# YATAS | A Simple Tool To Audit Your AWS Infrastructure For Misconfiguration Or Potential Security Issues With Plugins Integration **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, freebies, cloud-storage\ **Created:** [January 9, 2023, 10:31pm UTC](https://onehack.st/t/yatas-a-simple-tool-to-audit-your-aws-infrastructure-for-misconfiguration-or-potential-security-issues-with-plugins-integration/231044 "2023-01-09T22:31:32Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [January 9, 2023, 10:31pm UTC](https://onehack.st/t/yatas-a-simple-tool-to-audit-your-aws-infrastructure-for-misconfiguration-or-potential-security-issues-with-plugins-integration/231044/1 "2023-01-09T22:31:32Z")
[![yatas-logo](https://github.com/padok-team/YATAS/raw/main/docs/auditory.png)](https://github.com/padok-team/YATAS/blob/main/docs/auditory.png) # YATAS [![codecov](https://camo.githubusercontent.com/930cbd685a7946e871d474414af1bf742178e60d40647646948e42f5651d266e/68747470733a2f2f636f6465636f762e696f2f67682f7061646f6b2d7465616d2f59415441532f6272616e63682f6d61696e2f67726170682f62616467652e7376673f746f6b656e3d4f46476e79385a613478)](https://codecov.io/gh/padok-team/YATAS) [![goreport](https://camo.githubusercontent.com/1f17d1e74c4fcc9e19c30e1ed06995827810f4b6c5ca58919e117f819728e0b8/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f7061646f6b2d7465616d2f7961746173)](https://goreportcard.com/badge/github.com/padok-team/yatas) Yet Another Testing & Auditing Solution The goal of YATAS is to help you create a secure AWS environment without too much hassle. It won’t check for all best practices but only for the ones that are important for you based on my experience. Please feel free to tell me if you find something that is not covered. ## Features YATAS is a simple and easy to use tool to audit your infrastructure for misconfiguration or potential security issues. [![demo](https://github.com/padok-team/YATAS/raw/main/docs/demo.gif)](https://github.com/padok-team/YATAS/blob/main/docs/demo.gif) | No details | Details | | --- | --- | | [![](https://github.com/padok-team/YATAS/raw/main/docs/demo.png)](https://github.com/padok-team/YATAS/blob/main/docs/demo.png) | [![](https://github.com/padok-team/YATAS/raw/main/docs/details.png)](https://github.com/padok-team/YATAS/blob/main/docs/details.png) | ## Installation brew tap padok-team/tap brew install yatas yatas --init Modify .yatas.yml to your needs. yatas --install Installs the plugins you need. ## Usage yatas -h Flags: - `--details`: Show details of the issues found. - `--compare`: Compare the results of the previous run with the current run and show the differences. - `--ci`: Exit code 1 if there are issues found, 0 otherwise. - `--resume`: Only shows the number of tests passing and failing. - `--time`: Shows the time each test took to run in order to help you find bottlenecks. - `--init`: Creates a .yatas.yml file in the current directory. - `--install`: Installs the plugins you need. - `--only-failure`: Only show the tests that failed. ## Plugins | Plugins | Description | Checks | | --- | --- | --- | | [_AWS Audit_](https://github.com/padok-team/yatas-aws) | AWS checks | Good practices and security checks | | [_Markdown Reports_](https://github.com/padok-team/yatas-markdown) | Reporting | Generates a markdown report | ## Checks ### Ignore results for known issues You can ignore results of checks by adding the following to your `.yatas.yml` file: ignore: - id: “AWS\_VPC\_004” regex: true values: - “VPC Flow Logs are not enabled on vpc-.