Merge branch 'main' into imds-fix

Update Makefile to include 386 linux binary for release action

.github/CODEOWNERS

@@ -1 +1 @@
-@sethsec-bf carlosvendramini-bf
+* @bishopfaure @dbravo-bishopfox 

.github/workflows/autorelease.yml

@@ -15,8 +15,8 @@ jobs:
 
     steps:
 
-      - name: Go 1.20
-        uses: actions/setup-go@v2
+      - name: Go 1.21
+        uses: actions/setup-go@v4
         with:
           go-version: ^1.20
         id: go
@@ -28,7 +28,7 @@ jobs:
           gpg --list-secret-keys --keyid-format LONG
 
       - name: Check Out Code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Git Fetch Tags
         run: git fetch --prune --unshallow --tags -f

.github/workflows/codespell.yml

@@ -0,0 +1,16 @@
+# This Action uses minimal steps to run in ~5 seconds to rapidly:
+# Looks for typos in the codebase using codespell
+# https://github.com/codespell-project/codespell#readme
+name: codespell
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - run: pip install --user codespell
+    - run: codespell --ignore-words-list="aks" --skip="*.sum"

.gitignore

@@ -15,6 +15,7 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/
 .vscode
+.idea
 launch.json
 
 ######################################################
@@ -69,4 +70,9 @@ cloudfox
 *.txt
 *.json
 *.csv
-*.log
+*.log
+dist/
+
+# graphvis files
+*.gv
+*.svg

Makefile

@@ -1,20 +1,20 @@
 run:
-	/home/marauder/Downloads/go/bin/go run main.go
+	go run main.go
 
 windows:
-	GOOS=windows GOARCH=386 /home/marauder/Downloads/go/bin/go build 
+	GOOS=windows GOARCH=386 go build 
 	sha1sum cloudfox.exe > sha1sum-win.txt
 	zip cloudfox-win.zip cloudfox.exe sha1sum-win.txt
 	rm cloudfox.exe sha1sum-win.txt
 
 linux:
-	GOOS=linux GOARCH=386 /home/marauder/Downloads/go/bin/go build
+	GOOS=linux GOARCH=386 go build
 	sha1sum cloudfox > sha1sum-linux.txt
 	zip cloudfox-linux.zip cloudfox sha1sum-linux.txt
 	rm cloudfox sha1sum-linux.txt
 
 macos:
-	GOOS=darwin GOARCH=amd64 /home/marauder/Downloads/go/bin/go build
+	GOOS=darwin GOARCH=amd64 go build
 	sha1sum cloudfox > sha1sum-mac.txt
 	zip cloudfox-mac.zip cloudfox sha1sum-mac.txt
 	rm cloudfox sha1sum-mac.txt
@@ -24,20 +24,24 @@ all: windows linux macos
 .PHONY: release
 release: clean
 	mkdir -p ./cloudfox
-	mkdir -p ./cloudfox
-	GOOS=windows GOARCH=amd64 /home/marauder/Downloads/go/bin/go build -o ./cloudfox/cloudfox.exe .
+
+	GOOS=windows GOARCH=amd64 go build -o ./cloudfox/cloudfox.exe .
 	zip ./cloudfox/cloudfox-windows-amd64.zip ./cloudfox/cloudfox.exe
 	rm -rf ./cloudfox/cloudfox.exe
 	
-	GOOS=linux GOARCH=amd64 /home/marauder/Downloads/go/bin/go build -o ./cloudfox/cloudfox .
+	GOOS=linux GOARCH=amd64 go build -o ./cloudfox/cloudfox .
 	zip ./cloudfox/cloudfox-linux-amd64.zip ./cloudfox/cloudfox .
 	rm -rf ./cloudfox/cloudfox
 
-	GOOS=darwin GOARCH=amd64 /home/marauder/Downloads/go/bin/go build -o ./cloudfox/cloudfox .
+	GOOS=linux GOARCH=386 go build -o ./cloudfox/cloudfox .
+	zip ./cloudfox/cloudfox-linux-386.zip ./cloudfox/cloudfox .
+	rm -rf ./cloudfox/cloudfox
+
+	GOOS=darwin GOARCH=amd64 go build -o ./cloudfox/cloudfox .
 	zip ./cloudfox/cloudfox-macos-amd64.zip ./cloudfox/cloudfox
 	rm -rf ./cloudfox/cloudfox
 	
-	GOOS=darwin GOARCH=arm64 /home/marauder/Downloads/go/bin/go build -o ./cloudfox/cloudfox .
+	GOOS=darwin GOARCH=arm64 go build -o ./cloudfox/cloudfox .
 	zip ./cloudfox/cloudfox-macos-arm64.zip ./cloudfox/cloudfox
 	rm -rf ./cloudfox/cloudfox
 

README.md

@@ -14,8 +14,17 @@ CloudFox helps you gain situational awareness in unfamiliar cloud environments.
 
 ## Demos, Examples, Walkthroughs
 * [Blog - Introducing: CloudFox](https://bishopfox.com/blog/introducing-cloudfox)
+* [Video - CloudFox + CloudFoxable A Powerful Duo for Mastering the Art of Identifying and Exploiting AWS Attack Paths](https://www.youtube.com/watch?v=RdQiIvCrSzk)
+* [Video - Penetration Testing with CloudFox](https://www.youtube.com/watch?v=Ljt_JUp5HbM)
 * [Video - CloudFox Intro Demos](https://www.youtube.com/watch?v=ReWoUgpUuiQ)
-* [Video - Tool Talk: CloudFox AWS sub-command walkthroughs](https://youtu.be/KKsYfL5uVU4?t=360) 
+* [Video - Tool Talk: CloudFox AWS sub-command walkthroughs](https://youtu.be/KKsYfL5uVU4?t=360)
+
+## Intentionally Vulnerable Playground 
+* [CloudFoxable - A Gamified Cloud Hacking Sandbox](https://cloudfoxable.bishopfox.com/)
+
+## Want to chat about CloudFox? 
+Join us on the [RedSec discord server](https://discord.gg/redsec)
+
 
 ## Quick Start
 CloudFox is modular (you can run one command at a time), but there is an `aws all-checks` command that will run the other aws commands for you with sane defaults: 
@@ -39,9 +48,9 @@ For the full documentation please refer to our [wiki](https://github.com/BishopF
 
 | Provider| CloudFox Commands |
 | - | - |
-| AWS | 30 | 
+| AWS | 34 | 
 | Azure | 4 | 
-| GCP | 4 |
+| GCP | 8 |
 | Kubernetes | Support Planned | 
 
 
@@ -49,22 +58,36 @@ For the full documentation please refer to our [wiki](https://github.com/BishopF
 
 **Option 1:** Download the [latest binary release](https://github.com/BishopFox/cloudfox/releases) for your platform.
 
-**Option 2:** [Install Go](https://golang.org/doc/install), clone the CloudFox repository and compile from source
+**Option 2:** If you use homebrew: `brew install cloudfox`
+
+**Option 3:** [Install Go](https://golang.org/doc/install), use `go install github.com/BishopFox/cloudfox@latest` to install from the remote source
+ 
+**Option 4:** Developer mode:
+
+   [Install Go](https://golang.org/doc/install), clone the CloudFox repository and compile from source
    ```
    # git clone https://github.com/BishopFox/cloudfox.git
-   ...omitted for brevity...
    # cd ./cloudfox
+   # Make any changes necessary
    # go build .
    # ./cloudfox
    ```
 
+**Option 5:** Testing a bug fix
+  ```
+  git clone [email protected]:BishopFox/cloudfox.git
+  git checkout seth-dev 
+  go build .
+  ./cloudfox [rest of the command options]
+  ```
+
 # Prerequisites
 
 
 ### AWS
 * AWS CLI installed
 * Supports AWS profiles, AWS environment variables, or metadata retrieval (on an ec2 instance)
-   * To run commands on multiple profiles at once, you can specify the path to a file with a list of profile names seperated by a new line using the `-l` flag or pass all stored profiles with the `-a` flag.
+   * To run commands on multiple profiles at once, you can specify the path to a file with a list of profile names separated by a new line using the `-l` flag or pass all stored profiles with the `-a` flag.
 * A principal with one recommended policies attached (described below)
 * Recommended attached policies: **`SecurityAudit` + [CloudFox custom policy](./misc/aws/cloudfox-policy.json)** 
 
@@ -79,20 +102,19 @@ Additional policy notes (as of 09/2022):
 |  `arn:aws:iam::aws:policy/AdministratorAccess` | This will work just fine with CloudFox, but if you were handed this level of access as a penetration tester, that should probably be a finding in itself :) |
 
 ### Azure
-* Viewer or similar permissions applied.
-
-### GCP
-* `gcloud` CLI installed
- * Proper SDK credentials available (`gcloud auth application-default login`)
-* Viewer or similar permissions applied.
+* Viewer or similar permissions applied. 
 
 # AWS Commands
 | Provider | Command Name | Description 
 | - | - | - | 
 | AWS | [all-checks](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#all-checks) | Run all of the other commands using reasonable defaults. You'll  still want to check out the non-default options of each command, but this is a great place to start.  |
 | AWS | [access-keys](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#access-keys) | Lists active access keys for all users. Useful for cross referencing a key you found with which in-scope account it belongs to.  |
+| AWS | [api-gw](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#api-gw) | Lists API gateway endpoints and gives you custom curl commands including API tokens if they are stored in metadata. |
 | AWS | [buckets](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#filesystems)  | Lists the buckets in the account and gives you handy commands for inspecting them further.  |
+| AWS | [cape](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#cape)  |  Enumerates cross-account privilege escalation paths. Requires `pmapper` to be run first |
 | AWS | [cloudformation](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#cloudformation)  | Lists the cloudformation stacks in the account. Generates loot file with stack details, stack parameters, and stack output - look for secrets. |
+| AWS | [codebuild](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#codebuild)  | Enumerate CodeBuild projects |
+| AWS | [databases](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#databases)  | Enumerate RDS databases. Get a loot file with connection strings. |
 | AWS | [ecr](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#ecr) | List the most recently pushed image URI from all repositories. Use the loot file to pull selected images down with docker/nerdctl for inspection. |
 | AWS | [ecs-tasks](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#ecs-tasks) | List all ecs tasks. This returns a list of ecs tasks and associated cluster, task definition, container instance, launch type, and associated IAM principal. |
 | AWS | [eks](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#eks) | List all EKS clusters, see if they expose their endpoint publicly, and check the associated IAM roles attached to reach cluster or node group. Generates a loot file with the `aws eks udpate-kubeconfig` command needed to connect to each cluster. |
@@ -105,35 +127,46 @@ Additional policy notes (as of 09/2022):
 | AWS | [inventory](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#inventory) | Gain a rough understanding of size of the account and preferred regions.  |
 | AWS | [lambda](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#lambda)  | Lists the lambda functions in the account, including which one's have admin roles attached. Also gives you handy commands for downloading each function.  |
 | AWS | [network-ports](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#network-ports) | Enumerates AWS services that are potentially exposing a network service. The security groups and the network ACLs are parsed for each resource to determine what ports are potentially exposed. |
-| AWS | [outbound-assumed-roles](#outbound-assumed-roles)  |  List the roles that have been assumed by principals in this account. This is an excellent way to find outbound attack paths that lead into other accounts. |
+| AWS | [orgs](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#orgs)  |  Enumerate accounts in an organization |
+| AWS | [outbound-assumed-roles](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#outbound-assumed-roles)  |  List the roles that have been assumed by principals in this account. This is an excellent way to find outbound attack paths that lead into other accounts. |
 | AWS | [permissions](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#permissions) | Enumerates IAM permissions associated with all users and roles. Grep this output to figure out what permissions a particular principal has rather than logging into the AWS console and painstakingly expanding each policy attached to the principal you are investigating. |
-| AWS | [principals](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#principals) | Enumerates IAM users and Roles so you have the data at your fingertips. |
 | AWS | [pmapper](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#pmapper) | Looks for pmapper data stored on the local filesystem, [in the locations defined here](https://github.com/nccgroup/PMapper/wiki/Frequently-Asked-Questions#where-does-pmapper-store-its-data). If pmapper data has been found (you already ran `pmapper graph create`), then this command will use this data to build a graph in cloudfox memory let you know who can privesc to admin. 
 | AWS | [principals](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#principals) | Enumerates IAM users and Roles so you have the data at your fingertips. |
 | AWS | [ram](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#ram) | List all resources in this account that are shared with other accounts, or resources from other accounts that are shared with this account. Useful for cross-account attack paths. |
+| AWS | [resource-trusts](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#resource-trusts) | Looks through multiple services that support resource policies and helps you find any overly permissive resource trusts.|
 | AWS | [role-trusts](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#role-trusts) | Enumerates IAM role trust policies so you can look for overly permissive role trusts or find roles that trust a specific service. |
 | AWS | [route53](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#route53) | Enumerate all records from all route53 managed zones. Use this for application and service enumeration. |
 | AWS | [secrets](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#secrets) | List secrets from SecretsManager and SSM. Look for interesting secrets in the list and then see who has access to them using use `cloudfox iam-simulator` and/or `pmapper`. |
 | AWS | [sns](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#sns) | This command enumerates all of the sns topics and gives you the commands to subscribe to a topic or send messages to a topic (if you have the permissions needed). This command only deals with topics, and not the SMS functionality. This command also attempts to summarize topic resource policies if they exist.|
 | AWS | [sqs](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#sqs) | This command enumerates all of the sqs queues and gives you the commands to receive messages from a queue and send messages to a queue (if you have the permissions needed). This command also attempts to summarize queue resource policies if they exist.|
 | AWS | [tags](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#tags) | List all resources with tags, and all of the tags. This can be used similar to inventory as another method to identify what types of resources exist in an account. |
+| AWS | [workloads](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#workloads) | List all of the compute workloads and what role they have.  Tells you if any of the roles are admin (bad) and if you have pmapper data locally, it will tell you if any of the roles can privesc to admin (also bad) |
+| AWS | [ds](https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#workloads) | List all of the AWS-managed directories and their attributes. Also summarizes the current trusts with their directions and types. |
 
 
 # Azure Commands
 | Provider | Command Name | Description 
 | - | - | - | 
 | Azure | [whoami](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#whoami) | Displays information on the tenant, subscriptions and resource groups available to your current Azure CLI session. This is useful to provide situation awareness on what tenant and subscription IDs to use with the other sub commands. | 
-| Azure | [instances](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#instances) | Enumerates useful information for Compute instances in all available resource groups and subscriptions | 
+| Azure | [inventory](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#inventory) | Display an inventory table of all resources per location. | 
 | Azure | [rbac](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#rbac) | Lists Azure RBAC role assignments at subscription or tenant level |
 | Azure | [storage](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#storage) | The storage command is still under development. Currently it only displays limited data about the storage accounts | 
+| Azure | [vms](https://github.com/BishopFox/cloudfox/wiki/Azure-Commands#vms) | Enumerates useful information for Compute instances in all available resource groups and subscriptions | 
+
 
 # GCP Commands
 | Provider | Command Name | Description 
-| - | - | - | 
-| GCP | [access-tokens](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#access-tokens) | Displays handy information about existing GCP credentials on your local machine |
-| GCP | [hierarchy](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#hierarchy) Displays information on the projects available to your current Gcloud SDK credentials. This is useful to provide situation awareness on what organizations, folders and projects to use with the other sub commands.|
-| GCP | [inventory](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#inventory) Gain a rough understanding of size of the available organizations |
-| GCP | [buckets](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#buckets) Lists the buckets in the available organizations and gives you handy commands for inspecting them further. |
+| - | - | - |
+| GCP | [whoami](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#whoami) | Display the email address of the GCP authenticated user | 
+| GCP | [all-checks](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#all-checks) | Runs all available GCP commands | 
+| GCP | [artifact-registry](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#artifact-registry) | Display GCP artifact registry information | 
+| GCP | [bigquery](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#bigquery) | Display Bigquery datasets and tables information | 
+| GCP | [buckets](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#buckets) | Display GCP buckets information | 
+| GCP | [iam](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#iam) | Display GCP IAM information | 
+| GCP | [instances](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#instances) | Display GCP Compute Engine instances information |
+| GCP | [secrets](https://github.com/BishopFox/cloudfox/wiki/GCP-Commands#secrets) | Display GCP secrets information |
+
+
 
 # Authors
 * [Carlos Vendramini](https://github.com/carlosvendramini-bf)
@@ -151,7 +184,7 @@ CloudFox doesn't create any alerts or findings, and doesn't check your environme
 
 **Why do I see errors in some CloudFox commands?**
 
-* Services that don't exist in all regions - CloudFox tries a few ways to figure out what services are supported in each region. However some services don't support the methods CloudFox uses, so CloudFox defaults to just asking every region about the service. Regions that don't suppor the service will return errors. 
+* Services that don't exist in all regions - CloudFox tries a few ways to figure out what services are supported in each region. However some services don't support the methods CloudFox uses, so CloudFox defaults to just asking every region about the service. Regions that don't support the service will return errors. 
 * You don't have permission - Another reason you might see errors if you don't have permissions to make calls that CloudFox is making. Either because the policy doesn't allow it (e.g., SecurityAudit doesn't allow all of the permissions CloudFox needs. Or, it might be an SCP that is blocking you.  
 
 You can always look in the ~/.cloudfox/cloudfox-error.log file to get more information on errors. 

aws/access-keys.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
@@ -18,9 +19,10 @@ type AccessKeysModule struct {
 	IAMClient      sdk.AWSIAMClientInterface
 	Caller         sts.GetCallerIdentityOutput
 	AWSProfile     string
-	OutputFormat   string
 	Goroutines     int
 	WrapTable      bool
+	AWSOutputType  string
+	AWSTableCols   string
 	CommandCounter internal.CommandCounter
 
 	// Main module data
@@ -36,8 +38,8 @@ type UserKeys struct {
 	Key      string
 }
 
-func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *AccessKeysModule) PrintAccessKeys(filter string, outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "access-keys"
@@ -55,6 +57,7 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
 
 	// Variables used to draw table output
 	m.output.Headers = []string{
+		"Account",
 		"User Name",
 		"Access Key ID",
 	}
@@ -65,6 +68,7 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
 			m.output.Body = append(
 				m.output.Body,
 				[]string{
+					aws.ToString(m.Caller.Account),
 					key.Username,
 					key.Key,
 				},
@@ -79,9 +83,6 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
 		//fmt.Printf("[%s][%s] Preparing output.\n\n")
 
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -89,10 +90,37 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
 				Wrap: m.WrapTable,
 			},
 		}
+
+		// If the user specified table columns, use those.
+		// If the user specified -o wide, use the wide default cols for this module.
+		// Otherwise, use the hardcoded default cols for this module.
+		var tableCols []string
+		// If the user specified table columns, use those.
+		if m.AWSTableCols != "" {
+			// remove any spaces between any commas and the first letter after the commas
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+			tableCols = strings.Split(m.AWSTableCols, ",")
+			// If the user specified wide as the output format, use these columns.
+		} else if m.AWSOutputType == "wide" {
+			tableCols = []string{
+				"Account",
+				"User Name",
+				"Access Key ID",
+			}
+			// Otherwise, use the default columns.
+		} else {
+			tableCols = []string{
+				"User Name",
+				"Access Key ID",
+			}
+		}
+
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/api-gws.go

@@ -0,0 +1,681 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	apigatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+	apigatewayV2Types "github.com/aws/aws-sdk-go-v2/service/apigatewayv2/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/awsservicemap"
+	"github.com/sirupsen/logrus"
+)
+
+var CURL_COMMAND string = "curl -X %s %s"
+
+type ApiGwModule struct {
+	// General configuration data
+	APIGatewayClient   sdk.APIGatewayClientInterface
+	APIGatewayv2Client sdk.APIGatewayv2ClientInterface
+
+	Caller     sts.GetCallerIdentityOutput
+	AWSRegions []string
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
+
+	// Main module data
+	Gateways       []ApiGateway
+	CommandCounter internal.CommandCounter
+	Errors         []string
+	// Used to store output data for pretty printing
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type ApiGateway struct {
+	AWSService string
+	Region     string
+	Name       string
+	Endpoint   string
+	ApiKey     string
+	Public     string
+	Method     string
+}
+
+func (m *ApiGwModule) PrintApiGws(outputDirectory string, verbosity int) {
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "api-gw"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	fmt.Printf("[%s][%s] Enumerating api-gateways for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan ApiGateway)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+
+	go m.Receiver(dataReceiver, receiverDone)
+
+	//execute regional checks
+
+	for _, region := range m.AWSRegions {
+		wg.Add(1)
+		go m.executeChecks(region, wg, semaphore, dataReceiver)
+	}
+
+	wg.Wait()
+
+	// Send a message to the spinner goroutine to close the channel and stop
+	spinnerDone <- true
+	<-spinnerDone
+	receiverDone <- true
+	<-receiverDone
+
+	sort.Slice(m.Gateways, func(i, j int) bool {
+		return m.Gateways[i].AWSService < m.Gateways[j].AWSService
+	})
+
+	m.output.Headers = []string{
+		"Service",
+		"Region",
+		"Name",
+		"Method",
+		"Endpoint",
+		"ApiKey",
+		"Public",
+	}
+
+	// Table rows
+	for i := range m.Gateways {
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				m.Gateways[i].AWSService,
+				m.Gateways[i].Region,
+				m.Gateways[i].Name,
+				m.Gateways[i].Method,
+				m.Gateways[i].Endpoint,
+				m.Gateways[i].ApiKey,
+				m.Gateways[i].Public,
+			},
+		)
+
+	}
+	if len(m.output.Body) > 0 {
+		filepath := filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap:          m.WrapTable,
+				DirectoryName: filepath,
+			},
+			Loot: internal.LootClient{
+				DirectoryName: filepath,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		loot := m.writeLoot(filepath, verbosity)
+		o.Loot.LootFiles = append(o.Loot.LootFiles, internal.LootFile{
+			Name:     m.output.CallingModule,
+			Contents: loot,
+		})
+		o.WriteFullOutput(o.Table.TableFiles, o.Loot.LootFiles)
+
+		fmt.Printf("[%s][%s] %s API gateways found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+	} else {
+		fmt.Printf("[%s][%s] No API gateways found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+}
+
+func (m *ApiGwModule) Receiver(receiver chan ApiGateway, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Gateways = append(m.Gateways, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+
+func (m *ApiGwModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan ApiGateway) {
+	defer wg.Done()
+	// check the concurrency semaphore
+	// semaphore <- struct{}{}
+	// defer func() {
+	// 	<-semaphore
+	// }()
+
+	servicemap := &awsservicemap.AwsServiceMap{
+		JsonFileSource: "DOWNLOAD_FROM_AWS",
+	}
+	res, err := servicemap.IsServiceInRegion("apigateway", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		go m.getAPIGatewayAPIsPerRegion(r, wg, semaphore, dataReceiver)
+
+		m.CommandCounter.Total++
+		wg.Add(1)
+		go m.getAPIGatewayVIPsPerRegion(r, wg, semaphore, dataReceiver)
+
+		m.CommandCounter.Total++
+		wg.Add(1)
+		go m.getAPIGatewayv2APIsPerRegion(r, wg, semaphore, dataReceiver)
+
+		m.CommandCounter.Total++
+		wg.Add(1)
+		go m.getAPIGatewayv2VIPsPerRegion(r, wg, semaphore, dataReceiver)
+	}
+}
+
+func (m *ApiGwModule) writeLoot(outputDirectory string, verbosity int) string {
+	path := filepath.Join(outputDirectory, "loot")
+	f := filepath.Join(path, "api-gws.txt")
+
+	var out string
+
+	for _, endpoint := range m.Gateways {
+		method := endpoint.Method
+		// Write a GET and POST for ANY
+		if endpoint.Method == "ANY" {
+			line := fmt.Sprintf(CURL_COMMAND, "GET", endpoint.Endpoint)
+			if endpoint.ApiKey != "" {
+				line += fmt.Sprintf(" -H 'X-Api-Key: %s'", endpoint.ApiKey)
+			}
+
+			out += line + "\n"
+
+			method = "POST"
+		}
+
+		line := fmt.Sprintf(CURL_COMMAND, method, endpoint.Endpoint)
+		if endpoint.ApiKey != "" {
+			line += fmt.Sprintf(" -H 'X-Api-Key: %s'", endpoint.ApiKey)
+		}
+
+		if method == "DELETE" || method == "PATCH" || method == "POST" || method == "PUT" {
+			line += " -H 'Content-Type: application/json' -d '{}'"
+		}
+
+		out += line + "\n"
+	}
+
+	// err = os.WriteFile(f, []byte(out), 0644)
+	// if err != nil {
+	// 	m.modLog.Error(err.Error())
+	// 	m.CommandCounter.Error++
+	// 	panic(err.Error())
+	// }
+
+	if verbosity > 2 {
+		fmt.Println()
+		fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("Send these requests through your favorite interception proxy"))
+		fmt.Print(out)
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("End of loot file."))
+	}
+
+	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), f)
+
+	return out
+
+}
+
+func (m *ApiGwModule) getAPIGatewayAPIsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan ApiGateway) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
+
+	Items, err := sdk.CachedApiGatewayGetRestAPIs(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, api := range Items {
+		m.CommandCounter.Total++
+		for _, endpoint := range m.getEndpointsPerAPIGateway(r, api) {
+			dataReceiver <- endpoint
+		}
+	}
+}
+
+func (m *ApiGwModule) getAPIGatewayVIPsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan ApiGateway) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
+
+	Items, err := sdk.CachedApiGatewayGetRestAPIs(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	GetDomainNames, err := sdk.CachedApiGatewayGetDomainNames(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, item := range GetDomainNames {
+
+		domain := aws.ToString(item.DomainName)
+		GetBasePathMappings, err := sdk.CachedApiGatewayGetBasePathMappings(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, item.DomainName)
+
+		if err != nil {
+			m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			break
+		}
+
+		for _, mapping := range GetBasePathMappings {
+			stage := aws.ToString(mapping.Stage)
+			basePath := aws.ToString(mapping.BasePath)
+			if basePath == "(none)" {
+				basePath = "" // Empty string since '/' is already prepended
+			}
+
+			for _, api := range Items {
+				if api.Id != nil && aws.ToString(api.Id) == aws.ToString(mapping.RestApiId) {
+					m.CommandCounter.Total++
+
+					endpoints := m.getEndpointsPerAPIGateway(r, api)
+					for _, endpoint := range endpoints {
+						old := fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.RestApiId), r, stage)
+
+						if strings.HasPrefix(endpoint.Endpoint, old) {
+							var new string
+							if basePath == "" {
+								new = fmt.Sprintf("https://%s/", domain)
+							} else {
+								new = fmt.Sprintf("https://%s/%s/", domain, basePath)
+							}
+							endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
+							endpoint.Name = domain
+							dataReceiver <- endpoint
+						}
+					}
+					break
+				}
+			}
+		}
+
+	}
+
+}
+
+func (m *ApiGwModule) getEndpointsPerAPIGateway(r string, api apigatewayTypes.RestApi) []ApiGateway {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+	}()
+	var gateways []ApiGateway
+
+	//var PaginationControl2 *string
+	awsService := "APIGateway"
+	var public string
+
+	name := aws.ToString(api.Name)
+	id := aws.ToString(api.Id)
+	raw_endpoint := fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com", id, r)
+
+	endpointType := *api.EndpointConfiguration
+	//fmt.Println(endpointType)
+	if endpointType.Types[0] == "PRIVATE" {
+		public = "False"
+	} else {
+		public = "True"
+	}
+
+	GetStages, err := sdk.CachedApiGatewayGetStages(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, id)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return gateways
+	}
+
+	resources, err := sdk.CachedApiGatewayGetResources(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, id)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, stage := range GetStages.Item {
+		stageName := aws.ToString(stage.StageName)
+		for _, resource := range resources {
+			if len(resource.ResourceMethods) != 0 {
+				for method := range resource.ResourceMethods {
+
+					// Check if API Key is required for endpoint
+					apiKey := ""
+					if m.ApiGatewayApiKeyRequired(r, api.Id, resource.Id, method) {
+						apiKey, err = m.GetApiGatewayApiKey(r, id, stageName)
+						if err != nil {
+							m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+							m.modLog.Error(err.Error())
+							m.CommandCounter.Error++
+						}
+					}
+
+					path := aws.ToString(resource.Path)
+
+					endpoint := fmt.Sprintf("%s/%s%s", raw_endpoint, stageName, path)
+
+					gateways = append(gateways, ApiGateway{
+						AWSService: awsService,
+						Region:     r,
+						Name:       name,
+						Endpoint:   endpoint,
+						Method:     method,
+						Public:     public,
+						ApiKey:     apiKey,
+					})
+				}
+			}
+		}
+	}
+
+	return gateways
+}
+
+func (m *ApiGwModule) getAPIGatewayv2APIsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan ApiGateway) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
+
+	Items, err := sdk.CachedAPIGatewayv2GetAPIs(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+	for _, api := range Items {
+		m.CommandCounter.Total++
+		for _, endpoint := range m.getEndpointsPerAPIGatewayv2(r, api) {
+			dataReceiver <- endpoint
+		}
+	}
+
+}
+
+func (m *ApiGwModule) getAPIGatewayv2VIPsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan ApiGateway) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
+
+	Items, err := sdk.CachedAPIGatewayv2GetAPIs(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	GetDomainNames, err := sdk.CachedAPIGatewayv2GetDomainNames(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, item := range GetDomainNames {
+
+		domain := aws.ToString(item.DomainName)
+		GetApiMappings, err := sdk.CachedAPIGatewayv2GetApiMappings(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, domain)
+
+		if err != nil {
+			m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			break
+		}
+
+		for _, mapping := range GetApiMappings {
+			stage := aws.ToString(mapping.Stage)
+			if stage == "$default" {
+				stage = ""
+			}
+			path := aws.ToString(mapping.ApiMappingKey)
+
+			for _, api := range Items {
+				if api.ApiId != nil && aws.ToString(api.ApiId) == aws.ToString(mapping.ApiId) {
+					m.CommandCounter.Total++
+					endpoints := m.getEndpointsPerAPIGatewayv2(r, api)
+					for _, endpoint := range endpoints {
+						var old string
+						if stage == "" {
+							old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/", aws.ToString(mapping.ApiId), r)
+						} else {
+							old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.ApiId), r, stage)
+						}
+						if strings.HasPrefix(endpoint.Endpoint, old) {
+							var new string
+							if path == "" {
+								new = fmt.Sprintf("https://%s/", domain)
+							} else {
+								new = fmt.Sprintf("https://%s/%s/", domain, path)
+							}
+							endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
+							endpoint.Name = domain
+							dataReceiver <- endpoint
+						}
+					}
+					break
+				}
+			}
+		}
+
+	}
+}
+
+func (m *ApiGwModule) getEndpointsPerAPIGatewayv2(r string, api apigatewayV2Types.Api) []ApiGateway {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+	}()
+
+	var gateways []ApiGateway
+
+	awsService := "APIGatewayv2"
+
+	var public string
+
+	name := aws.ToString(api.Name)
+	raw_endpoint := aws.ToString(api.ApiEndpoint)
+	id := aws.ToString(api.ApiId)
+
+	var stages []string
+	GetStages, err := sdk.CachedAPIGatewayv2GetStages(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, id)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, stage := range GetStages {
+		s := aws.ToString(stage.StageName)
+		if s == "$default" {
+			s = ""
+		}
+		stages = append(stages, s)
+	}
+	GetRoutes, err := sdk.CachedAPIGatewayv2GetRoutes(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, id)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, stage := range stages {
+		for _, route := range GetRoutes {
+			routeKey := route.RouteKey
+			var method string
+			var path string
+			if len(strings.Fields(*routeKey)) == 2 {
+				method = strings.Fields(*routeKey)[0]
+				path = strings.Fields(*routeKey)[1]
+			}
+			var endpoint string
+			if stage == "" {
+				endpoint = fmt.Sprintf("%s%s", raw_endpoint, path)
+			} else {
+				endpoint = fmt.Sprintf("%s/%s%s", raw_endpoint, stage, path)
+			}
+			public = "True"
+
+			gateways = append(gateways, ApiGateway{
+				AWSService: awsService,
+				Region:     r,
+				Name:       name,
+				Method:     method,
+				Endpoint:   endpoint,
+				Public:     public,
+			})
+		}
+	}
+
+	return gateways
+}
+
+func (m *ApiGwModule) ApiGatewayApiKeyRequired(r string, ApiId *string, ResourceId *string, method string) bool {
+	GetMethod, err := sdk.CachedApiGatewayGetMethod(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, aws.ToString(ApiId), aws.ToString(ResourceId), method)
+
+	if err != nil {
+		m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s", r))
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	} else {
+		return aws.ToBool(GetMethod.ApiKeyRequired)
+	}
+	return false
+}
+
+func (m *ApiGwModule) GetApiGatewayApiKey(r string, ApiId string, Stage string) (string, error) {
+	var items []apigatewayTypes.UsagePlan
+
+	GetUsagePlans, err := sdk.CachedApiGatewayGetUsagePlans(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		return "", err
+	}
+
+	for _, item := range GetUsagePlans {
+		items = append(items, item)
+	}
+
+	for _, item := range items {
+		for _, apiStage := range item.ApiStages {
+			if aws.ToString(apiStage.ApiId) == ApiId && aws.ToString(apiStage.Stage) == Stage {
+				GetUsagePlanKeys, err := sdk.CachedApiGatewayGetUsagePlanKeys(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, aws.ToString(item.Id))
+
+				if err != nil {
+					return "", err
+				}
+
+				for _, i := range GetUsagePlanKeys {
+					if aws.ToString(i.Type) == "API_KEY" {
+						return aws.ToString(i.Value), nil
+					}
+				}
+
+			}
+		}
+	}
+
+	return "", nil
+}

aws/api-gws_test.go

@@ -0,0 +1,60 @@
+package aws
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go/ptr"
+	"github.com/spf13/afero"
+)
+
+func TestApiGw(t *testing.T) {
+
+	m := ApiGwModule{
+		AWSProfile: "unittesting",
+		AWSRegions: []string{"us-east-1"},
+		Caller: sts.GetCallerIdentityOutput{
+			Arn:     aws.String("arn:aws:iam::123456789012:user/Alice"),
+			Account: aws.String("123456789012"),
+		},
+		Goroutines:         3,
+		WrapTable:          false,
+		APIGatewayClient:   &sdk.MockedAWSAPIGatewayClient{},
+		APIGatewayv2Client: &sdk.MockedAWSAPIGatewayv2Client{},
+	}
+
+	fs := internal.MockFileSystem(true)
+	defer internal.MockFileSystem(false)
+	//tmpDir := "~/.cloudfox/"
+	tmpDir := ptr.ToString(internal.GetLogDirPath())
+
+	m.PrintApiGws(tmpDir, 2)
+
+	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/api-gw.txt")
+	resultsFile, err := afero.ReadFile(fs, resultsFilePath)
+	if err != nil {
+		t.Fatalf("Cannot read output file at %s: %s", resultsFilePath, err)
+	}
+	//print the results file to the screen
+	//fmt.Println(string(resultsFile))
+
+	// I want a test that runs the main function and checks the output to see if the following items are in the output: "https://qwerty.execute-api.us-east-1.amazonaws.com/stage1/path1", "https://asdfsdfasdf.execute-api.us-east-1.amazonaws.com/stage1/route2"
+
+	expectedResults := []string{
+		"https://qwerty.execute-api.us-east-1.amazonaws.com/stage1/path1",
+		"https://asdfsdfasdf.execute-api.us-east-1.amazonaws.com/stage1/route2",
+		"https://asdfsdfasdf.execute-api.us-east-1.amazonaws.com/stage2/route1",
+		"23oieuwefo3rfs",
+	}
+
+	for _, expected := range expectedResults {
+		if !strings.Contains(string(resultsFile), expected) {
+			t.Errorf("Expected %s to be in the results file", expected)
+		}
+	}
+}

aws/buckets.go

@@ -20,24 +20,26 @@ import (
 type BucketsModule struct {
 	// General configuration data
 	//BucketsS3Client CloudFoxS3Client
-	S3Client   sdk.AWSS3ClientInterface
-	AWSRegions []string
-	AWSProfile string
-	Caller     sts.GetCallerIdentityOutput
+	CheckBucketPolicies bool
+	S3Client            sdk.AWSS3ClientInterface
+	AWSRegions          []string
+	AWSProfile          string
+	Caller              sts.GetCallerIdentityOutput
+	AWSTableCols        string
+	AWSOutputType       string
 
-	OutputFormat string
-	Goroutines   int
-	WrapTable    bool
+	Goroutines int
+	WrapTable  bool
 
 	// Main module data
-	Buckets        []Bucket
+	Buckets        []BucketRow
 	CommandCounter internal.CommandCounter
 	// Used to store output data for pretty printing
 	output internal.OutputData2
 	modLog *logrus.Entry
 }
 
-type Bucket struct {
+type BucketRow struct {
 	Arn                   string
 	AWSService            string
 	Region                string
@@ -53,8 +55,8 @@ type Bucket struct {
 	ResourcePolicySummary string
 }
 
-func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *BucketsModule) PrintBuckets(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "buckets"
@@ -78,7 +80,7 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
 
 	//create a channel to receive the objects
-	dataReceiver := make(chan Bucket)
+	dataReceiver := make(chan BucketRow)
 
 	// Create a channel to signal to stop
 	receiverDone := make(chan bool)
@@ -100,6 +102,7 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
 	m.output.Headers = []string{
+		"Account",
 		"Name",
 		"Region",
 		"Public?",
@@ -111,17 +114,16 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				m.Buckets[i].Name,
 				m.Buckets[i].Region,
 				m.Buckets[i].IsPublic,
 				m.Buckets[i].ResourcePolicySummary,
 			},
 		)
-
 	}
+
 	if len(m.output.Body) > 0 {
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -129,10 +131,47 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 				Wrap: m.WrapTable,
 			},
 		}
+
+		// If the user specified table columns, use those.
+		// If the user specified -o wide, use the wide default cols for this module.
+		// Otherwise, use the hardcoded default cols for this module.
+		var tableCols []string
+		// If the user specified table columns, use those.
+		if m.AWSTableCols != "" {
+			// remove any spaces between any commas and the first letter after the commas
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+			tableCols = strings.Split(m.AWSTableCols, ",")
+			// If the user specified wide as the output format, use these columns.
+		} else if m.AWSOutputType == "wide" {
+			tableCols = []string{
+				"Account",
+				"Name",
+				"Region",
+				"Public?",
+				"Resource Policy Summary",
+			}
+			// Otherwise, use the default columns for this module (brief)
+		} else {
+			tableCols = []string{
+				"Name",
+				"Region",
+				"Public?",
+				"Resource Policy Summary",
+			}
+		}
+
+		// Remove the Public? and Resource Policy Summary columns if the user did not specify CheckBucketPolicies
+		if !m.CheckBucketPolicies {
+			tableCols = removeStringFromSlice(tableCols, "Public?")
+			tableCols = removeStringFromSlice(tableCols, "Resource Policy Summary")
+		}
+
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			TableCols: tableCols,
+			Body:      m.output.Body,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -148,7 +187,7 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
 }
 
-func (m *BucketsModule) Receiver(receiver chan Bucket, receiverDone chan bool) {
+func (m *BucketsModule) Receiver(receiver chan BucketRow, receiverDone chan bool) {
 	defer close(receiverDone)
 	for {
 		select {
@@ -161,7 +200,7 @@ func (m *BucketsModule) Receiver(receiver chan Bucket, receiverDone chan bool) {
 	}
 }
 
-func (m *BucketsModule) executeChecks(wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Bucket) {
+func (m *BucketsModule) executeChecks(wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan BucketRow) {
 	defer wg.Done()
 
 	m.CommandCounter.Total++
@@ -215,7 +254,7 @@ func (m *BucketsModule) writeLoot(outputDirectory string, verbosity int, profile
 
 }
 
-func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Bucket) {
+func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan BucketRow) {
 	defer func() {
 		m.CommandCounter.Executing--
 		m.CommandCounter.Complete++
@@ -237,42 +276,49 @@ func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, sem
 	}
 
 	for _, b := range ListBuckets {
-		bucket := &Bucket{
+		bucket := &BucketRow{
 			Name:       aws.ToString(b.Name),
 			AWSService: "S3",
 		}
 		region, err = sdk.CachedGetBucketLocation(m.S3Client, aws.ToString(m.Caller.Account), aws.ToString(b.Name))
 		if err != nil {
 			m.modLog.Error(err.Error())
+			region = "Unknown"
+
 		}
 		bucket.Region = region
 
-		policyJSON, err := sdk.CachedGetBucketPolicy(m.S3Client, aws.ToString(m.Caller.Account), region, aws.ToString(b.Name))
-		if err != nil {
-			m.modLog.Error(err.Error())
-		} else {
-			bucket.PolicyJSON = policyJSON
-		}
+		if m.CheckBucketPolicies {
 
-		policy, err := policy.ParseJSONPolicy([]byte(policyJSON))
-		if err != nil {
-			m.modLog.Error(fmt.Sprintf("parsing bucket access policy (%s) as JSON: %s", name, err))
-		} else {
-			bucket.Policy = policy
-		}
+			policyJSON, err := sdk.CachedGetBucketPolicy(m.S3Client, aws.ToString(m.Caller.Account), region, aws.ToString(b.Name))
+			if err != nil {
+				m.modLog.Error(err.Error())
+			} else {
+				bucket.PolicyJSON = policyJSON
+			}
 
-		bucket.IsPublic = "No"
-		if !bucket.Policy.IsEmpty() {
-			m.analyseBucketPolicy(bucket, dataReceiver)
+			policy, err := policy.ParseJSONPolicy([]byte(policyJSON))
+			if err != nil {
+				m.modLog.Error(fmt.Sprintf("parsing bucket access policy (%s) as JSON: %s", name, err))
+			} else {
+				bucket.Policy = policy
+			}
+
+			bucket.IsPublic = "No"
+			if !bucket.Policy.IsEmpty() {
+				m.analyseBucketPolicy(bucket, dataReceiver)
+			} else {
+				bucket.Access = "No resource policy"
+				dataReceiver <- *bucket
+			}
 		} else {
-			bucket.Access = "No resource policy"
+
+			// Send Bucket object through the channel to the receiver
+			bucket.Access = "Skipped"
+			bucket.IsPublic = "Skipped"
 			dataReceiver <- *bucket
 		}
-
-		// Send Bucket object through the channel to the receiver
-
 	}
-
 }
 
 func (m *BucketsModule) isPublicAccessBlocked(bucketName string, r string) bool {
@@ -280,11 +326,11 @@ func (m *BucketsModule) isPublicAccessBlocked(bucketName string, r string) bool
 	if err != nil {
 		return false
 	}
-	return publicAccessBlock.IgnorePublicAcls
+	return aws.ToBool(publicAccessBlock.IgnorePublicAcls) && aws.ToBool(publicAccessBlock.BlockPublicPolicy) && aws.ToBool(publicAccessBlock.RestrictPublicBuckets)
 
 }
 
-func (m *BucketsModule) analyseBucketPolicy(bucket *Bucket, dataReceiver chan Bucket) {
+func (m *BucketsModule) analyseBucketPolicy(bucket *BucketRow, dataReceiver chan BucketRow) {
 	m.storeAccessPolicy(bucket)
 
 	if bucket.Policy.IsPublic() && !bucket.Policy.IsConditionallyPublic() && !m.isPublicAccessBlocked(bucket.Name, bucket.Region) {
@@ -299,14 +345,14 @@ func (m *BucketsModule) analyseBucketPolicy(bucket *Bucket, dataReceiver chan Bu
 		} else {
 			bucket.ResourcePolicySummary = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
 		}
-		bucket.ResourcePolicySummary = strings.TrimSuffix(bucket.ResourcePolicySummary, "\n")
+		//bucket.ResourcePolicySummary = strings.TrimSuffix(bucket.ResourcePolicySummary, "\n")
 
