and issues
- creating new rules
- improving the overall quality

## Presentations

- RomHack 2022
  - [Slides](https://github.com/primait/nuvola/tree/master/assets/slides/RomHack_2022-You_shall_not_PassRole.pdf)
  - [Demos](https://github.com/primait/nuvola/tree/master/assets/demos/)

## License

nuvola uses graph theory to reveal possible attack paths and security misconfigurations on cloud environments.

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this repository and program. If not, see [http://www.gnu.org/licenses/](http://www.gnu.org/licenses/).

## GitHub:

[https://github.com/primait/nuvola](https://github.com/primait/nuvola)