\*” - id: “AWS\_VPC\_003” regex: false values: - “VPC has only one gateway on vpc-08ffec87e034a8953” ### Exclude a test You can exclude a test by adding the following to your `.yatas.yml` file: plugins: - name: “aws” enabled: true description: “Check for AWS good practices” exclude: - AWS\_S3\_001 ### Specify which tests to run To only run a specific test, add the following to your `.yatas.yml` file: plugins: - name: “aws” enabled: true description: “Check for AWS good practices” include: - “AWS\_VPC\_003” - “AWS\_VPC\_004” ### Get error logs You can get the error logs by adding the following to your env variables: export YATAS\_LOG\_LEVEL=debug The available log levels are: `debug`, `info`, `warn`, `error`, `fatal`, `panic` and `off` by default ## AWS - 63 Checks ### AWS Certificate Manager - AWS\_ACM\_001 ACM certificates are valid - AWS\_ACM\_002 ACM certificate expires in more than 90 days - AWS\_ACM\_003 ACM certificates are used ### APIGateway - AWS\_APG\_001 ApiGateways logs are sent to Cloudwatch - AWS\_APG\_002 ApiGateways are protected by an ACL - AWS\_APG\_003 ApiGateways have tracing enabled ### AutoScaling - AWS\_ASG\_001 Autoscaling maximum capacity is below 80% - AWS\_ASG\_002 Autoscaling group are in two availability zones ### Backup - AWS\_BAK\_001 EC2’s Snapshots are encrypted - AWS\_BAK\_002 EC2’s snapshots are younger than a day old ### Cloudfront - AWS\_CFT\_001 Cloudfronts enforce TLS 1.2 at least - AWS\_CFT\_002 Cloudfronts only allow HTTPS or redirect to HTTPS - AWS\_CFT\_003 Cloudfronts queries are logged - AWS\_CFT\_004 Cloudfronts are logging Cookies - AWS\_CFT\_005 Cloudfronts are protected by an ACL ### CloudTrail - AWS\_CLD\_001 Cloudtrails are encrypted - AWS\_CLD\_002 Cloudtrails have Global Service Events Activated - AWS\_CLD\_003 Cloudtrails are in multiple regions ### COG - AWS\_COG\_001 Cognito allows unauthenticated users ### DynamoDB - AWS\_DYN\_001 Dynamodbs are encrypted - AWS\_DYN\_002 Dynamodb have continuous backup enabled with PITR ### EC2 - AWS\_EC2\_001 EC2s don’t have a public IP - AWS\_EC2\_002 EC2s have the monitoring option enabled ### ECR - AWS\_ECR\_001 ECRs image are scanned on push - AWS\_ECR\_002 ECRs are encrypted - AWS\_ECR\_003 ECRs tags are immutable ### EKS - AWS\_EKS\_001 EKS clusters have logging enabled - AWS\_EKS\_002 EKS clusters have private endpoint or strict public access ### LoadBalancer - AWS\_ELB\_001 ELB have access logs enabled ### GuardDuty - AWS\_GDT\_001 GuardDuty is enabled in the account ### IAM - AWS\_IAM\_001 IAM Users have 2FA activated - AWS\_IAM\_002 IAM access key younger than 90 days - AWS\_IAM\_003 IAM User can’t elevate rights - AWS\_IAM\_004 IAM Users have not used their password for 120 days ### Lambda - AWS\_LMD\_001 Lambdas are private - AWS\_LMD\_002 Lambdas are in a security group - AWS\_LMD\_003 Lambdas are not with errors ### RDS - AWS\_RDS\_001 RDS are encrypted - AWS\_RDS\_002 RDS are backedup automatically with PITR - AWS\_RDS\_003 RDS have minor versions automatically updated - AWS\_RDS\_004 RDS aren’t publicly accessible - AWS\_RDS\_005 RDS logs are exported to cloudwatch - AWS\_RDS\_006 RDS have the deletion protection enabled - AWS\_RDS\_007 Aurora Clusters have minor versions automatically updated - AWS\_RDS\_008 Aurora RDS are backedup automatically with PITR - AWS\_RDS\_009 Aurora RDS have the deletion protection enabled - AWS\_RDS\_010 Aurora RDS are encrypted - AWS\_RDS\_011 Aurora RDS logs are exported to cloudwatch - AWS\_RDS\_012 Aurora RDS aren’t publicly accessible ### S3 Bucket - AWS\_S3\_001 S3 are encrypted - AWS\_S3\_002 S3 buckets are not global but in one zone - AWS\_S3\_003 S3 buckets are versioned - AWS\_S3\_004 S3 buckets have a retention policy - AWS\_S3\_005 S3 bucket have public access block enabled ### Volume - AWS\_VOL\_001 EC2’s volumes are encrypted - AWS\_VOL\_002 EC2 are using GP3 - AWS\_VOL\_003 EC2 have snapshots - AWS\_VOL\_004 EC2’s volumes are unused ### VPC - AWS\_VPC\_001 VPC CIDRs are bigger than /20 - AWS\_VPC\_002 VPC can’t be in the same account - AWS\_VPC\_003 VPC only have one Gateway - AWS\_VPC\_004 VPC Flow Logs are activated - AWS\_VPC\_005 VPC have at least 2 subnets ## How to create a new plugin ? You’d like to add a new plugin ? Then simply visit [yatas-plugin](https://github.com/padok-team/yatas-template) and follow the instructions. ## GitHub: [https://github.com/padok-team/YATAS](https://github.com/padok-team/YATAS)