 	}
 	dataReceiver <- *bucket
 
 }
 
-func (m *BucketsModule) storeAccessPolicy(bucket *Bucket) {
+func (m *BucketsModule) storeAccessPolicy(bucket *BucketRow) {
 	f := filepath.Join(m.getLootDir(), fmt.Sprintf("%s.json", bucket.Name))
 
 	if err := m.storeFile(f, bucket.PolicyJSON); err != nil {

aws/buckets_test.go

@@ -63,10 +63,10 @@ func (m *MockedS3Client) GetBucketLocation(ctx context.Context, params *s3.GetBu
 func (m *MockedS3Client) GetPublicAccessBlock(ctx context.Context, params *s3.GetPublicAccessBlockInput, optFns ...func(*s3.Options)) (*s3.GetPublicAccessBlockOutput, error) {
 	output := &s3.GetPublicAccessBlockOutput{
 		PublicAccessBlockConfiguration: &types.PublicAccessBlockConfiguration{
-			BlockPublicAcls:       true,
-			BlockPublicPolicy:     true,
-			IgnorePublicAcls:      false,
-			RestrictPublicBuckets: true,
+			BlockPublicAcls:       aws.Bool(true),
+			BlockPublicPolicy:     aws.Bool(true),
+			IgnorePublicAcls:      aws.Bool(false),
+			RestrictPublicBuckets: aws.Bool(true),
 		},
 	}
 	return output, nil
@@ -81,9 +81,11 @@ func TestListBuckets(t *testing.T) {
 			Arn:     aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests"),
 			Account: aws.String("123456789012"),
 		},
-		AWSRegions: []string{"us-east-1", "us-west-1", "us-west-2"},
-		AWSProfile: "unittesting",
-		Goroutines: 3,
+		AWSRegions:          []string{"us-east-1", "us-west-1", "us-west-2"},
+		AWSProfile:          "unittesting",
+		AWSOutputType:       "",
+		CheckBucketPolicies: true,
+		Goroutines:          3,
 	}
 
 	subtests := []struct {
@@ -91,14 +93,14 @@ func TestListBuckets(t *testing.T) {
 		outputDirectory string
 		verbosity       int
 		testModule      BucketsModule
-		expectedResult  []Bucket
+		expectedResult  []BucketRow
 	}{
 		{
 			name:            "test1",
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule:      m,
-			expectedResult: []Bucket{{
+			expectedResult: []BucketRow{{
 				Name: "mockBucket123",
 			}},
 		},
@@ -110,9 +112,9 @@ func TestListBuckets(t *testing.T) {
 
 	for _, subtest := range subtests {
 		t.Run(subtest.name, func(t *testing.T) {
-			subtest.testModule.PrintBuckets(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
+			subtest.testModule.PrintBuckets(subtest.outputDirectory, subtest.verbosity)
 			for index, expectedBucket := range subtest.expectedResult {
-				resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/123456789012-unittesting/table/buckets.txt")
+				resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/buckets.txt")
 				resultsFile, err := afero.ReadFile(fs, resultsFilePath)
 				if err != nil {
 					t.Fatalf("Cannot read output file at %s: %s", resultsFilePath, err)

aws/cape-tui.go

@@ -0,0 +1,538 @@
+package aws
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/charmbracelet/bubbles/help"
+	"github.com/charmbracelet/bubbles/key"
+	"github.com/charmbracelet/bubbles/table"
+	"github.com/charmbracelet/bubbles/viewport"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+)
+
+var (
+	titleStyle = func() lipgloss.Style {
+		b := lipgloss.RoundedBorder()
+		b.Right = "├"
+		return lipgloss.NewStyle().BorderStyle(b).Padding(0, 1)
+	}()
+
+	infoStyle = func() lipgloss.Style {
+		b := lipgloss.RoundedBorder()
+		b.Left = "┤"
+		return titleStyle.Copy().BorderStyle(b)
+	}()
+	magentaStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("magenta"))
+)
+
+type model struct {
+	preloadedData       *AllAccountData
+	awsAccountsTable    table.Model
+	awsAccountsViewport viewport.Model
+
+	mainTable         table.Model
+	mainTableViewport viewport.Model
+	mainTableData     map[int][]table.Row
+
+	detailsData     map[int]string
+	detailsViewport viewport.Model // Use viewport for details view
+
+	focusSelector     int
+	defaultTableStyle table.Styles
+
+	terminalWidth   int
+	terminalHeight  int // Add terminal height to manage viewport size
+	awsSelectedRow  int
+	mainSelectedRow int // Track the currently selected row for detail view updates
+	keys            keyMap
+	help            help.Model
+	lastKey         string
+	quitting        bool
+}
+
+type CapeJSON struct {
+	Account       string `json:"account"`
+	Source        string `json:"source"`
+	Summary       string `json:"summary"`
+	Target        string `json:"target"`
+	IsTargetAdmin string `json:"isTargetAdmin"`
+}
+
+type PerAccountData struct {
+	FilePath     string     // Path to the JSON file
+	PrivescPaths []CapeJSON // All records contained in the file
+}
+
+type AllAccountData struct {
+	Files map[string]*PerAccountData // Map of file paths to their records
+}
+
+func (m model) Init() tea.Cmd {
+	return nil
+}
+
+func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmd tea.Cmd
+
+	s := table.DefaultStyles()
+	s.Header = s.Header.
+		BorderStyle(lipgloss.NormalBorder()).
+		BorderForeground(lipgloss.Color("240")).
+		BorderBottom(true).
+		Bold(false)
+	s.Selected = s.Selected.
+		Foreground(lipgloss.Color("229")).
+		Background(lipgloss.Color("57")).
+		Bold(false)
+
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		m.terminalWidth = msg.Width
+		m.terminalHeight = msg.Height - 7 // Adjust as needed
+
+		// Calculate heights based on the specified percentages
+		awsAccountsHeight := int(float32(m.terminalHeight) * 0.2)
+		halfHeight := int(float32(m.terminalHeight) * 0.4) // For the other two viewports
+
+		// Update dimensions for all viewports
+		m.awsAccountsViewport.Width = m.terminalWidth - 4
+		m.awsAccountsViewport.Height = awsAccountsHeight
+
+		m.mainTableViewport.Width = m.terminalWidth - 4
+		m.mainTableViewport.Height = halfHeight
+		m.awsAccountsTable.SetHeight(awsAccountsHeight - 2)
+		m.awsAccountsTable.SetWidth(m.terminalWidth - 4)
+		m.awsAccountsViewport.Width = m.terminalWidth - 4
+
+		m.detailsViewport.Width = m.terminalWidth - 4
+		m.detailsViewport.Height = halfHeight
+		m.mainTable.SetHeight(halfHeight - 2)
+
+	case tea.KeyMsg:
+		switch {
+		case key.Matches(msg, m.keys.Up):
+			m.lastKey = "↑"
+		case key.Matches(msg, m.keys.Down):
+			m.lastKey = "↓"
+		case key.Matches(msg, m.keys.Left):
+			m.lastKey = "←"
+		case key.Matches(msg, m.keys.Right):
+			m.lastKey = "→"
+		case key.Matches(msg, m.keys.Help):
+			m.help.ShowAll = !m.help.ShowAll
+		case key.Matches(msg, m.keys.Tab):
+			// Switch focus between the the three viewports by cycling focusSelector between 0, 1, and 2
+			m.focusSelector = (m.focusSelector + 1) % 3
+			//m.focusOnTable = !m.focusOnTable
+		// add a case for shift and tab at the same time to to cycle the focusSelector backwards between 0, 1, and 2
+		case key.Matches(msg, m.keys.ShiftTab):
+			m.focusSelector = (m.focusSelector - 1) % 3
+
+		case key.Matches(msg, m.keys.Quit):
+			m.quitting = true
+			return m, tea.Quit
+		}
+
+		//var detailsData map[int]string
+		//var mainTable table.Model
+		var err error
+		var awsCurrentRow int
+		var mainCurrentRow int
+		switch m.focusSelector {
+		case 0:
+			m.awsAccountsTable, cmd = m.awsAccountsTable.Update(msg)
+			m.awsAccountsViewport.SetContent(m.awsAccountsTable.View())
+			awsCurrentRow = m.awsAccountsTable.Cursor()
+			if m.awsSelectedRow != awsCurrentRow {
+				m.awsSelectedRow = awsCurrentRow
+				// Update the viewport content based on the newly selected row
+				// Load the file for the selected account and show the file content in the main table
+				m.mainTable, m.detailsData, err = getRecordsForAccount(m.preloadedData.Files[m.awsAccountsTable.Rows()[awsCurrentRow][0]])
+				if err != nil {
+					// Handle error
+					break
+				}
+				m.mainTable.SetStyles(s)
+				m.mainTableViewport.SetContent(m.mainTable.View())
+				m.detailsViewport.SetContent(m.detailsData[0])
+
+			}
+		case 1:
+			m.mainTable, cmd = m.mainTable.Update(msg)
+			// Check if the selected row has changed
+			m.mainTableViewport.SetContent(m.mainTable.View())
+
+			mainCurrentRow = m.mainTable.Cursor()
+			if m.mainSelectedRow != mainCurrentRow {
+				m.mainSelectedRow = mainCurrentRow
+				// Update the viewport content based on the newly selected row
+				if detail, ok := m.detailsData[m.mainSelectedRow]; ok {
+					m.detailsViewport.SetContent(detail)
+				} else {
+					m.detailsViewport.SetContent(fmt.Sprintf("No details available for main row %d (aws row %d)", m.mainSelectedRow, m.awsSelectedRow))
+				}
+			}
+		case 2:
+			m.detailsViewport, cmd = m.detailsViewport.Update(msg)
+		}
+	}
+	return m, cmd
+}
+
+func (m model) View() string {
+	// Define styles for active and inactive viewports
+	activeBorderStyle := lipgloss.NewStyle().
+		BorderStyle(lipgloss.NormalBorder()).
+		BorderForeground(lipgloss.Color("#00FFFF")). // Cyan for active
+		Padding(0)
+	activeBorderStyle.PaddingLeft(1)
+	activeBorderStyle.PaddingRight(1)
+
+	inactiveBorderStyle := lipgloss.NewStyle().
+		BorderStyle(lipgloss.NormalBorder()).
+		BorderForeground(lipgloss.Color("#808080")). // Gray for inactive
+		Padding(0)
+	inactiveBorderStyle.PaddingLeft(1)
+	inactiveBorderStyle.PaddingRight(1)
+
+	// Conditionally apply border styles based on focus
+	awsTableViewStyle := activeBorderStyle
+	m.awsAccountsTable.SetStyles(m.defaultTableStyle)
+	tableViewStyle := inactiveBorderStyle
+	m.mainTable.SetStyles(m.defaultTableStyle)
+	detailsViewStyle := inactiveBorderStyle
+
+	switch m.focusSelector {
+	case 0:
+		awsTableViewStyle = activeBorderStyle
+		m.awsAccountsTable.SetStyles(m.defaultTableStyle)
+		tableViewStyle = inactiveBorderStyle
+		detailsViewStyle = inactiveBorderStyle
+	case 1:
+		awsTableViewStyle = inactiveBorderStyle
+		tableViewStyle = activeBorderStyle
+		m.mainTable.SetStyles(m.defaultTableStyle)
+		detailsViewStyle = inactiveBorderStyle
+	case 2:
+		awsTableViewStyle = inactiveBorderStyle
+		tableViewStyle = inactiveBorderStyle
+		detailsViewStyle = activeBorderStyle
+	}
+
+	// Render the table and details viewports with their styles (adjust based on focus)
+	awsAccountsView := awsTableViewStyle.Render(m.awsAccountsViewport.View())
+	tableView := tableViewStyle.Render(m.mainTableViewport.View())
+	detailsView := detailsViewStyle.Render(m.detailsViewport.View())
+
+	// Combine all views
+	fullView := lipgloss.JoinVertical(lipgloss.Top, awsAccountsView, tableView, detailsView)
+
+	helpView := m.help.View(m.keys)
+
+	return fmt.Sprintf("%s\n%s", fullView, helpView)
+}
+
+func calculateMaxWidths(rows []table.Row) []int {
+
+	var maxWidths []int
+	// make sure the length of the rows is greater than 0
+
+	if len(rows) > 0 {
+		maxWidths = make([]int, len(rows[0]))
+	} else {
+		maxWidths = []int{30, 30, 30, 30}
+	}
+
+	for _, row := range rows {
+		for i, cell := range row {
+			if len(cell) > maxWidths[i] {
+				maxWidths[i] = len(cell)
+			}
+		}
+	}
+
+	return maxWidths
+
+}
+
+func (m model) footerView() string {
+	info := infoStyle.Render(fmt.Sprintf("%3.f%%", m.detailsViewport.ScrollPercent()*100))
+	line := strings.Repeat("─", max(0, m.detailsViewport.Width-lipgloss.Width(info)))
+	return lipgloss.JoinHorizontal(lipgloss.Center, line, info)
+}
+
+func max(a, b int) int {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+func loadFileRecords(filePath string) (*PerAccountData, error) {
+	// Open the file
+	file, err := os.Open(filePath)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	// Decode the JSON data
+	var records []CapeJSON
+	decoder := json.NewDecoder(file)
+	if err := decoder.Decode(&records); err != nil {
+		return nil, err
+	}
+
+	// Return a new FileRecords instance
+	return &PerAccountData{
+		FilePath:     filePath,
+		PrivescPaths: records,
+	}, nil
+}
+
+func preloadData(filePaths []string) (*AllAccountData, error) {
+	appData := &AllAccountData{
+		Files: make(map[string]*PerAccountData),
+	}
+
+	for _, filePath := range filePaths {
+		fileRecords, err := loadFileRecords(filePath)
+		if err != nil {
+			return nil, err
+		}
+		appData.Files[filePath] = fileRecords
+	}
+
+	return appData, nil
+}
+
+func getRecordsForAccount(preloadedData *PerAccountData) (table.Model, map[int]string, error) {
+	// lets load the records for the first file in the list
+
+	records := preloadedData.PrivescPaths
+	if len(records) < 1 {
+		mainTable := table.New(
+			table.WithColumns([]table.Column{
+				{Title: "Account", Width: 30},
+				{Title: "Source", Width: 30},
+				{Title: "Target", Width: 30},
+				{Title: "isTargetAdmin", Width: 30},
+			}),
+			table.WithRows([]table.Row{{"No records found", "", "", ""}}),
+			table.WithFocused(true),
+		)
+		return mainTable, nil, nil
+
+	}
+
+	// Prepare rows for the table and data for the right view
+	rows := make([]table.Row, 0, len(records)-1)
+	detailsData := make(map[int]string)  // Initialize the map for the fourth column's data
+	for i, record := range records[1:] { // Skip the header row
+		rows = append(rows, table.Row{record.Account, record.Source, record.Target, record.IsTargetAdmin})
+		detailsData[i] = expandDetailsData(record.Summary)
+	}
+
+	// Calculate max widths
+	maxWidths := calculateMaxWidths(rows)
+
+	// Define columns with calculated widths
+	columns := make([]table.Column, len(maxWidths))
+	colNames := []string{}
+	for _, header := range []string{"Account", "Source", "Target", "isTargetAdmin"} {
+		colNames = append(colNames, header)
+	}
+
+	for i, width := range maxWidths {
+		colName := colNames[i]
+		// if column name width is greater than the calculated width, use the column name width
+		if len(colName) > width {
+			width = len(colName)
+		}
+		columns[i] = table.Column{
+			Title: colName,
+			Width: width,
+		}
+	}
+
+	mainTable := table.New(
+		table.WithColumns(columns),
+		table.WithRows(rows),
+		table.WithFocused(true),
+	)
+	return mainTable, detailsData, nil
+}
+
+func CapeTUI(outputFiles []string) {
+
+	preloadData, err := preloadData(outputFiles)
+	if err != nil {
+		fmt.Printf("Error preloading data: %s\n", err)
+		fmt.Println("Either remove this profile from the list of profiles, or make sure cape can run successfully for this profile")
+		os.Exit(1)
+	}
+
+	var awsAccountsRows []table.Row
+	for _, file := range preloadData.Files {
+		// Extract a user-friendly account name from the file path if needed
+		// For simplicity, here we use the file path itself
+		awsAccountsRows = append(awsAccountsRows, table.Row{file.FilePath})
+	}
+
+	mainTable, detailsData, err := getRecordsForAccount(preloadData.Files[outputFiles[0]])
+
+	s := table.DefaultStyles()
+	s.Header = s.Header.
+		BorderStyle(lipgloss.NormalBorder()).
+		BorderForeground(lipgloss.Color("240")).
+		BorderBottom(true).
+		Bold(false)
+	s.Selected = s.Selected.
+		Foreground(lipgloss.Color("229")).
+		Background(lipgloss.Color("57")).
+		Bold(false)
+
+	awsAccountsWidth := calculateMaxWidths(awsAccountsRows)
+	awsAccountsTable := table.New(
+		table.WithColumns([]table.Column{
+			{Title: "AWS Accounts", Width: awsAccountsWidth[0]},
+		}),
+		table.WithRows(awsAccountsRows),
+		table.WithFocused(true), // Initially unfocused
+	)
+
+	awsAccountsTable.SetStyles(s)
+	awsAccountsViewport := viewport.New(0, 0)               // Initialize with 0 size; will be updated
+	awsAccountsViewport.SetContent(awsAccountsTable.View()) // Set initial content
+
+	mainTable.SetStyles(s)
+	mainTableViewport := viewport.New(0, 0)        // Initialize with 0 size; it will be updated
+	mainTableViewport.SetContent(mainTable.View()) // Set the initial content of the table viewport
+
+	// Initialize viewport for details view
+	detailsViewportModel := viewport.New(0, 0) // Size will be set based on terminal size in Update
+	// show the first row's details by default
+	detailsViewportModel.SetContent(detailsData[0])
+
+	m := model{
+		preloadedData:       preloadData,
+		awsAccountsTable:    awsAccountsTable,
+		awsAccountsViewport: awsAccountsViewport,
+		mainTable:           mainTable,
+		mainTableViewport:   mainTableViewport,
+		detailsData:         detailsData,
+		detailsViewport:     detailsViewportModel,
+
+		//focusOnTable:  true,
+		focusSelector:     0,
+		mainSelectedRow:   0, // Initialize selectedRow with an invalid index
+		awsSelectedRow:    0,
+		defaultTableStyle: s,
+		keys:              keys,
+		help:              help.New(),
+	}
+
+	p := tea.NewProgram(m)
+	if err := p.Start(); err != nil {
+		fmt.Printf("Error starting program: %s\n", err)
+		os.Exit(1)
+	}
+}
+
+// keyMap defines a set of keybindings. To work for help it must satisfy
+// key.Map. It could also very easily be a map[string]key.Binding.
+type keyMap struct {
+	Up       key.Binding
+	Down     key.Binding
+	Left     key.Binding
+	Right    key.Binding
+	Help     key.Binding
+	Quit     key.Binding
+	Tab      key.Binding
+	ShiftTab key.Binding
+}
+
+// ShortHelp returns keybindings to be shown in the mini help view. It's part
+// of the key.Map interface.
+func (k keyMap) ShortHelp() []key.Binding {
+	return []key.Binding{k.Tab, k.ShiftTab, k.Up, k.Down, k.Help, k.Quit}
+}
+
+// FullHelp returns keybindings for the expanded help view. It's part of the
+// key.Map interface.
+func (k keyMap) FullHelp() [][]key.Binding {
+	return [][]key.Binding{
+		{k.Up, k.Down, k.Left, k.Right},     // first column
+		{k.Tab, k.ShiftTab, k.Help, k.Quit}, // second column
+	}
+}
+
+var keys = keyMap{
+	Up: key.NewBinding(
+		key.WithKeys("up", "k"),
+		key.WithHelp("↑/k", "move up"),
+	),
+	Down: key.NewBinding(
+		key.WithKeys("down", "j"),
+		key.WithHelp("↓/j", "move down"),
+	),
+	Left: key.NewBinding(
+		key.WithKeys("left", "h"),
+		key.WithHelp("←/h", "move left"),
+	),
+	Right: key.NewBinding(
+		key.WithKeys("right", "l"),
+		key.WithHelp("→/l", "move right"),
+	),
+	Help: key.NewBinding(
+		key.WithKeys("?"),
+		key.WithHelp("?", "toggle help"),
+	),
+	Quit: key.NewBinding(
+		key.WithKeys("q", "esc", "ctrl+c"),
+		key.WithHelp("q", "quit"),
+	),
+	Tab: key.NewBinding(
+		key.WithKeys("tab"),
+		key.WithHelp("tab", "Switch window focus"),
+	),
+	ShiftTab: key.NewBinding(
+		key.WithKeys("shift+tab"),
+		key.WithHelp("shift+tab", "Switch window focus"),
+	),
+}
+
+func expandDetailsData(input string) string {
+	output := ""
+	lines := strings.Split(input, "\n")
+
+	for _, line := range lines {
+		var hop, option int
+		var rest string
+
+		// Use Sscanf to extract hop and option values
+		n, err := fmt.Sscanf(line, "[Hop: %d] [Option: %d]", &hop, &option)
+		if err != nil || n != 2 {
+			fmt.Printf("Error parsing line, expected 2 got %d: %v\n", n, err)
+			continue
+		}
+
+		// Extract the rest of the line manually
+		restIndex := strings.Index(line, "]") + 1
+		restIndex = strings.Index(line[restIndex:], "]") + restIndex + 1
+		if restIndex > 1 && restIndex < len(line) {
+			rest = line[restIndex+1:] // +1 to skip the space after the second ]
+		}
+
+		// Construct the formatted output
+		formattedLine := fmt.Sprintf("[Hop: %d][Option: %d]\n\t%s\n\n", hop, option, rest)
+		output += formattedLine
+	}
+
+	return output
+
+}

aws/cape.go

@@ -0,0 +1,981 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/BishopFox/cloudfox/internal/common"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/knownawsaccountslookup"
+	"github.com/dominikbraun/graph"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+type CapeCommand struct {
+
+	// General configuration data
+	Cmd                 cobra.Command
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	Goroutines          int
+	AWSProfile          string
+	WrapTable           bool
+	AWSOutputType       string
+	AWSTableCols        string
+	Verbosity           int
+	AWSOutputDirectory  string
+	AWSConfig           aws.Config
+	Version             string
+	SkipAdminCheck      bool
+	GlobalGraph         graph.Graph[string, string]
+	PmapperDataBasePath string
+	AnalyzedAccounts    map[string]CapeJobInfo
+	CapeAdminOnly       bool
+	AccountsNotAnalyzed []string
+
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type CapeJobInfo struct {
+	AccountID            string
+	Profile              string
+	AnalyzedSuccessfully bool
+	AdminOnlyAnalysis    bool
+	Source               string
+}
+
+func (m *CapeCommand) RunCapeCommand() {
+
+	// These struct values are used by the output module
+	m.output.Verbosity = m.Verbosity
+	m.output.Directory = m.AWSOutputDirectory
+	m.output.CallingModule = "cape"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+	m.output.FilePath = filepath.Join(m.AWSOutputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
+	o := internal.OutputClient{
+		Verbosity:     m.Verbosity,
+		CallingModule: m.output.CallingModule,
+		Table: internal.TableClient{
+			Wrap: m.WrapTable,
+		},
+	}
+
+	o.PrefixIdentifier = m.AWSProfile
+	o.Table.DirectoryName = filepath.Join(m.AWSOutputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
+	// Table #1: Inbound Privilege Escalation Paths
+	fmt.Printf("[%s][%s] Printing inbound privesc paths for account: %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	if !m.CapeAdminOnly {
+		fmt.Printf("[%s][%s] This can take a really long time if the number of vertices/edges is in the thousands. Consider stopping here and re-running cape with --admin-only to speed this step up!\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	} else {
+		fmt.Printf("[%s][%s] This can take a really long time if the number of vertices/edges is in the thousands.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+
+	header, body, _ := m.generateInboundPrivEscTableData()
+
+	var fileName string
+	if m.CapeAdminOnly {
+		fileName = "inbound-privesc-paths-admin-targets-only"
+	} else {
+		fileName = "inbound-privesc-paths-all-targets"
+	}
+
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header: header,
+		Body:   body,
+		//TableCols:         tableCols,
+		Name:              fileName,
+		SkipPrintToScreen: false,
+	})
+
+	// // Table #2: Outbound Privilege Escalation Paths
+	// header, body, tableCols := m.generateOutBoundPrivEscTable()
+	// o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+	// 	Header:            header,
+	// 	Body:              body,
+	// 	TableCols:         tableCols,
+	// 	Name:              "outbound-privesc-paths",
+	// 	SkipPrintToScreen: false,
+	// })
+
+	o.WriteFullOutput(o.Table.TableFiles, nil)
+	fmt.Println("The following accounts are trusted by this account, but were not analyzed as part of this run.")
+	fmt.Println("As a result, we cannot determine which principals in these accounts have permission to assume roles in this account.")
+	// for account := range m.AnalyzedAccounts {
+	// 	if m.AnalyzedAccounts[account].AnalyzedSuccessfully == false {
+	// 		fmt.Println("\t\t" + account)
+	// 	}
+	// }
+	for _, account := range m.AccountsNotAnalyzed {
+		fmt.Println("\t\t" + account)
+	}
+
+}
+
+func (m *CapeCommand) generateInboundPrivEscTableData() ([]string, [][]string, []string) {
+	var body [][]string
+	var tableCols []string
+	var header []string
+	header = []string{
+		"Account",
+		"Source",
+		"Target",
+		"isTargetAdmin",
+		"Summary",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Source",
+			"Target",
+			"isTargetAdmin",
+			"Summary",
+		}
+		// Otherwise, use these columns.
+	} else {
+		tableCols = []string{
+			"Source",
+			"Target",
+			"isTargetAdmin",
+			"Summary",
+		}
+	}
+
+	var privescPathsBody [][]string
+
+	allGlobalNodes, _ := m.GlobalGraph.AdjacencyMap()
+	for destination := range allGlobalNodes {
+		d, destinationVertexWithProperties, _ := m.GlobalGraph.VertexWithProperties(destination)
+
+		// if the user specified the CapeAdminOnly flag, then we only want to show paths to admin roles
+		if m.CapeAdminOnly {
+			// if the user specified the CapeAdminOnly flag, then we only want to show paths to admin roles
+			if destinationVertexWithProperties.Attributes["IsAdminString"] == "Yes" {
+				//for the destination vertex, we only want to deal with the ones that are in this account
+				if destinationVertexWithProperties.Attributes["AccountID"] == aws.ToString(m.Caller.Account) {
+					privescPathsBody = m.findPathsToThisDestination(allGlobalNodes, d, destinationVertexWithProperties)
+					body = append(body, privescPathsBody...)
+				}
+			}
+		} else {
+			//for the destination vertex, we only want to deal with the ones that are in this account
+			if destinationVertexWithProperties.Attributes["AccountID"] == aws.ToString(m.Caller.Account) {
+				privescPathsBody := m.findPathsToThisDestination(allGlobalNodes, d, destinationVertexWithProperties)
+				body = append(body, privescPathsBody...)
+			}
+		}
+	}
+	body = append(body, privescPathsBody...)
+	return header, body, tableCols
+
+}
+
+func (m *CapeCommand) findPathsToThisDestination(allGlobalNodes map[string]map[string]graph.Edge[string], d string, destinationVertexWithProperties graph.VertexProperties) [][]string {
+	var privescPathsBody [][]string
+	var paths string
+	// now let's look at every other vertex and see if it has a path to this destination
+	for source := range allGlobalNodes {
+		s, sourceVertexWithProperties, _ := m.GlobalGraph.VertexWithProperties(source)
+		//for the source vertex, we only want to deal with the ones that are NOT in this account
+		if sourceVertexWithProperties.Attributes["AccountID"] != aws.ToString(m.Caller.Account) {
+			// now let's see if there is a path from this source to our destination
+			path, _ := graph.ShortestPath(m.GlobalGraph, s, d)
+			// if we have a path, then lets document this source as having a path to our destination
+			if path != nil {
+				if s != d {
+					fmt.Printf("[%s][%s] Found a path from %s to %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), s, d)
+
+					// check to see if the source account was analyzed. If not, lets add it to the list of accounts that were not analyzed
+					if strings.Contains(s, "Not analyzed/in-scope") {
+						// add it to the m.AccountsNotAnalyzed if it doesn't already exist
+						if !internal.Contains(s, m.AccountsNotAnalyzed) {
+							m.AccountsNotAnalyzed = append(m.AccountsNotAnalyzed, s)
+						}
+
+					}
+
+					paths = ""
+					// if we got here there's a path. Lets print the reason and the short reason for each edge in the path to the screen
+					// and then lets print the full path to the screen
+					for i := 0; i < len(path)-1; i++ {
+						thisEdge, _ := m.GlobalGraph.Edge(path[i], path[i+1])
+						j := 0
+						for _, value := range thisEdge.Properties.Attributes {
+							value = strings.ReplaceAll(value, ",", " and")
+							paths += fmt.Sprintf("[Hop: %d] [Option: %d] [%s] [%s] [%s]\n", i, j, thisEdge.Source, value, thisEdge.Target)
+							j++
+						}
+					}
+
+					//trim the last newline from csvPaths
+					paths = strings.TrimSuffix(paths, "\n")
+					if destinationVertexWithProperties.Attributes["IsAdminString"] == "Yes" {
+						privescPathsBody = append(privescPathsBody, []string{
+							aws.ToString(m.Caller.Account),
+							s,
+							magenta(d),
+							magenta(destinationVertexWithProperties.Attributes["IsAdminString"]),
+							paths})
+					} else {
+						privescPathsBody = append(privescPathsBody, []string{
+							aws.ToString(m.Caller.Account),
+							s,
+							d,
+							destinationVertexWithProperties.Attributes["IsAdminString"],
+							paths})
+					}
+				}
+			}
+		}
+	}
+	return privescPathsBody
+}
+
+func ConvertIAMRoleToNode(role types.Role, vendors *knownawsaccountslookup.Vendors, analyzedAccounts map[string]CapeJobInfo) Node {
+	//var isAdmin, canPrivEscToAdmin string
+
+	accountId := strings.Split(aws.ToString(role.Arn), ":")[4]
+	trustsdoc, err := policy.ParseRoleTrustPolicyDocument(role)
+	if err != nil {
+		internal.TxtLog.Error(err.Error())
+		return Node{}
+	}
+
+	var TrustedPrincipals []TrustedPrincipal
+	var TrustedServices []TrustedService
+	var TrustedFederatedProviders []TrustedFederatedProvider
+	//var TrustedFederatedSubjects string
+	var trustedProvider string
+	var trustedSubjects []string
+	var vendorName string
+	var isAnalyzedAccount bool
+
+	for _, statement := range trustsdoc.Statement {
+		for _, principal := range statement.Principal.AWS {
+			if strings.Contains(principal, ":root") {
+				//check to see if the trustedRootAccountID is known
+				trustedRootAccountID := strings.Split(principal, ":")[4]
+				vendorName = vendors.GetVendorNameFromAccountID(trustedRootAccountID)
+				// check to see if trustedRootAccountID is in the m.AnalyzedAccounts map
+				if _, ok := analyzedAccounts[trustedRootAccountID]; ok {
+					isAnalyzedAccount = analyzedAccounts[trustedRootAccountID].AnalyzedSuccessfully
+				} else {
+					isAnalyzedAccount = false
+				}
+
+			}
+
+			TrustedPrincipals = append(TrustedPrincipals, TrustedPrincipal{
+				TrustedPrincipal: principal,
+				ExternalID:       statement.Condition.StringEquals.StsExternalID,
+				VendorName:       vendorName,
+				//IsAdmin:           false,
+				//CanPrivEscToAdmin: false,
+				AccountIsInAnalyzedAccountList: isAnalyzedAccount,
+			})
+
+		}
+		for _, service := range statement.Principal.Service {
+			TrustedServices = append(TrustedServices, TrustedService{
+				TrustedService: service,
+				AccountID:      accountId,
+				//IsAdmin:           false,
+				//CanPrivEscToAdmin: false,
+			})
+
+		}
+		for _, federated := range statement.Principal.Federated {
+			// provider accountID
+			//accountId := strings.Split(federated, ":")[4]
+
+			trustedProvider, trustedSubjects = parseFederatedTrustPolicy(statement)
+			TrustedFederatedProviders = append(TrustedFederatedProviders, TrustedFederatedProvider{
+				TrustedFederatedProvider: federated,
+				ProviderShortName:        trustedProvider,
+				//ProviderAccountId:        accountId,
+				TrustedSubjects: trustedSubjects,
+				//IsAdmin:                  false,
+				//CanPrivEscToAdmin:        false,
+			})
+		}
+	}
+
+	node := Node{
+		Arn:                       aws.ToString(role.Arn),
+		Type:                      "Role",
+		AccountID:                 accountId,
+		Name:                      aws.ToString(role.RoleName),
+		TrustsDoc:                 trustsdoc,
+		TrustedPrincipals:         TrustedPrincipals,
+		TrustedServices:           TrustedServices,
+		TrustedFederatedProviders: TrustedFederatedProviders,
+	}
+
+	return node
+}
+
+func ConvertIAMUserToNode(user types.User) Node {
+	accountId := strings.Split(aws.ToString(user.Arn), ":")[4]
+	node := Node{
+		Arn:       aws.ToString(user.Arn),
+		Type:      "User",
+		AccountID: accountId,
+		Name:      aws.ToString(user.UserName),
+	}
+
+	return node
+}
+
+func FindVerticesInRoleTrust(a Node, vendors *knownawsaccountslookup.Vendors) []Node {
+
+	var newNodes []Node
+
+	// get thisAccount id from role arn
+	// var thisAccount string
+	// if len(a.Arn) >= 25 {
+	// 	thisAccount = a.Arn[13:25]
+	// } else {
+	// 	fmt.Sprintf("Could not get account number from this role arn%s", a.Arn)
+	// }
+
+	for _, TrustedPrincipal := range a.TrustedPrincipals {
+		//get account id from the trusted principal arn
+		var trustedPrincipalAccount string
+		if len(TrustedPrincipal.TrustedPrincipal) >= 25 {
+			trustedPrincipalAccount = TrustedPrincipal.TrustedPrincipal[13:25]
+		} else {
+			fmt.Sprintf("Could not get account number from this TrustedPrincipal%s", TrustedPrincipal.TrustedPrincipal)
+		}
+
+		// If the role trusts a principal in this account or another account using the :root notation, then we need to iterate over all of the rows in AllPermissionsRows to find the principals that have sts:AssumeRole permissions on this role
+		// if the role we are looking at trusts root in it's own account
+
+		// if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", thisAccount)) {
+
+		// 	newNodes = append(newNodes, Node{
+		// 		Arn:       a.Arn,
+		// 		Type:      "Account",
+		// 		AccountID: a.AccountID,
+		// 		Name:      a.Name,
+		// 	})
+
+		// } else
+
+		if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && TrustedPrincipal.VendorName != "" {
+			// First lets take care of vendor accounts
+			newNodes = append(newNodes, Node{
+				Arn: fmt.Sprintf("%s [%s]", TrustedPrincipal.VendorName, TrustedPrincipal.TrustedPrincipal),
+				//Arn:        TrustedPrincipal.VendorName,
+				Type:       "Account",
+				AccountID:  trustedPrincipalAccount,
+				Name:       TrustedPrincipal.VendorName,
+				VendorName: TrustedPrincipal.VendorName,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && !TrustedPrincipal.AccountIsInAnalyzedAccountList {
+			// Next lets take care of accounts that are not in the analyzed account list and add the full :root as the node
+
+			newNodes = append(newNodes, Node{
+				Arn:       fmt.Sprintf("%s [Not analyzed/in-scope]", TrustedPrincipal.TrustedPrincipal),
+				Type:      "Account",
+				AccountID: trustedPrincipalAccount,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && TrustedPrincipal.VendorName == "" {
+			// Now with those out of the way, lets take care of the accounts that are in the analyzed account list
+			newNodes = append(newNodes, Node{
+				Arn:       TrustedPrincipal.TrustedPrincipal,
+				Type:      "Account",
+				AccountID: trustedPrincipalAccount,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf(":user")) {
+			newNodes = append(newNodes, Node{
+				Arn:       TrustedPrincipal.TrustedPrincipal,
+				Type:      "User",
+				AccountID: trustedPrincipalAccount,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf(":role")) {
+			newNodes = append(newNodes, Node{
+				Arn:       TrustedPrincipal.TrustedPrincipal,
+				Type:      "Role",
+				AccountID: trustedPrincipalAccount,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf(":group")) {
+			newNodes = append(newNodes, Node{
+				Arn:       TrustedPrincipal.TrustedPrincipal,
+				Type:      "Group",
+				AccountID: trustedPrincipalAccount,
+			})
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf(":assumed-role")) {
+			newNodes = append(newNodes, Node{
+				Arn:       TrustedPrincipal.TrustedPrincipal,
+				Type:      "AssumedRole",
+				AccountID: trustedPrincipalAccount,
+			})
+		}
+	}
+	// pmapper takes care of this part so commenting out for now - but leaving as a placeholder
+	// for _, TrustedService := range a.TrustedServices {
+	// 	// make relationship from trusted service to this role of type can assume
+	// 	// make relationship from this role to trusted service of type can be assumed by
+	// }
+
+	for _, TrustedFederatedProvider := range a.TrustedFederatedProviders {
+		// make relationship from trusted federated provider to this role of type can assume
+
+		var providerAndSubject string
+		for _, trustedSubject := range TrustedFederatedProvider.TrustedSubjects {
+			if trustedSubject == "Not applicable" {
+				providerAndSubject = TrustedFederatedProvider.ProviderShortName
+			} else {
+				//providerAndSubject = TrustedFederatedProvider.ProviderShortName + ":" + trustedSubject
+				providerAndSubject = fmt.Sprintf("%s [%s]", TrustedFederatedProvider.ProviderShortName, trustedSubject)
+			}
+			//fmt.Println("TrustedFederatedProvider: ", TrustedFederatedProvider.TrustedFederatedProvider)
+			// if the TrustedFederatedProvider.TrustedFederatedProvider is an arn (check to see if it has at least 4 semicolons), grab the account id. Otherwise, use a.AccountID
+			var accountID string
+			if strings.Count(TrustedFederatedProvider.TrustedFederatedProvider, ":") >= 4 {
+				accountID = strings.Split(TrustedFederatedProvider.TrustedFederatedProvider, ":")[4]
+			} else {
+				accountID = a.AccountID
+			}
+
+			newNodes = append(newNodes, Node{
+				Arn:       providerAndSubject,
+				Name:      TrustedFederatedProvider.ProviderShortName,
+				Type:      "FederatedIdentity",
+				AccountID: accountID,
+			})
+		}
+
+	}
+
+	return newNodes
+}
+
+func MergeNodes(nodes []Node) []Node {
+	nodeMap := make(map[string]Node)
+
+	for _, node := range nodes {
+		existingNode, exists := nodeMap[node.Arn]
+		if exists {
+			// fmt.Println("Found a duplicate node: %s, merging", node.Arn)
+			// fmt.Println("Existing node: %v", existingNode)
+			// fmt.Println("New node: %v", node)
+
+			mergedNode := mergeNodeData(existingNode, node)
+			nodeMap[node.Arn] = mergedNode
+			//fmt.Println("Merged node: %v", mergedNode)
+		} else {
+			nodeMap[node.Arn] = node
+		}
+	}
+
+	var mergedNodes []Node
+	for _, node := range nodeMap {
+		mergedNodes = append(mergedNodes, node)
+	}
+
+	return mergedNodes
+}
+
+func mergeNodeData(existingNode Node, newNode Node) Node {
+	if existingNode.Arn == "" {
+		existingNode.Arn = newNode.Arn
+	} else {
+		existingNode.Arn = existingNode.Arn
+	}
+	if existingNode.Name == "" {
+		existingNode.Name = newNode.Name
+	} else {
+		existingNode.Name = existingNode.Name
+	}
+	if existingNode.Type == "" {
+		existingNode.Type = newNode.Type
+	} else {
+		existingNode.Type = existingNode.Type
+	}
+	if existingNode.AccountID == "" {
+		existingNode.AccountID = newNode.AccountID
+	} else {
+		existingNode.AccountID = existingNode.AccountID
+	}
+	if existingNode.CanPrivEscToAdminString == "" {
+		existingNode.CanPrivEscToAdminString = newNode.CanPrivEscToAdminString
+	} else {
+		existingNode.CanPrivEscToAdminString = existingNode.CanPrivEscToAdminString
+	}
+	if existingNode.IsAdminString == "" {
+		existingNode.IsAdminString = newNode.IsAdminString
+	} else {
+		existingNode.IsAdminString = existingNode.IsAdminString
+	}
+	if existingNode.VendorName == "" {
+		existingNode.VendorName = newNode.VendorName
+	} else {
+		existingNode.VendorName = existingNode.VendorName
+	}
+	if existingNode.AccessKeys == 0 {
+		existingNode.AccessKeys = newNode.AccessKeys
+	} else {
+		existingNode.AccessKeys = existingNode.AccessKeys
+	}
+	if existingNode.ActivePassword == false {
+		existingNode.ActivePassword = newNode.ActivePassword
+	} else {
+		existingNode.ActivePassword = existingNode.ActivePassword
+	}
+	if existingNode.HasMfa == false {
+		existingNode.HasMfa = newNode.HasMfa
+	} else {
+		existingNode.HasMfa = existingNode.HasMfa
+	}
+	if existingNode.PathToAdmin == false {
+		existingNode.PathToAdmin = newNode.PathToAdmin
+	} else {
+		existingNode.PathToAdmin = existingNode.PathToAdmin
+	}
+	if existingNode.AttachedPolicies == nil {
+		existingNode.AttachedPolicies = newNode.AttachedPolicies
+	} else {
+		existingNode.AttachedPolicies = existingNode.AttachedPolicies
+	}
+	if existingNode.TrustedFederatedProviders == nil {
+		existingNode.TrustedFederatedProviders = newNode.TrustedFederatedProviders
+	} else {
+		existingNode.TrustedFederatedProviders = existingNode.TrustedFederatedProviders
+	}
+	if existingNode.TrustedPrincipals == nil {
+		existingNode.TrustedPrincipals = newNode.TrustedPrincipals
+	} else {
+		existingNode.TrustedPrincipals = existingNode.TrustedPrincipals
+	}
+	if existingNode.TrustedServices == nil {
+		existingNode.TrustedServices = newNode.TrustedServices
+	} else {
+		existingNode.TrustedServices = existingNode.TrustedServices
+	}
+	// if existingNode.TrustsDoc.Statement == nil {
+	// 	existingNode.TrustsDoc = newNode.TrustsDoc
+	// } else {
+	// }
+	return existingNode
+}
+
+func (a *Node) MakeRoleEdges(GlobalGraph graph.Graph[string, string]) {
+
+	// get thisAccount id from role arn
+	var thisAccount string
+	if len(a.Arn) >= 25 {
+		thisAccount = a.Arn[13:25]
+	} else {
+		fmt.Sprintf("Could not get account number from this role arn%s", a.Arn)
+	}
+
+	for _, TrustedPrincipal := range a.TrustedPrincipals {
+		//get account id from the trusted principal arn
+		var trustedPrincipalAccount string
+		if len(TrustedPrincipal.TrustedPrincipal) >= 25 {
+			trustedPrincipalAccount = TrustedPrincipal.TrustedPrincipal[13:25]
+		} else {
+			fmt.Sprintf("Could not get account number from this TrustedPrincipal%s", TrustedPrincipal.TrustedPrincipal)
+		}
+		var PermissionsRowAccount string
+
+		// if the role trusts a principal in this same account explicitly, then the principal can assume the role
+		if thisAccount == trustedPrincipalAccount {
+			// make a CAN_ASSUME relationship between the trusted principal and this role
+
+			err := GlobalGraph.AddEdge(
+				TrustedPrincipal.TrustedPrincipal,
+				a.Arn,
+				//graph.EdgeAttribute("AssumeRole", "Same account explicit trust"),
+				graph.EdgeAttribute("AssumeRole", "can assume (because of an explicit same account trust) "),
+			)
+			if err != nil {
+				//fmt.Println(err)
+				//fmt.Println(TrustedPrincipal.TrustedPrincipal + a.Arn + "Same account explicit trust")
+				if err == graph.ErrEdgeAlreadyExists {
+					// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+					//fmt.Println("Edge already exists")
+
+					// get the existing edge
+					existingEdge, _ := GlobalGraph.Edge(TrustedPrincipal.TrustedPrincipal, a.Arn)
+					// get the map of attributes
+					existingProperties := existingEdge.Properties
+					// add the new attributes to attributes map within the properties struct
+					// Check if the Attributes map is initialized, if not, initialize it
+					if existingProperties.Attributes == nil {
+						existingProperties.Attributes = make(map[string]string)
+					}
+
+					// Add or update the attribute
+					existingProperties.Attributes["AssumeRole"] = "can assume (because of an explicit same account trust) "
+					err = GlobalGraph.UpdateEdge(
+						TrustedPrincipal.TrustedPrincipal,
+						a.Arn,
+						graph.EdgeAttributes(existingProperties.Attributes),
+					)
+					if err != nil {
+						fmt.Println(err)
+					}
+				}
+
+			}
+		}
+
+		// If the role trusts a principal in this account or another account using the :root notation, then we need to iterate over all of the rows in AllPermissionsRows to find the principals that have sts:AssumeRole permissions on this role
+		// if the role we are looking at trusts root in it's own account
+
+		if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", thisAccount)) {
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this account
+
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+
+				if PermissionsRowAccount == thisAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if policy.MatchesAfterExpansion(PermissionsRow.Action, "sts:AssumeRole") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.Arn) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+								//evaluate if the principal is a user or a role and set a variable accordingly
+								//var principalType schema.NodeLabel
+								if strings.EqualFold(PermissionsRow.Type, "User") || strings.EqualFold(PermissionsRow.Type, "Role") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Arn,
+										//graph.EdgeAttribute("AssumeRole", "Same account root trust and trusted principal has permission to assume role"),
+										graph.EdgeAttribute("AssumeRole", "can assume (because of a same account root trust and trusted principal has permission to assume role) "),
+									)
+									if err != nil {
+										// fmt.Println(err)
+										// fmt.Println(PermissionsRow.Arn + a.Arn + "Same account root trust and trusted principal has permission to assume role")
+										if err == graph.ErrEdgeAlreadyExists {
+											// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+											// get the existing edge
+											existingEdge, _ := GlobalGraph.Edge(PermissionsRow.Arn, a.Arn)
+											// get the map of attributes
+											existingProperties := existingEdge.Properties
+											// add the new attributes to attributes map within the properties struct
+											// Check if the Attributes map is initialized, if not, initialize it
+											if existingProperties.Attributes == nil {
+												existingProperties.Attributes = make(map[string]string)
+											}
+
+											// Add or update the attribute
+											existingProperties.Attributes["AssumeRole"] = "can assume (because of a same account root trust and trusted principal has permission to assume role) "
+											err = GlobalGraph.UpdateEdge(
+												PermissionsRow.Arn,
+												a.Arn,
+												graph.EdgeAttributes(existingProperties.Attributes),
+											)
+											if err != nil {
+												fmt.Println(err)
+											}
+										}
+
+									}
+								}
+							}
+						}
+						if strings.EqualFold(PermissionsRow.Effect, "Deny") {
+							// if the action is deny, we need to remove any edges between PermissionsRow.Arn and a.Arn
+							// if the edge exists, remove it
+							err := GlobalGraph.RemoveEdge(PermissionsRow.Arn, a.Arn)
+							if err != nil {
+								fmt.Println(err)
+							}
+
+						}
+					}
+				}
+			}
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && TrustedPrincipal.VendorName != "" {
+
+			// If the role trusts :root in another account and the trusted principal is a vendor, we will make a relationship between our role and a vendor node instead of a principal node
+
+			err := GlobalGraph.AddEdge(
+				//TrustedPrincipal.TrustedPrincipal,
+				//TrustedPrincipal.VendorName,
+				fmt.Sprintf("%s [%s]", TrustedPrincipal.VendorName, TrustedPrincipal.TrustedPrincipal),
+				a.Arn,
+				//graph.EdgeAttribute("VendorAssumeRole", "Cross account root trust and trusted principal is a vendor"),
+				graph.EdgeAttribute("VendorAssumeRole", "can assume (because of a cross account root trust and trusted principal is a vendor) "),
+			)
+			if err != nil {
+				// fmt.Println(err)
+				// fmt.Println(TrustedPrincipal.VendorName + a.Arn + "Cross account root trust and trusted principal is a vendor")
+				if err == graph.ErrEdgeAlreadyExists {
+					// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+					// get the existing edge
+					existingEdge, _ := GlobalGraph.Edge(TrustedPrincipal.VendorName, a.Arn)
+					// get the map of attributes
+					existingProperties := existingEdge.Properties
+					// add the new attributes to attributes map within the properties struct
+					// Check if the Attributes map is initialized, if not, initialize it
+					if existingProperties.Attributes == nil {
+						existingProperties.Attributes = make(map[string]string)
+					}
+
+					// Add or update the attribute
+					existingProperties.Attributes["VendorAssumeRole"] = "can assume (because of a cross account root trust and trusted principal is a vendor) "
+					err := GlobalGraph.UpdateEdge(
+						//fmt.Sprintf("%s-%s", a.Arn, TrustedPrincipal.VendorName),
+						TrustedPrincipal.TrustedPrincipal,
+						a.Arn,
+						graph.EdgeAttributes(existingProperties.Attributes),
+					)
+					if err != nil {
+						fmt.Println(err)
+					}
+				}
+
+			}
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", trustedPrincipalAccount)) && !TrustedPrincipal.AccountIsInAnalyzedAccountList {
+			// first lets check to see if the trustedRootAccountID is in the map of analzyeddAccounts
+			// if it is not, we can't iterate over the permissions, so we will just have to create an edge :root princpal and this role
+
+			err := GlobalGraph.AddEdge(
+				//TrustedPrincipal.TrustedPrincipal,
+				fmt.Sprintf("%s [Not analyzed/in-scope]", TrustedPrincipal.TrustedPrincipal),
+				a.Arn,
+				//graph.EdgeAttribute("CrossAccountRootTrust", "Cross account root trust and trusted principal is not in the analyzed account list"),
+				graph.EdgeAttribute("CrossAccountRootTrust", "can assume (because of a cross account root trust and trusted principal is not in the analyzed account list) "),
+			)
+			if err != nil {
+				// fmt.Println(err)
+				// fmt.Println(TrustedPrincipal.TrustedPrincipal + a.Arn + "Cross account root trust and trusted principal is not in the analyzed account list")
+				if err == graph.ErrEdgeAlreadyExists {
+					// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+					// get the existing edge
+					existingEdge, _ := GlobalGraph.Edge(TrustedPrincipal.TrustedPrincipal, a.Arn)
+					// get the map of attributes
+					existingProperties := existingEdge.Properties
+					// add the new attributes to attributes map within the properties struct
+					// Check if the Attributes map is initialized, if not, initialize it
+					if existingProperties.Attributes == nil {
+						existingProperties.Attributes = make(map[string]string)
+					}
+
+					// Add or update the attribute
+					existingProperties.Attributes["CrossAccountRootTrust"] = "can assume (because of a cross account root trust and trusted principal is not in the analyzed account list) "
+					err := GlobalGraph.UpdateEdge(
+						TrustedPrincipal.TrustedPrincipal,
+						a.Arn,
+						graph.EdgeAttributes(existingProperties.Attributes),
+					)
+					if err != nil {
+						fmt.Println(err)
+					}
+				}
+
+			}
+
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", trustedPrincipalAccount)) {
+
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this other account
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+				if PermissionsRowAccount == trustedPrincipalAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if policy.MatchesAfterExpansion(PermissionsRow.Action, "sts:AssumeRole") {
+						// if strings.EqualFold(PermissionsRow.Action, "sts:AssumeRole") ||
+						// 	strings.EqualFold(PermissionsRow.Action, "*") ||
+						// 	strings.EqualFold(PermissionsRow.Action, "sts:Assume*") ||
+						// 	strings.EqualFold(PermissionsRow.Action, "sts:*") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.Arn) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+
+								if strings.EqualFold(PermissionsRow.Type, "User") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Arn,
+										//graph.EdgeAttribute("CrossAccountAssumeRole", "Cross account root trust and trusted principal has permission to assume role"),
+										graph.EdgeAttribute("CrossAccountAssumeRole", "can assume (because of a cross account root trust and trusted principal has permission to assume role) "),
+									)
+									if err != nil {
+										//fmt.Println(err)
+										//fmt.Println(PermissionsRow.Arn + a.Arn + "Cross account root trust and trusted principal has permission to assume role")
+										if err == graph.ErrEdgeAlreadyExists {
+											// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+											// get the existing edge
+											existingEdge, _ := GlobalGraph.Edge(PermissionsRow.Arn, a.Arn)
+											// get the map of attributes
+											existingProperties := existingEdge.Properties
+											// add the new attributes to attributes map within the properties struct
+											// Check if the Attributes map is initialized, if not, initialize it
+											if existingProperties.Attributes == nil {
+												existingProperties.Attributes = make(map[string]string)
+											}
+
+											// Add or update the attribute
+											existingProperties.Attributes["CrossAccountAssumeRole"] = "can assume (because of a cross account root trust and trusted principal has permission to assume role) "
+											err = GlobalGraph.UpdateEdge(
+												PermissionsRow.Arn,
+												a.Arn,
+												graph.EdgeAttributes(existingProperties.Attributes),
+											)
+											if err != nil {
+												fmt.Println(err)
+											}
+										}
+									}
+
+								} else if strings.EqualFold(PermissionsRow.Type, "Role") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Arn,
+										//graph.EdgeAttribute("CrossAccountAssumeRole", "Cross account root trust and trusted principal has permission to assume role"),
+										graph.EdgeAttribute("CrossAccountAssumeRole", "can assume (because of a cross account root trust and trusted principal has permission to assume role) "),
+									)
+									if err != nil {
+										//fmt.Println(err)
+										//fmt.Println(PermissionsRow.Arn + a.Arn + "Cross account root trust and trusted principal has permission to assume role")
+										if err == graph.ErrEdgeAlreadyExists {
+											// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+											// get the existing edge
+											existingEdge, _ := GlobalGraph.Edge(PermissionsRow.Arn, a.Arn)
+											// get the map of attributes
+											existingProperties := existingEdge.Properties
+											// add the new attributes to attributes map within the properties struct
+											// Check if the Attributes map is initialized, if not, initialize it
+											if existingProperties.Attributes == nil {
+												existingProperties.Attributes = make(map[string]string)
+											}
+
+											// Add or update the attribute
+											existingProperties.Attributes["CrossAccountAssumeRole"] = "can assume (because of a cross account root trust and trusted principal has permission to assume role) "
+											err = GlobalGraph.UpdateEdge(
+												PermissionsRow.Arn,
+												a.Arn,
+												graph.EdgeAttributes(existingProperties.Attributes),
+											)
+											if err != nil {
+												fmt.Println(err)
+											}
+										}
+									}
+								}
+							}
+						}
+						if strings.EqualFold(PermissionsRow.Effect, "Deny") {
+							// if the action is deny, we need to remove any edges between PermissionsRow.Arn and a.Arn
+							// if the edge exists, remove it
+							err := GlobalGraph.RemoveEdge(PermissionsRow.Arn, a.Arn)
+							if err != nil {
+								fmt.Println(err)
+							}
+						}
+					}
+
+				}
+			}
+
+		}
+	}
+	// pmapper takes care of this part so commenting out for now - but leaving as a placeholder
+
+	// for _, TrustedService := range a.TrustedServices {
+	// 	// make relationship from trusted service to this role of type can assume
+	// 	// make relationship from this role to trusted service of type can be assumed by
+	// }
+
+	for _, TrustedFederatedProvider := range a.TrustedFederatedProviders {
+		// make relationship from trusted federated provider to this role of type can assume
+
+		var providerAndSubject string
+		for _, trustedSubject := range TrustedFederatedProvider.TrustedSubjects {
+			if trustedSubject == "Not applicable" {
+				providerAndSubject = TrustedFederatedProvider.ProviderShortName
+			} else {
+				//providerAndSubject = TrustedFederatedProvider.ProviderShortName + ":" + trustedSubject
+				providerAndSubject = fmt.Sprintf("%s [%s]", TrustedFederatedProvider.ProviderShortName, trustedSubject)
+			}
+
+			err := GlobalGraph.AddEdge(
+				providerAndSubject,
+				a.Arn,
+				//graph.EdgeAttribute("FederatedAssumeRole", "Trusted federated provider"),
+				graph.EdgeAttribute("FederatedAssumeRole", "can assume (because of a trusted federated provider) "),
+			)
+			if err != nil {
+				//fmt.Println(err)
+				//fmt.Println(TrustedFederatedProvider.TrustedFederatedProvider + a.Arn + "Trusted federated provider")
+				if err == graph.ErrEdgeAlreadyExists {
+					// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+
+					// get the existing edge
+					existingEdge, _ := GlobalGraph.Edge(TrustedFederatedProvider.TrustedFederatedProvider, a.Arn)
+					// get the map of attributes
+					existingProperties := existingEdge.Properties
+					// add the new attributes to attributes map within the properties struct
+					// Check if the Attributes map is initialized, if not, initialize it
+					if existingProperties.Attributes == nil {
+						existingProperties.Attributes = make(map[string]string)
+					}
+
+					// Add or update the attribute
+					existingProperties.Attributes["FederatedAssumeRole"] = "can assume (because of a trusted federated provider) "
+					err = GlobalGraph.UpdateEdge(
+						providerAndSubject,
+						a.Arn,
+						graph.EdgeAttributes(existingProperties.Attributes),
+					)
+					if err != nil {
+						fmt.Println(err)
+					}
+				}
+			}
+
+		}
+	}
+
+}

aws/client-initializers.go

@@ -3,38 +3,42 @@ package aws
 import (
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/codebuild"
 	"github.com/aws/aws-sdk-go-v2/service/ecr"
 	"github.com/aws/aws-sdk-go-v2/service/efs"
 	"github.com/aws/aws-sdk-go-v2/service/fsx"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
 	"github.com/aws/aws-sdk-go-v2/service/organizations"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
 	"github.com/aws/aws-sdk-go-v2/service/sns"
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-func initIAMSimClient(iamSimPPClient sdk.AWSIAMClientInterface, caller sts.GetCallerIdentityOutput, AWSProfile string, Goroutines int) IamSimulatorModule {
+func InitIamCommandClient(iamSimPPClient sdk.AWSIAMClientInterface, caller sts.GetCallerIdentityOutput, AWSProfile string, Goroutines int) IamSimulatorModule {
 
 	iamSimMod := IamSimulatorModule{
-		IAMClient:  iamSimPPClient,
-		Caller:     caller,
-		AWSProfile: AWSProfile,
-		Goroutines: Goroutines,
+		IAMClient:          iamSimPPClient,
+		Caller:             caller,
+		AWSProfileProvided: AWSProfile,
+		Goroutines:         Goroutines,
 	}
 
 	return iamSimMod
 
 }
 
-func InitCloudFoxSNSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSWrapTable bool) SNSModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitCloudFoxSNSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSWrapTable bool, AWSMFAToken string) SNSModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	cloudFoxSNSClient := SNSModule{
 		SNSClient:  sns.NewFromConfig(AWSConfig),
 		Caller:     caller,
 		AWSProfile: AWSProfile,
-		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 		Goroutines: Goroutines,
 		WrapTable:  AWSWrapTable,
 	}
@@ -42,25 +46,25 @@ func InitCloudFoxSNSClient(caller sts.GetCallerIdentityOutput, AWSProfile string
 
 }
 
-func initCloudFoxS3Client(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string) BucketsModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func initCloudFoxS3Client(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, AWSMFAToken string) BucketsModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	cloudFoxS3Client := BucketsModule{
 		S3Client:   s3.NewFromConfig(AWSConfig),
 		Caller:     caller,
 		AWSProfile: AWSProfile,
-		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return cloudFoxS3Client
 
 }
 
-func InitSQSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) SQSModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitSQSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) SQSModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	sqsClient := SQSModule{
 		SQSClient: sqs.NewFromConfig(AWSConfig),
 
 		Caller:     caller,
-		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 		AWSProfile: AWSProfile,
 		Goroutines: Goroutines,
 	}
@@ -69,58 +73,87 @@ func InitSQSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVers
 
 }
 
-func InitLambdaClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) LambdasModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitLambdaClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) LambdasModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	lambdaClient := LambdasModule{
 		LambdaClient: lambda.NewFromConfig(AWSConfig),
 		Caller:       caller,
 		AWSProfile:   AWSProfile,
-		AWSRegions:   internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions:   internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return lambdaClient
 }
 
-func InitCodeBuildClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) CodeBuildModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitCodeBuildClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) CodeBuildModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	codeBuildClient := CodeBuildModule{
 		CodeBuildClient: codebuild.NewFromConfig(AWSConfig),
 		Caller:          caller,
 		AWSProfile:      AWSProfile,
-		AWSRegions:      internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions:      internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return codeBuildClient
 }
 
-func InitECRClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) ECRModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitECRClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) ECRModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	ecrClient := ECRModule{
 		ECRClient:  ecr.NewFromConfig(AWSConfig),
 		Caller:     caller,
 		AWSProfile: AWSProfile,
-		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return ecrClient
 }
 
-func InitFileSystemsClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) FilesystemsModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitFileSystemsClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) FilesystemsModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	fileSystemsClient := FilesystemsModule{
 		EFSClient:  efs.NewFromConfig(AWSConfig),
 		FSxClient:  fsx.NewFromConfig(AWSConfig),
 		Caller:     caller,
 		AWSProfile: AWSProfile,
-		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return fileSystemsClient
 }
 
-func InitOrgClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) OrgModule {
-	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+func InitOrgsClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) OrgModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
 	orgClient := OrgModule{
 		OrganizationsClient: organizations.NewFromConfig(AWSConfig),
 		Caller:              caller,
 		AWSProfile:          AWSProfile,
-		AWSRegions:          internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSRegions:          internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
 	}
 	return orgClient
 }
+
+func InitPermissionsClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) IamPermissionsModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
+	permissionsClient := IamPermissionsModule{
+		IAMClient:  iam.NewFromConfig(AWSConfig),
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion, AWSMFAToken),
+	}
+	return permissionsClient
+}
+
+func InitSecretsManagerClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) *secretsmanager.Client {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
+	return secretsmanager.NewFromConfig(AWSConfig)
+}
+
+func InitGlueClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSMFAToken string) *glue.Client {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion, AWSMFAToken)
+	return glue.NewFromConfig(AWSConfig)
+}
+
+func InitOrgClient(AWSConfig aws.Config) *organizations.Client {
+	return organizations.NewFromConfig(AWSConfig)
+}
+
+func InitIAMClient(AWSConfig aws.Config) *iam.Client {
+	return iam.NewFromConfig(AWSConfig)
+}

aws/cloudformation.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -20,12 +21,13 @@ type CloudformationModule struct {
 	// General configuration data
 	CloudFormationClient sdk.CloudFormationClientInterface
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	Goroutines    int
+	AWSProfile    string
+	WrapTable     bool
+	AWSOutputType string
+	AWSTableCols  string
 
 	// Main module data
 	CFStacks       []CFStack
@@ -45,8 +47,8 @@ type CFStack struct {
 	Template   string
 }
 
-func (m *CloudformationModule) PrintCloudformationStacks(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *CloudformationModule) PrintCloudformationStacks(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "cloudformation"
@@ -93,48 +95,45 @@ func (m *CloudformationModule) PrintCloudformationStacks(outputFormat string, ou
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Region",
 		"Name",
 		"Role",
-		// "Parameters",
-		// "Outputs",
+		"Parameters",
+		"Outputs",
 	}
 
 	// Table rows
 	for i := range m.CFStacks {
-		// var isParameters string
-		// var isOutputs string
-		// if m.CFStacks[i].Parameters != nil {
-		// 	isParameters = "Y"
-		// } else {
-		// 	isParameters = "N"
-		// }
-		// if m.CFStacks[i].Outputs != nil {
-		// 	isOutputs = "Y"
-		// } else {
-		// 	isOutputs = "N"
-		// }
+		var hasParameters string
+		var hasOutputs string
+		if m.CFStacks[i].Parameters != nil {
+			hasParameters = "Y"
+		} else {
+			hasParameters = "N"
+		}
+		if m.CFStacks[i].Outputs != nil {
+			hasOutputs = "Y"
+		} else {
+			hasOutputs = "N"
+		}
 
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				m.CFStacks[i].AWSService,
 				m.CFStacks[i].Region,
 				m.CFStacks[i].Name,
 				m.CFStacks[i].Role,
-				// isParameters,
-				// isOutputs,
+				hasParameters,
+				hasOutputs,
 			},
 		)
 
 	}
 	if len(m.output.Body) > 0 {
-		//	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -142,10 +141,43 @@ func (m *CloudformationModule) PrintCloudformationStacks(outputFormat string, ou
 				Wrap: m.WrapTable,
 			},
 		}
+
+		// If the user specified table columns, use those.
+		// If the user specified -o wide, use the wide default cols for this module.
+		// Otherwise, use the hardcoded default cols for this module.
+		var tableCols []string
+		// If the user specified table columns, use those.
+		if m.AWSTableCols != "" {
+			// remove any spaces between any commas and the first letter after the commas
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+			tableCols = strings.Split(m.AWSTableCols, ",")
+			// If the user specified wide as the output format, use these columns.
+		} else if m.AWSOutputType == "wide" {
+			tableCols = []string{
+				"Account",
+				"Service",
+				"Region",
+				"Name",
+				"Role",
+				"Parameters",
+				"Outputs",
+			}
+			// Otherwise, use the default columns.
+		} else {
+			tableCols = []string{
+				"Service",
+				"Region",
+				"Name",
+				"Role",
+			}
+		}
+
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/cloudformation_test.go

@@ -1,81 +1,15 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
 	"log"
 	"testing"
-	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
-	"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-const DESCRIBE_STACKS_TEST_FILE = "./test-data/cloudformation-describestacks.json"
-const TEMPLATE_BODY_TEST_FILE = "./test-data/cloudformation-getTemplate.json"
-
-type Stacks struct {
-	Stacks []struct {
-		StackID           string            `json:"StackId"`
-		Description       string            `json:"Description"`
-		Tags              []interface{}     `json:"Tags"`
-		Outputs           []types.Output    `json:"Outputs"`
-		Parameters        []types.Parameter `json:"Parameters"`
-		StackStatusReason interface{}       `json:"StackStatusReason"`
-		CreationTime      time.Time         `json:"CreationTime"`
-		Capabilities      []interface{}     `json:"Capabilities"`
-		StackName         string            `json:"StackName"`
-		RoleArn           string            `json:"RoleArn"`
-		StackStatus       string            `json:"StackStatus"`
-		DisableRollback   bool              `json:"DisableRollback"`
-	} `json:"Stacks"`
-}
-
-type TemplateBody struct {
-	TemplateBody string `json:"TemplateBody"`
-}
-
-type MockedCloudformationClient struct {
-	describeStacks  Stacks
-	getTemplateBody TemplateBody
-}
-
-func (m *MockedCloudformationClient) DescribeStacks(ctx context.Context, params *cloudformation.DescribeStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.DescribeStacksOutput, error) {
-
-	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.describeStacks)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_STACKS_TEST_FILE)
-	}
-	var stacks []types.Stack
-	for _, stack := range m.describeStacks.Stacks {
-		stacks = append(stacks, types.Stack{
-			StackName:  &stack.StackName,
-			RoleARN:    &stack.RoleArn,
-			Outputs:    stack.Outputs,
-			Parameters: stack.Parameters,
-		})
-
-	}
-
-	return &cloudformation.DescribeStacksOutput{Stacks: stacks}, nil
-}
-
-func (m *MockedCloudformationClient) GetTemplate(ctx context.Context, params *cloudformation.GetTemplateInput, optFns ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error) {
-	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.getTemplateBody)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", TEMPLATE_BODY_TEST_FILE)
-	}
-
-	return &cloudformation.GetTemplateOutput{TemplateBody: &m.getTemplateBody.TemplateBody}, nil
-}
-
-func (m *MockedCloudformationClient) ListStacks(ctx context.Context, params *cloudformation.ListStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.ListStacksOutput, error) {
-	return &cloudformation.ListStacksOutput{}, nil
-}
-
 func TestCloudFormation(t *testing.T) {
 	subtests := []struct {
 		name            string
@@ -89,9 +23,8 @@ func TestCloudFormation(t *testing.T) {
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule: CloudformationModule{
-				CloudFormationClient: &MockedCloudformationClient{},
+				CloudFormationClient: &sdk.MockedCloudformationClient{},
 				Caller:               sts.GetCallerIdentityOutput{Arn: aws.String("test")},
-				OutputFormat:         "table",
 				AWSProfile:           "test",
 				Goroutines:           30,
 				AWSRegions:           AWSRegions,
@@ -105,7 +38,7 @@ func TestCloudFormation(t *testing.T) {
 	internal.MockFileSystem(true)
 	for _, subtest := range subtests {
 		t.Run(subtest.name, func(t *testing.T) {
-			subtest.testModule.PrintCloudformationStacks(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
+			subtest.testModule.PrintCloudformationStacks(subtest.outputDirectory, subtest.verbosity)
 			for index, expectedStack := range subtest.expectedResult {
 				if expectedStack.Name != subtest.testModule.CFStacks[index].Name {
 					log.Fatal("Stack name does not match expected name")

aws/codebuild.go

@@ -3,6 +3,7 @@ package aws
 import (
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -18,9 +19,12 @@ type CodeBuildModule struct {
 	CodeBuildClient sdk.CodeBuildClientInterface
 	IAMClient       sdk.AWSIAMClientInterface
 
-	Caller         sts.GetCallerIdentityOutput
-	AWSRegions     []string
-	OutputFormat   string
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	AWSOutputType       string
+	AWSTableCols        string
+	PmapperDataBasePath string
+
 	Goroutines     int
 	AWSProfile     string
 	SkipAdminCheck bool
@@ -46,8 +50,8 @@ type Project struct {
 	CanPrivEsc string
 }
 
-func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *CodeBuildModule) PrintCodeBuildProjects(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "codebuild"
@@ -61,8 +65,8 @@ func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDire
 	}
 
 	fmt.Printf("[%s][%s] Enumerating CodeBuild projects for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	wg := new(sync.WaitGroup)
 	semaphore := make(chan struct{}, m.Goroutines)
@@ -107,50 +111,66 @@ func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDire
 	}
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
-	if m.pmapperError == nil {
-		m.output.Headers = []string{
+	m.output.Headers = []string{
+		"Account",
+		"Region",
+		"Name",
+		"Role",
+		"IsAdminRole?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
 			"Region",
 			"Name",
 			"Role",
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
 		}
+		// Otherwise, use the default columns.
 	} else {
-		m.output.Headers = []string{
+		tableCols = []string{
 			"Region",
 			"Name",
 			"Role",
 			"IsAdminRole?",
-			//"CanPrivEscToAdmin?",
+			"CanPrivEscToAdmin?",
 		}
 	}
 
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
+
 	// Table rows
 
 	for i := range m.Projects {
-		if m.pmapperError == nil {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Projects[i].Region,
-					m.Projects[i].Name,
-					m.Projects[i].Role,
-					m.Projects[i].Admin,
-					m.Projects[i].CanPrivEsc,
-				},
-			)
-		} else {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Projects[i].Region,
-					m.Projects[i].Name,
-					m.Projects[i].Role,
-					m.Projects[i].Admin,
-				},
-			)
-
-		}
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				aws.ToString(m.Caller.Account),
+				m.Projects[i].Region,
+				m.Projects[i].Name,
+				m.Projects[i].Role,
+				m.Projects[i].Admin,
+				m.Projects[i].CanPrivEsc,
+			},
+		)
 	}
 
 	var seen []string
@@ -162,11 +182,6 @@ func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDire
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
-		//fmt.Printf("[%s][%s] %d projects with a total of %d node groups found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), len(seen), len(m.output.Body))
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -175,9 +190,10 @@ func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDire
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/codebuild_test.go

@@ -124,9 +124,9 @@ func TestCodeBuildProjects(t *testing.T) {
 	tmpDir := "."
 
 	// execute the module with verbosity set to 2
-	m.PrintCodeBuildProjects("table", tmpDir, 2)
+	m.PrintCodeBuildProjects(tmpDir, 2)
 
-	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/123456789012-unittesting/table/codebuild.txt")
+	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/codebuild.txt")
 	resultsFile, err := afero.ReadFile(fs, resultsFilePath)
 	if err != nil {
 		t.Fatalf("Cannot read output file at %s: %s", resultsFilePath, err)

aws/databases.go

@@ -3,10 +3,10 @@ package aws
 import (
 	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -19,16 +19,17 @@ import (
 
 type DatabasesModule struct {
 	RDSClient      sdk.RDSClientInterface
-	RedshiftClient sdk.RedShiftClientInterface
+	RedshiftClient sdk.AWSRedShiftClientInterface
 	DynamoDBClient sdk.DynamoDBClientInterface
-	DocDBClient    sdk.DocDBClientInterface
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	Databases      []Database
 	CommandCounter internal.CommandCounter
@@ -50,10 +51,11 @@ type Database struct {
 	Protocol   string
 	Public     string
 	Size       string
+	Roles      string
 }
 
-func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "databases"
@@ -65,13 +67,13 @@ func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory st
 	}
 
 	fmt.Printf("[%s][%s] Enumerating databases for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
-	fmt.Printf("[%s][%s] Supported Services: RDS, DynamoDB\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	fmt.Printf("[%s][%s] Supported Services: RDS, Redshift, DynamoDB, DocumentDB, Neptune\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 
 	wg := new(sync.WaitGroup)
 	semaphore := make(chan struct{}, m.Goroutines)
 	// Create a channel to signal the spinner aka task status goroutine to finish
 	spinnerDone := make(chan bool)
-	//fire up the the task status spinner/updated
+	//fire up the task status spinner/updated
 	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
 
 	//create a channel to receive the objects
@@ -101,6 +103,7 @@ func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory st
 	})
 
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Engine",
 		"Region",
@@ -108,17 +111,57 @@ func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory st
 		"Size",
 		"UserName",
 		"Endpoint",
-		//"Port",
+		"Port",
+		"Roles",
 		//"Protocol",
 		//"Public",
 
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Service",
+			"Engine",
+			"Region",
+			"Name",
+			"Size",
+			"UserName",
+			"Endpoint",
+			"Port",
+			"Roles",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Service",
+			"Engine",
+			"Region",
+			"Name",
+			"Size",
+			"UserName",
+			"Endpoint",
+			"Port",
+		}
+	}
+
 	// Table rows
 	for i := range m.Databases {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				m.Databases[i].AWSService,
 				m.Databases[i].Engine,
 				m.Databases[i].Region,
@@ -126,7 +169,8 @@ func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory st
 				m.Databases[i].Size,
 				m.Databases[i].UserName,
 				m.Databases[i].Endpoint,
-				// strconv.Itoa(int(m.Databases[i].Port)),
+				strconv.Itoa(int(m.Databases[i].Port)),
+				m.Databases[i].Roles,
 				// m.Databases[i].Protocol,
 				// m.Databases[i].Public,
 			},
@@ -134,27 +178,35 @@ func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory st
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
+		filepath := filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
 			Table: internal.TableClient{
-				Wrap: m.WrapTable,
+				Wrap:          m.WrapTable,
+				DirectoryName: filepath,
+			},
+			Loot: internal.LootClient{
+				DirectoryName: filepath,
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
-		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		o.WriteFullOutput(o.Table.TableFiles, nil)
-		m.writeLoot(o.Table.DirectoryName, verbosity)
+		loot := m.writeLoot(filepath, verbosity)
+		//o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
+		o.Loot.LootFiles = append(o.Loot.LootFiles, internal.LootFile{
+			Name:     "databases-UrlsOnly.txt",
+			Contents: loot,
+		})
+		o.WriteFullOutput(o.Table.TableFiles, o.Loot.LootFiles)
+
 		fmt.Printf("[%s][%s] %s databases found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No databases found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -179,56 +231,83 @@ func (m *DatabasesModule) Receiver(receiver chan Database, receiverDone chan boo
 func (m *DatabasesModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
 	defer wg.Done()
 
-	servicemap := &awsservicemap.AwsServiceMap{
+	serviceMap := &awsservicemap.AwsServiceMap{
 		JsonFileSource: "DOWNLOAD_FROM_AWS",
 	}
-	res, err := servicemap.IsServiceInRegion("rds", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		go m.getRdsClustersPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("redshift", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getRedshiftDatabasesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("dynamodb", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getDynamoDBTablesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("docdb", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getDocDBTablesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-
+	m.executeRdsCheck(r, wg, semaphore, dataReceiver, serviceMap) // Also returns Neptune and DocDB
+	m.executeRedshiftCheck(r, wg, semaphore, dataReceiver, serviceMap)
+	m.executeDynamoDbCheck(r, wg, semaphore, dataReceiver, serviceMap)
 }
 
-func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
-	path := filepath.Join(outputDirectory, "loot")
-	err := os.MkdirAll(path, os.ModePerm)
+type check struct {
+	region       string
+	wg           *sync.WaitGroup
+	semaphore    chan struct{}
+	dataReceiver chan Database
+	serviceMap   *awsservicemap.AwsServiceMap
+	service      string
+	executor     func(string, *sync.WaitGroup, chan struct{}, chan Database)
+}
+
+func (m *DatabasesModule) executeCheck(check check) {
+	res, err := check.serviceMap.IsServiceInRegion(check.service, check.region)
 	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		panic(err.Error())
+		m.modLog.Error(err)
 	}
+	if res {
+		m.CommandCounter.Total++
+		check.wg.Add(1)
+		go check.executor(check.region, check.wg, check.semaphore, check.dataReceiver)
+	}
+}
+
+func (m *DatabasesModule) executeRdsCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "rds",
+		executor:     m.getRdsClustersPerRegion,
+	})
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "rds",
+		executor:     m.getRdsInstancesPerRegion,
+	})
+}
+
+func (m *DatabasesModule) executeRedshiftCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "redshift",
+		executor:     m.getRedshiftDatabasesPerRegion,
+	})
+}
+
+func (m *DatabasesModule) executeDynamoDbCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "dynamodb",
+		executor:     m.getDynamoDBTablesPerRegion,
+	})
+}
+
+func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) string {
+	path := filepath.Join(outputDirectory, "loot")
 	f := filepath.Join(path, "databases-UrlsOnly.txt")
 
 	var out string
@@ -237,12 +316,12 @@ func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
 		out = out + fmt.Sprintln(database.Endpoint)
 	}
 
-	err = os.WriteFile(f, []byte(out), 0644)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		panic(err.Error())
-	}
+	// err = os.WriteFile(f, []byte(out), 0644)
+	// if err != nil {
+	// 	m.modLog.Error(err.Error())
+	// 	m.CommandCounter.Error++
+	// 	panic(err.Error())
+	// }
 
 	if verbosity > 2 {
 		fmt.Println()
@@ -253,6 +332,8 @@ func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
 
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), f)
 
+	return out
+
 }
 
 func (m *DatabasesModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
@@ -269,45 +350,127 @@ func (m *DatabasesModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup,
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
 
-	DBInstances, err := sdk.CachedRDSDescribeDBInstances(m.RDSClient, aws.ToString(m.Caller.Account), r)
+	DBClusters, err := sdk.CachedRDSDescribeDBClusters(m.RDSClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
-		if errors.As(err, &oe) {
-			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-		}
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
 		return
 	}
 
-	var public string
-	for _, instance := range DBInstances {
-		if instance.Endpoint != nil {
-			name := aws.ToString(instance.DBInstanceIdentifier)
-			port := instance.Endpoint.Port
-			endpoint := aws.ToString(instance.Endpoint.Address)
-			engine := aws.ToString(instance.Engine)
-
-			if instance.PubliclyAccessible {
-				public = "True"
-			} else {
-				public = "False"
-			}
-
-			dataReceiver <- Database{
-				AWSService: "RDS",
-				Region:     r,
-				Name:       name,
-				Engine:     engine,
-				Endpoint:   endpoint,
-				UserName:   aws.ToString(instance.MasterUsername),
-				Port:       port,
-				Protocol:   aws.ToString(instance.Engine),
-				Public:     public,
-			}
+	for _, cluster := range DBClusters {
+		var public string
+		var service string
+		var roles string
+		if cluster.Endpoint == nil {
+			continue
 		}
 
+		name := aws.ToString(cluster.DBClusterIdentifier)
+		port := cluster.Port
+		endpoint := aws.ToString(cluster.Endpoint)
+		engine := aws.ToString(cluster.Engine)
+
+		if aws.ToBool(cluster.PubliclyAccessible) {
+			public = "True"
+		} else {
+			public = "False"
+		}
+
+		if isNeptune(cluster.Engine) {
+			service = "Neptune"
+		} else if isDocDB(cluster.Engine) {
+			service = "DocsDB"
+		} else {
+			service = "RDS"
+		}
+
+		associatedRoles := cluster.AssociatedRoles
+		for _, role := range associatedRoles {
+			roles = roles + aws.ToString(role.RoleArn) + " "
+		}
+
+		dataReceiver <- Database{
+			AWSService: service,
+			Region:     r,
+			Name:       name,
+			Engine:     engine,
+			Endpoint:   endpoint,
+			UserName:   aws.ToString(cluster.MasterUsername),
+			Port:       aws.ToInt32(port),
+			Protocol:   aws.ToString(cluster.Engine),
+			Public:     public,
+			Roles:      roles,
+		}
+	}
+}
+
+func (m *DatabasesModule) getRdsInstancesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+
+	DBInstances, err := sdk.CachedRDSDescribeDBInstances(m.RDSClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
 
+	for _, instance := range DBInstances {
+		var public string
+		var service string
+		var roles string
+		if instance.Endpoint == nil {
+			continue
+		}
+
+		name := aws.ToString(instance.DBInstanceIdentifier)
+		port := instance.Endpoint.Port
+		endpoint := aws.ToString(instance.Endpoint.Address)
+		engine := aws.ToString(instance.Engine)
+
+		if aws.ToBool(instance.PubliclyAccessible) {
+			public = "True"
+		} else {
+			public = "False"
+		}
+
+		if isNeptune(instance.Engine) {
+			service = "Neptune"
+		} else if isDocDB(instance.Engine) {
+			service = "DocsDB"
+		} else {
+			service = "RDS"
+		}
+
+		associatedRoles := instance.AssociatedRoles
+		for _, role := range associatedRoles {
+			roles = roles + aws.ToString(role.RoleArn) + " "
+		}
+
+		dataReceiver <- Database{
+			AWSService: service,
+			Region:     r,
+			Name:       name,
+			Engine:     engine,
+			Endpoint:   endpoint,
+			UserName:   aws.ToString(instance.MasterUsername),
+			Port:       aws.ToInt32(port),
+			Protocol:   aws.ToString(instance.Engine),
+			Public:     public,
+			Roles:      roles,
+		}
+	}
 }
 
 func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
@@ -331,7 +494,7 @@ func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitG
 
 	if err != nil {
 		if errors.As(err, &oe) {
-			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+			m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation()))
 		}
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
@@ -343,13 +506,13 @@ func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitG
 		name := aws.ToString(cluster.DBName)
 		//id := workspace.Id
 		endpoint := aws.ToString(cluster.Endpoint.Address)
+		port := aws.ToInt32(cluster.Endpoint.Port)
 
-		if cluster.PubliclyAccessible {
+		if aws.ToBool(cluster.PubliclyAccessible) {
 			public = "True"
 		} else {
 			public = "False"
 		}
-		port := cluster.Endpoint.Port
 		dataReceiver <- Database{
 			AWSService: awsService,
 			Region:     r,
@@ -404,48 +567,12 @@ func (m *DatabasesModule) getDynamoDBTablesPerRegion(r string, wg *sync.WaitGrou
 			Endpoint:   "N/A",
 		}
 	}
-
 }
 
-func (m *DatabasesModule) getDocDBTablesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
-	defer func() {
-		m.CommandCounter.Executing--
-		m.CommandCounter.Complete++
-		wg.Done()
+func isNeptune(engine *string) bool {
+	return *engine == "neptune"
+}
 
-	}()
-	semaphore <- struct{}{}
-	defer func() {
-		<-semaphore
-	}()
-	// m.CommandCounter.Total++
-	m.CommandCounter.Pending--
-	m.CommandCounter.Executing++
-	awsService := "DocDB"
-
-	Clusters, err := sdk.CachedDocDBDescribeDBClusters(m.DocDBClient, aws.ToString(m.Caller.Account), r)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		return
-	}
-
-	for _, cluster := range Clusters {
-		name := aws.ToString(cluster.DBClusterIdentifier)
-
-		endpoint := aws.ToString(cluster.Endpoint)
-		port := aws.ToInt32(cluster.Port)
-		//size := aws.ToInt64(TableOutput.Table.TableSizeBytes)
-		userName := aws.ToString(cluster.MasterUsername)
-
-		dataReceiver <- Database{
-			AWSService: awsService,
-			Region:     r,
-			Name:       name,
-			Endpoint:   endpoint,
-			Port:       port,
-			UserName:   userName,
-			//Size:       strconv.Itoa(int(size)),
-		}
-	}
+func isDocDB(engine *string) bool {
+	return *engine == "docdb"
 }

aws/databases_test.go

@@ -0,0 +1,58 @@
+package aws
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go/ptr"
+	"github.com/spf13/afero"
+)
+
+func TestDatabasesCommand(t *testing.T) {
+
+	m := DatabasesModule{
+		AWSProfile: "unittesting",
+		AWSRegions: []string{"us-east-1"},
+		Caller: sts.GetCallerIdentityOutput{
+			Arn:     aws.String("arn:aws:iam::123456789012:user/Alice"),
+			Account: aws.String("123456789012"),
+		},
+		Goroutines:     3,
+		WrapTable:      false,
+		RDSClient:      &sdk.MockedRDSClient{},
+		DynamoDBClient: &sdk.MockedAWSDynamoDBClient{},
+		RedshiftClient: &sdk.MockedRedshiftClient{},
+	}
+
+	fs := internal.MockFileSystem(true)
+	defer internal.MockFileSystem(false)
+	tmpDir := ptr.ToString(internal.GetLogDirPath())
+
+	m.PrintDatabases(tmpDir, 2)
+	//resultsFile, err := afero.ReadFile(fs, "table/databases.txt")
+	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/databases.txt")
+	resultsFile, err := afero.ReadFile(fs, resultsFilePath)
+	if err != nil {
+		t.Fatalf("Cannot read output file at %s: %s", resultsFile, err)
+	}
+
+	expectedResults := []string{
+		"db1.cluster-123456789012.us-west-2.rds.amazonaws.com", // make sure it includes the Aurora clusters
+		"db2.cluster-123456789012.us-west-2.rds.amazonaws.com", // make sure it includes the Aurora clusters
+		"db3.cluster-123456789012.us-west-2.neptune.amazonaws.com", // make sure it includes the Neptune instances
+		"db4.cluster-123456789012.us-west-2.docdb.amazonaws.com", // make sure it includes the DocumentDB instances
+		"db1-instances-1.blah.us-west-2.rds.amazonaws.com", // make sure it includes the RDS instances
+	}
+
+	for _, expected := range expectedResults {
+		if !strings.Contains(string(resultsFile), expected) {
+			t.Errorf("Expected %s to be in the results file", expected)
+		}
+	}
+
+}

aws/directory-services.go

@@ -0,0 +1,276 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	dsTypes "github.com/aws/aws-sdk-go-v2/service/directoryservice/types"
+	"github.com/bishopfox/awsservicemap"
+	"github.com/sirupsen/logrus"
+)
+
+type DirectoryModule struct {
+	// General configuration data
+	DSClient           sdk.AWSDSClientInterface
+	Caller             sts.GetCallerIdentityOutput
+	AWSRegions         []string
+	AWSProfile         string
+	Goroutines         int
+	WrapTable          bool
+	AWSOutputType      string
+	AWSTableCols       string
+	AWSMFAToken        string
+	AWSConfig          aws.Config
+	AWSProfileProvided string
+	AWSProfileStub     string
+	CloudFoxVersion    string
+	
+	Directories        []Directory
+	CommandCounter     internal.CommandCounter
+	output             internal.OutputData2
+	modLog             *logrus.Entry
+}
+
+type Directory struct {
+	DirectoryId      string
+	DNS              string
+	NetBios          string
+	AccessURL        string
+	Alias            string
+	OsVersion        string
+	Region           string
+	TrustInfo        string
+}
+
+func (m *DirectoryModule) PrintDirectories(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "directory-services"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+
+	if m.AWSProfileProvided == "" {
+		m.AWSProfileStub = internal.BuildAWSPath(m.Caller)
+	} else {
+		m.AWSProfileStub = m.AWSProfileProvided
+	}
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileProvided, aws.ToString(m.Caller.Account)))
+
+	fmt.Printf("[%s][%s] Enumerating Cloud Directories with resource policies for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), aws.ToString(m.Caller.Account))
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan Directory)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+	go m.Receiver(dataReceiver, receiverDone)
+
+	for _, region := range m.AWSRegions {
+		wg.Add(1)
+		m.CommandCounter.Pending++
+		go m.executeChecks(region, wg, semaphore, dataReceiver)
+
+	}
+
+	wg.Wait()
+	// Send a message to the spinner goroutine to close the channel and stop
+	spinnerDone <- true
+	<-spinnerDone
+	// Send a message to the data receiver goroutine to close the channel and stop
+	receiverDone <- true
+	<-receiverDone
+
+	// add - if struct is not empty do this. otherwise, dont write anything.
+	m.output.Headers = []string{
+		"Account",
+		"Name",
+		"Alias",
+		"Domain",
+		"NetBIOS name",
+		"Access URL",
+		"Version",
+		"Trusts",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Name",
+			"Alias",
+			"Domain",
+			"NetBIOS name",
+			"Access URL",
+			"Version",
+			"Trusts",
+		}
+	} else {
+		tableCols = []string{
+			"Account",
+			"Name",
+			"Domain",
+			"NetBIOS name",
+			"Access URL",
+			"Version",
+			"Trusts",
+		}
+	}
+
+
+	// Table rows
+	for i := range m.Directories {
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				aws.ToString(m.Caller.Account),
+				m.Directories[i].DirectoryId,
+				m.Directories[i].Alias,
+				m.Directories[i].DNS,
+				m.Directories[i].NetBios,
+				m.Directories[i].AccessURL,
+				m.Directories[i].OsVersion,
+				m.Directories[i].TrustInfo,
+			},
+		)
+
+	}
+	if len(m.output.Body) > 0 {
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfileStub
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileStub, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
+		fmt.Printf("[%s][%s] %s directories found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), strconv.Itoa(len(m.output.Body)))
+		//fmt.Printf("[%s][%s] Resource policies stored to: %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.getLootDir())
+	} else {
+		fmt.Printf("[%s][%s] No directories found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub))
+	}
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), m.output.CallingModule)
+
+}
+
+func (m *DirectoryModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Directory) {
+	defer wg.Done()
+
+	servicemap := &awsservicemap.AwsServiceMap{
+		JsonFileSource: "DOWNLOAD_FROM_AWS",
+	}
+	res, err := servicemap.IsServiceInRegion("clouddirectory", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getDirectoriesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+}
+
+func (m *DirectoryModule) Receiver(receiver chan Directory, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Directories = append(m.Directories, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+func (m *DirectoryModule) getDirectoriesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Directory) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+
+	// Get directories
+	directories, err := sdk.CachedDSDescribeDirectories(m.DSClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	for _, directory := range directories {
+		trusts, err := sdk.CachedDSDescribeTrusts(m.DSClient, aws.ToString(m.Caller.Account), r, *directory.DirectoryId)
+		if err != nil {
+			m.modLog.Error(err)
+		}
+		dataReceiver <- Directory{
+			DirectoryId: *directory.DirectoryId,
+			DNS:         *directory.Name,
+			NetBios:     *directory.ShortName,
+			Region:      r,
+			AccessURL:   *directory.AccessUrl,
+			Alias:       *directory.Alias,
+			OsVersion:   fmt.Sprintf("%s", directory.OsVersion),
+			TrustInfo:   m.formatTrusts(trusts),
+		}
+	}
+}
+
+func (m *DirectoryModule) formatTrusts(t []dsTypes.Trust) string {
+	var output string = ""
+	for idx, trust := range t {
+		if idx != 0 {
+			output = output + "\n"
+		}
+		if trust.TrustDirection == "One-Way: Outgoing" {
+			output = output + "→"
+		} else if trust.TrustDirection == "One-Way: Ingoing" {
+			output = output + "←"
+		} else {
+			output = output + "↔"
+		}
+		output = fmt.Sprintf("%s %s", output, *trust.RemoteDomainName)
+		// check trust type (external or forest)
+		if trust.TrustType == "External" {
+			output = fmt.Sprintf("%s (%s)", output, "Domain")
+		} else {
+			output = fmt.Sprintf("%s (%s)", output, "Forest")
+		}
+	}
+	return output
+}

aws/ecr.go

@@ -21,13 +21,15 @@ import (
 
 type ECRModule struct {
 	// General configuration data
-	ECRClient    sdk.AWSECRClientInterface
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	ECRClient     sdk.AWSECRClientInterface
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	Repositories   []Repository
@@ -49,8 +51,8 @@ type Repository struct {
 	PolicyJSON string
 }
 
-func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *ECRModule) PrintECR(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "ecr"
@@ -95,8 +97,9 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
 	receiverDone <- true
 	<-receiverDone
 
-	// add - if struct is not empty do this. otherwise, dont write anything.
+	// This is the complete list of potential table columns
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Region",
 		"Name",
@@ -106,11 +109,53 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
 		"ImageSize",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Service",
+			"Region",
+			"Name",
+			"URI",
+			"PushedAt",
+			"ImageTags",
+			"ImageSize",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Service",
+			"Region",
+			"Name",
+			"URI",
+			"PushedAt",
+			"ImageTags",
+			"ImageSize",
+		}
+	}
+
+	// sort the table by Name
+	sort.Slice(m.Repositories, func(i, j int) bool {
+		return m.Repositories[i].Name < m.Repositories[j].Name
+	})
+
 	// Table rows
 	for i := range m.Repositories {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				m.Repositories[i].AWSService,
 				m.Repositories[i].Region,
 				m.Repositories[i].Name,
@@ -124,10 +169,7 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -136,9 +178,10 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -239,92 +282,89 @@ func (m *ECRModule) getECRRecordsPerRegion(r string, wg *sync.WaitGroup, semapho
 		<-semaphore
 	}()
 
-	var allImages []types.ImageDetail
-	var repoURI string
-	var repoName string
-
-	DescribeRepositories, err := m.describeRepositories(r)
+	Repositories, err := sdk.CachedECRDescribeRepositories(m.ECRClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
 		return
 	}
 
-	for _, repo := range DescribeRepositories {
-		repoName = aws.ToString(repo.RepositoryName)
-		repoURI = aws.ToString(repo.RepositoryUri)
+	for _, repo := range Repositories {
+		repoName := aws.ToString(repo.RepositoryName)
+		repoURI := aws.ToString(repo.RepositoryUri)
 		//created := *repo.CreatedAt
 		//fmt.Printf("%s, %s, %s", repoName, repoURI, created)
-
-		images, err := m.describeImages(r, repoName)
+		images, err := sdk.CachedECRDescribeImages(m.ECRClient, aws.ToString(m.Caller.Account), r, repoName)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
-			return
+			continue
 		}
-		allImages = append(allImages, images...)
-	}
 
-	sort.Slice(allImages, func(i, j int) bool {
-		return allImages[i].ImagePushedAt.Format("2006-01-02 15:04:05") < allImages[j].ImagePushedAt.Format("2006-01-02 15:04:05")
-	})
+		sort.Slice(images, func(i, j int) bool {
+			return images[i].ImagePushedAt.Format("2006-01-02 15:04:05") < images[j].ImagePushedAt.Format("2006-01-02 15:04:05")
+		})
 
-	var image types.ImageDetail
-	var imageTags string
+		var image types.ImageDetail
+		var imageTags string
 
-	if len(allImages) > 1 {
-		image = allImages[len(allImages)-1]
-	} else if len(allImages) == 1 {
-		image = allImages[0]
-	} else {
-		return
-	}
+		if len(images) > 1 {
+			image = images[len(images)-1]
+		} else if len(images) == 1 {
+			image = images[0]
+		} else {
+			continue
+		}
 
-	if len(image.ImageTags) > 0 {
-		imageTags = image.ImageTags[0]
-	}
-	//imageTags := image.ImageTags[0]
-	pushedAt := image.ImagePushedAt.Format("2006-01-02 15:04:05")
-	imageSize := aws.ToInt64(image.ImageSizeInBytes)
-	pullURI := fmt.Sprintf("%s:%s", repoURI, imageTags)
+		if len(image.ImageTags) > 0 {
+			imageTags = image.ImageTags[0]
+		} else {
+			imageTags = "No tags"
+		}
 
-	dataReceiver <- Repository{
-		AWSService: "ECR",
-		Name:       repoName,
-		Region:     r,
-		URI:        pullURI,
-		PushedAt:   pushedAt,
-		ImageTags:  imageTags,
-		ImageSize:  imageSize,
+		//imageTags := image.ImageTags[0]
+		pushedAt := image.ImagePushedAt.Format("2006-01-02 15:04:05")
+		imageSize := aws.ToInt64(image.ImageSizeInBytes)
+		pullURI := fmt.Sprintf("%s:%s", repoURI, imageTags)
+
+		dataReceiver <- Repository{
+			AWSService: "ECR",
+			Name:       repoName,
+			Region:     r,
+			URI:        pullURI,
+			PushedAt:   pushedAt,
+			ImageTags:  imageTags,
+			ImageSize:  imageSize,
+		}
 	}
 
 }
 
-func (m *ECRModule) describeRepositories(r string) ([]types.Repository, error) {
+// func (m *ECRModule) describeRepositories(r string) ([]types.Repository, error) {
 
-	var repositories []types.Repository
-	Repositories, err := sdk.CachedECRDescribeRepositories(m.ECRClient, aws.ToString(m.Caller.Account), r)
-	if err != nil {
-		m.CommandCounter.Error++
-		return nil, err
-	}
+// 	var repositories []types.Repository
+// 	Repositories, err := sdk.CachedECRDescribeRepositories(m.ECRClient, aws.ToString(m.Caller.Account), r)
+// 	if err != nil {
+// 		m.CommandCounter.Error++
+// 		return nil, err
+// 	}
 
-	repositories = append(repositories, Repositories...)
+// 	repositories = append(repositories, Repositories...)
 
-	return repositories, nil
-}
+// 	return repositories, nil
+// }
 
-func (m *ECRModule) describeImages(r string, repoName string) ([]types.ImageDetail, error) {
-	var images []types.ImageDetail
+// func (m *ECRModule) describeImages(r string, repoName string) ([]types.ImageDetail, error) {
+// 	var images []types.ImageDetail
 
-	ImageDetails, err := sdk.CachedECRDescribeImages(m.ECRClient, aws.ToString(m.Caller.Account), r, repoName)
-	if err != nil {
-		m.CommandCounter.Error++
-		return nil, err
-	}
-	images = append(images, ImageDetails...)
-	return images, nil
-}
+// 	ImageDetails, err := sdk.CachedECRDescribeImages(m.ECRClient, aws.ToString(m.Caller.Account), r, repoName)
+// 	if err != nil {
+// 		m.CommandCounter.Error++
+// 		return nil, err
+// 	}
+// 	images = append(images, ImageDetails...)
+// 	return images, nil
+// }
 
 func (m *ECRModule) getECRRepositoryPolicy(r string, repository string) (policy.Policy, error) {
 	var repoPolicy policy.Policy

aws/ecr_test.go

@@ -1,52 +1,15 @@
 package aws
 
 import (
-	"context"
 	"log"
 	"testing"
-	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ecr"
-	"github.com/aws/aws-sdk-go-v2/service/ecr/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-var AWSRegions = []string{"us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-1", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ca-central-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-north-1", "me-south-1", "sa-east-1"}
-
-type MockedECRClient struct {
-}
-
-func (m *MockedECRClient) DescribeRepositories(ctx context.Context, params *ecr.DescribeRepositoriesInput, optFns ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error) {
-	return &ecr.DescribeRepositoriesOutput{
-		Repositories: []types.Repository{
-			{
-				RepositoryName: aws.String("test1"),
-				RepositoryUri:  aws.String("testURI"),
-			},
-		},
-	}, nil
-}
-
-func (m *MockedECRClient) DescribeImages(context.Context, *ecr.DescribeImagesInput, ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error) {
-	return &ecr.DescribeImagesOutput{
-		ImageDetails: []types.ImageDetail{
-			{
-				ImagePushedAt:    aws.Time(time.Now()),
-				ImageSizeInBytes: aws.Int64(123456),
-				ImageTags:        []string{"latest"},
-			},
-		},
-	}, nil
-}
-
-func (m *MockedECRClient) GetRepositoryPolicy(context.Context, *ecr.GetRepositoryPolicyInput, ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error) {
-	return &ecr.GetRepositoryPolicyOutput{
-		PolicyText: aws.String("policyText"),
-	}, nil
-}
-
 func TestDescribeRepos(t *testing.T) {
 
 	subtests := []struct {
@@ -61,29 +24,37 @@ func TestDescribeRepos(t *testing.T) {
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule: ECRModule{
-				ECRClient: &MockedECRClient{},
+				ECRClient: &sdk.MockedECRClient{},
 				Caller: sts.GetCallerIdentityOutput{
 					Arn:     aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests"),
 					Account: aws.String("123456789012"),
 				},
-				OutputFormat: "table",
-				AWSProfile:   "test",
-				Goroutines:   30,
-				AWSRegions:   AWSRegions,
+				AWSProfile: "test",
+				Goroutines: 30,
+				AWSRegions: []string{"us-east-1"},
 			},
-			expectedResult: []Repository{{
-				Name:      "test1",
-				URI:       "testURI:latest",
-				PushedAt:  "2022-10-25 15:14:06",
-				ImageTags: "latest",
-				ImageSize: 123456,
-			}},
+			expectedResult: []Repository{
+				{
+					Name:      "repo1",
+					URI:       "11111111111111.dkr.ecr.us-east-1.amazonaws.com/repo1",
+					PushedAt:  "2022-10-25 15:14:00",
+					ImageTags: "customtag, tag2",
+					ImageSize: 123456,
+				},
+				{
+					Name:      "repo2",
+					URI:       "11111111111111.dkr.ecr.us-east-1.amazonaws.com/repo2",
+					PushedAt:  "2021-10-15 11:14:00",
+					ImageTags: "latest",
+					ImageSize: 2222222,
+				}},
 		},
 	}
+
 	internal.MockFileSystem(true)
 	for _, subtest := range subtests {
 		t.Run(subtest.name, func(t *testing.T) {
-			subtest.testModule.PrintECR(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
+			subtest.testModule.PrintECR(subtest.outputDirectory, subtest.verbosity)
 			for index, expectedRepo := range subtest.expectedResult {
 				if expectedRepo.Name != subtest.testModule.Repositories[index].Name {
 					log.Fatal("Repo name does not match expected name")

aws/ecs-tasks.go

@@ -13,7 +13,6 @@ import (
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ecs"
 	"github.com/aws/aws-sdk-go-v2/service/ecs/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
@@ -21,20 +20,17 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-type DescribeTasksDefinitionAPIClient interface {
-	DescribeTaskDefinition(context.Context, *ecs.DescribeTaskDefinitionInput, ...func(*ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error)
-}
 type ECSTasksModule struct {
-	DescribeTaskDefinitionClient    DescribeTasksDefinitionAPIClient
-	DescribeTasksClient             ecs.DescribeTasksAPIClient
-	ListTasksClient                 ecs.ListTasksAPIClient
-	ListClustersClient              ecs.ListClustersAPIClient
-	DescribeNetworkInterfacesClient ec2.DescribeNetworkInterfacesAPIClient
-	IAMClient                       sdk.AWSIAMClientInterface
+	ECSClient sdk.AWSECSClientInterface
+	EC2Client sdk.AWSEC2ClientInterface
+	IAMClient sdk.AWSIAMClientInterface
+
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	AWSOutputType       string
+	AWSTableCols        string
+	PmapperDataBasePath string
 
-	Caller         sts.GetCallerIdentityOutput
-	AWSRegions     []string
-	OutputFormat   string
 	AWSProfile     string
 	Goroutines     int
 	SkipAdminCheck bool
@@ -63,7 +59,7 @@ type MappedECSTask struct {
 	CanPrivEsc            string
 }
 
-func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, verbosity int) {
+func (m *ECSTasksModule) ECSTasks(outputDirectory string, verbosity int) {
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "ecs-tasks"
@@ -78,8 +74,8 @@ func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, v
 	fmt.Printf("[%s][%s] Enumerating ECS tasks in all regions for account %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -126,7 +122,7 @@ func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, v
 	receiverDone <- true
 	<-receiverDone
 
-	m.printECSTaskData(outputFormat, outputDirectory, dataReceiver, verbosity)
+	m.printECSTaskData(outputDirectory, dataReceiver, verbosity)
 
 }
 
@@ -143,9 +139,36 @@ func (m *ECSTasksModule) Receiver(receiver chan MappedECSTask, receiverDone chan
 	}
 }
 
-func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory string, dataReceiver chan MappedECSTask, verbosity int) {
-	if m.pmapperError == nil {
-		m.output.Headers = []string{
+func (m *ECSTasksModule) printECSTaskData(outputDirectory string, dataReceiver chan MappedECSTask, verbosity int) {
+	// This is the complete list of potential table columns
+	m.output.Headers = []string{
+		"Account",
+		"Cluster",
+		"TaskDefinition",
+		"LaunchType",
+		"ID",
+		"External IP",
+		"Internal IP",
+		"RoleArn",
+		"IsAdminRole?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
 			"Cluster",
 			"TaskDefinition",
 			"LaunchType",
@@ -156,61 +179,46 @@ func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory s
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
 		}
+		// Otherwise, use the default columns.
 	} else {
-		m.output.Headers = []string{
+		tableCols = []string{
 			"Cluster",
 			"TaskDefinition",
 			"LaunchType",
-			"ID",
 			"External IP",
 			"Internal IP",
 			"RoleArn",
 			"IsAdminRole?",
-			//"CanPrivEscToAdmin?",
+			"CanPrivEscToAdmin?",
 		}
 	}
 
-	if m.pmapperError == nil {
-		for _, ecsTask := range m.MappedECSTasks {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					ecsTask.Cluster,
-					ecsTask.TaskDefinitionName,
-					ecsTask.LaunchType,
-					ecsTask.ID,
-					ecsTask.ExternalIP,
-					ecsTask.PrivateIP,
-					ecsTask.Role,
-					ecsTask.Admin,
-					ecsTask.CanPrivEsc,
-				},
-			)
-		}
-	} else {
-		for _, ecsTask := range m.MappedECSTasks {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					ecsTask.Cluster,
-					ecsTask.TaskDefinitionName,
-					ecsTask.LaunchType,
-					ecsTask.ID,
-					ecsTask.ExternalIP,
-					ecsTask.PrivateIP,
-					ecsTask.Role,
-					ecsTask.Admin,
-					//ecsTask.CanPrivEsc,
-				},
-			)
-		}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
+
+	for _, ecsTask := range m.MappedECSTasks {
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				aws.ToString(m.Caller.Account),
+				ecsTask.Cluster,
+				ecsTask.TaskDefinitionName,
+				ecsTask.LaunchType,
+				ecsTask.ID,
+				ecsTask.ExternalIP,
+				ecsTask.PrivateIP,
+				ecsTask.Role,
+				ecsTask.Admin,
+				ecsTask.CanPrivEsc,
+			},
+		)
 	}
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -219,9 +227,10 @@ func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory s
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -313,75 +322,37 @@ func (m *ECSTasksModule) executeChecks(r string, wg *sync.WaitGroup, dataReceive
 
 func (m *ECSTasksModule) getListClusters(region string, dataReceiver chan MappedECSTask) {
 
-	var PaginationControl *string
-	for {
-		ListClusters, err := m.ListClustersClient.ListClusters(
-			context.TODO(),
-			&(ecs.ListClustersInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *ecs.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		for _, clusterARN := range ListClusters.ClusterArns {
-			m.getListTasks(clusterARN, region, dataReceiver)
-		}
-
-		if ListClusters.NextToken != nil {
-			PaginationControl = ListClusters.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
+	ClusterArns, err := sdk.CachedECSListClusters(m.ECSClient, aws.ToString(m.Caller.Account), region)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	for _, clusterARN := range ClusterArns {
+		m.getListTasks(clusterARN, region, dataReceiver)
+	}
+
 }
 
 func (m *ECSTasksModule) getListTasks(clusterARN string, region string, dataReceiver chan MappedECSTask) {
-	var PaginationControl *string
-	for {
-
-		ListTasks, err := m.ListTasksClient.ListTasks(
-			context.TODO(),
-			&(ecs.ListTasksInput{
-				Cluster:   aws.String(clusterARN),
-				NextToken: PaginationControl,
-			}),
-			func(o *ecs.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		batchSize := 100 // maximum value: https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html#API_DescribeTasks_RequestSyntax
-		for i := 0; i < len(ListTasks.TaskArns); i += batchSize {
-			j := i + batchSize
-			if j > len(ListTasks.TaskArns) {
-				j = len(ListTasks.TaskArns)
-			}
-
-			m.loadTasksData(clusterARN, ListTasks.TaskArns[i:j], region, dataReceiver)
-		}
-
-		if ListTasks.NextToken != nil {
-			PaginationControl = ListTasks.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
+	TaskArns, err := sdk.CachedECSListTasks(m.ECSClient, aws.ToString(m.Caller.Account), region, clusterARN)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	batchSize := 100 // maximum value: https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html#API_DescribeTasks_RequestSyntax
+	for i := 0; i < len(TaskArns); i += batchSize {
+		j := i + batchSize
+		if j > len(TaskArns) {
+			j = len(TaskArns)
+		}
+
+		m.loadTasksData(clusterARN, TaskArns[i:j], region, dataReceiver)
+	}
+
 }
 
 func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, region string, dataReceiver chan MappedECSTask) {
@@ -390,16 +361,7 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 		return
 	}
 
-	DescribeTasks, err := m.DescribeTasksClient.DescribeTasks(
-		context.TODO(),
-		&(ecs.DescribeTasksInput{
-			Cluster: aws.String(clusterARN),
-			Tasks:   taskARNs,
-		}),
-		func(o *ecs.Options) {
-			o.Region = region
-		},
-	)
+	Tasks, err := sdk.CachedECSDescribeTasks(m.ECSClient, aws.ToString(m.Caller.Account), region, clusterARN, taskARNs)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
@@ -407,7 +369,7 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 	}
 
 	eniIDs := []string{}
-	for _, task := range DescribeTasks.Tasks {
+	for _, task := range Tasks {
 		eniID := getElasticNetworkInterfaceIDOfECSTask(task)
 		if eniID != "" {
 			eniIDs = append(eniIDs, eniID)
@@ -420,8 +382,9 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 		return
 	}
 
-	for _, task := range DescribeTasks.Tasks {
-		taskDefinition, err := m.describeTaskDefinition(aws.ToString(task.TaskDefinitionArn), region)
+	for _, task := range Tasks {
+		//taskDefinition, err := m.describeTaskDefinition(aws.ToString(task.TaskDefinitionArn), region)
+		taskDefinition, err := sdk.CachedECSDescribeTaskDefinition(m.ECSClient, aws.ToString(m.Caller.Account), region, aws.ToString(task.TaskDefinitionArn))
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
@@ -461,7 +424,7 @@ func getTaskDefinitionContent(taskDefinition types.TaskDefinition) string {
 }
 
 func (m *ECSTasksModule) describeTaskDefinition(taskDefinitionArn string, region string) (types.TaskDefinition, error) {
-	DescribeTaskDefinition, err := m.DescribeTaskDefinitionClient.DescribeTaskDefinition(
+	DescribeTaskDefinition, err := m.ECSClient.DescribeTaskDefinition(
 		context.TODO(),
 		&ecs.DescribeTaskDefinitionInput{
 			TaskDefinition: &taskDefinitionArn,
@@ -511,20 +474,13 @@ func (m *ECSTasksModule) loadPublicIPs(eniIDs []string, region string) (map[stri
 	if len(eniIDs) == 0 {
 		return eniPublicIPs, nil
 	}
-	DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
-		context.TODO(),
-		&(ec2.DescribeNetworkInterfacesInput{
-			NetworkInterfaceIds: eniIDs,
-		}),
-		func(o *ec2.Options) {
-			o.Region = region
-		},
-	)
+
+	NetworkInterfaces, err := sdk.CachedEC2DescribeNetworkInterfaces(m.EC2Client, aws.ToString(m.Caller.Account), region)
 	if err != nil {
 		return nil, fmt.Errorf("getting elastic network interfaces: %s", err)
 	}
 
-	for _, eni := range DescribeNetworkInterfaces.NetworkInterfaces {
+	for _, eni := range NetworkInterfaces {
 		eniPublicIPs[aws.ToString(eni.NetworkInterfaceId)] = getPublicIPOfElasticNetworkInterface(eni)
 	}
 

aws/ecs-tasks_test.go

@@ -1,249 +1,15 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
 	"log"
-	"os"
 	"testing"
-	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
-	"github.com/aws/aws-sdk-go-v2/service/ecs"
-	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-const DESCRIBE_TASKS_TEST_FILE = "./test-data/describe-tasks.json"
-const DESCRIBE_NETWORK_INTEFACES_TEST_FILE = "./test-data/describe-network-interfaces.json"
-
-type ListTasks struct {
-	TaskArns []string `json:"taskArns"`
-}
-
-type DescribeTasks struct {
-	Tasks []struct {
-		Attachments []struct {
-			ID      string `json:"id"`
-			Type    string `json:"type"`
-			Status  string `json:"status"`
-			Details []struct {
-				Name  string `json:"name"`
-				Value string `json:"value"`
-			} `json:"details"`
-		} `json:"attachments"`
-		Attributes []struct {
-			Name  string `json:"name"`
-			Value string `json:"value"`
-		} `json:"attributes"`
-		AvailabilityZone string `json:"availabilityZone"`
-		ClusterArn       string `json:"clusterArn"`
-		Connectivity     string `json:"connectivity"`
-		ConnectivityAt   string `json:"connectivityAt"`
-		Containers       []struct {
-			ContainerArn      string        `json:"containerArn"`
-			TaskArn           string        `json:"taskArn"`
-			Name              string        `json:"name"`
-			Image             string        `json:"image"`
-			RuntimeID         string        `json:"runtimeId"`
-			LastStatus        string        `json:"lastStatus"`
-			NetworkBindings   []interface{} `json:"networkBindings"`
-			NetworkInterfaces []struct {
-				AttachmentID       string `json:"attachmentId"`
-				PrivateIpv4Address string `json:"privateIpv4Address"`
-			} `json:"networkInterfaces"`
-			HealthStatus string `json:"healthStatus"`
-			CPU          string `json:"cpu"`
-			Memory       string `json:"memory"`
-		} `json:"containers"`
-		CPU                  string `json:"cpu"`
-		CreatedAt            string `json:"createdAt"`
-		DesiredStatus        string `json:"desiredStatus"`
-		EnableExecuteCommand bool   `json:"enableExecuteCommand"`
-		Group                string `json:"group"`
-		HealthStatus         string `json:"healthStatus"`
-		LastStatus           string `json:"lastStatus"`
-		LaunchType           string `json:"launchType"`
-		Memory               string `json:"memory"`
-		Overrides            struct {
-			ContainerOverrides []struct {
-				Name string `json:"name"`
-			} `json:"containerOverrides"`
-			InferenceAcceleratorOverrides []interface{} `json:"inferenceAcceleratorOverrides"`
-		} `json:"overrides"`
-		PlatformVersion   string        `json:"platformVersion"`
-		PlatformFamily    string        `json:"platformFamily"`
-		PullStartedAt     string        `json:"pullStartedAt"`
-		PullStoppedAt     string        `json:"pullStoppedAt"`
-		StartedAt         string        `json:"startedAt"`
-		StartedBy         string        `json:"startedBy"`
-		Tags              []interface{} `json:"tags"`
-		TaskArn           string        `json:"taskArn"`
-		TaskDefinitionArn string        `json:"taskDefinitionArn"`
-		Version           int           `json:"version"`
-		EphemeralStorage  struct {
-			SizeInGiB int `json:"sizeInGiB"`
-		} `json:"ephemeralStorage"`
-	} `json:"tasks"`
-	Failures []interface{} `json:"failures"`
-}
-
-type DescribeNetworkInterfaces struct {
-	NetworkInterfaces []struct {
-		Status          string `json:"Status"`
-		MacAddress      string `json:"MacAddress"`
-		SourceDestCheck bool   `json:"SourceDestCheck"`
-		VpcID           string `json:"VpcId"`
-		Description     string `json:"Description"`
-		Association     struct {
-			PublicIP      string `json:"PublicIp"`
-			AssociationID string `json:"AssociationId"`
-			PublicDNSName string `json:"PublicDnsName"`
-			IPOwnerID     string `json:"IpOwnerId"`
-		} `json:"Association"`
-		NetworkInterfaceID string `json:"NetworkInterfaceId"`
-		PrivateIPAddresses []struct {
-			PrivateDNSName string `json:"PrivateDnsName"`
-			Association    struct {
-				PublicIP      string `json:"PublicIp"`
-				AssociationID string `json:"AssociationId"`
-				PublicDNSName string `json:"PublicDnsName"`
-				IPOwnerID     string `json:"IpOwnerId"`
-			} `json:"Association"`
-			Primary          bool   `json:"Primary"`
-			PrivateIPAddress string `json:"PrivateIpAddress"`
-		} `json:"PrivateIpAddresses"`
-		RequesterManaged bool          `json:"RequesterManaged"`
-		Ipv6Addresses    []interface{} `json:"Ipv6Addresses"`
-		PrivateDNSName   string        `json:"PrivateDnsName,omitempty"`
-		AvailabilityZone string        `json:"AvailabilityZone"`
-		Attachment       struct {
-			Status              string    `json:"Status"`
-			DeviceIndex         int       `json:"DeviceIndex"`
-			AttachTime          time.Time `json:"AttachTime"`
-			InstanceID          string    `json:"InstanceId"`
-			DeleteOnTermination bool      `json:"DeleteOnTermination"`
-			AttachmentID        string    `json:"AttachmentId"`
-			InstanceOwnerID     string    `json:"InstanceOwnerId"`
-		} `json:"Attachment"`
-		Groups []struct {
-			GroupName string `json:"GroupName"`
-			GroupID   string `json:"GroupId"`
-		} `json:"Groups"`
-		SubnetID         string        `json:"SubnetId"`
-		OwnerID          string        `json:"OwnerId"`
-		TagSet           []interface{} `json:"TagSet"`
-		PrivateIPAddress string        `json:"PrivateIpAddress"`
-	} `json:"NetworkInterfaces"`
-}
-
-func readTestFile(testFile string) []byte {
-	file, err := os.ReadFile(testFile)
-	if err != nil {
-		log.Fatalf("can't read file %s", testFile)
-	}
-	return file
-}
-
-type mockedListclustersClient struct {
-}
-
-func (c *mockedListclustersClient) ListClusters(context.Context, *ecs.ListClustersInput, ...func(*ecs.Options)) (*ecs.ListClustersOutput, error) {
-	return &ecs.ListClustersOutput{ClusterArns: []string{
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster",
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster2",
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster3",
-	}}, nil
-}
-
-type mockedListTasksClient struct{}
-
-func (c *mockedListTasksClient) ListTasks(ctx context.Context, input *ecs.ListTasksInput, f ...func(*ecs.Options)) (*ecs.ListTasksOutput, error) {
-	return &ecs.ListTasksOutput{TaskArns: []string{
-		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/74de0355a10a4f979ac495c14EXAMPLE",
-		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/d789e94343414c25b9f6bd59eEXAMPLE",
-	}}, nil
-}
-
-type mockedDescribeTasksClient struct {
-	describeTasks DescribeTasks
-}
-
-func (c *mockedDescribeTasksClient) DescribeTasks(ctx context.Context, input *ecs.DescribeTasksInput, f ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error) {
-	err := json.Unmarshal(readTestFile(DESCRIBE_TASKS_TEST_FILE), &c.describeTasks)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_TASKS_TEST_FILE)
-	}
-	var tasks []ecsTypes.Task
-	for _, mockedTask := range c.describeTasks.Tasks {
-		if mockedTask.ClusterArn == aws.ToString(input.Cluster) {
-			for _, inputTask := range input.Tasks {
-				if mockedTask.TaskArn == inputTask {
-					var attachments []ecsTypes.Attachment
-					for _, a := range mockedTask.Attachments {
-						var deets []ecsTypes.KeyValuePair
-						for _, detail := range a.Details {
-							deets = append(deets, ecsTypes.KeyValuePair{
-								Name:  aws.String(detail.Name),
-								Value: aws.String(detail.Value)})
-						}
-						attachments = append(attachments, ecsTypes.Attachment{
-							Type:    aws.String(a.Type),
-							Details: deets,
-							Id:      aws.String(a.ID),
-							Status:  aws.String(a.Status),
-						})
-					}
-					tasks = append(tasks, ecsTypes.Task{
-						ClusterArn:        aws.String(mockedTask.ClusterArn),
-						TaskDefinitionArn: aws.String(mockedTask.TaskDefinitionArn),
-						LaunchType:        ecsTypes.LaunchType(*aws.String(mockedTask.LaunchType)),
-						TaskArn:           aws.String(mockedTask.TaskArn),
-						Attachments:       attachments,
-					})
-				}
-			}
-		}
-	}
-	return &ecs.DescribeTasksOutput{Tasks: tasks}, nil
-}
-
-type mockedDescribeNetworkInterfacesClient struct {
-	describeNetworkInterfaces DescribeNetworkInterfaces
-}
-
-func (c *mockedDescribeNetworkInterfacesClient) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
-	var nics []ec2types.NetworkInterface
-	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
-	}
-	for _, mockedNic := range c.describeNetworkInterfaces.NetworkInterfaces {
-		for _, inputNicID := range input.NetworkInterfaceIds {
-			if mockedNic.NetworkInterfaceID == inputNicID {
-				nics = append(nics, ec2types.NetworkInterface{
-					Association: &ec2types.NetworkInterfaceAssociation{
-						PublicIp: aws.String(mockedNic.Association.PublicIP),
-					},
-					NetworkInterfaceId: aws.String(mockedNic.NetworkInterfaceID)})
-			}
-		}
-	}
-	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
-}
-
-type mockedDescribeTaskDefinitionInterface struct {
-}
-
-func (c *mockedDescribeTaskDefinitionInterface) DescribeTaskDefinition(ctx context.Context, input *ecs.DescribeTaskDefinitionInput, f ...func(o *ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error) {
-	testTaskDefinition := ecsTypes.TaskDefinition{}
-	testTaskDefinition.TaskRoleArn = aws.String("test123")
-	return &ecs.DescribeTaskDefinitionOutput{TaskDefinition: &testTaskDefinition}, nil
-}
-
 func TestECSTasks(t *testing.T) {
 	subtests := []struct {
 		name            string
@@ -258,17 +24,13 @@ func TestECSTasks(t *testing.T) {
 			verbosity:       2,
 			testModule: ECSTasksModule{
 
-				AWSProfile:                      "default",
-				AWSRegions:                      []string{"us-east-1", "us-west-1"},
-				Caller:                          sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
-				SkipAdminCheck:                  true,
-				Goroutines:                      30,
-				DescribeNetworkInterfacesClient: &mockedDescribeNetworkInterfacesClient{},
-				DescribeTasksClient:             &mockedDescribeTasksClient{},
-				ListTasksClient:                 &mockedListTasksClient{},
-				ListClustersClient:              &mockedListclustersClient{},
-				DescribeTaskDefinitionClient:    &mockedDescribeTaskDefinitionInterface{},
-				//IAMSimulatePrincipalPolicyClient: &mockedDescribeTaskDefinitionsClient{},
+				AWSProfile:     "default",
+				AWSRegions:     []string{"us-east-1", "us-west-1"},
+				Caller:         sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
+				SkipAdminCheck: true,
+				Goroutines:     30,
+				EC2Client:      &sdk.MockedEC2Client2{},
+				ECSClient:      &sdk.MockedECSClient{},
 			},
 			expectedResult: []MappedECSTask{{
 				Cluster:    "MyCluster",
@@ -281,7 +43,7 @@ func TestECSTasks(t *testing.T) {
 	internal.MockFileSystem(true)
 	for _, subtest := range subtests {
 		t.Run(subtest.name, func(t *testing.T) {
-			subtest.testModule.ECSTasks(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
+			subtest.testModule.ECSTasks(subtest.outputDirectory, subtest.verbosity)
 			for index, expectedTask := range subtest.expectedResult {
 				if expectedTask.Cluster != subtest.testModule.MappedECSTasks[index].Cluster {
 					log.Fatal("Cluster name does not match expected value")

aws/eks.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -21,9 +22,12 @@ type EKSModule struct {
 	EKSClient sdk.EKSClientInterface
 	IAMClient sdk.AWSIAMClientInterface
 
-	Caller         sts.GetCallerIdentityOutput
-	AWSRegions     []string
-	OutputFormat   string
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	AWSOutputType       string
+	AWSTableCols        string
+	PmapperDataBasePath string
+
 	Goroutines     int
 	AWSProfile     string
 	SkipAdminCheck bool
@@ -52,8 +56,8 @@ type Cluster struct {
 	CanPrivEsc string
 }
 
-func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *EKSModule) EKS(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "eks"
@@ -69,8 +73,8 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 	fmt.Printf("[%s][%s] Enumerating EKS clusters for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -122,10 +126,48 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 		}
 	}
 
-	// add - if struct is not empty do this. otherwise, dont write anything.
-	if m.pmapperError == nil {
-		m.output.Headers = []string{
-			"Service",
+	// This is the complete list of potential table columns
+	m.output.Headers = []string{
+		"Account",
+		"Region",
+		"Name",
+		//"Endpoint",
+		"Public",
+		//"OIDC",
+		"NodeGroup",
+		"Role",
+		"IsAdminRole?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Region",
+			"Name",
+			"Endpoint",
+			"Public",
+			"OIDC",
+			"NodeGroup",
+			"Role",
+			"IsAdminRole?",
+			"CanPrivEscToAdmin?",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
 			"Region",
 			"Name",
 			//"Endpoint",
@@ -136,58 +178,32 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
 		}
-	} else {
-		m.output.Headers = []string{
-			"Service",
-			"Region",
-			"Name",
-			//"Endpoint",
-			"Public",
-			//"OIDC",
-			"NodeGroup",
-			"Role",
-			"IsAdminRole?",
-			//"CanPrivEscToAdmin?",
-		}
+	}
+
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
 	}
 
 	// Table rows
 
 	for i := range m.Clusters {
-		if m.pmapperError == nil {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Clusters[i].AWSService,
-					m.Clusters[i].Region,
-					m.Clusters[i].Name,
-					//m.Clusters[i].Endpoint,
-					m.Clusters[i].Public,
-					//m.Clusters[i].OIDC,
-					m.Clusters[i].NodeGroup,
-					m.Clusters[i].Role,
-					m.Clusters[i].Admin,
-					m.Clusters[i].CanPrivEsc,
-				},
-			)
-		} else {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Clusters[i].AWSService,
-					m.Clusters[i].Region,
-					m.Clusters[i].Name,
-					//m.Clusters[i].Endpoint,
-					m.Clusters[i].Public,
-					//m.Clusters[i].OIDC,
-					m.Clusters[i].NodeGroup,
-					m.Clusters[i].Role,
-					m.Clusters[i].Admin,
-					//m.Clusters[i].CanPrivEsc,
-				},
-			)
-
-		}
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				aws.ToString(m.Caller.Account),
+				m.Clusters[i].Region,
+				m.Clusters[i].Name,
+				//m.Clusters[i].Endpoint,
+				m.Clusters[i].Public,
+				//m.Clusters[i].OIDC,
+				m.Clusters[i].NodeGroup,
+				m.Clusters[i].Role,
+				m.Clusters[i].Admin,
+				m.Clusters[i].CanPrivEsc,
+			},
+		)
 	}
 
 	var seen []string
@@ -199,10 +215,6 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -211,9 +223,10 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/eks_test.go

@@ -86,7 +86,6 @@ func TestEks(t *testing.T) {
 				EKSClient: &MockedEKSClientInterface{},
 				//IAMSimulatePrincipalPolicyClient:    iam.SimulatePrincipalPolicyAPIClient,
 				Caller:         sts.GetCallerIdentityOutput{Arn: aws.String("test")},
-				OutputFormat:   "table",
 				AWSProfile:     "test",
 				Goroutines:     30,
 				AWSRegions:     AWSRegions,
@@ -104,7 +103,7 @@ func TestEks(t *testing.T) {
 	internal.MockFileSystem(true)
 	for _, subtest := range subtests {
 		t.Run(subtest.name, func(t *testing.T) {
-			subtest.testModule.EKS(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
+			subtest.testModule.EKS(subtest.outputDirectory, subtest.verbosity)
 			for index, expectedCluster := range subtest.expectedResult {
 				if expectedCluster.Name != subtest.testModule.Clusters[index].Name {
 					log.Fatal("Cluster name does not match expected value")

aws/elastic-network-interfaces.go

@@ -1,16 +1,16 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
@@ -18,14 +18,15 @@ import (
 )
 
 type ElasticNetworkInterfacesModule struct {
-	//EC2Client                       *ec2.Client
-	DescribeNetworkInterfacesClient ec2.DescribeNetworkInterfacesAPIClient
+	EC2Client sdk.AWSEC2ClientInterface
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	AWSProfile string
+	WrapTable  bool
 
 	MappedENIs     []MappedENI
 	CommandCounter internal.CommandCounter
@@ -44,7 +45,7 @@ type MappedENI struct {
 	Description      string
 }
 
-func (m *ElasticNetworkInterfacesModule) ElasticNetworkInterfaces(outputFormat string, outputDirectory string, verbosity int) {
+func (m *ElasticNetworkInterfacesModule) ElasticNetworkInterfaces(outputDirectory string, verbosity int) {
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "elastic-network-interfaces"
@@ -84,7 +85,7 @@ func (m *ElasticNetworkInterfacesModule) ElasticNetworkInterfaces(outputFormat s
 	receiverDone <- true
 	<-receiverDone
 
-	m.printENIsData(outputFormat, outputDirectory, dataReceiver, verbosity)
+	m.printENIsData(outputDirectory, dataReceiver, verbosity)
 
 }
 
@@ -101,8 +102,9 @@ func (m *ElasticNetworkInterfacesModule) Receiver(receiver chan MappedENI, recei
 	}
 }
 
-func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outputDirectory string, dataReceiver chan MappedENI, verbosity int) {
+func (m *ElasticNetworkInterfacesModule) printENIsData(outputDirectory string, dataReceiver chan MappedENI, verbosity int) {
 	m.output.Headers = []string{
+		"Account",
 		"ID",
 		"Type",
 		"External IP",
@@ -111,10 +113,48 @@ func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outp
 		"Attached Instance",
 		"Description",
 	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"ID",
+			"Type",
+			"External IP",
+			"Internal IP",
+			"VPC ID",
+			"Attached Instance",
+			"Description",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"ID",
+			"Type",
+			"External IP",
+			"Internal IP",
+			"VPC ID",
+			"Attached Instance",
+			"Description",
+		}
+	}
+
 	for _, eni := range m.MappedENIs {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				eni.ID,
 				eni.Type,
 				eni.ExternalIP,
@@ -127,10 +167,7 @@ func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outp
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 
-		//m.writeLoot(m.output.FilePath)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -139,9 +176,10 @@ func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outp
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -213,50 +251,45 @@ func (m *ElasticNetworkInterfacesModule) executeChecks(r string, wg *sync.WaitGr
 }
 
 func (m *ElasticNetworkInterfacesModule) getDescribeNetworkInterfaces(region string, dataReceiver chan MappedENI) {
-	var PaginationControl *string
-	for {
-		DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
-			context.TODO(),
-			&(ec2.DescribeNetworkInterfacesInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *ec2.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
 
-		for _, eni := range DescribeNetworkInterfaces.NetworkInterfaces {
-			status := string(eni.Status)
-			if status == "available" {
-				continue // unused ENI
-			}
-
-			mappedENI := MappedENI{
-				ID:               aws.ToString(eni.NetworkInterfaceId),
-				Type:             string(eni.InterfaceType),
-				ExternalIP:       getPublicIPOfElasticNetworkInterface(eni),
-				PrivateIP:        aws.ToString(eni.PrivateIpAddress),
-				VPCID:            aws.ToString(eni.VpcId),
-				AttachedInstance: getAttachmentInstanceOfElasticNetworkInterface(eni),
-				Description:      aws.ToString(eni.Description),
-			}
-
-			dataReceiver <- mappedENI
-		}
-
-		if DescribeNetworkInterfaces.NextToken != nil {
-			PaginationControl = DescribeNetworkInterfaces.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
+	NetworkInterfaces, err := sdk.CachedEC2DescribeNetworkInterfaces(m.EC2Client, aws.ToString(m.Caller.Account), region)
 
+	// var PaginationControl *string
+	// for {
+	// 	DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
+	// 		context.TODO(),
+	// 		&(ec2.DescribeNetworkInterfacesInput{
+	// 			NextToken: PaginationControl,
+	// 		}),
+	// 		func(o *ec2.Options) {
+	// 			o.Region = region
+	// 		},
+	// 	)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	for _, eni := range NetworkInterfaces {
+		status := string(eni.Status)
+		if status == "available" {
+			continue // unused ENI
+		}
+
+		mappedENI := MappedENI{
+			ID:               aws.ToString(eni.NetworkInterfaceId),
+			Type:             string(eni.InterfaceType),
+			ExternalIP:       getPublicIPOfElasticNetworkInterface(eni),
+			PrivateIP:        aws.ToString(eni.PrivateIpAddress),
+			VPCID:            aws.ToString(eni.VpcId),
+			AttachedInstance: getAttachmentInstanceOfElasticNetworkInterface(eni),
+			Description:      aws.ToString(eni.Description),
+		}
+
+		dataReceiver <- mappedENI
+	}
+
 }
 
 func getPublicIPOfElasticNetworkInterface(elasticNetworkInterface types.NetworkInterface) string {

aws/elastic-network-interfaces_test.go

@@ -1,48 +1,59 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
-	"log"
 	"testing"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-type mockedDescribeNetworkInterfacesClient2 struct {
-	describeNetworkInterfaces DescribeNetworkInterfaces
-}
+func TestElasticNetworkInterfaces(t *testing.T) {
 
-func (c *mockedDescribeNetworkInterfacesClient2) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
-	var nics []ec2types.NetworkInterface
-	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
+	m := ElasticNetworkInterfacesModule{
+		AWSProfile: "default",
+		AWSRegions: []string{"us-east-1", "us-west-1"},
+		Caller:     sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
+		EC2Client:  &sdk.MockedEC2Client2{},
 	}
-	for _, mockednic := range c.describeNetworkInterfaces.NetworkInterfaces {
-		nics = append(nics, ec2types.NetworkInterface{
-			Association: &ec2types.NetworkInterfaceAssociation{
-				PublicIp: aws.String(mockednic.Association.PublicIP),
+
+	//m.ElasticNetworkInterfaces("table", ".", 3)
+	subtests := []struct {
+		name           string
+		testModule     ElasticNetworkInterfacesModule
+		expectedResult []MappedENI
+	}{
+		{
+			name:       "Test ElasticNetworkInterfaces",
+			testModule: m,
+			expectedResult: []MappedENI{
+				{
+					PrivateIP:  "10.0.1.17",
+					ExternalIP: "203.0.113.12",
+				},
+				{
+					PrivateIP:  "10.0.1.149",
+					ExternalIP: "198.51.100.0",
+				},
 			},
-			NetworkInterfaceId: aws.String(mockednic.NetworkInterfaceID),
-			PrivateIpAddress:   aws.String(mockednic.PrivateIPAddress),
-			VpcId:              aws.String(mockednic.VpcID),
-			Attachment:         &ec2types.NetworkInterfaceAttachment{InstanceId: aws.String(mockednic.Attachment.InstanceID)},
-			Description:        aws.String(mockednic.Description),
+		},
+	}
+	internal.MockFileSystem(true)
+	for _, subtest := range subtests {
+		t.Run(subtest.name, func(t *testing.T) {
+			subtest.testModule.ElasticNetworkInterfaces(".", 3)
+			for index, expectedTask := range subtest.expectedResult {
+				if expectedTask.ExternalIP != subtest.testModule.MappedENIs[index].ExternalIP {
+					t.Errorf("expected %s, got %s", expectedTask.ExternalIP, subtest.testModule.MappedENIs[index].ExternalIP)
+				}
+				if expectedTask.PrivateIP != subtest.testModule.MappedENIs[index].PrivateIP {
+					t.Errorf("expected %s, got %s", expectedTask.PrivateIP, subtest.testModule.MappedENIs[index].PrivateIP)
+				}
+
+			}
 		})
 	}
-	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
-}
-
-func TestElasticNetworkInterfaces(t *testing.T) {
-	m := ElasticNetworkInterfacesModule{
-		AWSProfile:                      "default",
-		AWSRegions:                      []string{"us-east-1", "us-west-1"},
-		Caller:                          sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
-		DescribeNetworkInterfacesClient: &mockedDescribeNetworkInterfacesClient2{},
-	}
-	m.ElasticNetworkInterfaces("table", ".", 3)
 }

aws/endpoints.go

@@ -55,12 +55,14 @@ type EndpointsModule struct {
 	AppRunnerClient    *apprunner.Client
 	LightsailClient    *lightsail.Client
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	Endpoints      []Endpoint
@@ -83,8 +85,8 @@ type Endpoint struct {
 
 var oe *smithy.OperationError
 
-func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *EndpointsModule) PrintEndpoints(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "endpoints"
@@ -147,6 +149,7 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
 	})
 
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Region",
 		"Name",
@@ -156,11 +159,48 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
 		"Public",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Service",
+			"Region",
+			"Name",
+			"Endpoint",
+			"Port",
+			"Protocol",
+			"Public",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Service",
+			"Region",
+			"Name",
+			"Endpoint",
+			"Port",
+			"Protocol",
+			"Public",
+		}
+	}
+
 	// Table rows
 	for i := range m.Endpoints {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
+				aws.ToString(m.Caller.Account),
 				m.Endpoints[i].AWSService,
 				m.Endpoints[i].Region,
 				m.Endpoints[i].Name,
@@ -174,10 +214,6 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -186,9 +222,10 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -545,7 +582,7 @@ func (m *EndpointsModule) getMqBrokersPerRegion(r string, wg *sync.WaitGroup, se
 			m.CommandCounter.Error++
 			continue
 		}
-		if BrokerDetails.PubliclyAccessible {
+		if aws.ToBool(BrokerDetails.PubliclyAccessible) {
 			public = "True"
 		} else {
 			public = "False"
@@ -615,7 +652,7 @@ func (m *EndpointsModule) getOpenSearchPerRegion(r string, wg *sync.WaitGroup, s
 		var endpoint string
 		var kibana_endpoint string
 
-		// This exits thie function if an opensearch domain exists but there is no endpoint
+		// This exits the function if an opensearch domain exists but there is no endpoint
 		if raw_endpoint == nil {
 			return
 		} else {
@@ -893,10 +930,6 @@ func (m *EndpointsModule) getAPIGatewayVIPsPerRegion(r string, wg *sync.WaitGrou
 	// m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-
-	var PaginationControl2 *string
-	var PaginationControl3 *string
 
 	Items, err := sdk.CachedApiGatewayGetRestAPIs(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
 
@@ -906,16 +939,20 @@ func (m *EndpointsModule) getAPIGatewayVIPsPerRegion(r string, wg *sync.WaitGrou
 		return
 	}
 
-	for {
-		GetDomainNames, err := m.APIGatewayClient.GetDomainNames(
-			context.TODO(),
-			&apigateway.GetDomainNamesInput{
-				Position: PaginationControl2,
-			},
-			func(o *apigateway.Options) {
-				o.Region = r
-			},
-		)
+	GetDomainNames, err := sdk.CachedApiGatewayGetDomainNames(m.APIGatewayClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, item := range GetDomainNames {
+
+		domain := aws.ToString(item.DomainName)
+		GetBasePathMappings, err := sdk.CachedApiGatewayGetBasePathMappings(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, item.DomainName)
 
 		if err != nil {
 			if errors.As(err, &oe) {
@@ -926,82 +963,43 @@ func (m *EndpointsModule) getAPIGatewayVIPsPerRegion(r string, wg *sync.WaitGrou
 			break
 		}
 
-		for _, item := range GetDomainNames.Items {
+		for _, mapping := range GetBasePathMappings {
+			stage := aws.ToString(mapping.Stage)
+			basePath := aws.ToString(mapping.BasePath)
+			if basePath == "(none)" {
+				basePath = "" // Empty string since '/' is already prepended
+			}
 
-			domain := aws.ToString(item.DomainName)
+			for _, api := range Items {
+				if api.Id != nil && aws.ToString(api.Id) == aws.ToString(mapping.RestApiId) {
+					endpoints := m.getEndpointsPerAPIGateway(r, api)
+					for _, endpoint := range endpoints {
+						old := fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.RestApiId), r, stage)
 
-			for {
-				GetBasePathMappings, err := m.APIGatewayClient.GetBasePathMappings(
-					context.TODO(),
-					&apigateway.GetBasePathMappingsInput{
-						DomainName: item.DomainName,
-						Position:   PaginationControl3,
-					},
-					func(o *apigateway.Options) {
-						o.Region = r
-					},
-				)
-
-				if err != nil {
-					if errors.As(err, &oe) {
-						m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-					}
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
-				}
-
-				for _, mapping := range GetBasePathMappings.Items {
-					stage := aws.ToString(mapping.Stage)
-					basePath := aws.ToString(mapping.BasePath)
-					if basePath == "(none)" {
-						basePath = "" // Empty string since '/' is already prepended
-					}
-
-					for _, api := range Items {
-						if api.Id != nil && aws.ToString(api.Id) == aws.ToString(mapping.RestApiId) {
-							endpoints := m.getEndpointsPerAPIGateway(r, api)
-							for _, endpoint := range endpoints {
-								old := fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.RestApiId), r, stage)
-
-								if strings.HasPrefix(endpoint.Endpoint, old) {
-									var new string
-									if basePath == "" {
-										new = fmt.Sprintf("https://%s/", domain)
-									} else {
-										new = fmt.Sprintf("https://%s/%s/", domain, basePath)
-									}
-									endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
-									endpoint.Name = domain
-									dataReceiver <- endpoint
-								}
+						if strings.HasPrefix(endpoint.Endpoint, old) {
+							var new string
+							if basePath == "" {
+								new = fmt.Sprintf("https://%s/", domain)
+							} else {
+								new = fmt.Sprintf("https://%s/%s/", domain, basePath)
 							}
-							break
+							endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
+							endpoint.Name = domain
+							dataReceiver <- endpoint
 						}
 					}
-				}
-
-				if GetBasePathMappings.Position != nil {
-					PaginationControl3 = GetBasePathMappings.Position
-				} else {
-					PaginationControl3 = nil
 					break
 				}
 			}
 		}
-		if GetDomainNames.Position != nil {
-			PaginationControl2 = GetDomainNames.Position
-		} else {
-			PaginationControl2 = nil
-			break
-		}
+
 	}
+
 }
 
 func (m *EndpointsModule) getEndpointsPerAPIGateway(r string, api apigatewayTypes.RestApi) []Endpoint {
 	var endpoints []Endpoint
 
-	var PaginationControl2 *string
 	awsService := "APIGateway"
 	var public string
 
@@ -1019,15 +1017,7 @@ func (m *EndpointsModule) getEndpointsPerAPIGateway(r string, api apigatewayType
 		public = "True"
 	}
 
-	GetStages, err := m.APIGatewayClient.GetStages(
-		context.TODO(),
-		&apigateway.GetStagesInput{
-			RestApiId: &id,
-		},
-		func(o *apigateway.Options) {
-			o.Region = r
-		},
-	)
+	GetStages, err := sdk.CachedApiGatewayGetStages(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, id)
 
 	if err != nil {
 		if errors.As(err, &oe) {
@@ -1037,54 +1027,38 @@ func (m *EndpointsModule) getEndpointsPerAPIGateway(r string, api apigatewayType
 		m.CommandCounter.Error++
 	}
 
-	for {
-		GetResources, err := m.APIGatewayClient.GetResources(
-			context.TODO(),
-			&apigateway.GetResourcesInput{
-				RestApiId: &id,
-				Position:  PaginationControl2,
-			},
-			func(o *apigateway.Options) {
-				o.Region = r
-			},
-		)
+	GetResources, err := sdk.CachedApiGatewayGetResources(m.APIGatewayClient, aws.ToString(m.Caller.Account), r, id)
 
-		if err != nil {
-			if errors.As(err, &oe) {
-				m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-			}
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
 		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
 
-		for _, stage := range GetStages.Item {
-			stageName := aws.ToString(stage.StageName)
-			for _, resource := range GetResources.Items {
-				if len(resource.ResourceMethods) != 0 {
-					path := aws.ToString(resource.Path)
+	}
 
-					endpoint := fmt.Sprintf("%s/%s%s", raw_endpoint, stageName, path)
+	for _, stage := range GetStages.Item {
+		stageName := aws.ToString(stage.StageName)
+		for _, resource := range GetResources {
+			if len(resource.ResourceMethods) != 0 {
+				path := aws.ToString(resource.Path)
 
-					endpoints = append(endpoints, Endpoint{
-						AWSService: awsService,
-						Region:     r,
-						Name:       name,
-						Endpoint:   endpoint,
-						Port:       port,
-						Protocol:   protocol,
-						Public:     public,
-					})
-				}
+				endpoint := fmt.Sprintf("%s/%s%s", raw_endpoint, stageName, path)
+
+				endpoints = append(endpoints, Endpoint{
+					AWSService: awsService,
+					Region:     r,
+					Name:       name,
+					Endpoint:   endpoint,
+					Port:       port,
+					Protocol:   protocol,
+					Public:     public,
+				})
 			}
 		}
-		if GetResources.Position != nil {
-			PaginationControl2 = GetResources.Position
-		} else {
-			PaginationControl2 = nil
-			break
-		}
 	}
+
 	return endpoints
 }
 
@@ -1133,10 +1107,6 @@ func (m *EndpointsModule) getAPIGatewayv2VIPsPerRegion(r string, wg *sync.WaitGr
 	// m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-
-	var PaginationControl2 *string
-	var PaginationControl3 *string
 
 	Items, err := sdk.CachedAPIGatewayv2GetAPIs(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r)
 
@@ -1146,16 +1116,20 @@ func (m *EndpointsModule) getAPIGatewayv2VIPsPerRegion(r string, wg *sync.WaitGr
 		return
 	}
 
-	for {
-		GetDomainNames, err := m.APIGatewayv2Client.GetDomainNames(
-			context.TODO(),
-			&apigatewayv2.GetDomainNamesInput{
-				NextToken: PaginationControl2,
-			},
-			func(o *apigatewayv2.Options) {
-				o.Region = r
-			},
-		)
+	GetDomainNames, err := sdk.CachedAPIGatewayv2GetDomainNames(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, item := range GetDomainNames {
+
+		domain := aws.ToString(item.DomainName)
+		GetApiMappings, err := sdk.CachedAPIGatewayv2GetApiMappings(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, domain)
 
 		if err != nil {
 			if errors.As(err, &oe) {
@@ -1166,87 +1140,46 @@ func (m *EndpointsModule) getAPIGatewayv2VIPsPerRegion(r string, wg *sync.WaitGr
 			break
 		}
 
-		for _, item := range GetDomainNames.Items {
+		for _, mapping := range GetApiMappings {
+			stage := aws.ToString(mapping.Stage)
+			if stage == "$default" {
+				stage = ""
+			}
+			path := aws.ToString(mapping.ApiMappingKey)
 
-			domain := aws.ToString(item.DomainName)
-
-			for {
-				GetApiMappings, err := m.APIGatewayv2Client.GetApiMappings(
-					context.TODO(),
-					&apigatewayv2.GetApiMappingsInput{
-						DomainName: item.DomainName,
-						NextToken:  PaginationControl3,
-					},
-					func(o *apigatewayv2.Options) {
-						o.Region = r
-					},
-				)
-
-				if err != nil {
-					if errors.As(err, &oe) {
-						m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-					}
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
-				}
-
-				for _, mapping := range GetApiMappings.Items {
-					stage := aws.ToString(mapping.Stage)
-					if stage == "$default" {
-						stage = ""
-					}
-					path := aws.ToString(mapping.ApiMappingKey)
-
-					for _, api := range Items {
-						if api.ApiId != nil && aws.ToString(api.ApiId) == aws.ToString(mapping.ApiId) {
-							endpoints := m.getEndpointsPerAPIGatewayv2(r, api)
-							for _, endpoint := range endpoints {
-								var old string
-								if stage == "" {
-									old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/", aws.ToString(mapping.ApiId), r)
-								} else {
-									old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.ApiId), r, stage)
-								}
-								if strings.HasPrefix(endpoint.Endpoint, old) {
-									var new string
-									if path == "" {
-										new = fmt.Sprintf("https://%s/", domain)
-									} else {
-										new = fmt.Sprintf("https://%s/%s/", domain, path)
-									}
-									endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
-									endpoint.Name = domain
-									dataReceiver <- endpoint
-								}
+			for _, api := range Items {
+				if api.ApiId != nil && aws.ToString(api.ApiId) == aws.ToString(mapping.ApiId) {
+					endpoints := m.getEndpointsPerAPIGatewayv2(r, api)
+					for _, endpoint := range endpoints {
+						var old string
+						if stage == "" {
+							old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/", aws.ToString(mapping.ApiId), r)
+						} else {
+							old = fmt.Sprintf("https://%s.execute-api.%s.amazonaws.com/%s/", aws.ToString(mapping.ApiId), r, stage)
+						}
+						if strings.HasPrefix(endpoint.Endpoint, old) {
+							var new string
+							if path == "" {
+								new = fmt.Sprintf("https://%s/", domain)
+							} else {
+								new = fmt.Sprintf("https://%s/%s/", domain, path)
 							}
-							break
+							endpoint.Endpoint = strings.Replace(endpoint.Endpoint, old, new, 1)
+							endpoint.Name = domain
+							dataReceiver <- endpoint
 						}
 					}
-				}
-
-				if GetApiMappings.NextToken != nil {
-					PaginationControl3 = GetApiMappings.NextToken
-				} else {
-					PaginationControl3 = nil
 					break
 				}
 			}
 		}
-		if GetDomainNames.NextToken != nil {
-			PaginationControl2 = GetDomainNames.NextToken
-		} else {
-			PaginationControl2 = nil
-			break
-		}
+
 	}
+
 }
 
 func (m *EndpointsModule) getEndpointsPerAPIGatewayv2(r string, api apigatewayV2Types.Api) []Endpoint {
 	var endpoints []Endpoint
-
-	var PaginationControl2 *string
-	var PaginationControl3 *string
 	awsService := "APIGatewayv2"
 
 	var public string
@@ -1258,98 +1191,61 @@ func (m *EndpointsModule) getEndpointsPerAPIGatewayv2(r string, api apigatewayV2
 	protocol := "https"
 
 	var stages []string
-	for {
-		GetStages, err := m.APIGatewayv2Client.GetStages(
-			context.TODO(),
-			&apigatewayv2.GetStagesInput{
-				ApiId:     &id,
-				NextToken: PaginationControl2,
-			},
-			func(o *apigatewayv2.Options) {
-				o.Region = r
-			},
-		)
+	GetStages, err := sdk.CachedAPIGatewayv2GetStages(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, id)
 
-		if err != nil {
-			if errors.As(err, &oe) {
-				m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-			}
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
 		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
-		for _, stage := range GetStages.Items {
-			s := aws.ToString(stage.StageName)
-			if s == "$default" {
-				s = ""
-			}
-			stages = append(stages, s)
+	for _, stage := range GetStages {
+		s := aws.ToString(stage.StageName)
+		if s == "$default" {
+			s = ""
 		}
+		stages = append(stages, s)
+	}
 
-		if GetStages.NextToken != nil {
-			PaginationControl2 = GetStages.NextToken
-		} else {
-			PaginationControl2 = nil
-			break
+	GetRoutes, err := sdk.CachedAPIGatewayv2GetRoutes(m.APIGatewayv2Client, aws.ToString(m.Caller.Account), r, id)
+
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+
+	for _, stage := range stages {
+		for _, route := range GetRoutes {
+			routeKey := route.RouteKey
+			var path string
+			if len(strings.Fields(*routeKey)) == 2 {
+				path = strings.Fields(*routeKey)[1]
+			}
+			var endpoint string
+			if stage == "" {
+				endpoint = fmt.Sprintf("%s%s", raw_endpoint, path)
+			} else {
+				endpoint = fmt.Sprintf("%s/%s%s", raw_endpoint, stage, path)
+			}
+			public = "True"
+
+			endpoints = append(endpoints, Endpoint{
+				AWSService: awsService,
+				Region:     r,
+				Name:       name,
+				Endpoint:   endpoint,
+				Port:       port,
+				Protocol:   protocol,
+				Public:     public,
+			})
 		}
 	}
 
-	for {
-		GetRoutes, err := m.APIGatewayv2Client.GetRoutes(
-			context.TODO(),
-			&apigatewayv2.GetRoutesInput{
-				ApiId:     &id,
-				NextToken: PaginationControl3,
-			},
-			func(o *apigatewayv2.Options) {
-				o.Region = r
-			},
-		)
-
-		if err != nil {
-			if errors.As(err, &oe) {
-				m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-			}
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			continue
-		}
-
-		for _, stage := range stages {
-			for _, route := range GetRoutes.Items {
-				routeKey := route.RouteKey
-				var path string
-				if len(strings.Fields(*routeKey)) == 2 {
-					path = strings.Fields(*routeKey)[1]
-				}
-				var endpoint string
-				if stage == "" {
-					endpoint = fmt.Sprintf("%s%s", raw_endpoint, path)
-				} else {
-					endpoint = fmt.Sprintf("%s/%s%s", raw_endpoint, stage, path)
-				}
-				public = "True"
-
-				endpoints = append(endpoints, Endpoint{
-					AWSService: awsService,
-					Region:     r,
-					Name:       name,
-					Endpoint:   endpoint,
-					Port:       port,
-					Protocol:   protocol,
-					Public:     public,
-				})
-			}
-		}
-		if GetRoutes.NextToken != nil {
-			PaginationControl3 = GetRoutes.NextToken
-		} else {
-			PaginationControl3 = nil
-			break
-		}
-
-	}
 	return endpoints
 }
 
@@ -1386,7 +1282,7 @@ func (m *EndpointsModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup,
 			endpoint := aws.ToString(instance.Endpoint.Address)
 			awsService := "RDS"
 
-			if instance.PubliclyAccessible {
+			if aws.ToBool(instance.PubliclyAccessible) {
 				public = "True"
 			} else {
 				public = "False"
@@ -1397,7 +1293,7 @@ func (m *EndpointsModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup,
 				Region:     r,
 				Name:       name,
 				Endpoint:   endpoint,
-				Port:       port,
+				Port:       aws.ToInt32(port),
 				Protocol:   aws.ToString(instance.Engine),
 				Public:     public,
 			}
@@ -1442,7 +1338,7 @@ func (m *EndpointsModule) getRedshiftEndPointsPerRegion(r string, wg *sync.WaitG
 		//id := workspace.Id
 		endpoint := aws.ToString(cluster.Endpoint.Address)
 
-		if cluster.PubliclyAccessible {
+		if aws.ToBool(cluster.PubliclyAccessible) {
 			public = "True"
 		} else {
 			public = "False"
@@ -1455,7 +1351,7 @@ func (m *EndpointsModule) getRedshiftEndPointsPerRegion(r string, wg *sync.WaitG
 			Region:     r,
 			Name:       name,
 			Endpoint:   endpoint,
-			Port:       port,
+			Port:       aws.ToInt32(port),
 			Protocol:   protocol,
 			Public:     public,
 		}

aws/env-vars.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -34,12 +35,14 @@ import (
 
 type EnvsModule struct {
 	// General configuration data
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	AWSProfile   string
-	OutputFormat string
-	Goroutines   int
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSProfile    string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	WrapTable  bool
 
 	// Service Clients
 	ECSClient       *ecs.Client
@@ -63,10 +66,11 @@ type EnvironmentVariable struct {
 	region              string
 	environmentVarName  string
 	environmentVarValue string
+	interesting         bool
 }
 
-func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *EnvsModule) PrintEnvs(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "env-vars"
@@ -119,6 +123,7 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
 
 	// Table headers
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Region",
 		"Name",
@@ -126,24 +131,70 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
 		"Value",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Service",
+			"Region",
+			"Name",
+			"Key",
+			"Value",
+		}
+	} else {
+		tableCols = []string{
+			"Service",
+			"Region",
+			"Name",
+			"Key",
+			"Value",
+		}
+	}
+
+	m.determineIfInteresting()
 	//Table rows
 	for _, envVar := range m.EnvironmentVariables {
-		m.output.Body = append(
-			m.output.Body, []string{
-				envVar.service,
-				envVar.region,
-				envVar.name,
-				envVar.environmentVarName,
-				envVar.environmentVarValue,
-			},
-		)
+
+		if envVar.interesting {
+			m.output.Body = append(
+				m.output.Body, []string{
+					aws.ToString(m.Caller.Account),
+					envVar.service,
+					envVar.region,
+					envVar.name,
+					magenta(envVar.environmentVarName),
+					magenta(envVar.environmentVarValue),
+				},
+			)
+		} else {
+			m.output.Body = append(
+				m.output.Body, []string{
+					aws.ToString(m.Caller.Account),
+					envVar.service,
+					envVar.region,
+					envVar.name,
+					envVar.environmentVarName,
+					envVar.environmentVarValue,
+				},
+			)
+		}
 	}
+
 	if len(m.output.Body) > 0 {
 
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -151,13 +202,27 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
 				Wrap: m.WrapTable,
 			},
 		}
-		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
-		})
+
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
+		})
+
+		// Create another table file that only contains the environment variables that seem to be secrets.
+		body := m.interestingEnvVarsOnly()
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header:            m.output.Headers,
+			Body:              body,
+			TableCols:         tableCols,
+			Name:              fmt.Sprintf("%s-interesting", m.output.CallingModule),
+			SkipPrintToScreen: true,
+		})
+
 		o.WriteFullOutput(o.Table.TableFiles, nil)
 		fmt.Printf("[%s][%s] %s environment variables found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
@@ -167,6 +232,20 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
 	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
 }
 
+func (m *EnvsModule) determineIfInteresting() {
+	for i, envVar := range m.EnvironmentVariables {
+		// If the environment variable name contains the word secret, key, token, or password, we'll make it magenta to make it stand out.
+		lowerEnvVar := strings.ToLower(envVar.environmentVarName)
+		if (strings.Contains(lowerEnvVar, "secret") && !strings.Contains(lowerEnvVar, "arn")) ||
+			strings.Contains(lowerEnvVar, "key") ||
+			strings.Contains(lowerEnvVar, "token") ||
+			strings.Contains(lowerEnvVar, "user") ||
+			strings.Contains(lowerEnvVar, "pass") {
+			m.EnvironmentVariables[i].interesting = true
+		}
+	}
+}
+
 func EnvVarsContains(element EnvironmentVariable, array []EnvironmentVariable) bool {
 	for _, v := range array {
 		if v == element {
@@ -751,3 +830,22 @@ func (m *EnvsModule) getSagemakerEnvironmentVariablesPerRegion(r string, wg *syn
 
 	}
 }
+
+func (m *EnvsModule) interestingEnvVarsOnly() [][]string {
+	var interestingBody [][]string
+	for _, envVar := range m.EnvironmentVariables {
+		if envVar.interesting {
+			interestingBody = append(
+				interestingBody, []string{
+					aws.ToString(m.Caller.Account),
+					envVar.service,
+					envVar.region,
+					envVar.name,
+					magenta(envVar.environmentVarName),
+					magenta(envVar.environmentVarValue),
+				},
+			)
+		}
+	}
+	return interestingBody
+}

aws/filesystems.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -27,12 +28,14 @@ type FilesystemsModule struct {
 	EFSClient *efs.Client
 	FSxClient *fsx.Client
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	Filesystems []FilesystemObject
@@ -55,8 +58,8 @@ type FilesystemObject struct {
 	Permissions string
 }
 
-func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *FilesystemsModule) PrintFilesystems(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "filesystems"
@@ -107,7 +110,7 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 	})
 
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Region",
 		"Name",
 		"DNS Name",
@@ -117,12 +120,48 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 		"Permissions",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Region",
+			"Name",
+			"DNS Name",
+			//"IP",
+			"Mount Target",
+			"Policy",
+			"Permissions",
+		}
+	} else {
+		tableCols = []string{
+			"Region",
+			"Name",
+			"DNS Name",
+			//"IP",
+			"Mount Target",
+			"Policy",
+			"Permissions",
+		}
+
+	}
+
 	// Table rows
 	for i := range m.Filesystems {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Filesystems[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Filesystems[i].Region,
 				m.Filesystems[i].Name,
 				m.Filesystems[i].DnsName,
@@ -137,10 +176,7 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 	if len(m.output.Body) > 0 {
 
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -149,9 +185,10 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/graph.go

@@ -0,0 +1,418 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	ingestor "github.com/BishopFox/cloudfox/aws/graph/ingester"
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema/models"
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/knownawsaccountslookup"
+	"github.com/sirupsen/logrus"
+)
+
+type GraphCommand struct {
+
+	// General configuration data
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	Goroutines          int
+	AWSProfile          string
+	WrapTable           bool
+	AWSOutputType       string
+	AWSTableCols        string
+	Verbosity           int
+	AWSOutputDirectory  string
+	AWSConfig           aws.Config
+	Version             string
+	SkipAdminCheck      bool
+	PmapperDataBasePath string
+
+	pmapperMod   PmapperModule
+	pmapperError error
+
+	vendors *knownawsaccountslookup.Vendors
+
+	// Main module data
+	// Used to store output data for pretty printing
+	output internal.OutputData2
+
+	modLog *logrus.Entry
+}
+
+func (m *GraphCommand) RunGraphCommand() {
+
+	// These struct values are used by the output module
+	m.output.Verbosity = m.Verbosity
+	m.output.Directory = m.AWSOutputDirectory
+	m.output.CallingModule = "graph"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	m.vendors = knownawsaccountslookup.NewVendorMap()
+	m.vendors.PopulateKnownAWSAccounts()
+
+	m.modLog.Info("Collecting data for graph ingestor...")
+
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+
+	////////////////
+	// Accounts
+	////////////////
+
+	accounts := m.collectAccountDataForGraph()
+	// write data to jsonl file for ingestor to read
+	fileName := fmt.Sprintf("%s/graph/%s/%s.jsonl", m.output.Directory, aws.ToString(m.Caller.Account), "accounts")
+	// create file and directory if it doesn't exist
+	if err := os.MkdirAll(fmt.Sprintf("%s/graph/%s", m.output.Directory, aws.ToString(m.Caller.Account)), 0755); err != nil {
+		m.modLog.Error(err)
+		return
+	}
+
+	outputFile, err := os.OpenFile(fileName, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
+	if err != nil {
+		m.modLog.Error(err)
+		return
+	}
+	defer outputFile.Close()
+
+	for _, account := range accounts {
+		if err := internal.WriteJsonlFile(outputFile, account); err != nil {
+			m.modLog.Error(err)
+			return
+		}
+	}
+
+	////////////////
+	// Users
+	////////////////
+
+	// users := m.collectUserDataForGraph()
+	// // write data to jsonl file for ingestor to read
+	// fileName = fmt.Sprintf("%s/graph/%s/%s.jsonl", m.output.Directory, aws.ToString(m.Caller.Account), "users")
+	// // create file and directory if it doesn't exist
+	// if err := os.MkdirAll(fmt.Sprintf("%s/graph/%s", m.output.Directory, aws.ToString(m.Caller.Account)), 0755); err != nil {
+	// 	m.modLog.Error(err)
+	// 	return
+	// }
+
+	// outputFile, err = os.OpenFile(fileName, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
+	// if err != nil {
+	// 	m.modLog.Error(err)
+	// 	return
+	// }
+	// defer outputFile.Close()
+
+	// for _, user := range users {
+	// 	if err := internal.WriteJsonlFile(outputFile, user); err != nil {
+	// 		m.modLog.Error(err)
+	// 		return
+	// 	}
+	// }
+
+	////////////////
+	// Roles
+	////////////////
+
+	roles := m.collectRoleDataForGraph()
+	// write data to jsonl file for ingestor to read
+	fileName = fmt.Sprintf("%s/graph/%s/%s.jsonl", m.output.Directory, aws.ToString(m.Caller.Account), "roles")
+	// create file and directory if it doesn't exist
+	if err := os.MkdirAll(fmt.Sprintf("%s/graph/%s", m.output.Directory, aws.ToString(m.Caller.Account)), 0755); err != nil {
+		m.modLog.Error(err)
+		return
+	}
+
+	outputFile, err = os.OpenFile(fileName, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
+	if err != nil {
+		m.modLog.Error(err)
+		return
+	}
+	defer outputFile.Close()
+
+	for _, role := range roles {
+		if err := internal.WriteJsonlFile(outputFile, role); err != nil {
+			m.modLog.Error(err)
+			return
+		}
+	}
+
+	ingestor, err := ingestor.NewCloudFoxIngestor()
+	if err != nil {
+		return
+	}
+
+	// Pmapper hack
+
+	goCtx := context.Background()
+	sharedLogger.Infof("Verifying connectivity to Neo4J at %s", ingestor.Uri)
+	if err := ingestor.Driver.VerifyConnectivity(goCtx); err != nil {
+		sharedLogger.Error(err)
+	}
+	defer ingestor.Driver.Close(goCtx)
+	m.pmapperMod.GenerateCypherStatements(goCtx, ingestor.Driver)
+
+	// back to regular stuff
+
+	ingestor.Run(fmt.Sprintf("%s/graph/%s", m.output.Directory, aws.ToString(m.Caller.Account)))
+
+}
+
+func (m *GraphCommand) collectAccountDataForGraph() []models.Account {
+	//OrganizationsCommandClient := InitOrgClient(m.AWSConfig)
+	var accounts []models.Account
+	OrganizationsCommandClient := InitOrgClient(m.AWSConfig)
+	DescribeOrgOutput, err := sdk.CachedOrganizationsDescribeOrganization(OrganizationsCommandClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Fatal(err)
+	}
+	if DescribeOrgOutput.MasterAccountId == nil {
+		m.modLog.Error("Organization is not configured")
+	}
+	// If the account is not the org mgmt account, it can only see some info about itself and some info about the org mgmt account.
+	// populate both of them here.
+	if aws.ToString(DescribeOrgOutput.MasterAccountId) != aws.ToString(m.Caller.Account) {
+
+		//create new object of type models.Account for this account
+		thisAccount := models.Account{
+			Id:  aws.ToString(m.Caller.Account),
+			Arn: fmt.Sprintf("arn:aws:iam::%s:root", aws.ToString(m.Caller.Account)),
+			//Name:             aws.ToString(m.Caller.Account),
+			IsOrgMgmt:        false,
+			IsChildAccount:   true,
+			OrgMgmtAccountID: aws.ToString(DescribeOrgOutput.MasterAccountId),
+			OrganizationID:   aws.ToString(DescribeOrgOutput.Id),
+		}
+		accounts = append(accounts, thisAccount)
+
+		//create new object of type models.Account for the mgmt account
+		mgmtAccount := models.Account{
+			Id:    aws.ToString(DescribeOrgOutput.MasterAccountId),
+			Arn:   aws.ToString(DescribeOrgOutput.MasterAccountArn),
+			Email: aws.ToString(DescribeOrgOutput.MasterAccountEmail),
+			//Status:           string(account.Status),
+			//JoinedMethod:     string(account.JoinedMethod),
+			//JoinedTimestamp:  account.JoinedTimestamp.String(),
+			IsOrgMgmt:        true,
+			IsChildAccount:   false,
+			OrgMgmtAccountID: aws.ToString(DescribeOrgOutput.MasterAccountId),
+			OrganizationID:   aws.ToString(DescribeOrgOutput.Id),
+		}
+		accounts = append(accounts, mgmtAccount)
+		return accounts
+
+	} else {
+		// In this case we are the org mgmt account, so we can see all the accounts in the org.
+		ListAccounts, err := sdk.CachedOrganizationsListAccounts(OrganizationsCommandClient, aws.ToString(DescribeOrgOutput.MasterAccountId))
+		if err != nil {
+			m.modLog.Fatal(err)
+		}
+		for _, account := range ListAccounts {
+			var isMgmtAccount bool
+			var isChildAccount bool
+			m.modLog.Info("Account: ", aws.ToString(account.Name))
+			if aws.ToString(DescribeOrgOutput.MasterAccountId) == aws.ToString(account.Id) {
+				// this is the org mgmt account
+				isMgmtAccount = true
+				isChildAccount = false
+			} else if DescribeOrgOutput.MasterAccountId == nil {
+				// this is a standalone account
+				isChildAccount = false
+				isMgmtAccount = false
+			} else {
+				// this is a child account
+				isChildAccount = true
+				isMgmtAccount = false
+			}
+
+			//create new object of type models.Account
+			account := models.Account{
+				Id:               aws.ToString(account.Id),
+				Arn:              aws.ToString(account.Arn),
+				Name:             aws.ToString(account.Name),
+				Email:            aws.ToString(account.Email),
+				Status:           string(account.Status),
+				JoinedMethod:     string(account.JoinedMethod),
+				JoinedTimestamp:  account.JoinedTimestamp.String(),
+				IsOrgMgmt:        isMgmtAccount,
+				IsChildAccount:   isChildAccount,
+				OrgMgmtAccountID: aws.ToString(DescribeOrgOutput.MasterAccountId),
+				OrganizationID:   aws.ToString(DescribeOrgOutput.Id),
+			}
+			accounts = append(accounts, account)
+		}
+		return accounts
+	}
+}
+
+func (m *GraphCommand) collectRoleDataForGraph() []models.Role {
+	var isAdmin, canPrivEscToAdmin string
+
+	// iamClient := InitIAMClient(m.AWSConfig)
+	// iamSimClient := InitIamCommandClient(iamClient, m.Caller, m.AWSProfile, m.Goroutines)
+	// localAdminMap := make(map[string]bool)
+
+	var roles []models.Role
+	IAMCommandClient := InitIAMClient(m.AWSConfig)
+	ListRolesOutput, err := sdk.CachedIamListRoles(IAMCommandClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err)
+	}
+
+	for _, role := range ListRolesOutput {
+		accountId := strings.Split(aws.ToString(role.Arn), ":")[4]
+		trustsdoc, err := policy.ParseRoleTrustPolicyDocument(role)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			break
+		}
+
+		// if m.pmapperError == nil {
+		// 	isAdmin, canPrivEscToAdmin = GetPmapperResults(m.SkipAdminCheck, m.pmapperMod, role.Arn)
+		// } else {
+		// 	isAdmin, canPrivEscToAdmin = GetIamSimResult(m.SkipAdminCheck, role.Arn, iamSimClient, localAdminMap)
+		// }
+
+		// for _, row := range m.PermissionRowsFromAllProfiles {
+		// 	if row.Arn == aws.ToString(role.Arn) {
+
+		// 		// look for cases where there is a permission that allows sts:assumeRole or *
+		// 		// lowercase the action and compare it against the list of checks below
+		// 		if strings.EqualFold(row.Action, "sts:AssumeRole") ||
+		// 			strings.EqualFold(row.Action, "*") ||
+		// 			strings.EqualFold(row.Action, "sts:Assume*") ||
+		// 			strings.EqualFold(row.Action, "sts:*") {
+
+		// 			if row.Effect == "Allow" {
+		// 				//PrivEscPermissions = append(PrivEscPermissions, "sts:AssumeRole")
+		// 				if row.Resource == "*" {
+		// 					PrivEscPermissions = append(PrivEscPermissions, "sts:AssumeRole")
+		// 				} else if strings.EqualFold(row.Resource, aws.ToString(role.Arn)) {
+		// 					PrivEscPermissions = append(PrivEscPermissions, "sts:AssumeRole")
+		// 				}
+		// 			}
+		// 		}
+		// 		if row.Effect == "Deny" {
+		// 			// Remove the string sts:AssumeRole from the PrivEscPermissions slice
+		// 			for i, v := range PrivEscPermissions {
+		// 				if v == "sts:AssumeRole" {
+		// 					PrivEscPermissions = append(PrivEscPermissions[:i], PrivEscPermissions[i+1:]...)
+		// 				}
+		// 			}
+		// 		}
+		// 	}
+		// }
+
+		var TrustedPrincipals []models.TrustedPrincipal
+		var TrustedServices []models.TrustedService
+		var TrustedFederatedProviders []models.TrustedFederatedProvider
+		//var TrustedFederatedSubjects string
+		var trustedProvider string
+		var trustedSubjects string
+		var vendorName string
+
+		for _, statement := range trustsdoc.Statement {
+			for _, principal := range statement.Principal.AWS {
+				if strings.Contains(principal, ":root") {
+					//check to see if the accountID is known
+					accountID := strings.Split(principal, ":")[4]
+					vendorName = m.vendors.GetVendorNameFromAccountID(accountID)
+				}
+
+				TrustedPrincipals = append(TrustedPrincipals, models.TrustedPrincipal{
+					TrustedPrincipal: principal,
+					ExternalID:       statement.Condition.StringEquals.StsExternalID,
+					VendorName:       vendorName,
+					//IsAdmin:           false,
+					//CanPrivEscToAdmin: false,
+				})
+
+			}
+			for _, service := range statement.Principal.Service {
+				TrustedServices = append(TrustedServices, models.TrustedService{
+					TrustedService: service,
+					AccountID:      accountId,
+					//IsAdmin:           false,
+					//CanPrivEscToAdmin: false,
+				})
+
+			}
+			for _, federated := range statement.Principal.Federated {
+				if statement.Condition.StringLike.TokenActionsGithubusercontentComAud != "" || len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
+					trustedProvider = "GitHub"
+					trustedSubjects := strings.Join(statement.Condition.StringLike.TokenActionsGithubusercontentComSub, ",")
+					if trustedSubjects == "" {
+						trustedSubjects = "ALL REPOS!!!"
+					} else {
+						trustedSubjects = "Repos: " + trustedSubjects
+					}
+
+				} else if statement.Condition.StringEquals.SAMLAud == "https://signin.aws.amazon.com/saml" {
+					if strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
+						trustedProvider = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
+					} else if strings.Contains(statement.Principal.Federated[0], "Okta") {
+						trustedProvider = "Okta" //  (" + statement.Principal.Federated[0] + ")"
+					}
+					trustedSubjects = "Not applicable"
+				} else if statement.Condition.StringEquals.OidcEksAud != "" || statement.Condition.StringEquals.OidcEksSub != nil || statement.Condition.StringLike.OidcEksAud != "" || statement.Condition.StringLike.OidcEksSub != nil {
+					trustedProvider = "EKS" // (" + statement.Principal.Federated[0] + ")"
+					// if statement.Condition.StringEquals.OidcEksSub != "" {
+					// 	trustedSubjects = statement.Condition.StringEquals.OidcEksSub
+					// } else if statement.Condition.StringLike.OidcEksSub != "" {
+					// 	trustedSubjects = statement.Condition.StringLike.OidcEksSub
+					// } else {
+					// 	trustedSubjects = "ALL SERVICE ACCOUNTS!"
+					// }
+					trustedSubjects = "ALL SERVICE ACCOUNTS!"
+				} else if statement.Principal.Federated[0] == "cognito-identity.amazonaws.com" {
+					trustedProvider = "Cognito" // (" + statement.Principal.Federated[0] + ")"
+					if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
+						trustedSubjects = statement.Condition.ForAnyValueStringLike.CognitoAMR
+					}
+				} else {
+					if trustedProvider == "" && strings.Contains(statement.Principal.Federated[0], "oidc.eks") {
+						trustedProvider = "EKS" // (" + statement.Principal.Federated[0] + ")"
+						trustedSubjects = "ALL SERVICE ACCOUNTS!"
+					} else if trustedProvider == "" && strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
+						trustedProvider = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
+					}
+					trustedSubjects = "Not applicable"
+				}
+
+				TrustedFederatedProviders = append(TrustedFederatedProviders, models.TrustedFederatedProvider{
+					TrustedFederatedProvider: federated,
+					ProviderShortName:        trustedProvider,
+					TrustedSubjects:          trustedSubjects,
+					//IsAdmin:                  false,
+					//CanPrivEscToAdmin:        false,
+				})
+			}
+		}
+
+		//create new object of type models.Role
+		role := models.Role{
+			Id:                        aws.ToString(role.Arn),
+			AccountID:                 accountId,
+			ARN:                       aws.ToString(role.Arn),
+			Name:                      aws.ToString(role.RoleName),
+			TrustsDoc:                 trustsdoc,
+			TrustedPrincipals:         TrustedPrincipals,
+			TrustedServices:           TrustedServices,
+			TrustedFederatedProviders: TrustedFederatedProviders,
+			CanPrivEscToAdmin:         canPrivEscToAdmin,
+			IsAdmin:                   isAdmin,
+		}
+		roles = append(roles, role)
+	}
+	return roles
+}

aws/graph/collectors/accounts.go

@@ -0,0 +1 @@
+package collectors

aws/graph/ingester/ingestor.go

@@ -0,0 +1,283 @@
+package ingestor
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema/models"
+	"github.com/neo4j/neo4j-go-driver/v5/neo4j"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// Neo4j
+	MergeNodeQueryTemplate = `CALL apoc.merge.node([$labels[0]], {Id: $Id}, $properties, $properties) YIELD node as obj
+	CALL apoc.create.setLabels(obj, $labels) YIELD node as labeledObj
+	RETURN labeledObj`
+
+	MergeRelationQueryTemplate = `UNWIND $batch as row
+	CALL apoc.merge.node([row.sourceLabel], apoc.map.fromValues([row.sourceProperty, row.sourceNodeId])) YIELD node as from
+	CALL apoc.merge.node([row.targetLabel], apoc.map.fromValues([row.targetProperty, row.targetNodeId])) YIELD node as to
+	CALL apoc.merge.relationship(from, row.relationshipType, {}, row.properties, to) YIELD rel
+	RETURN rel`
+
+	// Using sprintf to insert the label name since the driver doesn't support parameters for labels here
+	// %[1]s is a nice way to say "insert the first parameter here"
+	CreateConstraintQueryTemplate = "CREATE CONSTRAINT IF NOT EXISTS FOR (n: %s) REQUIRE n.Id IS UNIQUE"
+	CreateIndexQueryTemplate      = "CREATE INDEX %[1]s_Id IF NOT EXISTS FOR (n: %[1]s) ON (n.Id)"
+
+	PostProcessMergeQueryTemplate = `MATCH (n)
+	WITH n.Id AS Id, COLLECT(n) AS nodesToMerge
+	WHERE size(nodesToMerge) > 1
+	CALL apoc.refactor.mergeNodes(nodesToMerge, {properties: 'combine', mergeRels:true})
+	YIELD node
+	RETURN count(*);`
+)
+
+type Neo4jConfig struct {
+	Uri      string
+	Username string
+	Password string
+}
+
+type CloudFoxIngestor struct {
+	Neo4jConfig
+	//ResultsFile string
+	Driver neo4j.DriverWithContext
+	TmpDir string
+}
+
+func NewCloudFoxIngestor() (*CloudFoxIngestor, error) {
+	config := Neo4jConfig{
+		Uri:      "neo4j://localhost:7687",
+		Username: "neo4j",
+		Password: "cloudfox",
+	}
+	driver, err := neo4j.NewDriverWithContext(config.Uri, neo4j.BasicAuth(config.Username, config.Password, ""))
+	if err != nil {
+		return nil, err
+	}
+	return &CloudFoxIngestor{
+		Neo4jConfig: config,
+		//ResultsFile: resultsFile,
+		Driver: driver,
+	}, nil
+}
+
+// func unzipToTemp(zipFilePath string) (string, error) {
+// 	// Create a temporary directory to extract the zip file to
+// 	tempDir, err := os.MkdirTemp("", "cloudfox-graph")
+// 	if err != nil {
+// 		return "", err
+// 	}
+
+// 	// Open the zip file and extract to a temporary directory
+// 	zipfile, err := zip.OpenReader(zipFilePath)
+// 	if err != nil {
+// 		return "", err
+// 	}
+// 	defer zipfile.Close()
+
+// 	for _, file := range zipfile.File {
+// 		path := filepath.Join(tempDir, file.Name)
+// 		log.Debugf("Extracting file: %s", path)
+
+// 		fileData, err := file.Open()
+// 		if err != nil {
+// 			return "", err
+// 		}
+// 		defer fileData.Close()
+
+// 		newFile, err := os.Create(path)
+// 		if err != nil {
+// 			return "", err
+// 		}
+// 		defer newFile.Close()
+
+// 		if _, err := io.Copy(newFile, fileData); err != nil {
+// 			return "", err
+// 		}
+// 	}
+// 	return tempDir, nil
+// }
+
+func (i *CloudFoxIngestor) ProcessFile(path string, info os.FileInfo) error {
+	log.Infof("Processing file: %s", info.Name())
+
+	switch info.Name() {
+	case "accounts.jsonl":
+		return i.ProcessFileObjects(path, schema.Account, schema.Account)
+	case "roles.jsonl":
+		return i.ProcessFileObjects(path, schema.Role, schema.Role)
+	// case "servicePrincipals.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.GraphServicePrincipal, schema.GraphObject)
+	// case "applications.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.GraphApplication, schema.GraphObject)
+	// case "devices.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.GraphDevice, schema.GraphObject)
+	// case "directoryRoles.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.GraphRole, schema.GraphObject)
+	// case "subscriptions.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.Subscription, schema.ArmResource)
+	// case "tenants.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.Tenant, schema.ArmResource)
+	// case "rbac.jsonl":
+	// 	return i.ProcessFileObjects(path, schema.AzureRbac, "")
+	default:
+		return nil
+	}
+}
+
+func (i *CloudFoxIngestor) ProcessFileObjects(path string, objectType schema.NodeLabel, generalType schema.NodeLabel) error {
+
+	var object = models.NodeLabelToNodeMap[objectType]
+
+	// Open the file
+	file, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	// Read the file line by line
+	scanner := bufio.NewScanner(file)
+
+	//Iterate over the lines and create the nodes
+	for scanner.Scan() {
+		line := strings.TrimSuffix(scanner.Text(), "\n")
+
+		// Skip empty lines
+		if len(line) > 0 {
+			if err := json.Unmarshal([]byte(line), &object); err != nil {
+				log.Errorf("%s : %s", err, line)
+				continue
+			}
+		}
+		relationships := object.MakeRelationships()
+		if err := i.InsertDBObjects(object, relationships, []schema.NodeLabel{generalType, objectType}); err != nil {
+			log.Error(err)
+			continue
+		}
+
+	}
+	return nil
+}
+
+func (i *CloudFoxIngestor) InsertDBObjects(object schema.Node, relationships []schema.Relationship, labels []schema.NodeLabel) error {
+	goCtx := context.Background()
+	var err error
+
+	// Insert the node
+	if object != nil {
+		nodeMap, err := schema.ConvertCustomTypesToNeo4j(&object)
+		if err != nil {
+			log.Errorf("Error converting custom types to neo4j: %s -- %v", err, object)
+			return err
+		}
+
+		//nodeMap := schema.AsNeo4j(&object)
+		nodeQueryParams := map[string]interface{}{
+			"Id":         nodeMap["Id"],
+			"labels":     labels,
+			"properties": nodeMap,
+		}
+		_, err = neo4j.ExecuteQuery(goCtx, i.Driver, MergeNodeQueryTemplate, nodeQueryParams, neo4j.EagerResultTransformer, neo4j.ExecuteQueryWithDatabase("neo4j"))
+		if err != nil {
+			log.Errorf("Error inserting node: %s -- %v", err, nodeQueryParams)
+			return err
+		}
+	}
+
+	// Insert the relationships
+	if len(relationships) > 0 {
+		var relationshipInterface []map[string]interface{}
+
+		// Check the default SourceProperty and TargetProperty values
+		for _, relationship := range relationships {
+			var currentRelationship map[string]interface{}
+
+			if relationship.SourceProperty == "" {
+				relationship.SourceProperty = "Id"
+			}
+			if relationship.TargetProperty == "" {
+				relationship.TargetProperty = "Id"
+			}
+			relationshipBytes, err := json.Marshal(relationship)
+			if err != nil {
+				return err
+			}
+			if err := json.Unmarshal(relationshipBytes, &currentRelationship); err != nil {
+				return err
+			}
+			relationshipInterface = append(relationshipInterface, currentRelationship)
+		}
+
+		_, err = neo4j.ExecuteQuery(goCtx, i.Driver, MergeRelationQueryTemplate, map[string]interface{}{"batch": relationshipInterface}, neo4j.EagerResultTransformer, neo4j.ExecuteQueryWithDatabase("neo4j"))
+		if err != nil {
+			log.Errorf("Error inserting relationships: %s -- %v", err, relationshipInterface)
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (i *CloudFoxIngestor) Run(graphOutputDir string) error {
+	goCtx := context.Background()
+	log.Infof("Verifying connectivity to Neo4J at %s", i.Uri)
+	if err := i.Driver.VerifyConnectivity(goCtx); err != nil {
+		return err
+	}
+	defer i.Driver.Close(goCtx)
+	var err error
+
+	// Get the label to model map
+
+	// Create constraints and indexes
+	// log.Info("Creating constraints and indexes for labels")
+	// for label := range models.NodeLabelToNodeMap {
+	// 	for _, query := range []string{CreateConstraintQueryTemplate, CreateIndexQueryTemplate} {
+	// 		_, err := neo4j.ExecuteQuery(goCtx, i.Driver, fmt.Sprintf(query, label), nil, neo4j.EagerResultTransformer, neo4j.ExecuteQueryWithDatabase("neo4j"))
+	// 		if err != nil {
+	// 			log.Error(err)
+	// 			continue
+	// 		}
+	// 	}
+	// }
+
+	// Process the files in the output directory
+	fileWg := new(sync.WaitGroup)
+	filepath.Walk(graphOutputDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if graphOutputDir == path {
+			return nil
+		}
+
+		fileWg.Add(1)
+		go func(path string) {
+			defer fileWg.Done()
+			i.ProcessFile(path, info)
+			log.Infof("Finished processing file: %s", info.Name())
+		}(path)
+		return nil
+	})
+	fileWg.Wait()
+	log.Info("Finished processing files")
+
+	// Run the post processing merge query
+	log.Info("Running post processing merge query")
+	_, err = neo4j.ExecuteQuery(goCtx, i.Driver, PostProcessMergeQueryTemplate, nil, neo4j.EagerResultTransformer, neo4j.ExecuteQueryWithDatabase("neo4j"))
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	return nil
+}

aws/graph/ingester/schema/models/account.go

@@ -0,0 +1,44 @@
+package models
+
+import "github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+
+type Account struct {
+	Id               string
+	Arn              string
+	Email            string
+	Name             string
+	Status           string
+	JoinedMethod     string
+	JoinedTimestamp  string
+	IsOrgMgmt        bool
+	IsChildAccount   bool
+	OrgMgmtAccountID string
+	OrganizationID   string
+}
+
+func (a *Account) MakeRelationships() []schema.Relationship {
+	var relationships []schema.Relationship
+
+	// make relationship from children accounts to parent org
+	if a.IsChildAccount {
+		// make relationship from child to org mgmt account
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     a.OrganizationID,
+			TargetNodeID:     a.Id,
+			SourceLabel:      schema.Organization,
+			TargetLabel:      schema.Account,
+			RelationshipType: schema.Manages,
+		})
+		// make relationship from parent org mgmt account to child account
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     a.Id,
+			TargetNodeID:     a.OrganizationID,
+			SourceLabel:      schema.Account,
+			TargetLabel:      schema.Organization,
+			RelationshipType: schema.MemberOf,
+		})
+
+	}
+
+	return relationships
+}

aws/graph/ingester/schema/models/constants.go

@@ -0,0 +1,11 @@
+package models
+
+import (
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+)
+
+var NodeLabelToNodeMap = map[schema.NodeLabel]schema.Node{
+	schema.Organization: &Organization{},
+	schema.Account:      &Account{},
+	schema.Role:         &Role{},
+}

aws/graph/ingester/schema/models/org.go

@@ -0,0 +1,20 @@
+package models
+
+import (
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+)
+
+type Organization struct {
+	Id                 string
+	OrgId              string
+	Arn                string
+	MasterAccountArn   string
+	MasterAccountId    string
+	MasterAccountEmail string
+	ChildAccounts      []Account
+	MgmtAccount        Account
+}
+
+func (o *Organization) MakeRelationships() []schema.Relationship {
+	return []schema.Relationship{}
+}

aws/graph/ingester/schema/models/resource.go

@@ -0,0 +1,5 @@
+package models
+
+type Resource struct {
+	ARN string
+}

aws/graph/ingester/schema/models/roles.go

@@ -0,0 +1,647 @@
+package models
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/BishopFox/cloudfox/internal/common"
+	"github.com/dominikbraun/graph"
+)
+
+type Role struct {
+	Id                        string
+	AccountID                 string
+	ARN                       string
+	Name                      string
+	TrustsDoc                 policy.TrustPolicyDocument
+	TrustedPrincipals         []TrustedPrincipal
+	TrustedServices           []TrustedService
+	TrustedFederatedProviders []TrustedFederatedProvider
+	CanPrivEscToAdmin         string
+	IsAdmin                   string
+	IdValue                   string
+	IsAdminP                  bool
+	PathToAdminSameAccount    bool
+	PathToAdminCrossAccount   bool
+}
+
+type TrustedPrincipal struct {
+	TrustedPrincipal string
+	ExternalID       string
+	VendorName       string
+	//IsAdmin           bool
+	//CanPrivEscToAdmin bool
+}
+
+type TrustedService struct {
+	TrustedService string
+	AccountID      string
+	//IsAdmin           bool
+	//CanPrivEscToAdmin bool
+}
+
+type TrustedFederatedProvider struct {
+	TrustedFederatedProvider string
+	ProviderShortName        string
+	TrustedSubjects          string
+	//IsAdmin                  bool
+	//CanPrivEscToAdmin        bool
+}
+
+func (a *Role) MakeRelationships() []schema.Relationship {
+	var relationships []schema.Relationship
+	//instance := singleton.GetInstance()
+
+	// get thisAccount id from role arn
+	var thisAccount string
+	if len(a.ARN) >= 25 {
+		thisAccount = a.ARN[13:25]
+	} else {
+		fmt.Sprintf("Could not get account number from this role arn%s", a.ARN)
+	}
+
+	// make a relationship between each role and the account it belongs to
+	relationships = append(relationships, schema.Relationship{
+		SourceNodeID:     a.Id,
+		TargetNodeID:     thisAccount,
+		SourceLabel:      schema.Role,
+		TargetLabel:      schema.Account,
+		RelationshipType: schema.MemberOf,
+	})
+
+	for _, TrustedPrincipal := range a.TrustedPrincipals {
+		//get account id from the trusted principal arn
+		var trustedPrincipalAccount string
+		if len(TrustedPrincipal.TrustedPrincipal) >= 25 {
+			trustedPrincipalAccount = TrustedPrincipal.TrustedPrincipal[13:25]
+		} else {
+			fmt.Sprintf("Could not get account number from this TrustedPrincipal%s", TrustedPrincipal.TrustedPrincipal)
+		}
+		var PermissionsRowAccount string
+		// make a TRUSTED_BY relationship between the role and the trusted principal. This does not mean the principal can assume this role, we need more logic to determine that (see below)
+		// relationships = append(relationships, schema.Relationship{
+		// 	SourceNodeID:     TrustedPrincipal.TrustedPrincipal,
+		// 	TargetNodeID:     a.Id,
+		// 	SourceLabel:      schema.Principal,
+		// 	TargetLabel:      schema.Role,
+		// 	RelationshipType: schema.IsTrustedBy,
+		// })
+		// // make a TRUSTS relationship between the trusted principal and this role. This does not mean the principal can assume this role, we need more logic to determine that (see below)
+		// relationships = append(relationships, schema.Relationship{
+		// 	SourceNodeID:     a.Id,
+		// 	TargetNodeID:     TrustedPrincipal.TrustedPrincipal,
+		// 	SourceLabel:      schema.Role,
+		// 	TargetLabel:      schema.Principal,
+		// 	RelationshipType: schema.Trusts,
+		// })
+		// // make a MEMBER_OF relationship between the role and the account
+		// relationships = append(relationships, schema.Relationship{
+		// 	SourceNodeID:     TrustedPrincipal.TrustedPrincipal,
+		// 	TargetNodeID:     trustedPrincipalAccount,
+		// 	SourceLabel:      schema.Principal,
+		// 	TargetLabel:      schema.Account,
+		// 	RelationshipType: schema.MemberOf,
+		// })
+
+		// if the role trusts a principal in this same account explicitly, then the principal can assume the role
+		if thisAccount == trustedPrincipalAccount {
+			// make a CAN_ASSUME relationship between the trusted principal and this role
+			relationships = append(relationships, schema.Relationship{
+				SourceNodeID:     TrustedPrincipal.TrustedPrincipal,
+				TargetNodeID:     a.Id,
+				SourceLabel:      schema.Principal,
+				TargetLabel:      schema.Role,
+				RelationshipType: schema.CanAssume,
+			})
+
+			// make a CAN_BE_ASSUMED_BY relationship between this role and the trusted principal
+			// relationships = append(relationships, schema.Relationship{
+			// 	SourceNodeID:     a.Id,
+			// 	TargetNodeID:     TrustedPrincipal.TrustedPrincipal,
+			// 	SourceLabel:      schema.Role,
+			// 	TargetLabel:      schema.Principal,
+			// 	RelationshipType: schema.CanBeAssumedBy,
+			// })
+		}
+
+		// If the role trusts a principal in this account or another account using the :root notation, then we need to iterate over all of the rows in AllPermissionsRows to find the principals that have sts:AssumeRole permissions on this role
+		// if the role we are looking at trusts root in it's own account
+
+		if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", thisAccount)) {
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this account
+
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+
+				if PermissionsRowAccount == thisAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if strings.EqualFold(PermissionsRow.Action, "sts:AssumeRole") ||
+						strings.EqualFold(PermissionsRow.Action, "*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:Assume*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:*") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.ARN) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+								//evaluate if the princiapl is a user or a role and set a variable accordingly
+								//var principalType schema.NodeLabel
+								if strings.EqualFold(PermissionsRow.Type, "User") {
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.User,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAssume,
+									})
+								} else if strings.EqualFold(PermissionsRow.Type, "Role") {
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.Role,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAssume,
+									})
+								}
+
+								// relationships = append(relationships, schema.Relationship{
+								// 	SourceNodeID:     PermissionsRow.Arn,
+								// 	TargetNodeID:     a.Id,
+								// 	SourceLabel:      principalType,
+								// 	TargetLabel:      schema.Role,
+								// 	RelationshipType: schema.CanAssumeTest,
+								// })
+								// make a CAN_BE_ASSUMED_BY relationship between this role and the trusted principal
+								// relationships = append(relationships, schema.Relationship{
+								// 	SourceNodeID:     a.Id,
+								// 	TargetNodeID:     PermissionsRow.Arn,
+								// 	SourceLabel:      schema.Role,
+								// 	TargetLabel:      schema.Principal,
+								// 	RelationshipType: schema.CanBeAssumedByTest,
+								// })
+
+							}
+						}
+					}
+
+				}
+			}
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", trustedPrincipalAccount)) {
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this other account
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+				if PermissionsRowAccount == trustedPrincipalAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if strings.EqualFold(PermissionsRow.Action, "sts:AssumeRole") ||
+						strings.EqualFold(PermissionsRow.Action, "*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:Assume*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:*") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.ARN) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+
+								if strings.EqualFold(PermissionsRow.Type, "User") {
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.User,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAssumeCrossAccount,
+									})
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.User,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAccess,
+									})
+								} else if strings.EqualFold(PermissionsRow.Type, "Role") {
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.Role,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAssumeCrossAccount,
+									})
+									relationships = append(relationships, schema.Relationship{
+										SourceNodeID:     PermissionsRow.Arn,
+										TargetNodeID:     a.Id,
+										SourceLabel:      schema.Role,
+										TargetLabel:      schema.Role,
+										RelationshipType: schema.CanAccess,
+									})
+								}
+								// // make a CAN_BE_ASSUMED_BY relationship between this role and the trusted principal
+								// relationships = append(relationships, schema.Relationship{
+								// 	SourceNodeID:     a.Id,
+								// 	TargetNodeID:     PermissionsRow.Arn,
+								// 	SourceLabel:      schema.Role,
+								// 	TargetLabel:      schema.Principal,
+								// 	RelationshipType: schema.CanBeAssumedByTest,
+								// })
+
+							}
+						}
+					}
+
+				}
+			}
+			// If the role trusts :root in another account and the trusted principal is a vendor, we will make a relationship between our role and a vendor node instead of a principal node
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && TrustedPrincipal.VendorName != "" {
+			relationships = append(relationships, schema.Relationship{
+				SourceNodeID:     TrustedPrincipal.TrustedPrincipal,
+				TargetNodeID:     a.Id,
+				SourceLabel:      schema.Vendor,
+				TargetLabel:      schema.Role,
+				RelationshipType: schema.CanAssume,
+			})
+		}
+
+	}
+
+	for _, TrustedService := range a.TrustedServices {
+		// make relationship from trusted service to this role of type can assume
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     TrustedService.TrustedService + "_" + TrustedService.AccountID,
+			TargetNodeID:     a.Id,
+			SourceLabel:      schema.Service,
+			TargetLabel:      schema.Role,
+			RelationshipType: schema.IsTrustedBy,
+		})
+		// make relationship from this role to trusted service of type can be assumed by
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     a.Id,
+			TargetNodeID:     TrustedService.TrustedService + "_" + TrustedService.AccountID,
+			SourceLabel:      schema.Role,
+			TargetLabel:      schema.Service,
+			RelationshipType: schema.Trusts,
+		})
+	}
+
+	for _, TrustedFederatedProvider := range a.TrustedFederatedProviders {
+		// make relationship from trusted federated provider to this role of type can assume
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     TrustedFederatedProvider.TrustedFederatedProvider,
+			TargetNodeID:     a.Id,
+			SourceLabel:      schema.FederatedIdentity,
+			TargetLabel:      schema.Role,
+			RelationshipType: schema.CanAssume,
+		})
+		// make relationship from this role to trusted federated provider of type can be assumed by
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     a.Id,
+			TargetNodeID:     TrustedFederatedProvider.TrustedFederatedProvider,
+			SourceLabel:      schema.Role,
+			TargetLabel:      schema.FederatedIdentity,
+			RelationshipType: schema.CanBeAssumedBy,
+		})
+		// make relationship from trusted federated provider to this role of type can assume
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     TrustedFederatedProvider.TrustedFederatedProvider,
+			TargetNodeID:     a.Id,
+			SourceLabel:      schema.FederatedIdentity,
+			TargetLabel:      schema.Role,
+			RelationshipType: schema.IsTrustedBy,
+		})
+		// make relationship from this role to trusted federated provider of type can be assumed by
+		relationships = append(relationships, schema.Relationship{
+			SourceNodeID:     a.Id,
+			TargetNodeID:     TrustedFederatedProvider.TrustedFederatedProvider,
+			SourceLabel:      schema.Role,
+			TargetLabel:      schema.FederatedIdentity,
+			RelationshipType: schema.Trusts,
+		})
+	}
+
+	return relationships
+}
+
+// func (a *Node) GenerateAttributes() map[string]string {
+// 	attributes := make(map[string]string)
+// 	attributes["Id"] = a.Id
+// 	attributes["Name"] = a.Name
+// 	attributes["Type"] = "Role"
+// 	attributes["AccountID"] = a.AccountID
+// 	attributes["ARN"] = a.ARN
+// 	attributes["CanPrivEscToAdmin"] = a.CanPrivEscToAdmin
+// 	attributes["IsAdmin"] = a.IsAdmin
+// 	attributes["IdValue"] = a.IdValue
+// 	return attributes
+// }
+
+// func (a *Role) MergeAttributes(newAttributes map[string]string) {
+// 	if a.Id == "" {
+// 		a.Id = newAttributes["Id"]
+// 	}
+// 	if a.Name == "" {
+// 		a.Name = newAttributes["Name"]
+// 	}
+// 	if a.Type == "" {
+// 		a.Type = newAttributes["Type"]
+// 	}
+// 	if a.AccountID == "" {
+// 		a.AccountID = newAttributes["AccountID"]
+// 	}
+// 	if a.ARN == "" {
+// 		a.ARN = newAttributes["ARN"]
+// 	}
+// 	if a.CanPrivEscToAdmin == "" {
+// 		a.CanPrivEscToAdmin = newAttributes["CanPrivEscToAdmin"]
+// 	}
+// 	if a.IsAdmin == "" {
+// 		a.IsAdmin = newAttributes["IsAdmin"]
+// 	}
+// 	if a.IdValue == "" {
+// 		a.IdValue = newAttributes["IdValue"]
+// 	}
+// }
+
+func (a *Role) MakeVertices(GlobalGraph graph.Graph[string, string]) {
+
+	// make a vertex for this role as populate all of the data in the Role struct as attributes
+	err := GlobalGraph.AddVertex(
+		a.Id,
+		graph.VertexAttribute("Name", a.Name),
+		graph.VertexAttribute("Type", "Role"),
+		graph.VertexAttribute("AccountID", a.AccountID),
+		graph.VertexAttribute("ARN", a.ARN),
+		graph.VertexAttribute("CanPrivEscToAdmin", a.CanPrivEscToAdmin),
+		graph.VertexAttribute("IsAdmin", a.IsAdmin),
+		graph.VertexAttribute("IdValue", a.IdValue),
+	)
+	if err != nil {
+		if err == graph.ErrVertexAlreadyExists {
+			fmt.Println(a.Id + " already exists")
+		}
+	}
+
+}
+
+// func MakeAllVertices(GlobalRoles []Role, GlobalPmapperGraph aws.PmapperModule) (GlobalGraph graph.Graph[string, string]) {
+
+// 	// for all nodes in the GlobalPmapperGraph, check to see if they exist in the GlobalRoles slice. If they do, then update the node with the new data. If they don't, then add the node to the GlobalRoles slice
+// 	for _, node := range GlobalPmapperGraph.Nodes {
+// 		// check to see if the node exists in the GlobalRoles slice
+// 		var nodeExists bool
+// 		for _, role := range GlobalRoles {
+// 			if node.Id == role.Id {
+// 				nodeExists = true
+// 			}
+// 		}
+
+// 	// // make a vertex for this role as populate all of the data in the Role struct as attributes
+// 	// err := GlobalGraph.AddVertex(
+// 	// 	a.Id,
+// 	// 	graph.VertexAttribute("Name", a.Name),
+// 	// 	graph.VertexAttribute("Type", "Role"),
+// 	// 	graph.VertexAttribute("AccountID", a.AccountID),
+// 	// 	graph.VertexAttribute("ARN", a.ARN),
+// 	// 	graph.VertexAttribute("CanPrivEscToAdmin", a.CanPrivEscToAdmin),
+// 	// 	graph.VertexAttribute("IsAdmin", a.IsAdmin),
+// 	// 	graph.VertexAttribute("IdValue", a.IdValue),
+// 	// )
+// 	// if err != nil {
+// 	// 	if err == graph.ErrVertexAlreadyExists {
+// 	// 		fmt.Println(a.Id + " already exists")
+// 	// 	}
+// 	// }
+
+// }
+
+func (a *Role) MakeEdges(GlobalGraph graph.Graph[string, string]) []schema.Relationship {
+	var relationships []schema.Relationship
+
+	// get thisAccount id from role arn
+	var thisAccount string
+	if len(a.ARN) >= 25 {
+		thisAccount = a.ARN[13:25]
+	} else {
+		fmt.Sprintf("Could not get account number from this role arn%s", a.ARN)
+	}
+
+	for _, TrustedPrincipal := range a.TrustedPrincipals {
+		//get account id from the trusted principal arn
+		var trustedPrincipalAccount string
+		if len(TrustedPrincipal.TrustedPrincipal) >= 25 {
+			trustedPrincipalAccount = TrustedPrincipal.TrustedPrincipal[13:25]
+		} else {
+			fmt.Sprintf("Could not get account number from this TrustedPrincipal%s", TrustedPrincipal.TrustedPrincipal)
+		}
+		var PermissionsRowAccount string
+
+		// if the role trusts a principal in this same account explicitly, then the principal can assume the role
+		if thisAccount == trustedPrincipalAccount {
+			// make a CAN_ASSUME relationship between the trusted principal and this role
+
+			err := GlobalGraph.AddEdge(
+				TrustedPrincipal.TrustedPrincipal,
+				a.Id,
+				graph.EdgeAttribute("AssumeRole", "Same account explicit trust"),
+			)
+			if err != nil {
+				fmt.Println(err)
+				fmt.Println(TrustedPrincipal.TrustedPrincipal + a.Id + "Same account explicit trust")
+			}
+		}
+
+		// If the role trusts a principal in this account or another account using the :root notation, then we need to iterate over all of the rows in AllPermissionsRows to find the principals that have sts:AssumeRole permissions on this role
+		// if the role we are looking at trusts root in it's own account
+
+		if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", thisAccount)) {
+			err := GlobalGraph.AddVertex(
+				a.Id,
+				graph.VertexAttribute("Name", a.Name),
+				graph.VertexAttribute("Type", "Account"),
+				graph.VertexAttribute("AccountID", a.AccountID),
+			)
+			if err != nil {
+				if err == graph.ErrVertexAlreadyExists {
+					fmt.Println(a.Id + " already exists")
+				}
+			}
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this account
+
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+
+				if PermissionsRowAccount == thisAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if strings.EqualFold(PermissionsRow.Action, "sts:AssumeRole") ||
+						strings.EqualFold(PermissionsRow.Action, "*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:Assume*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:*") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.ARN) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+								//evaluate if the princiapl is a user or a role and set a variable accordingly
+								//var principalType schema.NodeLabel
+								if strings.EqualFold(PermissionsRow.Type, "User") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Id,
+										graph.EdgeAttribute("AssumeRole", "Same account root trust and trusted principal has permission to assume role"),
+									)
+									if err != nil {
+										fmt.Println(err)
+										fmt.Println(PermissionsRow.Arn + a.Id + "Same account root trust and trusted principal has permission to assume role")
+									}
+								} else if strings.EqualFold(PermissionsRow.Type, "Role") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Id,
+										graph.EdgeAttribute("AssumeRole", "Same account root trust and trusted principal has permission to assume role"),
+									)
+									if err != nil {
+										fmt.Println(err)
+										fmt.Println(PermissionsRow.Arn + a.Id + "Same account root trust and trusted principal has permission to assume role")
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, ":root") && TrustedPrincipal.VendorName != "" {
+			err := GlobalGraph.AddVertex(
+				a.Id,
+				graph.VertexAttribute("Name", a.Name),
+				graph.VertexAttribute("Type", "Account"),
+				graph.VertexAttribute("AccountID", a.AccountID),
+				graph.VertexAttribute("VendorName", TrustedPrincipal.VendorName),
+			)
+			if err != nil {
+				if err == graph.ErrVertexAlreadyExists {
+					fmt.Println(a.Id + " already exists")
+				}
+			}
+			// If the role trusts :root in another account and the trusted principal is a vendor, we will make a relationship between our role and a vendor node instead of a principal node
+			relationships = append(relationships, schema.Relationship{
+				SourceNodeID:     TrustedPrincipal.TrustedPrincipal,
+				TargetNodeID:     a.Id,
+				SourceLabel:      schema.Vendor,
+				TargetLabel:      schema.Role,
+				RelationshipType: schema.CanAssume,
+			})
+			err = GlobalGraph.AddEdge(
+				//TrustedPrincipal.TrustedPrincipal,
+				TrustedPrincipal.VendorName,
+				a.Id,
+				graph.EdgeAttribute("VendorAssumeRole", "Cross account root trust and trusted principal is a vendor"),
+			)
+			if err != nil {
+				fmt.Println(err)
+				fmt.Println(TrustedPrincipal.VendorName + a.Id + "Cross account root trust and trusted principal is a vendor")
+
+			}
+		} else if strings.Contains(TrustedPrincipal.TrustedPrincipal, fmt.Sprintf("%s:root", trustedPrincipalAccount)) {
+			err := GlobalGraph.AddVertex(
+				a.Id,
+				graph.VertexAttribute("Name", a.Name),
+				graph.VertexAttribute("Type", "Account"),
+				graph.VertexAttribute("AccountID", a.AccountID),
+			)
+			if err != nil {
+				if err == graph.ErrVertexAlreadyExists {
+					fmt.Println(a.Id + " already exists")
+				}
+			}
+			// iterate over all rows in AllPermissionsRows
+			for _, PermissionsRow := range common.PermissionRowsFromAllProfiles {
+				// but we only care about the rows that have arns that are in this other account
+				if len(PermissionsRow.Arn) >= 25 {
+					PermissionsRowAccount = PermissionsRow.Arn[13:25]
+				} else {
+					fmt.Sprintf("Could not get account number from this PermissionsRow%s", PermissionsRow.Arn)
+				}
+				if PermissionsRowAccount == trustedPrincipalAccount {
+					// lets only look for rows that have sts:AssumeRole permissions
+					if strings.EqualFold(PermissionsRow.Action, "sts:AssumeRole") ||
+						strings.EqualFold(PermissionsRow.Action, "*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:Assume*") ||
+						strings.EqualFold(PermissionsRow.Action, "sts:*") {
+						// lets only focus on rows that have an effect of Allow
+						if strings.EqualFold(PermissionsRow.Effect, "Allow") {
+							// if the resource is * or the resource is this role arn, then this principal can assume this role
+							if PermissionsRow.Resource == "*" || strings.Contains(PermissionsRow.Resource, a.ARN) {
+								// make a CAN_ASSUME relationship between the trusted principal and this role
+
+								if strings.EqualFold(PermissionsRow.Type, "User") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Id,
+										graph.EdgeAttribute("CrossAccountAssumeRole", "Cross account root trust and trusted principal has permission to assume role"),
+									)
+									if err != nil {
+										fmt.Println(err)
+										fmt.Println(PermissionsRow.Arn + a.Id + "Cross account root trust and trusted principal has permission to assume role")
+									}
+
+								} else if strings.EqualFold(PermissionsRow.Type, "Role") {
+									err := GlobalGraph.AddEdge(
+										PermissionsRow.Arn,
+										a.Id,
+										graph.EdgeAttribute("CrossAccountAssumeRole", "Cross account root trust and trusted principal has permission to assume role"),
+									)
+									if err != nil {
+										fmt.Println(err)
+										fmt.Println(PermissionsRow.Arn + a.Id + "Cross account root trust and trusted principal has permission to assume role")
+									}
+								}
+							}
+						}
+					}
+
+				}
+			}
+
+		}
+	}
+	// pmapper takes care of this part so commenting out for now - but leaving as a placeholder
+
+	// for _, TrustedService := range a.TrustedServices {
+	// 	// make relationship from trusted service to this role of type can assume
+	// 	// make relationship from this role to trusted service of type can be assumed by
+	// }
+
+	for _, TrustedFederatedProvider := range a.TrustedFederatedProviders {
+		// make relationship from trusted federated provider to this role of type can assume
+
+		GlobalGraph.AddVertex(
+			TrustedFederatedProvider.TrustedFederatedProvider,
+			graph.VertexAttribute("Type", "FederatedIdentity"),
+		)
+		err := GlobalGraph.AddEdge(
+			TrustedFederatedProvider.TrustedFederatedProvider,
+			a.Id,
+			graph.EdgeAttribute("FederatedAssumeRole", "Trusted federated provider"),
+		)
+		if err != nil {
+			fmt.Println(err)
+			fmt.Println(TrustedFederatedProvider.TrustedFederatedProvider + a.Id + "Trusted federated provider")
+		}
+
+	}
+
+	return relationships
+}

aws/graph/ingester/schema/models/users.go

@@ -0,0 +1,71 @@
+package models
+
+import (
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/aws/graph/ingester/schema"
+)
+
+type User struct {
+	Id                string
+	ARN               string
+	Name              string
+	IsAdmin           string
+	CanPrivEscToAdmin string
+	IdValue           string
+}
+
+func (a *User) MakeRelationships() []schema.Relationship {
+	// make a relationship between each role and the account it belongs to
+	relationships := []schema.Relationship{}
+
+	// get thisAccount id from user arn
+	var thisAccount string
+	if len(a.ARN) >= 25 {
+		thisAccount = a.ARN[13:25]
+	} else {
+		fmt.Sprintf("Could not get account number from this user arn%s", a.ARN)
+	}
+
+	relationships = append(relationships, schema.Relationship{
+		SourceNodeID:     a.Id,
+		TargetNodeID:     thisAccount,
+		SourceLabel:      schema.User,
+		TargetLabel:      schema.Account,
+		RelationshipType: schema.MemberOf,
+		Properties:       map[string]interface{}{},
+	})
+	return relationships
+}
+
+func (a *User) GenerateAttributes() map[string]string {
+	return map[string]string{
+		"Id":                a.Id,
+		"ARN":               a.ARN,
+		"Name":              a.Name,
+		"IsAdmin":           a.IsAdmin,
+		"CanPrivEscToAdmin": a.CanPrivEscToAdmin,
+		"IdValue":           a.IdValue,
+	}
+}
+
+func (a *User) MergeAttributes(other map[string]string) {
+	if other["Id"] != "" {
+		a.Id = other["Id"]
+	}
+	if other["ARN"] != "" {
+		a.ARN = other["ARN"]
+	}
+	if other["Name"] != "" {
+		a.Name = other["Name"]
+	}
+	if other["IsAdmin"] != "" {
+		a.IsAdmin = other["IsAdmin"]
+	}
+	if other["CanPrivEscToAdmin"] != "" {
+		a.CanPrivEscToAdmin = other["CanPrivEscToAdmin"]
+	}
+	if other["IdValue"] != "" {
+		a.IdValue = other["IdValue"]
+	}
+}

aws/graph/ingester/schema/schema.go

@@ -0,0 +1,148 @@
+package schema
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/goccy/go-json"
+	"golang.org/x/exp/slices"
+)
+
+type RelationshipType string
+type NodeLabel string
+
+type Node interface {
+	MakeRelationships() []Relationship
+}
+
+type Relationship struct {
+	SourceNodeID     string                 `json:"sourceNodeId"`
+	TargetNodeID     string                 `json:"targetNodeId"`
+	SourceLabel      NodeLabel              `json:"sourceLabel"`
+	TargetLabel      NodeLabel              `json:"targetLabel"`
+	RelationshipType RelationshipType       `json:"relationshipType"`
+	Properties       map[string]interface{} `json:"properties"`
+	SourceProperty   string                 `json:"sourceProperty"`
+	TargetProperty   string                 `json:"targetProperty"`
+}
+
+const (
+	// Relationships
+
+	AssociatedTo          RelationshipType = "AssociatedTo"
+	AttachedTo            RelationshipType = "AttachedTo"
+	Authenticates         RelationshipType = "Authenticates"
+	ConnectedTo           RelationshipType = "ConnectedTo"
+	Contains              RelationshipType = "Contains"
+	Exposes               RelationshipType = "Exposes"
+	HasAccess             RelationshipType = "HasAccess"
+	HasConfig             RelationshipType = "HasConfig"
+	HasDisk               RelationshipType = "HasDisk"
+	HasInstance           RelationshipType = "HasInstance"
+	HasRbac               RelationshipType = "HasRbac"
+	HasRole               RelationshipType = "HasRole"
+	Manages               RelationshipType = "Manages"
+	MemberOf              RelationshipType = "MemberOf"
+	Owns                  RelationshipType = "Owns"
+	Represents            RelationshipType = "Represents"
+	Trusts                RelationshipType = "Trusts"
+	IsTrustedBy           RelationshipType = "IsTrustedBy"
+	CanAssume             RelationshipType = "CanAssume"
+	CanAssumeCrossAccount RelationshipType = "CanAssumeCrossAccount"
+	CanBeAssumedBy        RelationshipType = "CanBeAssumedBy"
+	CanBeAssumedByTest    RelationshipType = "CanBeAssumedByTest"
+	CanAssumeTest         RelationshipType = "CanAssumeTest"
+	CanAccess             RelationshipType = "CAN_ACCESS"
+)
+
+const (
+	// Node labels
+	Resource          NodeLabel = "Resource"
+	Account           NodeLabel = "Account"
+	Organization      NodeLabel = "Org"
+	Service           NodeLabel = "Service"
+	Principal         NodeLabel = "Principal"
+	Vendor            NodeLabel = "Vendor"
+	Role              NodeLabel = "Role"
+	Group             NodeLabel = "Group"
+	User              NodeLabel = "User"
+	FederatedIdentity NodeLabel = "FederatedIdentity"
+)
+
+func AsNeo4j(object *Node) map[string]interface{} {
+
+	// We don't want to include these fields in the map
+	fieldsToExclude := []string{"members", "owners", "appRoles", "registeredUsers"}
+	objectMap, err := json.Marshal(object)
+	if err != nil {
+		return nil
+	}
+
+	var objectMapInterface map[string]interface{}
+	json.Unmarshal(objectMap, &objectMapInterface)
+	for _, field := range fieldsToExclude {
+		delete(objectMapInterface, field)
+	}
+
+	// We need to convert flatten maps to an array
+	// We'll want to keep order of the keys for things like extensionAttributes
+	for key, value := range objectMapInterface {
+		_, isMap := value.(map[string]interface{})
+		if isMap {
+			var valueArray []string
+			var keys []string
+
+			for k := range value.(map[string]interface{}) {
+				keys = append(keys, k)
+			}
+			slices.Sort(keys)
+
+			for _, k := range keys {
+				valueString := value.(map[string]interface{})[k].(string)
+				if valueString != "" {
+					valueArray = append(valueArray, k, valueString)
+				}
+			}
+			objectMapInterface[key] = valueArray
+		}
+	}
+	return objectMapInterface
+}
+
+func ConvertCustomTypesToNeo4j(node interface{}) (map[string]interface{}, error) {
+	result := make(map[string]interface{})
+	val := reflect.ValueOf(node)
+
+	// Handling pointers to structs or interfaces
+	for val.Kind() == reflect.Ptr || val.Kind() == reflect.Interface {
+		val = val.Elem()
+	}
+
+	// Check if the value is valid and if it's a struct
+	if !val.IsValid() || val.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("invalid input: not a struct or a pointer to a struct")
+	}
+
+	for i := 0; i < val.NumField(); i++ {
+		field := val.Field(i)
+		fieldType := val.Type().Field(i) // Get the StructField
+
+		// Check if the field is a struct or slice of structs and not one of the basic types
+		if (fieldType.Type.Kind() == reflect.Struct ||
+			(fieldType.Type.Kind() == reflect.Slice && fieldType.Type.Elem().Kind() == reflect.Struct)) &&
+			fieldType.Type != reflect.TypeOf([]string{}) &&
+			fieldType.Type != reflect.TypeOf([]int{}) &&
+			fieldType.Type != reflect.TypeOf([]bool{}) {
+			// Convert complex field to JSON string
+			jsonStr, err := json.Marshal(field.Interface())
+			if err != nil {
+				return nil, err
+			}
+			result[fieldType.Name] = string(jsonStr)
+		} else {
+			// Directly use the field for primitive types
+			result[fieldType.Name] = field.Interface()
+		}
+	}
+	return result, nil
+}

aws/iam-simulator.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -20,13 +21,16 @@ import (
 
 type IamSimulatorModule struct {
 	// General configuration data
-	IAMClient    sdk.AWSIAMClientInterface
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	IAMClient     sdk.AWSIAMClientInterface
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines         int
+	AWSProfileProvided string
+	AWSProfileStub     string
+	WrapTable          bool
 
 	// Main module data
 	SimulatorResults []SimulatorResult
@@ -64,23 +68,28 @@ var (
 	TxtLogger = internal.TxtLogger()
 )
 
-func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string, resource string, outputFormat string, outputDirectory string, verbosity int) {
+func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string, resource string, outputDirectory string, verbosity int) {
 
-	// These stuct values are used by the output module
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "iam-simulator"
 	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
 		"module": m.output.CallingModule,
 	})
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileStub, aws.ToString(m.Caller.Account)))
+	var filename string
 	var actionList []string
 	var pmapperCommands []string
 	var pmapperOutFileName string
+	var inputArn string
 
-	if m.AWSProfile == "" {
-		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	if m.AWSProfileProvided == "" {
+		m.AWSProfileStub = internal.BuildAWSPath(m.Caller)
+	} else {
+		m.AWSProfileStub = m.AWSProfileProvided
 	}
+
 	wg := new(sync.WaitGroup)
 	// Create a channel to signal the spinner aka task status goroutine to finish
 	spinnerDone := make(chan bool)
@@ -99,37 +108,69 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 	if principal != "" {
 		if action != "" {
 			// The user specified a specific --principal and a specific --action
-			fmt.Printf("[%s][%s] Checking to see if %s can do %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), principal, action)
-			m.output.FullFilename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
+			fmt.Printf("[%s][%s] Checking to see if %s can do %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), principal, action)
+			filename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
 			actionList = append(actionList, action)
-			m.getPolicySimulatorResult((&principal), actionList, resource, dataReceiver)
+			// if user supplied a principal name without the arn, try to create the arn as a user and as a role and run both
+			if !strings.Contains(principal, "arn:") {
+				// try as a role
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:role/%s", aws.ToString(m.Caller.Account), principal)
+				m.getPolicySimulatorResult((&inputArn), actionList, resource, dataReceiver)
+				// try as a user
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:user/%s", aws.ToString(m.Caller.Account), principal)
+				m.getPolicySimulatorResult((&inputArn), actionList, resource, dataReceiver)
+			} else {
+				// the arn was supplied so just run it
+				m.getPolicySimulatorResult((&principal), actionList, resource, dataReceiver)
+			}
 
 		} else {
 			// The user specified a specific --principal, but --action was empty
-			fmt.Printf("[%s][%s] Checking to see if %s can do any actions of interest.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), principal)
-			m.output.FullFilename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
-			m.getPolicySimulatorResult((&principal), defaultActionNames, resource, dataReceiver)
+			fmt.Printf("[%s][%s] Checking to see if %s can do any actions of interest.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), principal)
+			filename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
+
+			// if user supplied a principal name without the arn, try to create the arn as a user and as a role and run both
+			if !strings.Contains(principal, "arn:") {
+				// try as a role
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:role/%s", aws.ToString(m.Caller.Account), principal)
+				m.getPolicySimulatorResult((&inputArn), defaultActionNames, resource, dataReceiver)
+				// try as a user
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:user/%s", aws.ToString(m.Caller.Account), principal)
+				m.getPolicySimulatorResult((&inputArn), defaultActionNames, resource, dataReceiver)
+			} else {
+				// the arn was supplied so just run it
+				m.getPolicySimulatorResult((&principal), defaultActionNames, resource, dataReceiver)
+			}
+
 		}
 	} else {
 		if action != "" {
 			// The did not specify a specific --principal, but they did specify an --action
-			fmt.Printf("[%s][%s] Checking to see if any principal can do %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), action)
-			m.output.FullFilename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
+			fmt.Printf("[%s][%s] Checking to see if any principal can do %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), action)
+			filename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
 			actionList = append(actionList, action)
 			wg.Add(1)
 			m.getIAMUsers(wg, actionList, resource, dataReceiver)
 			wg.Add(1)
 			m.getIAMRoles(wg, actionList, resource, dataReceiver)
-			pmapperOutFileName = filepath.Join(m.output.FullFilename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
-			pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfile, action, resource, pmapperOutFileName))
+			pmapperOutFileName = filepath.Join(filename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
+			if m.AWSProfileProvided != "" {
+				pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfileProvided, action, resource, pmapperOutFileName))
+			} else {
+				pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper query \"who can do %s with %s\" | tee %s\n", action, resource, pmapperOutFileName))
+			}
 		} else {
 			// Both --principal and --action are empty. Run in default mode!
-			fmt.Printf("[%s][%s] Running multiple iam-simulator queries for account %s. (This command can be pretty slow, FYI)\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
-			m.output.FullFilename = m.output.CallingModule
+			fmt.Printf("[%s][%s] Running multiple iam-simulator queries for account %s. (This command can be pretty slow, FYI)\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), aws.ToString(m.Caller.Account))
+			filename = m.output.CallingModule
 			m.executeChecks(wg, resource, dataReceiver)
 			for _, action := range defaultActionNames {
-				pmapperOutFileName = filepath.Join(m.output.FullFilename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
-				pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfile, action, resource, pmapperOutFileName))
+				pmapperOutFileName = filepath.Join(filename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
+				if m.AWSProfileProvided != "" {
+					pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfileProvided, action, resource, pmapperOutFileName))
+				} else {
+					pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper query \"who can do %s with %s\" | tee %s\n", action, resource, pmapperOutFileName))
+				}
 			}
 
 		}
@@ -149,11 +190,36 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 
 	// Regardless of what options were selected, for now at least, we will always print the data using the output module (table/csv mode)
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Principal",
 		"Query",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Principal",
+			"Query",
+		}
+	} else {
+		tableCols = []string{
+			"Principal",
+			"Query",
+		}
+	}
+
 	sort.Slice(m.SimulatorResults, func(i, j int) bool {
 		return m.SimulatorResults[i].Query < m.SimulatorResults[j].Query
 	})
@@ -163,7 +229,7 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.SimulatorResults[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.SimulatorResults[i].Principal,
 				m.SimulatorResults[i].Query,
 			},
@@ -171,9 +237,8 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileStub, aws.ToString(m.Caller.Account)))
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -182,14 +247,15 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      filename,
 		})
-		o.PrefixIdentifier = m.AWSProfile
-		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.PrefixIdentifier = m.AWSProfileStub
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileStub, aws.ToString(m.Caller.Account)))
 		o.WriteFullOutput(o.Table.TableFiles, nil)
-		fmt.Printf("[%s][%s] We suggest running the pmapper commands in the loot file to get the same information but taking privesc paths into account.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+		fmt.Printf("[%s][%s] We suggest running the pmapper commands in the loot file to get the same information but taking privesc paths into account.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub))
 		// fmt.Printf("[%s]\t\tpmapper --profile %s graph create\n", cyan(m.output.CallingModule),  cyan(m.AWSProfile), m.AWSProfile)
 		// for _, line := range pmapperCommands {
 		// 	fmt.Printf("[%s]\t\t%s", cyan(m.output.CallingModule),  cyan(m.AWSProfile), line)
@@ -197,9 +263,9 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 		m.writeLoot(o.Table.DirectoryName, verbosity, pmapperCommands)
 
 	} else if principal != "" || action != "" {
-		fmt.Printf("[%s][%s] No allowed permissions identified, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+		fmt.Printf("[%s][%s] No allowed permissions identified, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub))
 	}
-	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), m.output.CallingModule)
 }
 
 func (m *IamSimulatorModule) writeLoot(outputDirectory string, verbosity int, pmapperCommands []string) {
@@ -212,7 +278,11 @@ func (m *IamSimulatorModule) writeLoot(outputDirectory string, verbosity int, pm
 
 	outFile := filepath.Join(path, "iam-simulator-pmapper-commands.txt")
 	var out string
-	out = out + fmt.Sprintf("pmapper --profile %s graph create\n", m.AWSProfile)
+	if m.AWSProfileProvided != "" {
+		out = out + fmt.Sprintf("pmapper --profile %s graph create\n", m.AWSProfileProvided)
+	} else {
+		out = out + fmt.Sprintf("pmapper graph create\n")
+	}
 	for _, line := range pmapperCommands {
 		out = out + line
 	}
@@ -224,12 +294,12 @@ func (m *IamSimulatorModule) writeLoot(outputDirectory string, verbosity int, pm
 
 	if verbosity > 2 {
 		fmt.Println()
-		fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("We suggest running these pmapper commands in the loot file to get the same information but taking privesc paths into account."))
+		fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), green("We suggest running these pmapper commands in the loot file to get the same information but taking privesc paths into account."))
 		fmt.Print(out)
-		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("End of loot file."))
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), green("End of loot file."))
 	}
 
-	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), outFile)
+	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), outFile)
 
 }
 

aws/instances.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -13,7 +14,6 @@ import (
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
@@ -24,11 +24,14 @@ import (
 
 type InstancesModule struct {
 	// General configuration data
-	EC2Client                 *ec2.Client
-	IAMClient                 sdk.AWSIAMClientInterface
-	Caller                    sts.GetCallerIdentityOutput
-	AWSRegions                []string
-	OutputFormat              string
+	EC2Client           sdk.AWSEC2ClientInterface
+	IAMClient           sdk.AWSIAMClientInterface
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	AWSOutputType       string
+	AWSTableCols        string
+	PmapperDataBasePath string
+
 	Goroutines                int
 	UserDataAttributesOnly    bool
 	AWSProfile                string
@@ -63,8 +66,8 @@ type MappedInstance struct {
 	CanPrivEsc       string
 }
 
-func (m *InstancesModule) Instances(filter string, outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *InstancesModule) Instances(filter string, outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "instances"
@@ -92,8 +95,8 @@ func (m *InstancesModule) Instances(filter string, outputFormat string, outputDi
 
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -147,9 +150,9 @@ func (m *InstancesModule) Instances(filter string, outputFormat string, outputDi
 	// This conditional block will either dump the userData attribute content or the general instances data, depending on what you select via command line.
 	//fmt.Printf("\n[*] Preparing output...\n\n")
 	if m.UserDataAttributesOnly {
-		m.printInstancesUserDataAttributesOnly(outputFormat, outputDirectory, dataReceiver)
+		m.printInstancesUserDataAttributesOnly(outputDirectory, dataReceiver)
 	} else {
-		m.printGeneralInstanceData(outputFormat, outputDirectory, dataReceiver, verbosity)
+		m.printGeneralInstanceData(outputDirectory, dataReceiver, verbosity)
 	}
 
 }
@@ -167,7 +170,7 @@ func (m *InstancesModule) Receiver(receiver chan MappedInstance, receiverDone ch
 	}
 }
 
-func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat string, outputDirectory string, dataReceiver chan MappedInstance) {
+func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputDirectory string, dataReceiver chan MappedInstance) {
 	defer func() {
 		m.output.CallingModule = "instances"
 	}()
@@ -217,12 +220,39 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
 	}
 }
 
-func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDirectory string, dataReceiver chan MappedInstance, verbosity int) {
+func (m *InstancesModule) printGeneralInstanceData(outputDirectory string, dataReceiver chan MappedInstance, verbosity int) {
 	// Prepare Table headers
 	//m.output.Headers = table.Row{
-	if m.pmapperError == nil {
+	m.output.Headers = []string{
+		"Account",
+		//"ID",
+		"Name",
+		//"Arn",
+		"ID",
+		"Zone",
+		"State",
+		"External IP",
+		"Internal IP",
+		"Role",
+		"IsAdminRole?",
+		"CanPrivEscToAdmin?",
+	}
 
-		m.output.Headers = []string{
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
 			//"ID",
 			"Name",
 			//"Arn",
@@ -235,8 +265,9 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
 		}
+		// Otherwise, use the default columns.
 	} else {
-		m.output.Headers = []string{
+		tableCols = []string{
 			//"ID",
 			"Name",
 			//"Arn",
@@ -247,59 +278,40 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
 			"Internal IP",
 			"Role",
 			"IsAdminRole?",
-			//"CanPrivEscToAdmin?",
+			"CanPrivEscToAdmin?",
 		}
 	}
 
-	//Table rows
-	if m.pmapperError == nil {
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
 
-		for _, instance := range m.MappedInstances {
-			m.output.Body = append(
-				m.output.Body,
-				//table.Row{
-				[]string{
-					//instance.ID,
-					instance.Name,
-					//instance.Arn,
-					instance.ID,
-					instance.AvailabilityZone,
-					instance.State,
-					instance.ExternalIP,
-					instance.PrivateIP,
-					instance.Role,
-					instance.Admin,
-					instance.CanPrivEsc,
-				},
-			)
-		}
-	} else {
-		for _, instance := range m.MappedInstances {
-			m.output.Body = append(
-				m.output.Body,
-				//table.Row{
-				[]string{
-					//instance.ID,
-					instance.Name,
-					//instance.Arn,
-					instance.ID,
-					instance.AvailabilityZone,
-					instance.State,
-					instance.ExternalIP,
-					instance.PrivateIP,
-					instance.Role,
-					instance.Admin,
-					//instance.CanPrivEsc,
-				},
-			)
-		}
+	//Table rows
+	for _, instance := range m.MappedInstances {
+		m.output.Body = append(
+			m.output.Body,
+			//table.Row{
+			[]string{
+				aws.ToString(m.Caller.Account),
+				//instance.ID,
+				instance.Name,
+				//instance.Arn,
+				instance.ID,
+				instance.AvailabilityZone,
+				instance.State,
+				instance.ExternalIP,
+				instance.PrivateIP,
+				instance.Role,
+				instance.Admin,
+				instance.CanPrivEsc,
+			},
+		)
 	}
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		////m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 
 		//m.writeLoot(m.output.FilePath)
 		o := internal.OutputClient{
@@ -310,9 +322,10 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -440,27 +453,17 @@ func (m *InstancesModule) executeChecks(instancesToSearch []string, r string, wg
 }
 
 func (m *InstancesModule) getInstanceUserDataAttribute(instanceID *string, region string) (userData *string, err error) {
-
-	Attributes, err := m.EC2Client.DescribeInstanceAttribute(
-		context.TODO(),
-		&ec2.DescribeInstanceAttributeInput{
-			InstanceId: instanceID,
-			Attribute:  types.InstanceAttributeName("userData"),
-		},
-		func(o *ec2.Options) {
-			o.Region = region
-		},
-	)
+	UserData, err := sdk.CachedEC2DescribeInstanceAttributeUserData(m.EC2Client, aws.ToString(m.Caller.Account), region, aws.ToString(instanceID))
 
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
 		return nil, err
 	} else {
-		if Attributes.UserData.Value == nil {
+		if UserData == "" {
 			return aws.String("NoUserData"), nil
 		} else {
-			data, _ := base64.StdEncoding.DecodeString(*Attributes.UserData.Value)
+			data, _ := base64.StdEncoding.DecodeString(UserData)
 			return aws.String(string(data)), nil
 		}
 	}
@@ -470,53 +473,27 @@ func (m *InstancesModule) getInstanceUserDataAttribute(instanceID *string, regio
 func (m *InstancesModule) getDescribeInstances(instancesToSearch []string, region string, dataReceiver chan MappedInstance) {
 
 	// The "PaginationControl" value is nil when there's no more data to return.
-	var PaginationControl *string
-	for {
 
-		DescribeInstances, err := m.EC2Client.DescribeInstances(
-			context.TODO(),
-			&(ec2.DescribeInstancesInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *ec2.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
+	Instances, err := sdk.CachedEC2DescribeInstances(m.EC2Client, aws.ToString(m.Caller.Account), region)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, instance := range Instances {
+		if instancesToSearch[0] == "all" || internal.Contains(aws.ToString(instance.InstanceId), instancesToSearch) {
+			m.loadInstanceData(instance, region, dataReceiver)
 		}
-
-		for _, reservation := range DescribeInstances.Reservations {
-			accountId := reservation.OwnerId
-
-			for _, instance := range reservation.Instances {
-
-				if instancesToSearch[0] == "all" || internal.Contains(aws.ToString(instance.InstanceId), instancesToSearch) {
-					m.loadInstanceData(instance, region, accountId, dataReceiver)
-				}
-			}
-		}
-
-		// The "NextToken" value is nil when there's no more data to return.
-		if DescribeInstances.NextToken != nil {
-			PaginationControl = DescribeInstances.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
 	}
 }
 
-func (m *InstancesModule) loadInstanceData(instance types.Instance, region string, accountId *string, dataReceiver chan MappedInstance) {
+func (m *InstancesModule) loadInstanceData(instance types.Instance, region string, dataReceiver chan MappedInstance) {
 
 	var profile string
 	var externalIP string
-	var name string = ""
 	var adminRole string = ""
-	var roleArn string = ""
+	var profileArn, profileName, name string
 
 	// The name is in a tag so we have to do this to grab the value from the right tag
 	for _, tag := range instance.Tags {
@@ -536,34 +513,50 @@ func (m *InstancesModule) loadInstanceData(instance types.Instance, region strin
 
 	if instance.IamInstanceProfile == nil {
 		profile = "NoInstanceProfile"
-	} else {
-		// This returns only the role name without the preceding forward slash.
-		profileARN := aws.ToString(instance.IamInstanceProfile.Arn)
-		profileID := aws.ToString(instance.IamInstanceProfile.Id)
-		profile = strings.Split(profileARN, "/")[len(strings.Split(profileARN, "/"))-1]
-
-		if roles, ok := m.InstanceProfileToRolesMap[profileID]; ok {
-			for _, role := range roles {
-				roleArn = aws.ToString(role.Arn)
-			}
+		dataReceiver <- MappedInstance{
+			ID:               aws.ToString(instance.InstanceId),
+			Name:             aws.ToString(&name),
+			Arn:              fmt.Sprintf("arn:aws:ec2:%s:%s:instance/%s", region, aws.ToString(m.Caller.Account), aws.ToString(instance.InstanceId)),
+			AvailabilityZone: aws.ToString(instance.Placement.AvailabilityZone),
+			State:            string(instance.State.Name),
+			ExternalIP:       externalIP,
+			PrivateIP:        aws.ToString(instance.PrivateIpAddress),
+			Profile:          profile,
+			Role:             "",
+			Region:           region,
+			Admin:            adminRole,
+			CanPrivEsc:       "",
 		}
 
-	}
-	dataReceiver <- MappedInstance{
-		ID:               aws.ToString(instance.InstanceId),
-		Name:             aws.ToString(&name),
-		Arn:              fmt.Sprintf("arn:aws:ec2:%s:%s:instance/%s", region, aws.ToString(accountId), aws.ToString(instance.InstanceId)),
-		AvailabilityZone: aws.ToString(instance.Placement.AvailabilityZone),
-		State:            string(instance.State.Name),
-		ExternalIP:       externalIP,
-		PrivateIP:        aws.ToString(instance.PrivateIpAddress),
-		Profile:          profile,
-		Role:             roleArn,
-		Region:           region,
-		Admin:            adminRole,
-		CanPrivEsc:       "",
-	}
+	} else {
+		profileArn = aws.ToString(instance.IamInstanceProfile.Arn)
 
+		// Extracting instance profile name from ARN
+		profileName = strings.Split(profileArn, "/")[len(strings.Split(profileArn, "/"))-1]
+
+		// Describe the IAM instance profile
+		profileOutput, err := sdk.CachedIamGetInstanceProfile(m.IAMClient, aws.ToString(m.Caller.Account), profileName)
+		if err != nil {
+			log.Printf("failed to get instance profile for %s, %v", profileArn, err)
+		}
+
+		for _, role := range profileOutput.Roles {
+			dataReceiver <- MappedInstance{
+				ID:               aws.ToString(instance.InstanceId),
+				Name:             aws.ToString(&name),
+				Arn:              fmt.Sprintf("arn:aws:ec2:%s:%s:instance/%s", region, aws.ToString(m.Caller.Account), aws.ToString(instance.InstanceId)),
+				AvailabilityZone: aws.ToString(instance.Placement.AvailabilityZone),
+				State:            string(instance.State.Name),
+				ExternalIP:       externalIP,
+				PrivateIP:        aws.ToString(instance.PrivateIpAddress),
+				Profile:          profile,
+				Role:             aws.ToString(role.Arn),
+				Region:           region,
+				Admin:            adminRole,
+				CanPrivEsc:       "",
+			}
+		}
+	}
 }
 
 func (m *InstancesModule) getRolesFromInstanceProfiles() {

aws/lambda.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -25,16 +26,20 @@ type LambdasModule struct {
 	LambdaClient *lambda.Client
 	IAMClient    sdk.AWSIAMClientInterface
 
-	Caller         sts.GetCallerIdentityOutput
-	AWSRegions     []string
-	OutputFormat   string
-	Goroutines     int
-	AWSProfile     string
-	SkipAdminCheck bool
-	WrapTable      bool
-	pmapperMod     PmapperModule
-	pmapperError   error
-	iamSimClient   IamSimulatorModule
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines          int
+	AWSProfile          string
+	SkipAdminCheck      bool
+	WrapTable           bool
+	pmapperMod          PmapperModule
+	pmapperError        error
+	PmapperDataBasePath string
+
+	iamSimClient IamSimulatorModule
 
 	// Main module data
 	Lambdas        []Lambda
@@ -49,15 +54,16 @@ type Lambda struct {
 	Region     string
 	Type       string
 	Name       string
+	Arn        string
 	Role       string
 	Admin      string
 	CanPrivEsc string
 	Public     string
 }
 
-func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string, verbosity int) {
+func (m *LambdasModule) PrintLambdas(outputDirectory string, verbosity int) {
 
-	// These stuct values are used by the output module
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "lambda"
@@ -71,8 +77,8 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 
 	fmt.Printf("[%s][%s] Enumerating lambdas for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -123,24 +129,52 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 	<-receiverDone
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
-	if m.pmapperError == nil {
-		m.output.Headers = []string{
-			"Service",
+	m.output.Headers = []string{
+		"Account",
+		"Region",
+		"Name",
+		"Arn",
+		"Role",
+		"IsAdminRole?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
 			"Region",
-			"Resource",
+			"Arn",
 			"Role",
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
 		}
+		// Otherwise, use the default columns.
 	} else {
-		m.output.Headers = []string{
+		tableCols = []string{
 			"Service",
 			"Region",
-			"Resource",
+			"Name",
 			"Role",
 			"IsAdminRole?",
+			"CanPrivEscToAdmin?",
 		}
 	}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
 
 	sort.Slice(m.Lambdas, func(i, j int) bool {
 		return m.Lambdas[i].AWSService < m.Lambdas[j].AWSService
@@ -149,41 +183,24 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 	// Table rows
 	for i := range m.Lambdas {
 
-		if m.pmapperError == nil {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Lambdas[i].AWSService,
-					m.Lambdas[i].Region,
-					//m.Lambdas[i].Type,
-					m.Lambdas[i].Name,
-					m.Lambdas[i].Role,
-					m.Lambdas[i].Admin,
-					m.Lambdas[i].CanPrivEsc,
-					//m.Lambdas[i].Public,
-				},
-			)
-		} else {
-			m.output.Body = append(
-				m.output.Body,
-				[]string{
-					m.Lambdas[i].AWSService,
-					m.Lambdas[i].Region,
-					//m.Lambdas[i].Type,
-					m.Lambdas[i].Name,
-					m.Lambdas[i].Role,
-					m.Lambdas[i].Admin,
-					//m.Lambdas[i].CanPrivEsc,
-					//m.Lambdas[i].Public,
-				},
-			)
-		}
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				aws.ToString(m.Caller.Account),
+				m.Lambdas[i].Region,
+				//m.Lambdas[i].Type,
+				m.Lambdas[i].Name,
+				m.Lambdas[i].Arn,
+				m.Lambdas[i].Role,
+				m.Lambdas[i].Admin,
+				m.Lambdas[i].CanPrivEsc,
+				//m.Lambdas[i].Public,
+			},
+		)
 
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -192,9 +209,10 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -300,13 +318,14 @@ func (m *LambdasModule) getLambdasPerRegion(r string, wg *sync.WaitGroup, semaph
 	}
 
 	for _, function := range functions {
-		//arn := aws.ToString(function.FunctionArn)
+		arn := aws.ToString(function.FunctionArn)
 		name := aws.ToString(function.FunctionName)
 		role := aws.ToString(function.Role)
 
 		dataReceiver <- Lambda{
 			AWSService: "Lambda",
 			Name:       name,
+			Arn:        arn,
 			Region:     r,
 			Type:       "",
 			Role:       role,

aws/network-ports.go

@@ -65,13 +65,15 @@ type NetworkPortsModule struct {
 	LightsailClient   *lightsail.Client
 	RDSClient         *rds.Client
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
-	Verbosity    int
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
+	Verbosity  int
 
 	// Main module data
 	IPv4_Private   []NetworkService
@@ -136,8 +138,8 @@ var naclToSG = map[string]string{
 
 var validSecurityGroupProtocols = []string{"-1", "tcp", "udp"}
 
-func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirectory string) {
-	// These stuct values are used by the output module
+func (m *NetworkPortsModule) PrintNetworkPorts(outputDirectory string) {
+	// These struct values are used by the output module
 	m.output.Verbosity = m.Verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "network-ports"
@@ -184,6 +186,7 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
 	m.output.Headers = []string{
+		"Account",
 		"Service",
 		"Region",
 		"Protocol",
@@ -191,6 +194,36 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 		"Ports",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Service",
+			"Region",
+			"Protocol",
+			"Host",
+			"Ports",
+		}
+	} else {
+		tableCols = []string{
+			"Service",
+			"Region",
+			"Protocol",
+			"Host",
+			"Ports",
+		}
+	}
+
 	// Table rows
 	for _, arr := range [][]NetworkService{m.IPv4_Private, m.IPv4_Public, m.IPv6} {
 		for _, i := range arr {
@@ -198,6 +231,7 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 				m.output.Body = append(
 					m.output.Body,
 					[]string{
+						aws.ToString(m.Caller.Account),
 						i.AWSService,
 						i.Region,
 						i.Protocol,
@@ -211,9 +245,6 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 
 	if len(m.IPv4_Private) > 0 || len(m.IPv4_Public) > 0 || len(m.IPv6) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//internal.OutputSelector(m.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath)
 		o := internal.OutputClient{
 			Verbosity:     m.Verbosity,
 			CallingModule: m.output.CallingModule,
@@ -222,9 +253,10 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -742,7 +774,7 @@ func (m *NetworkPortsModule) getElastiCacheNetworkPortsPerRegion(r string, dataR
 		// Memcached
 		if cluster.ConfigurationEndpoint != nil {
 			ipv4_private = addHost(ipv4_private, aws.ToString(cluster.ConfigurationEndpoint.Address))
-			tcpPortsInts = addPort(tcpPortsInts, cluster.ConfigurationEndpoint.Port)
+			tcpPortsInts = addPort(tcpPortsInts, aws.ToInt32(cluster.ConfigurationEndpoint.Port))
 		} else {
 			replicationGroupId := aws.ToString(cluster.ReplicationGroupId)
 			for _, group := range nodes {
@@ -751,7 +783,7 @@ func (m *NetworkPortsModule) getElastiCacheNetworkPortsPerRegion(r string, dataR
 						// Primary
 						if g.PrimaryEndpoint != nil && !strContains(reportedClusters, aws.ToString(g.PrimaryEndpoint.Address)) {
 							ipv4_private = addHost(ipv4_private, aws.ToString(g.PrimaryEndpoint.Address))
-							tcpPortsInts = addPort(tcpPortsInts, g.PrimaryEndpoint.Port)
+							tcpPortsInts = addPort(tcpPortsInts, aws.ToInt32(g.PrimaryEndpoint.Port))
 
 							reportedClusters = addHost(reportedClusters, aws.ToString(g.PrimaryEndpoint.Address))
 						}
@@ -759,7 +791,7 @@ func (m *NetworkPortsModule) getElastiCacheNetworkPortsPerRegion(r string, dataR
 						// Reader
 						if g.ReaderEndpoint != nil && !strContains(reportedClusters, aws.ToString(g.ReaderEndpoint.Address)) {
 							ipv4_private = addHost(ipv4_private, aws.ToString(g.ReaderEndpoint.Address))
-							tcpPortsInts = addPort(tcpPortsInts, g.ReaderEndpoint.Port)
+							tcpPortsInts = addPort(tcpPortsInts, aws.ToInt32(g.ReaderEndpoint.Port))
 
 							reportedClusters = addHost(reportedClusters, aws.ToString(g.ReaderEndpoint.Address))
 						}
@@ -769,7 +801,7 @@ func (m *NetworkPortsModule) getElastiCacheNetworkPortsPerRegion(r string, dataR
 							if aws.ToString(m.CacheClusterId) == aws.ToString(cluster.CacheClusterId) {
 								if m.ReadEndpoint != nil {
 									ipv4_private = addHost(ipv4_private, aws.ToString(m.ReadEndpoint.Address))
-									tcpPortsInts = addPort(tcpPortsInts, m.ReadEndpoint.Port)
+									tcpPortsInts = addPort(tcpPortsInts, aws.ToInt32(m.ReadEndpoint.Port))
 								}
 							}
 						}
@@ -1047,7 +1079,7 @@ func (m *NetworkPortsModule) getRdsNetworkPortsPerRegion(r string, dataReceiver
 	for _, instance := range DBInstances {
 		if aws.ToString(instance.DBInstanceStatus) == "available" {
 			host := []string{aws.ToString(instance.Endpoint.Address)}
-			var port int32 = instance.Endpoint.Port
+			var port int32 = aws.ToInt32(instance.Endpoint.Port)
 
 			var groups []SecurityGroup
 			for _, group := range instance.VpcSecurityGroups {

aws/org.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
@@ -19,12 +20,14 @@ type OrgModule struct {
 	OrganizationsClient sdk.OrganizationsClientInterface
 	Caller              sts.GetCallerIdentityOutput
 	AWSRegions          []string
-	OutputFormat        string
-	Goroutines          int
-	AWSProfile          string
-	SkipAdminCheck      bool
-	WrapTable           bool
-	DescribeOrgOutput   *types.Organization
+	AWSOutputType       string
+	AWSTableCols        string
+
+	Goroutines        int
+	AWSProfile        string
+	SkipAdminCheck    bool
+	WrapTable         bool
+	DescribeOrgOutput *types.Organization
 
 	// Main module data
 	Accounts       []Account
@@ -52,8 +55,8 @@ type Account struct {
 	OrgId               string
 }
 
-func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *OrgModule) PrintOrgAccounts(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	var err error
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
@@ -85,6 +88,7 @@ func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string
 		}
 
 		m.output.Headers = []string{
+			"Account",
 			"Name",
 			"ID",
 			"isManagementAccount?",
@@ -92,12 +96,44 @@ func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string
 			"Email",
 		}
 
+		// If the user specified table columns, use those.
+		// If the user specified -o wide, use the wide default cols for this module.
+		// Otherwise, use the hardcoded default cols for this module.
+		var tableCols []string
+		// If the user specified table columns, use those.
+		if m.AWSTableCols != "" {
+			// If the user specified wide as the output format, use these columns.
+			// remove any spaces between any commas and the first letter after the commas
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+			m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+			tableCols = strings.Split(m.AWSTableCols, ",")
+		} else if m.AWSOutputType == "wide" {
+			tableCols = []string{
+				"Account",
+				"Name",
+				"ID",
+				"isManagementAccount?",
+				"Status",
+				"Email",
+			}
+			// Otherwise, use the default columns.
+		} else {
+			tableCols = []string{
+				"Name",
+				"ID",
+				"isManagementAccount?",
+				"Status",
+				"Email",
+			}
+		}
+
 		// Table rows
 
 		for i := range m.Accounts {
 			m.output.Body = append(
 				m.output.Body,
 				[]string{
+					aws.ToString(m.Caller.Account),
 					m.Accounts[i].Name,
 					m.Accounts[i].Id,
 					strconv.FormatBool(m.Accounts[i].isManagementAccount),
@@ -109,8 +145,6 @@ func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string
 
 		if len(m.output.Body) > 0 {
 			m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-			//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-			//m.writeLoot(m.output.FilePath, verbosity)
 			o := internal.OutputClient{
 				Verbosity:     verbosity,
 				CallingModule: m.output.CallingModule,
@@ -119,9 +153,10 @@ func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string
 				},
 			}
 			o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-				Header: m.output.Headers,
-				Body:   m.output.Body,
-				Name:   m.output.CallingModule,
+				Header:    m.output.Headers,
+				Body:      m.output.Body,
+				TableCols: tableCols,
+				Name:      m.output.CallingModule,
 			})
 			o.PrefixIdentifier = m.AWSProfile
 			o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -272,7 +307,7 @@ func (m *OrgModule) addOrgAccount() {
 		isManagementAccount: false,
 		Name:                "This account",
 		Id:                  aws.ToString(m.Caller.Account),
-		Email:               "Unkonwn",
+		Email:               "Unknown",
 		Arn:                 aws.ToString(m.Caller.Arn),
 		Status:              "ACTIVE",
 	})

aws/outbound-assumed-roles.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -22,12 +23,14 @@ type OutboundAssumedRolesModule struct {
 	// General configuration data
 	CloudTrailClient *cloudtrail.Client
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	OutboundAssumeRoleEntries []OutboundAssumeRoleEntry
@@ -47,6 +50,7 @@ type OutboundAssumeRoleEntry struct {
 	SourcePrincipal      string
 	DestinationAccount   string
 	DestinationPrincipal string
+	Action               string
 	LogTimestamp         string
 }
 
@@ -114,8 +118,26 @@ type CloudTrailEvent struct {
 	} `json:"tlsDetails"`
 }
 
-func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+var interestingCrossAccountEventNames = []string{
+	"AssumeRole",
+	"AssumeRoleWithSAML",
+	"AssumeRoleWithWebIdentity",
+	"GetObject",
+	"ListBuckets",
+	"BatchGetImage",
+	"GetDownloadUrlForLayer",
+	"SendMessage",
+	"GetQueueUrl",
+	"Invoke20150331",
+	"RunInstances",
+	"RunTask",
+	"StartTask",
+	"CreateTask",
+	"CreateTaskSet",
+}
+
+func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "outbound-assumed-roles"
@@ -161,28 +183,68 @@ func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFor
 	<-receiverDone
 
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Region",
 		"Type",
 		//"Source Account",
 		"Source Principal",
 		//"Destination Account",
 		"Destination Principal",
+		"Action",
 		"Log Entry Timestamp",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Region",
+			"Type",
+			//"Source Account",
+			"Source Principal",
+			//"Destination Account",
+			"Destination Principal",
+			"Action",
+			"Log Entry Timestamp",
+		}
+		// Otherwise, use the default columns.
+	} else {
+
+		tableCols = []string{
+			"Region",
+			"Type",
+			//"Source Account",
+			"Source Principal",
+			//"Destination Account",
+			"Destination Principal",
+			"Action",
+			"Log Entry Timestamp",
+		}
+	}
+
 	// Table rows
 	for i := range m.OutboundAssumeRoleEntries {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.OutboundAssumeRoleEntries[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.OutboundAssumeRoleEntries[i].Region,
 				m.OutboundAssumeRoleEntries[i].Type,
 				//m.OutboundAssumeRoleEntries[i].SourceAccount,
 				m.OutboundAssumeRoleEntries[i].SourcePrincipal,
 				//m.OutboundAssumeRoleEntries[i].DestinationAccount,
 				m.OutboundAssumeRoleEntries[i].DestinationPrincipal,
+				m.OutboundAssumeRoleEntries[i].Action,
 				m.OutboundAssumeRoleEntries[i].LogTimestamp,
 			},
 		)
@@ -191,9 +253,6 @@ func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFor
 	if len(m.output.Body) > 0 {
 
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -202,9 +261,10 @@ func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFor
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -242,9 +302,12 @@ func (m *OutboundAssumedRolesModule) executeChecks(r string, wg *sync.WaitGroup,
 		m.modLog.Error(err)
 	}
 	if res {
+		// wg.Add(1)
+		// m.CommandCounter.Total++
+		// m.getAssumeRoleLogEntriesPerRegion(r, wg, semaphore, dataReceiver)
 		wg.Add(1)
 		m.CommandCounter.Total++
-		m.getAssumeRoleLogEntriesPerRegion(r, wg, semaphore, dataReceiver)
+		m.getCrossAccountBatchGetImageEntriesPerRegion(r, wg, semaphore, dataReceiver)
 	}
 
 }
@@ -322,6 +385,7 @@ func (m *OutboundAssumedRolesModule) getAssumeRoleLogEntriesPerRegion(r string,
 					SourcePrincipal:      sourcePrincipal,
 					DestinationAccount:   destinationAccount,
 					DestinationPrincipal: destinationPrincipal,
+					Action:               "sts:AssumeRole",
 					LogTimestamp:         logTimestamp,
 				}
 			}
@@ -339,3 +403,107 @@ func (m *OutboundAssumedRolesModule) getAssumeRoleLogEntriesPerRegion(r string,
 	}
 
 }
+
+// get cross account batch get image entries
+func (m *OutboundAssumedRolesModule) getCrossAccountBatchGetImageEntriesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan OutboundAssumeRoleEntry) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
+	var PaginationControl *string
+	//var LookupAttributes []types.LookupAttributes
+	//var LookupAttribute types.LookupAttribute
+	var pages int
+
+	days := 0 - m.Days
+	endTime := aws.Time(time.Now())
+	startTime := endTime.AddDate(0, 0, days)
+	for {
+		LookupEvents, err := m.CloudTrailClient.LookupEvents(
+			context.TODO(),
+			&cloudtrail.LookupEventsInput{
+				EndTime:   endTime,
+				StartTime: &startTime,
+				// LookupAttributes: []cloudtrailTypes.LookupAttribute{
+				// 	{
+				// 		AttributeKey:   cloudtrailTypes.LookupAttributeKeyEventName,
+				// 		AttributeValue: aws.String("BatchGetImage"),
+				// 	},
+				// },
+				NextToken: PaginationControl,
+			},
+
+			func(o *cloudtrail.Options) {
+				o.Region = r
+			},
+		)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			break
+		}
+
+		for _, event := range LookupEvents.Events {
+			//eventData := *event.CloudTrailEvent
+			//fmt.Println(eventData)
+			var sourceAccount, sourcePrincipal, destinationAccount, destinationPrincipal, userType string
+			cloudtrailEvent := CloudTrailEvent{}
+			json.Unmarshal([]byte(*event.CloudTrailEvent), &cloudtrailEvent)
+
+			for _, eventName := range interestingCrossAccountEventNames {
+				if aws.ToString(event.EventName) == eventName {
+
+					// extract the source account and principal
+					if cloudtrailEvent.UserIdentity.Type == "AssumedRole" || cloudtrailEvent.UserIdentity.Type == "IAMUser" || cloudtrailEvent.UserIdentity.Type == "Role" {
+						if cloudtrailEvent.UserIdentity.Type == "AssumedRole" {
+							sourcePrincipal = cloudtrailEvent.UserIdentity.SessionContext.SessionIssuer.Arn
+						} else {
+							sourcePrincipal = cloudtrailEvent.UserIdentity.Arn
+						}
+						userType = cloudtrailEvent.UserIdentity.Type
+						sourceAccount = cloudtrailEvent.UserIdentity.AccountID
+
+						//fmt.Printf("%s,%s,%s,%s\n", sourceAccount, sourcePrincipal, destinationAccount, destinationPrincipal)
+
+						if cloudtrailEvent.Resources != nil {
+							destinationAccount = cloudtrailEvent.Resources[0].AccountID
+							destinationPrincipal = cloudtrailEvent.Resources[0].Arn
+							if sourceAccount != destinationAccount {
+								logTimestamp := cloudtrailEvent.EventTime.Format("2006-01-02 15:04:05")
+								dataReceiver <- OutboundAssumeRoleEntry{
+									AWSService:           "CloudTrail",
+									Region:               r,
+									Type:                 userType,
+									SourceAccount:        sourceAccount,
+									SourcePrincipal:      sourcePrincipal,
+									DestinationAccount:   destinationAccount,
+									DestinationPrincipal: destinationPrincipal,
+									Action:               aws.ToString(event.EventName),
+									LogTimestamp:         logTimestamp,
+								}
+							}
+						}
+
+					}
+				}
+			}
+		}
+
+		// The "NextToken" value is nil when there's no more data to return.
+		if LookupEvents.NextToken != nil {
+			PaginationControl = LookupEvents.NextToken
+			pages++
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+}

aws/permissions.go

@@ -11,6 +11,7 @@ import (
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/BishopFox/cloudfox/internal/common"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
@@ -21,12 +22,14 @@ type IamPermissionsModule struct {
 	// General configuration data
 	IAMClient sdk.AWSIAMClientInterface
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 
@@ -34,7 +37,7 @@ type IamPermissionsModule struct {
 	Users          []GAADUser
 	Roles          []GAADRole
 	Groups         []GAADGroup
-	Rows           []PermissionsRow
+	Rows           []common.PermissionsRow
 	CommandCounter internal.CommandCounter
 	// Used to store output data for pretty printing
 	output internal.OutputData2
@@ -69,25 +72,12 @@ type GAADGroup struct {
 	InlinePolicies   []types.PolicyDetail
 }
 
-type PermissionsRow struct {
-	AWSService string
-	Type       string
-	Name       string
-	Arn        string
-	PolicyType string
-	PolicyName string
-	Effect     string
-	Action     string
-	Resource   string
-	Condition  string
-}
-
-func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDirectory string, verbosity int, principal string) {
-	// These stuct values are used by the output module
+func (m *IamPermissionsModule) PrintIamPermissions(outputDirectory string, verbosity int, principal string) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "permissions"
-	m.output.FullFilename = m.output.CallingModule
+	filename := m.output.CallingModule
 	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
 		"module": m.output.CallingModule,
 	})
@@ -98,19 +88,20 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 	fmt.Printf("[%s][%s] Enumerating IAM permissions for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 
 	if principal != "" {
-		m.output.FullFilename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
+		filename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
 	}
 
-	m.getGAAD()
-	m.parsePermissions(principal)
+	m.GetGAAD()
+	m.ParsePermissions(principal)
 
 	m.output.Headers = []string{
-		//"Service",
+		"Account",
 		"Type",
 		"Name",
-		//"Arn",
+		"Arn",
 		"Policy",
 		"Policy Name",
+		"Policy Arn",
 		"Effect",
 		"Action",
 		"Resource",
@@ -122,12 +113,13 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				//m.Rows[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Rows[i].Type,
 				m.Rows[i].Name,
-				//m.Rows[i].Arn,
+				m.Rows[i].Arn,
 				m.Rows[i].PolicyType,
 				m.Rows[i].PolicyName,
+				m.Rows[i].PolicyArn,
 				m.Rows[i].Effect,
 				m.Rows[i].Action,
 				m.Rows[i].Resource,
@@ -139,9 +131,6 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector3(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -149,10 +138,48 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 				Wrap: m.WrapTable,
 			},
 		}
+
+		// If the user specified table columns, use those.
+		// If the user specified -o wide, use the wide default cols for this module.
+		// Otherwise, use the hardcoded default cols for this module.
+		var tableCols []string
+		// If the user specified table columns, use those.
+		if m.AWSTableCols != "" {
+			tableCols = strings.Split(m.AWSTableCols, ",")
+			// If the user specified wide as the output format, use these columns.
+		} else if m.AWSOutputType == "wide" {
+			tableCols = []string{
+				"Account",
+				"Type",
+				//"Name",
+				"Arn",
+				"Policy",
+				"Policy Name",
+				"Policy Arn",
+				"Effect",
+				"Action",
+				"Resource",
+				"Condition"}
+			// Otherwise, use the default columns for this module (brief)
+		} else {
+			tableCols = []string{
+				"Type",
+				"Name",
+				//"Arn",
+				"Policy",
+				"Policy Name",
+				"Effect",
+				"Action",
+				"Resource",
+				"Condition",
+			}
+		}
+
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			TableCols: tableCols,
+			Body:      m.output.Body,
+			Name:      filename,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -166,10 +193,10 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
 }
 
-func (m *IamPermissionsModule) getGAAD() {
+func (m *IamPermissionsModule) GetGAAD() {
 	GAAD, err := sdk.CachedIAMGetAccountAuthorizationDetails(m.IAMClient, aws.ToString(m.Caller.Account))
 	if err != nil {
-		m.modLog.Error(err.Error())
+		TxtLogger.Error(err.Error())
 		m.CommandCounter.Error++
 		return
 	}
@@ -257,7 +284,7 @@ func (m *IamPermissionsModule) getPrincipalArn(principal string) string {
 	return arn
 }
 
-func (m *IamPermissionsModule) parsePermissions(principal string) {
+func (m *IamPermissionsModule) ParsePermissions(principal string) {
 	var inputArn string
 	for i := range m.Roles {
 		if principal == "" {
@@ -382,6 +409,10 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 					//parsedPolicyDocument, _ := parsePolicyDocument(d.Document)
 					document, _ := url.QueryUnescape(aws.ToString(d.Document))
 					parsedPolicyDocument, _ := policy.ParseJSONPolicy([]byte(document))
+
+					// hasStsAssumeRole := parsedPolicyDocument.DoesPolicyHaveMatchingStatement("Allow", "sts:AssumeRole", "*")
+					// fmt.Println(hasStsAssumeRole)
+
 					for _, s = range parsedPolicyDocument.Statement {
 						//version := parsedPolicyDocument.Version
 						effect := s.Effect
@@ -395,13 +426,14 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 									}
 									m.Rows = append(
 										m.Rows,
-										PermissionsRow{
+										common.PermissionsRow{
 											AWSService: AWSService,
 											Arn:        arn,
 											Name:       name,
 											Type:       IAMtype,
 											PolicyType: "Managed",
 											PolicyName: p.Name,
+											PolicyArn:  p.Arn,
 											Effect:     effect,
 											Action:     action,
 											Resource:   resource,
@@ -421,13 +453,14 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 									}
 									m.Rows = append(
 										m.Rows,
-										PermissionsRow{
+										common.PermissionsRow{
 											AWSService: AWSService,
 											Arn:        arn,
 											Name:       name,
 											Type:       IAMtype,
 											PolicyType: "Managed",
 											PolicyName: p.Name,
+											PolicyArn:  p.Arn,
 											Effect:     effect,
 											Action:     "[NotAction] " + action,
 											Resource:   resource,
@@ -466,13 +499,14 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 					}
 					m.Rows = append(
 						m.Rows,
-						PermissionsRow{
+						common.PermissionsRow{
 							AWSService: AWSService,
 							Arn:        arn,
 							Name:       name,
 							Type:       IAMtype,
 							PolicyType: "Inline",
 							PolicyName: aws.ToString(inlinePolicy.PolicyName),
+							PolicyArn:  aws.ToString(inlinePolicy.PolicyName),
 							Effect:     effect,
 							Action:     action,
 							Resource:   resource,
@@ -491,13 +525,14 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 					}
 					m.Rows = append(
 						m.Rows,
-						PermissionsRow{
+						common.PermissionsRow{
 							AWSService: AWSService,
 							Arn:        arn,
 							Name:       name,
 							Type:       IAMtype,
 							PolicyType: "Inline",
 							PolicyName: aws.ToString(inlinePolicy.PolicyName),
+							PolicyArn:  aws.ToString(inlinePolicy.PolicyName),
 							Effect:     effect,
 							Action:     "[NotAction] " + action,
 							Resource:   resource,

aws/pmapper.go

@@ -1,39 +1,52 @@
 package aws
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/dominikbraun/graph"
+	"github.com/neo4j/neo4j-go-driver/v5/neo4j"
 	"github.com/sirupsen/logrus"
 )
 
 type PmapperModule struct {
 	// General configuration data
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
-	pmapperGraph   graph.Graph[string, string]
-	Nodes          []Node
-	Edges          []Edge
-	CommandCounter internal.CommandCounter
+	PmapperDataBasePath string
+	pmapperGraph        graph.Graph[string, string]
+	Nodes               []Node
+	Edges               []Edge
+	CommandCounter      internal.CommandCounter
 	// Used to store output data for pretty printing
 	output internal.OutputData2
 	modLog *logrus.Entry
 }
 
+type PmapperOutputRow struct {
+	Start string
+	End   string
+	Paths []string
+}
+
 type Edge struct {
 	Source      string `json:"source"`
 	Destination string `json:"destination"`
@@ -42,19 +55,54 @@ type Edge struct {
 }
 
 type Node struct {
-	Arn                 string             `json:"arn"`
-	IDValue             string             `json:"id_value"`
-	AttachedPolicies    []AttachedPolicies `json:"attached_policies"`
-	GroupMemberships    []interface{}      `json:"group_memberships"`
-	TrustPolicy         interface{}        `json:"trust_policy"`
-	InstanceProfile     interface{}        `json:"instance_profile"`
-	ActivePassword      bool               `json:"active_password"`
-	AccessKeys          int                `json:"access_keys"`
-	IsAdmin             bool               `json:"is_admin"`
-	PermissionsBoundary interface{}        `json:"permissions_boundary"`
-	HasMfa              bool               `json:"has_mfa"`
-	Tags                Tags               `json:"tags"`
-	PathToAdmin         bool
+	Arn                       string `json:"arn"`
+	Type                      string
+	AccountID                 string
+	Name                      string
+	IDValue                   string             `json:"id_value"`
+	AttachedPolicies          []AttachedPolicies `json:"attached_policies"`
+	GroupMemberships          []interface{}      `json:"group_memberships"`
+	TrustPolicy               interface{}        `json:"trust_policy"`
+	TrustsDoc                 policy.TrustPolicyDocument
+	TrustedPrincipals         []TrustedPrincipal
+	TrustedServices           []TrustedService
+	TrustedFederatedProviders []TrustedFederatedProvider
+	InstanceProfile           interface{} `json:"instance_profile"`
+	ActivePassword            bool        `json:"active_password"`
+	AccessKeys                int         `json:"access_keys"`
+	IsAdmin                   bool        `json:"is_admin"`
+	PathToAdmin               bool
+	PermissionsBoundary       interface{} `json:"permissions_boundary"`
+	HasMfa                    bool        `json:"has_mfa"`
+	Tags                      Tags        `json:"tags"`
+	CanPrivEscToAdminString   string
+	IsAdminString             string
+	VendorName                string
+}
+
+type TrustedPrincipal struct {
+	TrustedPrincipal               string
+	ExternalID                     string
+	VendorName                     string
+	AccountIsInAnalyzedAccountList bool
+	//IsAdmin           bool
+	//CanPrivEscToAdmin bool
+}
+
+type TrustedService struct {
+	TrustedService string
+	AccountID      string
+	//IsAdmin           bool
+	//CanPrivEscToAdmin bool
+}
+
+type TrustedFederatedProvider struct {
+	TrustedFederatedProvider string
+	ProviderAccountId        string
+	ProviderShortName        string
+	TrustedSubjects          []string
+	//IsAdmin                  bool
+	//CanPrivEscToAdmin        bool
 }
 
 type AttachedPolicies struct {
@@ -76,9 +124,16 @@ func (m *PmapperModule) initPmapperGraph() error {
 	for i := range m.Nodes {
 		if m.doesNodeHavePathToAdmin(m.Nodes[i]) {
 			m.Nodes[i].PathToAdmin = true
+			m.Nodes[i].CanPrivEscToAdminString = "Yes"
 			//fmt.Println(m.Nodes[i].Arn, m.Nodes[i].IsAdmin, m.Nodes[i].PathToAdmin)
 		} else {
 			m.Nodes[i].PathToAdmin = false
+			m.Nodes[i].CanPrivEscToAdminString = "No"
+		}
+		if m.Nodes[i].IsAdmin {
+			m.Nodes[i].IsAdminString = "Yes"
+		} else {
+			m.Nodes[i].IsAdminString = "No"
 		}
 	}
 
@@ -104,7 +159,39 @@ func (m *PmapperModule) createAndPopulateGraph() graph.Graph[string, string] {
 	}
 
 	for _, edge := range m.Edges {
-		_ = pmapperGraph.AddEdge(edge.Source, edge.Destination)
+		err := pmapperGraph.AddEdge(
+			edge.Source,
+			edge.Destination,
+			graph.EdgeAttribute(edge.ShortReason, edge.Reason),
+		)
+		if err != nil {
+			if err == graph.ErrEdgeAlreadyExists {
+				// update the edge by copying the existing graph.Edge with attributes and add the new attributes
+				//fmt.Println("Edge already exists, but adding a new one!")
+
+				// get the existing edge
+				existingEdge, _ := pmapperGraph.Edge(edge.Source, edge.Destination)
+				// get the map of attributes
+				existingProperties := existingEdge.Properties
+				// add the new attributes to attributes map within the properties struct
+				// Check if the Attributes map is initialized, if not, initialize it
+				if existingProperties.Attributes == nil {
+					existingProperties.Attributes = make(map[string]string)
+				}
+
+				// Add or update the attribute
+				existingProperties.Attributes[edge.ShortReason] = edge.Reason
+				//Update the edge
+				pmapperGraph.UpdateEdge(
+					edge.Source,
+					edge.Destination,
+					graph.EdgeAttributes(existingProperties.Attributes),
+				)
+
+			}
+			//fmt.Println(edge.Reason)
+		}
+
 	}
 
 	//internal.Cache.Set(cacheKey, pmapperGraph, cache.DefaultExpiration)
@@ -116,7 +203,11 @@ func (m *PmapperModule) DoesPrincipalHavePathToAdmin(principal string) bool {
 	for i := range m.Nodes {
 		if m.Nodes[i].Arn == principal {
 			if m.Nodes[i].PathToAdmin {
+				m.Nodes[i].CanPrivEscToAdminString = "Yes"
 				return true
+			} else {
+				m.Nodes[i].CanPrivEscToAdminString = "No"
+				return false
 			}
 		}
 
@@ -128,7 +219,11 @@ func (m *PmapperModule) DoesPrincipalHaveAdmin(principal string) bool {
 	for i := range m.Nodes {
 		if m.Nodes[i].Arn == principal {
 			if m.Nodes[i].IsAdmin {
+				m.Nodes[i].IsAdminString = "Yes"
 				return true
+			} else {
+				m.Nodes[i].IsAdminString = "No"
+				return false
 			}
 		}
 
@@ -136,8 +231,8 @@ func (m *PmapperModule) DoesPrincipalHaveAdmin(principal string) bool {
 	return false
 }
 
-func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *PmapperModule) PrintPmapperData(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "pmapper"
@@ -163,11 +258,39 @@ func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory st
 	}
 
 	m.output.Headers = []string{
+		"Account",
 		"Principal Arn",
 		"IsAdmin?",
 		"CanPrivEscToAdmin?",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Principal Arn",
+			"IsAdmin?",
+			"CanPrivEscToAdmin?",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Principal Arn",
+			"IsAdmin?",
+			"CanPrivEscToAdmin?",
+		}
+	}
+
 	//Table rows
 	var isAdmin, pathToAdmin string
 	for i := range m.Nodes {
@@ -186,6 +309,7 @@ func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory st
 			m.output.Body = append(
 				m.output.Body,
 				[]string{
+					aws.ToString(m.Caller.Account),
 					m.Nodes[i].Arn,
 					isAdmin,
 					pathToAdmin,
@@ -196,23 +320,39 @@ func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory st
 
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
 			Table: internal.TableClient{
 				Wrap: m.WrapTable,
 			},
+			Loot: internal.LootClient{
+				DirectoryName: m.output.FilePath,
+			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		o.WriteFullOutput(o.Table.TableFiles, nil)
+
+		header, body := m.createPmapperTableData(outputDirectory)
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header:            header,
+			Body:              body,
+			Name:              "pmapper-privesc-paths-enhanced",
+			SkipPrintToScreen: true,
+		})
+
+		loot := m.writeLoot(o.Table.DirectoryName, verbosity)
+		o.Loot.LootFiles = append(o.Loot.LootFiles, internal.LootFile{
+			Name:     m.output.CallingModule,
+			Contents: loot,
+		})
+		o.WriteFullOutput(o.Table.TableFiles, o.Loot.LootFiles)
 		//m.writeLoot(o.Table.DirectoryName, verbosity)
 
 		fmt.Printf("[%s][%s] %s principals who are admin or have a path to admin identified.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
@@ -233,9 +373,6 @@ func (m *PmapperModule) doesNodeHavePathToAdmin(startNode Node) bool {
 				for _, p := range path {
 					if p != "" {
 						if startNode.Arn != destNode.Arn {
-							// if we got here there is a path
-							//fmt.Printf("%s has a path %s who is an admin.\n", startNode.Arn, destNode.Arn)
-							//fmt.Println(path)
 							return true
 						}
 
@@ -247,9 +384,136 @@ func (m *PmapperModule) doesNodeHavePathToAdmin(startNode Node) bool {
 	return false
 }
 
+func (m *PmapperModule) createPmapperTableData(outputDirectory string) ([]string, [][]string) {
+	var header []string
+	var body [][]string
+
+	header = []string{
+		"Start",
+		"End",
+		"Path(s)",
+	}
+
+	var paths string
+	var admins, privescPathsBody [][]string
+
+	for _, startNode := range m.Nodes {
+		if startNode.IsAdmin {
+			admins = append(admins, []string{startNode.Arn, "", "ADMIN"})
+
+		} else {
+			for _, destNode := range m.Nodes {
+				if destNode.IsAdmin {
+					path, _ := graph.ShortestPath(m.pmapperGraph, startNode.Arn, destNode.Arn)
+					// if we have a path,
+
+					if len(path) > 0 {
+						if startNode.Arn != destNode.Arn {
+							paths = ""
+							// if we got herethere's a path. Lets print the reason and the short reason for each edge in the path to the screen
+							for i := 0; i < len(path)-1; i++ {
+								for _, edge := range m.Edges {
+									if edge.Source == path[i] && edge.Destination == path[i+1] {
+
+										//Some pmapper reasons have commas in them so lets get rid of them in the csvOutputdata
+										edge.Reason = strings.ReplaceAll(edge.Reason, ",", " and")
+										paths += fmt.Sprintf("%s %s %s\n", path[i], edge.Reason, path[i+1])
+									}
+
+								}
+							}
+							//trim the last newline from csvPaths
+							paths = strings.TrimSuffix(paths, "\n")
+							privescPathsBody = append(privescPathsBody, []string{startNode.Arn, destNode.Arn, paths})
+
+						}
+
+					}
+				}
+			}
+		}
+	}
+
+	// create body by first adding the admins and then the privesc paths
+	body = append(body, admins...)
+	body = append(body, privescPathsBody...)
+	return header, body
+
+}
+
+func (m *PmapperModule) writeLoot(outputDirectory string, verbosity int) string {
+	path := filepath.Join(outputDirectory, "loot")
+	err := os.MkdirAll(path, os.ModePerm)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		panic(err.Error())
+	}
+	lootFilePath := filepath.Join(path, "pmapper.txt")
+
+	var admins, out string
+
+	for _, startNode := range m.Nodes {
+		if startNode.IsAdmin {
+			admins += fmt.Sprintf("ADMIN FOUND: %s\n", startNode.Arn)
+		} else {
+			for _, destNode := range m.Nodes {
+				if destNode.IsAdmin {
+					path, _ := graph.ShortestPath(m.pmapperGraph, startNode.Arn, destNode.Arn)
+					// if we have a path,
+
+					if len(path) > 0 {
+						if startNode.Arn != destNode.Arn {
+							// if we got here there is a path
+							out += fmt.Sprintf("PATH TO ADMIN FOUND\n   Start: %s\n     End: %s\n Path(s):\n", startNode.Arn, destNode.Arn)
+							//fmt.Println(path)
+							// if we got herethere's a path. Lets print the reason and the short reason for each edge in the path to the screen
+							for i := 0; i < len(path)-1; i++ {
+								for _, edge := range m.Edges {
+									if edge.Source == path[i] && edge.Destination == path[i+1] {
+										// print it like this: [start node] [reason] [end node]
+										out += fmt.Sprintf("     %s %s %s\n", path[i], edge.Reason, path[i+1])
+									}
+									// shortest path only finds the shortest path. We want to find all paths. So we need to find all paths that have the same start and end nodes from the path, but going back to the main edges slice
+									//for _, edge := range GlobalPmapperEdges {
+									// 	if edge.Source == path[i] && edge.Destination == path[i+1] {
+									// 		// print it like this: [start node] [reason] [end node]
+									// 		out += fmt.Sprintf("   %s %s %s\n", path[i], edge.Reason, path[i+1])
+									// 	}
+									// }
+								}
+							}
+							out += fmt.Sprintf("\n")
+
+						}
+
+					}
+				}
+			}
+		}
+	}
+	out = admins + "\n\n" + out
+
+	if verbosity > 2 {
+		fmt.Println()
+		fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("Beginning of loot file"))
+		fmt.Print(out)
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("End of loot file"))
+	}
+	fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfile), magenta(fmt.Sprintf("Loot file with ALL potential paths written to: [%s]", lootFilePath)))
+	return out
+
+}
+
 func (m *PmapperModule) readPmapperData(accountID *string) error {
 
-	e, n := generatePmapperDataBasePaths(accountID)
+	var e, n string
+	if m.PmapperDataBasePath == "" {
+		e, n = generatePmapperDataBasePaths(accountID)
+	} else {
+		e = filepath.Join(m.PmapperDataBasePath, aws.ToString(accountID), "graph", "edges.json")
+		n = filepath.Join(m.PmapperDataBasePath, aws.ToString(accountID), "graph", "nodes.json")
+	}
 
 	nodesFile, err := os.Open(n)
 	if err != nil {
@@ -270,3 +534,101 @@ func (m *PmapperModule) readPmapperData(accountID *string) error {
 	return nil
 
 }
+
+func (m *PmapperModule) GenerateCypherStatements(goCtx context.Context, driver neo4j.DriverWithContext) error {
+	// Insert nodes
+	for i, node := range m.Nodes {
+		query, params := m.generateNodeCreateStatement(node, i)
+		if err := m.executeCypherQuery(goCtx, driver, query, params); err != nil {
+			return err
+		}
+	}
+
+	// Insert edges
+	for i, edge := range m.Edges {
+		query, params := m.generateEdgeCreateStatement(edge, i)
+		if err := m.executeCypherQuery(goCtx, driver, query, params); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *PmapperModule) generateNodeCreateStatement(node Node, i int) (string, map[string]interface{}) {
+	var ptype, label, query string
+	var params map[string]any
+
+	if strings.Contains(node.Arn, "role") {
+		label = GetResourceNameFromArn(node.Arn)
+		ptype = "Role"
+		params = map[string]any{
+			"Id":          node.Arn,
+			"ARN":         node.Arn,
+			"Name":        GetResourceNameFromArn(node.Arn),
+			"IdValue":     node.IDValue,
+			"IsAdminP":    node.IsAdmin,
+			"PathToAdmin": node.PathToAdmin,
+		}
+
+	} else if strings.Contains(node.Arn, "user") {
+		label = GetResourceNameFromArn(node.Arn)
+		ptype = "User"
+		//node.TrustPolicy = ""
+		params = map[string]any{
+			"Id":          node.Arn,
+			"ARN":         node.Arn,
+			"Name":        GetResourceNameFromArn(node.Arn),
+			"IdValue":     node.IDValue,
+			"IsAdminP":    node.IsAdmin,
+			"PathToAdmin": node.PathToAdmin,
+		}
+
+	} else if strings.Contains(node.Arn, "group") {
+		label = GetResourceNameFromArn(node.Arn)
+		ptype = "Group"
+	}
+	label = strings.ReplaceAll(label, "-", "_")
+	label = strings.ReplaceAll(label, ".", "_")
+
+	query = `MERGE (%s:%s {Id: $Id, ARN: $ARN, Name: $Name, IdValue: $IdValue, IsAdminP: $IsAdminP, PathToAdmin: $PathToAdmin})`
+
+	//sanitizedArn := sanitizeArnForNeo4jLabel(node.Arn)
+	//id := fmt.Sprintf("%s_%s", sanitizedArn, ptype)
+
+	fmt.Println(fmt.Sprintf(query, label, ptype), params)
+	return fmt.Sprintf(query, label, ptype), params
+}
+
+func (m *PmapperModule) generateEdgeCreateStatement(edge Edge, i int) (string, map[string]interface{}) {
+	// Sanitize ARNs for matching nodes
+	//srcArnSanitized := sanitizeArnForNeo4jLabel(edge.Source)
+	//destArnSanitized := sanitizeArnForNeo4jLabel(edge.Destination)
+
+	query := `MATCH (a {ARN: $srcArn}), (b {ARN: $destArn}) CREATE (a)-[:CAN_ACCESS {reason: $reason, shortReason: $shortReason}]->(b)`
+	params := map[string]any{
+		"srcArn":      edge.Source,
+		"destArn":     edge.Destination,
+		"reason":      edge.Reason,
+		"shortReason": edge.ShortReason,
+	}
+	fmt.Println(query, params)
+	return query, params
+}
+
+func (m *PmapperModule) executeCypherQuery(ctx context.Context, driver neo4j.DriverWithContext, query string, params map[string]interface{}) error {
+	_, err := neo4j.ExecuteQuery(ctx, driver, query, params, neo4j.EagerResultTransformer, neo4j.ExecuteQueryWithDatabase("neo4j"))
+	if err != nil {
+		sharedLogger.Errorf("Error executing query: %s -- %v", err, params)
+		return err
+	}
+	return nil
+}
+
+func sanitizeArnForNeo4jLabel(arn string) string {
+	// Replace non-allowed characters with underscores or other allowed characters
+	sanitized := strings.ReplaceAll(arn, ":", "_")
+	sanitized = strings.ReplaceAll(sanitized, "-", "_")
+	// Add more replacements if needed
+	return sanitized
+}

aws/principals.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
@@ -16,12 +17,14 @@ type IamPrincipalsModule struct {
 	// General configuration data
 	IAMClient sdk.AWSIAMClientInterface
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	Users          []User
@@ -61,8 +64,8 @@ type Role struct {
 	InlinePolicies   []string
 }
 
-func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *IamPrincipalsModule) PrintIamPrincipals(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "principals"
@@ -92,13 +95,44 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 	//fmt.Printf("\nAnalyzed Resources by Region\n\n")
 
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Type",
 		"Name",
 		"Arn",
+		"AttachedPolicies",
+		"InlinePolicies",
+	}
 
-		// "AttachedPolicies",
-		// "InlinePolicies",
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Type",
+			"Name",
+			"Arn",
+			//"AttachedPolicies",
+			//"InlinePolicies",
+		}
+
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Type",
+			"Name",
+			"Arn",
+			// "AttachedPolicies",
+			// "InlinePolicies",
+		}
 	}
 
 	//Table rows
@@ -106,13 +140,12 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Users[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Users[i].Type,
 				m.Users[i].Name,
 				m.Users[i].Arn,
-
-				// m.Users[i].AttachedPolicies,
-				// m.Users[i].InlinePolicies,
+				strings.Join(m.Users[i].AttachedPolicies, " , "),
+				strings.Join(m.Users[i].InlinePolicies, " , "),
 			},
 		)
 
@@ -122,22 +155,19 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Roles[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Roles[i].Type,
 				m.Roles[i].Name,
 				m.Roles[i].Arn,
-
-				// m.Roles[i].AttachedPolicies,
-				// m.Roles[i].InlinePolicies,
+				strings.Join(m.Roles[i].AttachedPolicies, " , "),
+				strings.Join(m.Roles[i].InlinePolicies, " , "),
 			},
 		)
 
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -146,9 +176,10 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/ram.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/BishopFox/cloudfox/internal"
@@ -20,12 +21,14 @@ type RAMModule struct {
 	// General configuration data
 	RAMClient *ram.Client
 
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
-	OutputFormat string
-	Goroutines   int
-	AWSProfile   string
-	WrapTable    bool
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
+
+	Goroutines int
+	AWSProfile string
+	WrapTable  bool
 
 	// Main module data
 	Resources      []Resource
@@ -44,8 +47,8 @@ type Resource struct {
 	ShareType  string
 }
 
-func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *RAMModule) PrintRAM(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "ram"
@@ -91,7 +94,7 @@ func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbos
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Region",
 		"Share Name",
 		"Type",
@@ -99,12 +102,44 @@ func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbos
 		"Share Type",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Region",
+			"Share Name",
+			"Type",
+			"Owner",
+			"Share Type",
+		}
+		// Otherwise, use the default columns.
+	} else {
+		tableCols = []string{
+			"Service",
+			"Region",
+			"Share Name",
+			"Type",
+			"Owner",
+			"Share Type",
+		}
+	}
+
 	// Table rows
 	for i := range m.Resources {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Resources[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Resources[i].Region,
 				m.Resources[i].Name,
 				m.Resources[i].Type,
@@ -116,9 +151,7 @@ func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbos
 	}
 	if len(m.output.Body) > 0 {
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -127,9 +160,10 @@ func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbos
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))

aws/resource-trusts.go

@@ -20,12 +20,17 @@ import (
 
 type ResourceTrustsModule struct {
 	// General configuration data
-	Caller          sts.GetCallerIdentityOutput
-	AWSRegions      []string
-	Goroutines      int
-	WrapTable       bool
-	AWSProfile      string
-	CloudFoxVersion string
+	Caller             sts.GetCallerIdentityOutput
+	AWSRegions         []string
+	Goroutines         int
+	WrapTable          bool
+	AWSOutputType      string
+	AWSTableCols       string
+	AWSMFAToken        string
+	AWSConfig          aws.Config
+	AWSProfileProvided string
+	AWSProfileStub     string
+	CloudFoxVersion    string
 
 	Resources2     []Resource2
 	CommandCounter internal.CommandCounter
@@ -44,23 +49,30 @@ type Resource2 struct {
 	ResourcePolicySummary string
 	Public                string
 	Interesting           string
+	TrustedPrincipals     string
+	TrustsCrossAccount    string
+	TrustsAllAccounts     string
+	HasConditions         string
 }
 
-func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirectory string, verbosity int) {
-	// These stuct values are used by the output module
+func (m *ResourceTrustsModule) PrintResources(outputDirectory string, verbosity int) {
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "resource-trusts"
 	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
 		"module": m.output.CallingModule,
 	})
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-	if m.AWSProfile == "" {
-		m.AWSProfile = internal.BuildAWSPath(m.Caller)
-	}
 
-	fmt.Printf("[%s][%s] Enumerating Resources with resource policies for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
-	fmt.Printf("[%s][%s] Supported Services: CodeBuild, ECR, EFS, Lambda, S3, SNS, SQS\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	if m.AWSProfileProvided == "" {
+		m.AWSProfileStub = internal.BuildAWSPath(m.Caller)
+	} else {
+		m.AWSProfileStub = m.AWSProfileProvided
+	}
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileProvided, aws.ToString(m.Caller.Account)))
+
+	fmt.Printf("[%s][%s] Enumerating Resources with resource policies for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), aws.ToString(m.Caller.Account))
+	fmt.Printf("[%s][%s] Supported Services: CodeBuild, ECR, EFS, Glue, Lambda, SecretsManager, S3, SNS, SQS\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub))
 	wg := new(sync.WaitGroup)
 	semaphore := make(chan struct{}, m.Goroutines)
 
@@ -95,13 +107,42 @@ func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirecto
 
 	// add - if struct is not empty do this. otherwise, dont write anything.
 	m.output.Headers = []string{
-		//"Account ID",
+		"Account",
 		"ARN",
 		"Public",
 		"Interesting",
 		"Resource Policy Summary",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"ARN",
+			"Public",
+			"Interesting",
+			"Resource Policy Summary",
+		}
+	} else {
+		tableCols = []string{
+			//"Account ID",
+			"ARN",
+			"Public",
+			"Interesting",
+			"Resource Policy Summary",
+		}
+	}
+
 	// sort the table roles by Interesting
 	sort.Slice(m.Resources2, func(i, j int) bool {
 		return m.Resources2[j].Interesting > m.Resources2[i].Interesting
@@ -112,7 +153,7 @@ func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirecto
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				//m.Resources2[i].AccountID,
+				aws.ToString(m.Caller.Account),
 				m.Resources2[i].ARN,
 				m.Resources2[i].Public,
 				m.Resources2[i].Interesting,
@@ -122,8 +163,6 @@ func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirecto
 
 	}
 	if len(m.output.Body) > 0 {
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -132,20 +171,21 @@ func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirecto
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
-		o.PrefixIdentifier = m.AWSProfile
-		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.PrefixIdentifier = m.AWSProfileStub
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfileStub, aws.ToString(m.Caller.Account)))
 		o.WriteFullOutput(o.Table.TableFiles, nil)
 		//m.writeLoot(o.Table.DirectoryName, verbosity)
-		fmt.Printf("[%s][%s] %s resource policies found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+		fmt.Printf("[%s][%s] %s resource policies found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), strconv.Itoa(len(m.output.Body)))
 		//fmt.Printf("[%s][%s] Resource policies stored to: %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.getLootDir())
 	} else {
-		fmt.Printf("[%s][%s] No resource policies found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+		fmt.Printf("[%s][%s] No resource policies found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub))
 	}
-	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfileStub), m.output.CallingModule)
 
 }
 
@@ -212,6 +252,24 @@ func (m *ResourceTrustsModule) executeChecks(r string, wg *sync.WaitGroup, semap
 		wg.Add(1)
 		m.getEFSfilesystemPoliciesPerRegion(r, wg, semaphore, dataReceiver)
 	}
+	res, err = servicemap.IsServiceInRegion("secretsmanager", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getSecretsManagerSecretsPoliciesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("glue", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getGlueResourcePoliciesPerRegion(r, wg, semaphore, dataReceiver)
+	}
 
 }
 
@@ -238,7 +296,7 @@ func (m *ResourceTrustsModule) getSNSTopicsPerRegion(r string, wg *sync.WaitGrou
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxSNSClient := InitCloudFoxSNSClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines, m.WrapTable)
+	cloudFoxSNSClient := InitCloudFoxSNSClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.WrapTable, m.AWSMFAToken)
 
 	ListTopics, err := cloudFoxSNSClient.listTopics(r)
 	if err != nil {
@@ -270,7 +328,7 @@ func (m *ResourceTrustsModule) getSNSTopicsPerRegion(r string, wg *sync.WaitGrou
 			topic.IsPublic = "No"
 		}
 
-		// If there is a resouce policy, convert the resource policy into plain english
+		// If there is a resource policy, convert the resource policy into plain english
 		if !topic.Policy.IsEmpty() {
 
 			for i, statement := range topic.Policy.Statement {
@@ -314,7 +372,7 @@ func (m *ResourceTrustsModule) getS3Buckets(wg *sync.WaitGroup, semaphore chan s
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxS3Client := initCloudFoxS3Client(m.Caller, m.AWSProfile, m.CloudFoxVersion)
+	cloudFoxS3Client := initCloudFoxS3Client(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.AWSMFAToken)
 
 	ListBuckets, err := sdk.CachedListBuckets(cloudFoxS3Client.S3Client, aws.ToString(m.Caller.Account))
 	if err != nil {
@@ -325,7 +383,7 @@ func (m *ResourceTrustsModule) getS3Buckets(wg *sync.WaitGroup, semaphore chan s
 	for _, b := range ListBuckets {
 		var statementSummaryInEnglish string
 		var isInteresting string = "No"
-		bucket := &Bucket{
+		bucket := &BucketRow{
 			Arn: fmt.Sprintf("arn:aws:s3:::%s", aws.ToString(b.Name)),
 		}
 		name := aws.ToString(b.Name)
@@ -357,7 +415,7 @@ func (m *ResourceTrustsModule) getS3Buckets(wg *sync.WaitGroup, semaphore chan s
 			bucket.IsPublic = "No"
 		}
 
-		// If there is a resouce policy, convert the resource policy into plain english
+		// If there is a resource policy, convert the resource policy into plain english
 		if !bucket.Policy.IsEmpty() {
 			for i, statement := range bucket.Policy.Statement {
 				var prefix string = ""
@@ -397,7 +455,7 @@ func (m *ResourceTrustsModule) getSQSQueuesPerRegion(r string, wg *sync.WaitGrou
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxSQSClient := InitSQSClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+	cloudFoxSQSClient := InitSQSClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
 
 	ListQueues, err := cloudFoxSQSClient.listQueues(r)
 	if err != nil {
@@ -459,9 +517,9 @@ func (m *ResourceTrustsModule) getECRRecordsPerRegion(r string, wg *sync.WaitGro
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxECRClient := InitECRClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+	cloudFoxECRClient := InitECRClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
 
-	DescribeRepositories, err := cloudFoxECRClient.describeRepositories(r)
+	DescribeRepositories, err := sdk.CachedECRDescribeRepositories(cloudFoxECRClient.ECRClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		return
@@ -523,7 +581,7 @@ func (m *ResourceTrustsModule) getCodeBuildResourcePoliciesPerRegion(r string, w
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxCodeBuildClient := InitCodeBuildClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+	cloudFoxCodeBuildClient := InitCodeBuildClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
 
 	ListProjects, err := sdk.CachedCodeBuildListProjects(cloudFoxCodeBuildClient.CodeBuildClient, aws.ToString(cloudFoxCodeBuildClient.Caller.Account), r)
 	if err != nil {
@@ -597,7 +655,7 @@ func (m *ResourceTrustsModule) getLambdaPolicyPerRegion(r string, wg *sync.WaitG
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxLambdaClient := InitLambdaClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+	cloudFoxLambdaClient := InitLambdaClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
 
 	ListFunctions, err := cloudFoxLambdaClient.listFunctions(r)
 	if err != nil {
@@ -662,7 +720,7 @@ func (m *ResourceTrustsModule) getEFSfilesystemPoliciesPerRegion(r string, wg *s
 	semaphore <- struct{}{}
 	defer func() { <-semaphore }()
 
-	cloudFoxEFSClient := InitFileSystemsClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+	cloudFoxEFSClient := InitFileSystemsClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
 
 	ListFileSystems, err := sdk.CachedDescribeFileSystems(cloudFoxEFSClient.EFSClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
@@ -718,6 +776,134 @@ func (m *ResourceTrustsModule) getEFSfilesystemPoliciesPerRegion(r string, wg *s
 	}
 }
 
+// getSecretsManagerSecretsPoliciesPerRegion retrieves the resource policies for all Secrets Manager secrets in the specified region.
+// It sends the resulting Resource2 objects to the dataReceiver channel.
+// It uses a semaphore to limit the number of concurrent requests and a WaitGroup to wait for all requests to complete.
+// It takes the region to search in, the WaitGroup to use, the semaphore to use, and the dataReceiver channel to send results to.
+func (m *ResourceTrustsModule) getSecretsManagerSecretsPoliciesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxSecretsManagerClient := InitSecretsManagerClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
+
+	ListSecrets, err := sdk.CachedSecretsManagerListSecrets(cloudFoxSecretsManagerClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return
+	}
+
+	for _, s := range ListSecrets {
+		var isPublic string
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		secretPolicy, err := sdk.CachedSecretsManagerGetResourcePolicy(cloudFoxSecretsManagerClient, aws.ToString(s.ARN), r, aws.ToString(m.Caller.Account))
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		if secretPolicy.IsPublic() {
+			isPublic = magenta("Yes")
+			isInteresting = magenta("Yes")
+
+		} else {
+			isPublic = "No"
+		}
+
+		if !secretPolicy.IsEmpty() {
+			for i, statement := range secretPolicy.Statement {
+				prefix := ""
+				if len(secretPolicy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(s.ARN),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  aws.ToString(s.Name),
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getGlueResourcePoliciesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxGlueClient := InitGlueClient(m.Caller, m.AWSProfileProvided, m.CloudFoxVersion, m.Goroutines, m.AWSMFAToken)
+
+	ResourcePolicies, err := sdk.CachedGlueGetResourcePolicies(cloudFoxGlueClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return
+	}
+
+	for _, resourcePolicy := range ResourcePolicies {
+		var isPublic string
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+
+		if resourcePolicy.IsPublic() {
+			isPublic = magenta("Yes")
+			isInteresting = magenta("Yes")
+
+		} else {
+			isPublic = "No"
+		}
+
+		if !resourcePolicy.IsEmpty() {
+			for _, statement := range resourcePolicy.Statement {
+				statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				resources := statement.Resource
+				for _, resource := range resources {
+
+					statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+					if isResourcePolicyInteresting(statementSummaryInEnglish) {
+						//magenta(statementSummaryInEnglish)
+						isInteresting = magenta("Yes")
+					}
+
+					dataReceiver <- Resource2{
+						AccountID:             aws.ToString(m.Caller.Account),
+						ARN:                   resource,
+						ResourcePolicySummary: statementSummaryInEnglish,
+						Public:                isPublic,
+						Name:                  resource,
+						Region:                r,
+						Interesting:           isInteresting,
+					}
+				}
+			}
+		}
+	}
+}
+
 func isResourcePolicyInteresting(statementSummaryInEnglish string) bool {
 	// check if the statement has any of the following items, but make sure the check is case insensitive
 	// if it does, then return true

aws/resource-trusts_test.go

@@ -0,0 +1,43 @@
+package aws
+
+import (
+	"testing"
+)
+
+func TestIsResourcePolicyInteresting(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected bool
+	}{
+		{
+			name:     "test1",
+			input:    "Everyone can sqs:SendMessage & can sqs:ReceiveMessage",
+			expected: true,
+		},
+		{
+			name:     "PrincipalOrgPaths",
+			input:    "aws:PrincipalOrgPaths",
+			expected: true,
+		},
+		{
+			name:     "Empty",
+			input:    "",
+			expected: false,
+		},
+		{
+			name:     "NotInteresting",
+			input:    "sns.amazonaws.com can lambda:InvokeFunction",
+			expected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := isResourcePolicyInteresting(tc.input)
+			if actual != tc.expected {
+				t.Errorf("Expected %v but got %v for input %s", tc.expected, actual, tc.input)
+			}
+		})
+	}
+}

aws/role-trusts.go

@@ -1,22 +1,19 @@
 package aws
 
 import (
-	"encoding/json"
-	"errors"
 	"fmt"
-	"net/url"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
-	"github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/knownawsaccountslookup"
 	"github.com/sirupsen/logrus"
 )
 
@@ -31,12 +28,20 @@ type RoleTrustsModule struct {
 	CommandCounter internal.CommandCounter
 	SkipAdminCheck bool
 	WrapTable      bool
-	pmapperMod     PmapperModule
-	pmapperError   error
-	iamSimClient   IamSimulatorModule
+	AWSOutputType  string
+	AWSTableCols   string
+
+	pmapperMod          PmapperModule
+	pmapperError        error
+	PmapperDataBasePath string
+
+	iamSimClient IamSimulatorModule
 
 	// Main module data
-	AnalyzedRoles []AnalyzedRole
+	AnalyzedRoles  []AnalyzedRole
+	RoleTrustTable []RoleTrustRow
+
+	vendors *knownawsaccountslookup.Vendors
 
 	// Used to store output data for pretty printing
 	output internal.OutputData2
@@ -44,49 +49,27 @@ type RoleTrustsModule struct {
 	modLog *logrus.Entry
 }
 
+type RoleTrustRow struct {
+	RoleARN                  string
+	RoleName                 string
+	TrustedPrincipal         string
+	TrustedService           string
+	TrustedFederatedProvider string
+	TrustedFederatedSubject  string
+	ExternalID               string
+	IsAdmin                  string
+	CanPrivEsc               string
+}
+
 type AnalyzedRole struct {
 	roleARN   *string
-	trustsDoc trustPolicyDocument
+	trustsDoc policy.TrustPolicyDocument
 	// trustType  string // UNUSED FIELD, PLEASE REVIEW
 	Admin      string
 	CanPrivEsc string
 }
 
-type trustPolicyDocument struct {
-	Version   string                    `json:"Version"`
-	Statement []RoleTrustStatementEntry `json:"Statement"`
-}
-
-type RoleTrustStatementEntry struct {
-	Sid       string `json:"Sid"`
-	Effect    string `json:"Effect"`
-	Principal struct {
-		AWS       ListOfPrincipals `json:"AWS"`
-		Service   ListOfPrincipals `json:"Service"`
-		Federated ListOfPrincipals `json:"Federated"`
-	} `json:"Principal"`
-	Action    string `json:"Action"`
-	Condition struct {
-		StringEquals struct {
-			StsExternalID string `json:"sts:ExternalId"`
-			SAMLAud       string `json:"SAML:aud"`
-			OidcEksSub    string `json:"OidcEksSub"`
-			OidcEksAud    string `json:"OidcEksAud"`
-			CognitoAud    string `json:"cognito-identity.amazonaws.com:aud"`
-		} `json:"StringEquals"`
-		StringLike struct {
-			TokenActionsGithubusercontentComSub ListOfPrincipals `json:"token.actions.githubusercontent.com:sub"`
-			TokenActionsGithubusercontentComAud string           `json:"token.actions.githubusercontent.com:aud"`
-			OidcEksSub                          string           `json:"OidcEksSub"`
-			OidcEksAud                          string           `json:"OidcEksAud"`
-		} `json:"StringLike"`
-		ForAnyValueStringLike struct {
-			CognitoAMR string `json:"cognito-identity.amazonaws.com:amr"`
-		} `json:"ForAnyValue:StringLike"`
-	} `json:"Condition"`
-}
-
-func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory string, verbosity int) {
+func (m *RoleTrustsModule) PrintRoleTrusts(outputDirectory string, verbosity int) {
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "role-trusts"
@@ -97,10 +80,13 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 		m.AWSProfile = internal.BuildAWSPath(m.Caller)
 	}
 	localAdminMap := make(map[string]bool)
+	m.vendors = knownawsaccountslookup.NewVendorMap()
+	m.vendors.PopulateKnownAWSAccounts()
+
 	fmt.Printf("[%s][%s] Enumerating role trusts for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	//fmt.Printf("[%s][%s] Looking for pmapper data for this account and building a PrivEsc graph in golang if it exists.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.pmapperMod, m.pmapperError = InitPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines, m.PmapperDataBasePath)
+	m.iamSimClient = InitIamCommandClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	// } else {
@@ -118,6 +104,7 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 
 		}
 	}
+
 	o := internal.OutputClient{
 		Verbosity:     verbosity,
 		CallingModule: m.output.CallingModule,
@@ -129,25 +116,35 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 	o.PrefixIdentifier = m.AWSProfile
 	o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 
-	principalsHeader, principalsBody := m.printPrincipalTrusts(outputFormat, outputDirectory)
+	principalsHeader, principalsBody, principalTableCols := m.printPrincipalTrusts(outputDirectory)
 	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-		Header: principalsHeader,
-		Body:   principalsBody,
-		Name:   "role-trusts-principals",
+		Header:    principalsHeader,
+		Body:      principalsBody,
+		TableCols: principalTableCols,
+		Name:      "role-trusts-principals",
+	})
+	rootPrincipalsHeader, rootPrincipalsBody, rootPrincipalTableCols := m.printPrincipalTrustsRootOnly(outputDirectory)
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header:            rootPrincipalsHeader,
+		Body:              rootPrincipalsBody,
+		TableCols:         rootPrincipalTableCols,
+		Name:              "role-trusts-principals-root-trusts-without-external-id",
+		SkipPrintToScreen: true,
+	})
+	servicesHeader, servicesBody, serviceTableCols := m.printServiceTrusts(outputDirectory)
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header:    servicesHeader,
+		Body:      servicesBody,
+		TableCols: serviceTableCols,
+		Name:      "role-trusts-services",
 	})
 
-	servicesHeader, servicesBody := m.printServiceTrusts(outputFormat, outputDirectory)
+	federatedHeader, federatedBody, federatedTableCols := m.printFederatedTrusts(outputDirectory)
 	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-		Header: servicesHeader,
-		Body:   servicesBody,
-		Name:   "role-trusts-services",
-	})
-
-	federatedHeader, federatedBody := m.printFederatedTrusts(outputFormat, outputDirectory)
-	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-		Header: federatedHeader,
-		Body:   federatedBody,
-		Name:   "role-trusts-federated",
+		Header:    federatedHeader,
+		Body:      federatedBody,
+		TableCols: federatedTableCols,
+		Name:      "role-trusts-federated",
 	})
 
 	o.WriteFullOutput(o.Table.TableFiles, nil)
@@ -157,251 +154,424 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
 	if len(servicesBody) > 0 {
-		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(servicesBody)))
+		fmt.Printf("[%s][%s] %s service role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(servicesBody)))
 	} else {
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
 	if len(federatedBody) > 0 {
-		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(federatedBody)))
+		fmt.Printf("[%s][%s] %s federated role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(federatedBody)))
 	} else {
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
 
 }
 
-func (m *RoleTrustsModule) printPrincipalTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+func (m *RoleTrustsModule) printPrincipalTrusts(outputDirectory string) ([]string, [][]string, []string) {
 	var header []string
 	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-principals"
-	var column1 string
-	if m.pmapperError == nil {
-		header = []string{
-			"Role",
-			"Trusted Principal",
-			"ExternalID",
-			"IsAdmin?",
-			"CanPrivEscToAdmin?",
-		}
-	} else {
-		header = []string{
-			"Role",
-			"Trusted Principal",
-			"ExternalID",
-			"IsAdmin?",
-			//"CanPrivEscToAdmin?",
-		}
+	header = []string{
+		"Account",
+		"Role Arn",
+		"Role Name",
+		"Trusted Principal",
+		"ExternalID",
+		"IsAdmin?",
+		"CanPrivEscToAdmin?",
+	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{"Account", "Role Arn", "Trusted Principal", "ExternalID", "IsAdmin?", "CanPrivEscToAdmin?"}
+		// Otherwise, use the default columns for this module (brief)
+	} else {
+		tableCols = []string{"Role Name", "Trusted Principal", "ExternalID", "IsAdmin?", "CanPrivEscToAdmin?"}
+	}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
 	}
 
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			for _, principal := range statement.Principal.AWS {
-				if outputFormat == "wide" {
-					column1 = aws.ToString(role.roleARN)
-				} else {
-					column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
-				}
-				column2 := principal
-				column3 := statement.Condition.StringEquals.StsExternalID
-				column4 := role.Admin
-				column5 := role.CanPrivEsc
-				if m.pmapperError == nil {
-					body = append(body, []string{column1, column2, column3, column4, column5})
-				} else {
-					body = append(body, []string{column1, column2, column3, column4})
+				//check to see if the accountID is known
+				if strings.Contains(principal, "arn:aws:iam::") || strings.Contains(principal, "root") {
+					accountID := strings.Split(principal, ":")[4]
+					vendorName := m.vendors.GetVendorNameFromAccountID(accountID)
+					if vendorName != "" {
+						principal = fmt.Sprintf("%s (%s)", principal, vendorName)
+					}
 				}
 
+				RoleTrustRow := RoleTrustRow{
+					RoleARN:          aws.ToString(role.roleARN),
+					RoleName:         GetResourceNameFromArn(aws.ToString(role.roleARN)),
+					TrustedPrincipal: principal,
+					ExternalID:       statement.Condition.StringEquals.StsExternalID,
+					IsAdmin:          role.Admin,
+					CanPrivEsc:       role.CanPrivEsc,
+				}
+				body = append(body, []string{
+					aws.ToString(m.Caller.Account),
+					RoleTrustRow.RoleARN,
+					RoleTrustRow.RoleName,
+					RoleTrustRow.TrustedPrincipal,
+					RoleTrustRow.ExternalID,
+					RoleTrustRow.IsAdmin,
+					RoleTrustRow.CanPrivEsc})
+			}
+		}
+
+	}
+
+	m.sortTrustsTablePerTrustedPrincipal()
+	return header, body, tableCols
+
+}
+
+// printPrincipalTrusts but only those that have a trusted principal that contains :root and also does not have an external ID
+func (m *RoleTrustsModule) printPrincipalTrustsRootOnly(outputDirectory string) ([]string, [][]string, []string) {
+	var header []string
+	var body [][]string
+	m.output.FullFilename = ""
+	m.output.Body = nil
+	m.output.CallingModule = "role-trusts"
+	m.output.FullFilename = "role-trusts-principals-root-trusts-without-external-id"
+	header = []string{
+		"Account",
+		"Role Arn",
+		"Role Name",
+		"Trusted Principal",
+		"ExternalID",
+		"IsAdmin?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{"Account", "Role Arn", "Trusted Principal", "ExternalID", "IsAdmin?", "CanPrivEscToAdmin?"}
+		// Otherwise, use the default columns for this module (brief)
+	} else {
+		tableCols = []string{"Role Name", "Trusted Principal", "ExternalID", "IsAdmin?", "CanPrivEscToAdmin?"}
+	}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
+	for _, role := range m.AnalyzedRoles {
+		for _, statement := range role.trustsDoc.Statement {
+			for _, principal := range statement.Principal.AWS {
+				if strings.Contains(principal, ":root") && statement.Condition.StringEquals.StsExternalID == "" {
+					accountID := strings.Split(principal, ":")[4]
+					vendorName := m.vendors.GetVendorNameFromAccountID(accountID)
+					if vendorName != "" {
+						principal = fmt.Sprintf("%s (%s)", principal, vendorName)
+					}
+
+					RoleTrustRow := RoleTrustRow{
+						RoleARN:          aws.ToString(role.roleARN),
+						RoleName:         GetResourceNameFromArn(aws.ToString(role.roleARN)),
+						TrustedPrincipal: principal,
+						ExternalID:       statement.Condition.StringEquals.StsExternalID,
+						IsAdmin:          role.Admin,
+						CanPrivEsc:       role.CanPrivEsc,
+					}
+					body = append(body, []string{
+						aws.ToString(m.Caller.Account),
+						RoleTrustRow.RoleARN,
+						RoleTrustRow.RoleName,
+						RoleTrustRow.TrustedPrincipal,
+						RoleTrustRow.ExternalID,
+						RoleTrustRow.IsAdmin,
+						RoleTrustRow.CanPrivEsc})
+				}
 			}
 		}
 	}
-	m.sortTrustsTablePerTrustedPrincipal()
-	return header, body
-	// if len(m.output.Body) > 0 {
-	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
-	// 	////m.output.OutputSelector(outputFormat)
-	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-	// 	//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
-	// } else {
-	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	// }
-	// fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+	m.sortTrustsTablePerTrustedPrincipal()
+	return header, body, tableCols
 }
 
-func (m *RoleTrustsModule) printServiceTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+func (m *RoleTrustsModule) printServiceTrusts(outputDirectory string) ([]string, [][]string, []string) {
 	var header []string
 	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-services"
-	var column1 string
-	if m.pmapperError == nil {
-		header = []string{
-			"Role",
-			"Trusted Service",
-			"ExternalID",
-			"IsAdmin?",
-			"CanPrivEscToAdmin?",
-		}
+	header = []string{
+		"Account",
+		"Role Arn",
+		"Role Name",
+		"Trusted Service",
+		"IsAdmin?",
+		"CanPrivEscToAdmin?",
+	}
+
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{"Account", "Role Arn", "Trusted Service", "IsAdmin?", "CanPrivEscToAdmin?"}
+		// Otherwise, use the default columns for this module (brief)
 	} else {
-		header = []string{
-			"Role",
-			"Trusted Service",
-			"ExternalID",
-			"IsAdmin?",
-			//"CanPrivEscToAdmin?",
-		}
+		tableCols = []string{"Role Name", "Trusted Service", "IsAdmin?", "CanPrivEscToAdmin?"}
+	}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
 	}
 
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			for _, service := range statement.Principal.Service {
-				if outputFormat == "wide" {
-					column1 = aws.ToString(role.roleARN)
-				} else {
-					column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
-				}
-				column2 := service
-				column3 := statement.Condition.StringEquals.StsExternalID
-				column4 := role.Admin
-				column5 := role.CanPrivEsc
-				if m.pmapperError == nil {
-					body = append(body, []string{column1, column2, column3, column4, column5})
-				} else {
-					body = append(body, []string{column1, column2, column3, column4})
+				RoleTrustRow := RoleTrustRow{
+					RoleARN:        aws.ToString(role.roleARN),
+					RoleName:       GetResourceNameFromArn(aws.ToString(role.roleARN)),
+					TrustedService: service,
+					IsAdmin:        role.Admin,
+					CanPrivEsc:     role.CanPrivEsc,
 				}
+				body = append(body, []string{
+					aws.ToString(m.Caller.Account),
+					RoleTrustRow.RoleARN,
+					RoleTrustRow.RoleName,
+					RoleTrustRow.TrustedService,
+					RoleTrustRow.IsAdmin,
+					RoleTrustRow.CanPrivEsc})
+
 			}
 		}
 	}
 
 	// sort the rows based on column 2 (service)
 	sort.SliceStable(body, func(i, j int) bool {
-		return body[i][1] < body[j][1]
+		return body[i][3] < body[j][3]
 	})
 
-	//m.sortTrustsTablePerTrustedPrincipal()
-	return header, body
+	return header, body, tableCols
 
-	// if len(m.output.Body) > 0 {
-	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
-	// 	//m.output.OutputSelector(outputFormat)
-	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-	// 	internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
-
-	// } else {
-	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	// }
 }
 
-func (m *RoleTrustsModule) printFederatedTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+func (m *RoleTrustsModule) printFederatedTrusts(outputDirectory string) ([]string, [][]string, []string) {
 	var header []string
 	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-federated"
-	var column1, column3, column2 string
-	if m.pmapperError == nil {
-
-		header = []string{
-			"Role",
-			"Trusted Provider",
-			"Trusted Subject",
-			"IsAdmin?",
-			"CanPrivEscToAdmin?",
-		}
-	} else {
-		header = []string{
-			"Role",
-			"Trusted Provider",
-			"Trusted Subject",
-			"IsAdmin?",
-			//"CanPrivEscToAdmin?",
-		}
+	header = []string{
+		"Account",
+		"Role Arn",
+		"Role Name",
+		"Trusted Provider",
+		"Trusted Subject",
+		"IsAdmin?",
+		"CanPrivEscToAdmin?",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		tableCols = strings.Split(m.AWSTableCols, ",")
+		// If the user specified wide as the output format, use these columns.
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{"Account", "Role Arn", "Trusted Provider", "Trusted Subject", "IsAdmin?", "CanPrivEscToAdmin?"}
+		// Otherwise, use the default columns for this module (brief)
+	} else {
+		tableCols = []string{"Role Name", "Trusted Provider", "Trusted Subject", "IsAdmin?", "CanPrivEscToAdmin?"}
+	}
+	// Remove the pmapper row if there is no pmapper data
+	if m.pmapperError != nil {
+		sharedLogger.Errorf("%s - %s - No pmapper data found for this account. Skipping the pmapper column in the output table.", m.output.CallingModule, m.AWSProfile)
+		tableCols = removeStringFromSlice(tableCols, "CanPrivEscToAdmin?")
+	}
 	for _, role := range m.AnalyzedRoles {
-		if outputFormat == "wide" {
-			column1 = aws.ToString(role.roleARN)
-		} else {
-			column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
-		}
 		for _, statement := range role.trustsDoc.Statement {
 			if len(statement.Principal.Federated) > 0 {
-				column2, column3 = parseFederatedTrustPolicy(statement)
-				column4 := role.Admin
-				column5 := role.CanPrivEsc
-				if m.pmapperError == nil {
-					body = append(body, []string{column1, column2, column3, column4, column5})
-				} else {
-					body = append(body, []string{column1, column2, column3, column4})
+				provider, subjects := parseFederatedTrustPolicy(statement)
+				for _, subject := range subjects {
+					RoleTrustRow := RoleTrustRow{
+						RoleARN:                  aws.ToString(role.roleARN),
+						RoleName:                 GetResourceNameFromArn(aws.ToString(role.roleARN)),
+						TrustedFederatedProvider: provider,
+						TrustedFederatedSubject:  subject,
+						IsAdmin:                  role.Admin,
+						CanPrivEsc:               role.CanPrivEsc,
+					}
+					body = append(body, []string{
+						aws.ToString(m.Caller.Account),
+						RoleTrustRow.RoleARN,
+						RoleTrustRow.RoleName,
+						RoleTrustRow.TrustedFederatedProvider,
+						RoleTrustRow.TrustedFederatedSubject,
+						RoleTrustRow.IsAdmin,
+						RoleTrustRow.CanPrivEsc})
 				}
 			}
+
 		}
 	}
 
 	m.sortTrustsTablePerTrustedPrincipal()
-	return header, body
+	return header, body, tableCols
 
-	// if len(m.output.Body) > 0 {
-	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
-	// 	//m.output.OutputSelector(outputFormat)
-	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-	// 	internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
-
-	// } else {
-	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	// }
 }
 
-func parseFederatedTrustPolicy(statement RoleTrustStatementEntry) (string, string) {
-	var column2, column3 string
-	if statement.Condition.StringLike.TokenActionsGithubusercontentComAud != "" || len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
-		column2 = "GitHub Actions" //  (" + statement.Principal.Federated[0] + ")"
-		trustedRepos := strings.Join(statement.Condition.StringLike.TokenActionsGithubusercontentComSub, "\n")
-		if trustedRepos == "" {
-			column3 = "ALL REPOS!!!"
+func parseFederatedTrustPolicy(statement policy.RoleTrustStatementEntry) (string, []string) {
+	var provider string
+	var subjects []string
+	if len(statement.Principal.Federated) > 1 {
+		sharedLogger.Warnf("Multiple federated providers found in the trust policy. This is not currently supported. Please review the trust policy for specifics.")
+		provider = "Multiple Federated Providers"
+		subjects = append(subjects, "Review policy for specifics\nand submit issue to cloudfox repo.")
+	}
+
+	switch {
+	// lets use the Federated field to determine the provider, then based on the provider we can grab the list of subjects
+	case strings.Contains(statement.Principal.Federated[0], "token.actions.githubusercontent.com"):
+		provider = "GitHub"
+		if len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.TokenActionsGithubusercontentComSub...)
+		} else if len(statement.Condition.StringEquals.TokenActionsGithubusercontentComSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.TokenActionsGithubusercontentComSub...)
 		} else {
-			column3 = trustedRepos
+			subjects = append(subjects, "ALL REPOS!!!")
 		}
-	} else if statement.Condition.StringEquals.SAMLAud == "https://signin.aws.amazon.com/saml" {
-		if strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
-		} else if strings.Contains(statement.Principal.Federated[0], "Okta") {
-			column2 = "Okta" //  (" + statement.Principal.Federated[0] + ")"
-		}
-		column3 = "Not applicable"
-	} else if statement.Condition.StringEquals.OidcEksAud != "" || statement.Condition.StringEquals.OidcEksSub != "" || statement.Condition.StringLike.OidcEksAud != "" || statement.Condition.StringLike.OidcEksSub != "" {
-		column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
-		if statement.Condition.StringEquals.OidcEksSub != "" {
-			column3 = statement.Condition.StringEquals.OidcEksSub
-		} else if statement.Condition.StringLike.OidcEksSub != "" {
-			column3 = statement.Condition.StringLike.OidcEksSub
+	case strings.Contains(statement.Principal.Federated[0], "oidc.eks"):
+		// extract accountId from statement.Principal.Federated[0]
+		accountId := strings.Split(statement.Principal.Federated[0], ":")[4]
+		provider = fmt.Sprintf("EKS-%s", accountId)
+		//provider = "EKS"
+		//provider = statement.Principal.Federated[0]
+		if len(statement.Condition.StringLike.OidcEksSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.OidcEksSub...)
+		} else if len(statement.Condition.StringEquals.OidcEksSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.OidcEksSub...)
 		} else {
-			column3 = "ALL SERVICE ACCOUNTS!"
+			subjects = append(subjects, "ALL SERVICE ACCOUNTS!!!")
 		}
-	} else if statement.Principal.Federated[0] == "cognito-identity.amazonaws.com" {
-		column2 = "Cognito" // (" + statement.Principal.Federated[0] + ")"
-		if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
-			column3 = statement.Condition.ForAnyValueStringLike.CognitoAMR
+		// terraform case
+	case strings.Contains(statement.Principal.Federated[0], "app.terraform.io"):
+		provider = "Terraform Cloud"
+		if len(statement.Condition.StringLike.TerraformSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.TerraformSub...)
+		} else if len(statement.Condition.StringEquals.TerraformSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.TerraformSub...)
+		} else {
+			subjects = append(subjects, "ALL WORKSPACES")
 		}
-	} else {
-		if column2 == "" && strings.Contains(statement.Principal.Federated[0], "oidc.eks") {
-			column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
-			column3 = "ALL SERVICE ACCOUNTS!"
-		} else if column2 == "" && strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
+		// Azure AD case
+	case strings.Contains(statement.Principal.Federated[0], "http://sts.windows.net"):
+		provider = "Azure AD"
+		if len(statement.Condition.StringLike.AzureADIss) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.AzureADIss...)
+		} else if len(statement.Condition.StringEquals.AzureADIss) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.AzureADIss...)
+		} else {
+			subjects = append(subjects, "ALL ISSUERS")
 		}
 
+	///AWS SSO case
+	case strings.Contains(statement.Principal.Federated[0], "AWSSSO"):
+		//provider = "AWS SSO"
+		accountId := strings.Split(statement.Principal.Federated[0], ":")[4]
+		provider = fmt.Sprintf("AWSSSO-%s", accountId)
+		subjects = append(subjects, "Not applicable")
+
+	// okta case
+	case strings.Contains(statement.Principal.Federated[0], "Okta"):
+		provider = "Okta"
+		subjects = append(subjects, "Not applicable")
+
+	// cognito case
+	case statement.Principal.Federated[0] == "cognito-identity.amazonaws.com":
+		provider = "Cognito"
+		if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
+			subjects = append(subjects, statement.Condition.ForAnyValueStringLike.CognitoAMR)
+		} else {
+			subjects = append(subjects, "ALL IDENTITIES")
+		}
+		// google workspace case
+	case strings.Contains(statement.Principal.Federated[0], "workspace.google.com"):
+		provider = "Google Workspace"
+		if len(statement.Condition.StringLike.GoogleWorkspaceSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.GoogleWorkspaceSub...)
+		} else if len(statement.Condition.StringEquals.GoogleWorkspaceSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.GoogleWorkspaceSub...)
+		} else {
+			subjects = append(subjects, "ALL USERS")
+		}
+		// GCP case
+	case strings.Contains(statement.Principal.Federated[0], "accounts.google.com"):
+		provider = "GCP"
+		if len(statement.Condition.StringLike.GCPSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.GCPSub...)
+		} else if len(statement.Condition.StringEquals.GCPSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.GCPSub...)
+		} else {
+			subjects = append(subjects, "ALL USERS")
+		}
+	// auth0 case
+	//not ready yet
+	// case strings.Contains(statement.Principal.Federated[0], "auth0.com"):
+	// 	provider = "Auth0"
+	// 	if len(statement.Condition.ForAnyValueStringLike.Auth0Amr) > 0 {
+	// 		subjects = append(subjects, statement.Condition.ForAnyValueStringLike.Auth0Amr...)
+	// 	} else {
+	// 		subjects = append(subjects, "ALL GROUPS")
+	// 	}
+	// circleci case
+	case strings.Contains(statement.Principal.Federated[0], "oidc.circleci.com"):
+		provider = "CircleCI"
+		if len(statement.Condition.StringLike.CircleCIAud) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.CircleCIAud...)
+		} else if len(statement.Condition.StringEquals.CircleCIAud) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.CircleCIAud...)
+		} else {
+			subjects = append(subjects, "ALL PROJECTS")
+		}
+	case strings.Contains(statement.Principal.Federated[0], "saml-provider"):
+		// the provider name is the last part of the ARN
+		provider = strings.Split(statement.Principal.Federated[0], ":saml-provider/")[1]
+		subjects = append(subjects, "Not applicable")
+
+	default:
+		provider = "Unknown Federated Provider"
+		subjects = append(subjects, "Review policy for specifics\nand submit issue to cloudfox repo.")
+
 	}
-	return column2, column3
+	return provider, subjects
 }
 
 func (m *RoleTrustsModule) sortTrustsTablePerTrustedPrincipal() {
@@ -421,7 +591,7 @@ func (m *RoleTrustsModule) getAllRoleTrusts() {
 	}
 
 	for _, role := range ListRoles {
-		trustsdoc, err := parseRoleTrustPolicyDocument(role)
+		trustsdoc, err := policy.ParseRoleTrustPolicyDocument(role)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
@@ -435,45 +605,9 @@ func (m *RoleTrustsModule) getAllRoleTrusts() {
 				Admin:      "",
 				CanPrivEsc: "",
 			})
+
 		}
 
 	}
 
 }
-
-func parseRoleTrustPolicyDocument(role types.Role) (trustPolicyDocument, error) {
-	document, _ := url.QueryUnescape(aws.ToString(role.AssumeRolePolicyDocument))
-
-	// These next six lines are a hack, needed because the EKS OIDC json field name is dynamic
-	// and therefore can't be used to unmarshall in a predictable way. The hack involves replacing
-	// the random pattern with a predictable one so that we can add the predictable one in the struct
-	// used to unmarshall.
-	pattern := `(\w+)\:`
-	pattern2 := `".[a-zA-Z0-9\-\.]+/id/`
-	var reEKSSub = regexp.MustCompile(pattern2 + pattern + "sub")
-	var reEKSAud = regexp.MustCompile(pattern2 + pattern + "aud")
-	document = reEKSSub.ReplaceAllString(document, "\"OidcEksSub")
-	document = reEKSAud.ReplaceAllString(document, "\"OidcEksAud")
-
-	var parsedDocumentToJSON trustPolicyDocument
-	_ = json.Unmarshal([]byte(document), &parsedDocumentToJSON)
-	return parsedDocumentToJSON, nil
-}
-
-// A custom unmarshaller is necessary because the list of principals can be an array of strings or a string.
-// https://stackoverflow.com/questions/65854778/parsing-arn-from-iam-policy-using-regex
-type ListOfPrincipals []string
-
-func (r *ListOfPrincipals) UnmarshalJSON(b []byte) error {
-	var s string
-	if err := json.Unmarshal(b, &s); err == nil {
-		*r = append(*r, s)
-		return nil
-	}
-	var ss []string
-	if err := json.Unmarshal(b, &ss); err == nil {
-		*r = ss
-		return nil
-	}
-	return errors.New("cannot unmarshal neither to a string nor a slice of strings")
-}

aws/route53.go

@@ -1,26 +1,28 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/route53"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
 )
 
 type Route53Module struct {
 	// General configuration data
-	Route53Client *route53.Client
+	Route53Client sdk.AWSRoute53ClientInterface
+
+	Caller        sts.GetCallerIdentityOutput
+	AWSRegions    []string
+	AWSOutputType string
+	AWSTableCols  string
 
-	Caller         sts.GetCallerIdentityOutput
-	AWSRegions     []string
-	OutputFormat   string
 	Goroutines     int
 	AWSProfile     string
 	WrapTable      bool
@@ -42,9 +44,9 @@ type Record struct {
 	PrivateZone string
 }
 
-func (m *Route53Module) PrintRoute53(outputFormat string, outputDirectory string, verbosity int) {
+func (m *Route53Module) PrintRoute53(outputDirectory string, verbosity int) {
 
-	// These stuct values are used by the output module
+	// These struct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
 	m.output.CallingModule = "route53"
@@ -60,19 +62,48 @@ func (m *Route53Module) PrintRoute53(outputFormat string, outputDirectory string
 	m.getRoute53Records()
 
 	m.output.Headers = []string{
-		"Service",
+		"Account",
 		"Name",
 		"Type",
 		"Value",
 		"PrivateZone",
 	}
 
+	// If the user specified table columns, use those.
+	// If the user specified -o wide, use the wide default cols for this module.
+	// Otherwise, use the hardcoded default cols for this module.
+	var tableCols []string
+	// If the user specified table columns, use those.
+	if m.AWSTableCols != "" {
+		// If the user specified wide as the output format, use these columns.
+		// remove any spaces between any commas and the first letter after the commas
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ", ", ",")
+		m.AWSTableCols = strings.ReplaceAll(m.AWSTableCols, ",  ", ",")
+		tableCols = strings.Split(m.AWSTableCols, ",")
+	} else if m.AWSOutputType == "wide" {
+		tableCols = []string{
+			"Account",
+			"Name",
+			"Type",
+			"Value",
+			"PrivateZone",
+		}
+
+	} else {
+		tableCols = []string{
+			"Name",
+			"Type",
+			"Value",
+			"PrivateZone",
+		}
+	}
+
 	// Table rows
 	for i := range m.Records {
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Records[i].AWSService,
+				aws.ToString(m.Caller.Account),
 				m.Records[i].Name,
 				m.Records[i].Type,
 				m.Records[i].Value,
@@ -84,10 +115,7 @@ func (m *Route53Module) PrintRoute53(outputFormat string, outputDirectory string
 	if len(m.output.Body) > 0 {
 
 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		//m.writeLoot(m.output.FilePath, verbosity)
+
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
@@ -96,9 +124,10 @@ func (m *Route53Module) PrintRoute53(outputFormat string, outputDirectory string
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
-			Header: m.output.Headers,
-			Body:   m.output.Body,
-			Name:   m.output.CallingModule,
+			Header:    m.output.Headers,
+			Body:      m.output.Body,
+			TableCols: tableCols,
+			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
 		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
@@ -127,7 +156,7 @@ func (m *Route53Module) writeLoot(outputDirectory string, verbosity int) {
 	var route53APublicRecords string
 
 	for _, record := range m.Records {
-		if record.Type == "A" || record.Type == "AAAA" {
+		if record.Type == "A" || record.Type == "AAAA" || record.Type == "CNAME" {
 			if record.PrivateZone == "True" {
 				route53APrivateRecords = route53APrivateRecords + fmt.Sprintln(record.Name)
 			} else {
@@ -176,71 +205,51 @@ func (m *Route53Module) writeLoot(outputDirectory string, verbosity int) {
 
 func (m *Route53Module) getRoute53Records() {
 	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
 	var recordName string
 	var recordType string
 
-	for {
-		ListHostedZones, err := m.Route53Client.ListHostedZones(
-			context.TODO(),
-			&route53.ListHostedZonesInput{
-				Marker: PaginationControl,
-			},
-		)
+	HostedZones, err := sdk.CachedRoute53ListHostedZones(m.Route53Client, aws.ToString(m.Caller.Account))
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	var privateZone string
+	for _, zone := range HostedZones {
+		if zone.Config.PrivateZone {
+			privateZone = "True"
+		} else {
+			privateZone = "False"
+		}
+
+		Records, err := sdk.CachedRoute53ListResourceRecordSets(m.Route53Client, aws.ToString(m.Caller.Account), aws.ToString(zone.Id))
 
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
 			break
 		}
+		for _, record := range Records {
+			recordName = aws.ToString(record.Name)
+			recordType = string(record.Type)
+
+			for _, resourceRecord := range record.ResourceRecords {
+				recordValue := resourceRecord.Value
+				m.Records = append(
+					m.Records,
+					Record{
+						AWSService:  "Route53",
+						Name:        recordName,
+						Type:        recordType,
+						Value:       aws.ToString(recordValue),
+						PrivateZone: privateZone,
+					})
 
-		var privateZone string
-		for _, zone := range ListHostedZones.HostedZones {
-			id := aws.ToString(zone.Id)
-			if zone.Config.PrivateZone {
-				privateZone = "True"
-			} else {
-				privateZone = "False"
 			}
-
-			ListResourceRecordSets, err := m.Route53Client.ListResourceRecordSets(
-				context.TODO(),
-				&route53.ListResourceRecordSetsInput{
-					HostedZoneId: &id,
-				},
-			)
-			if err != nil {
-				m.modLog.Error(err.Error())
-				m.CommandCounter.Error++
-				break
-			}
-			for _, record := range ListResourceRecordSets.ResourceRecordSets {
-				recordName = aws.ToString(record.Name)
-				recordType = string(record.Type)
-
-				for _, resourceRecord := range record.ResourceRecords {
-					recordValue := resourceRecord.Value
-					m.Records = append(
-						m.Records,
-						Record{
-							AWSService:  "Route53",
-							Name:        recordName,
-							Type:        recordType,
-							Value:       aws.ToString(recordValue),
-							PrivateZone: privateZone,
-						})
-
-				}
-			}
-
 		}
 
-		// The "NextToken" value is nil when there's no more data to return.
-		if ListHostedZones.NextMarker != nil {
-			PaginationControl = ListHostedZones.NextMarker
-		} else {
-			PaginationControl = nil
-			break
-		}
 	}
+
 }

aws/sdk/apigateway.go

@@ -6,16 +6,51 @@ import (
 	"fmt"
 
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/apigateway"
 	apiGatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+	"github.com/patrickmn/go-cache"
 )
 
 type APIGatewayClientInterface interface {
 	GetRestApis(context.Context, *apigateway.GetRestApisInput, ...func(*apigateway.Options)) (*apigateway.GetRestApisOutput, error)
+	GetStages(context.Context, *apigateway.GetStagesInput, ...func(*apigateway.Options)) (*apigateway.GetStagesOutput, error)
+	GetResources(context.Context, *apigateway.GetResourcesInput, ...func(*apigateway.Options)) (*apigateway.GetResourcesOutput, error)
+	GetDomainNames(context.Context, *apigateway.GetDomainNamesInput, ...func(*apigateway.Options)) (*apigateway.GetDomainNamesOutput, error)
+	GetBasePathMappings(context.Context, *apigateway.GetBasePathMappingsInput, ...func(*apigateway.Options)) (*apigateway.GetBasePathMappingsOutput, error)
+	GetMethod(context.Context, *apigateway.GetMethodInput, ...func(*apigateway.Options)) (*apigateway.GetMethodOutput, error)
+	GetUsagePlans(context.Context, *apigateway.GetUsagePlansInput, ...func(*apigateway.Options)) (*apigateway.GetUsagePlansOutput, error)
+	GetUsagePlanKeys(context.Context, *apigateway.GetUsagePlanKeysInput, ...func(*apigateway.Options)) (*apigateway.GetUsagePlanKeysOutput, error)
 }
 
-func RegisterApiGatewayTypes() {
+type CachedGetMethodOutput struct {
+	ApiKeyRequired      *bool
+	AuthorizationScopes []string
+	AuthorizationType   *string
+	AuthorizerId        *string
+	HttpMethod          *string
+	MethodIntegration   *apiGatewayTypes.Integration
+	MethodResponses     map[string]apiGatewayTypes.MethodResponse
+	OperationName       *string
+	RequestModels       map[string]string
+	RequestParameters   map[string]bool
+	RequestValidatorId  *string
+	ResourceId          *string
+}
+
+type CachedGetStagesOutput struct {
+	Item []apiGatewayTypes.Stage
+}
+
+func init() {
 	gob.Register([]apiGatewayTypes.RestApi{})
+	gob.Register(CachedGetStagesOutput{})
+	gob.Register([]apiGatewayTypes.Resource{})
+	gob.Register([]apiGatewayTypes.DomainName{})
+	gob.Register([]apiGatewayTypes.BasePathMapping{})
+	gob.Register(CachedGetMethodOutput{})
+	gob.Register([]apiGatewayTypes.UsagePlan{})
+	gob.Register([]apiGatewayTypes.UsagePlanKey{})
 }
 
 // create a CachedApiGatewayGetRestAPIs function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination
@@ -51,6 +86,310 @@ func CachedApiGatewayGetRestAPIs(client APIGatewayClientInterface, accountID str
 		}
 		PaginationControl = GetRestApis.Position
 	}
-
+	internal.Cache.Set(cacheKey, restAPIs, cache.DefaultExpiration)
 	return restAPIs, nil
 }
+
+// create a CachedApiGatewayGetStages function that accepts a client, account id, region, and rest api id. Make sure it handles caching, the region option and pagination
+func CachedApiGatewayGetStages(client APIGatewayClientInterface, accountID string, region string, restAPIID string) (*apigateway.GetStagesOutput, error) {
+	cacheKey := fmt.Sprintf("%s-apigateway-GetStages-%s-%s", accountID, region, restAPIID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		// Convert cached data back to GetStagesOutput before returning
+		cachedOutput := cached.(*CachedGetStagesOutput) // Ensure this type assertion matches your caching logic
+		return fromCachedGetStagesOutput(cachedOutput), nil
+	}
+
+	GetStages, err := client.GetStages(
+		context.TODO(),
+		&apigateway.GetStagesInput{
+			RestApiId: &restAPIID,
+		},
+		func(o *apigateway.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return &apigateway.GetStagesOutput{}, err
+	}
+
+	// Convert GetStagesOutput to CachedGetStagesOutput before caching
+	cachedVersion := toCachedGetStagesOutput(GetStages)
+	internal.Cache.Set(cacheKey, cachedVersion, cache.DefaultExpiration)
+	return GetStages, err
+}
+
+// Convert from AWS SDK type to custom type for caching
+func toCachedGetStagesOutput(gso *apigateway.GetStagesOutput) *CachedGetStagesOutput {
+	return &CachedGetStagesOutput{
+		Item: gso.Item,
+	}
+}
+
+// Convert back to AWS SDK type after fetching from cache
+func fromCachedGetStagesOutput(cgso *CachedGetStagesOutput) *apigateway.GetStagesOutput {
+	return &apigateway.GetStagesOutput{
+		Item: cgso.Item,
+		// Initialize ResultMetadata or leave it as zero value if it's not required for your use case
+	}
+}
+
+// create a CachedApiGatewayGetResources function that accepts a client, account id, region, and rest api id. Make sure it handles caching, the region option and pagination
+func CachedApiGatewayGetResources(client APIGatewayClientInterface, accountID string, region string, restAPIID string) ([]apiGatewayTypes.Resource, error) {
+	var PaginationControl *string
+	var resources []apiGatewayTypes.Resource
+	cacheKey := fmt.Sprintf("%s-apigateway-GetResources-%s-%s", accountID, region, restAPIID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.Resource), nil
+	}
+
+	for {
+		GetResources, err := client.GetResources(
+			context.TODO(),
+			&apigateway.GetResourcesInput{
+				RestApiId: &restAPIID,
+				Position:  PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return resources, err
+		}
+
+		resources = append(resources, GetResources.Items...)
+
+		//pagination
+		if GetResources.Position == nil {
+			break
+		}
+		PaginationControl = GetResources.Position
+	}
+	internal.Cache.Set(cacheKey, resources, cache.DefaultExpiration)
+	return resources, nil
+}
+
+// create a CachedApiGatewayGetDomainNames function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination if needed
+func CachedApiGatewayGetDomainNames(client APIGatewayClientInterface, accountID string, region string) ([]apiGatewayTypes.DomainName, error) {
+	var PaginationControl *string
+	var domainNames []apiGatewayTypes.DomainName
+	cacheKey := fmt.Sprintf("%s-apigateway-GetDomainNames-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.DomainName), nil
+	}
+
+	for {
+		GetDomainNames, err := client.GetDomainNames(
+			context.TODO(),
+			&apigateway.GetDomainNamesInput{
+				Position: PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return domainNames, err
+		}
+
+		domainNames = append(domainNames, GetDomainNames.Items...)
+
+		//pagination
+		if GetDomainNames.Position == nil {
+			break
+		}
+		PaginationControl = GetDomainNames.Position
+	}
+	internal.Cache.Set(cacheKey, domainNames, cache.DefaultExpiration)
+	return domainNames, nil
+}
+
+// create a CachedApiGatewayGetBasePathMappings function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination if needed
+func CachedApiGatewayGetBasePathMappings(client APIGatewayClientInterface, accountID string, region string, domain *string) ([]apiGatewayTypes.BasePathMapping, error) {
+	var PaginationControl *string
+	var basePathMappings []apiGatewayTypes.BasePathMapping
+	cacheKey := fmt.Sprintf("%s-apigateway-GetBasePathMappings-%s-%s", accountID, region, aws.ToString(domain))
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.BasePathMapping), nil
+	}
+
+	for {
+		GetBasePathMappings, err := client.GetBasePathMappings(
+			context.TODO(),
+			&apigateway.GetBasePathMappingsInput{
+				DomainName: domain,
+				Position:   PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return basePathMappings, err
+		}
+
+		basePathMappings = append(basePathMappings, GetBasePathMappings.Items...)
+
+		//pagination
+		if GetBasePathMappings.Position == nil {
+			break
+		}
+		PaginationControl = GetBasePathMappings.Position
+	}
+	internal.Cache.Set(cacheKey, basePathMappings, cache.DefaultExpiration)
+	return basePathMappings, nil
+}
+
+// create a CachedApiGatewayGetMethod function that accepts a client, account id, region, rest api id, and resource id. Make sure it handles caching, the region option and pagination if needed
+func CachedApiGatewayGetMethod(client APIGatewayClientInterface, accountID string, region string, restAPIID string, resourceID string, method string) (*apigateway.GetMethodOutput, error) {
+
+	cacheKey := fmt.Sprintf("%s-apigateway-GetMethod-%s-%s-%s-%s", accountID, region, restAPIID, resourceID, method)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		// Convert cached data back to GetMethodOutput before returning
+		cachedOutput := cached.(*CachedGetMethodOutput) // Ensure this type assertion matches your caching logic
+		return fromCachedGetMethodOutput(cachedOutput), nil
+	}
+
+	GetMethod, err := client.GetMethod(
+		context.TODO(),
+		&apigateway.GetMethodInput{
+			RestApiId:  &restAPIID,
+			ResourceId: &resourceID,
+			HttpMethod: &method,
+		},
+		func(o *apigateway.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return &apigateway.GetMethodOutput{}, err
+	}
+
+	// Convert GetMethodOutput to CachedGetMethodOutput before caching
+	cachedVersion := toCachedGetMethodOutput(GetMethod)
+	internal.Cache.Set(cacheKey, cachedVersion, cache.DefaultExpiration)
+	return GetMethod, nil
+
+}
+
+// Convert from AWS SDK type to custom type for caching
+func toCachedGetMethodOutput(gmo *apigateway.GetMethodOutput) *CachedGetMethodOutput {
+	return &CachedGetMethodOutput{
+		ApiKeyRequired:      gmo.ApiKeyRequired,
+		AuthorizationScopes: gmo.AuthorizationScopes,
+		AuthorizationType:   gmo.AuthorizationType,
+		AuthorizerId:        gmo.AuthorizerId,
+		HttpMethod:          gmo.HttpMethod,
+		MethodIntegration:   gmo.MethodIntegration,
+		MethodResponses:     gmo.MethodResponses,
+		OperationName:       gmo.OperationName,
+		RequestModels:       gmo.RequestModels,
+		RequestParameters:   gmo.RequestParameters,
+		RequestValidatorId:  gmo.RequestValidatorId,
+	}
+}
+
+// Convert back to AWS SDK type after fetching from cache
+func fromCachedGetMethodOutput(cgmo *CachedGetMethodOutput) *apigateway.GetMethodOutput {
+	return &apigateway.GetMethodOutput{
+		ApiKeyRequired:      cgmo.ApiKeyRequired,
+		AuthorizationScopes: cgmo.AuthorizationScopes,
+		AuthorizationType:   cgmo.AuthorizationType,
+		AuthorizerId:        cgmo.AuthorizerId,
+		HttpMethod:          cgmo.HttpMethod,
+		MethodIntegration:   cgmo.MethodIntegration,
+		MethodResponses:     cgmo.MethodResponses,
+		OperationName:       cgmo.OperationName,
+		RequestModels:       cgmo.RequestModels,
+		RequestParameters:   cgmo.RequestParameters,
+		RequestValidatorId:  cgmo.RequestValidatorId,
+		// ResultMetadata: This will be missing or zero value; handle accordingly
+	}
+}
+
+// create a CachedApiGatewayGetUsagePlans function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination if needed
+func CachedApiGatewayGetUsagePlans(client APIGatewayClientInterface, accountID string, region string) ([]apiGatewayTypes.UsagePlan, error) {
+	var PaginationControl *string
+	var usagePlans []apiGatewayTypes.UsagePlan
+	cacheKey := fmt.Sprintf("%s-apigateway-GetUsagePlans-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.UsagePlan), nil
+	}
+
+	for {
+		GetUsagePlans, err := client.GetUsagePlans(
+			context.TODO(),
+			&apigateway.GetUsagePlansInput{
+				Position: PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return usagePlans, err
+		}
+
+		usagePlans = append(usagePlans, GetUsagePlans.Items...)
+
+		//pagination
+		if GetUsagePlans.Position == nil {
+			break
+		}
+		PaginationControl = GetUsagePlans.Position
+	}
+
+	internal.Cache.Set(cacheKey, usagePlans, cache.DefaultExpiration)
+	return usagePlans, nil
+}
+
+// create a CachedApiGatewayGetUsagePlanKeys function that accepts a client, account id, region, and usage plan id. Make sure it handles caching, the region option and pagination if needed
+func CachedApiGatewayGetUsagePlanKeys(client APIGatewayClientInterface, accountID string, region string, usagePlanID string) ([]apiGatewayTypes.UsagePlanKey, error) {
+	var PaginationControl *string
+	var usagePlanKeys []apiGatewayTypes.UsagePlanKey
+	cacheKey := fmt.Sprintf("%s-apigateway-GetUsagePlanKeys-%s-%s", accountID, region, usagePlanID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.UsagePlanKey), nil
+	}
+
+	for {
+		GetUsagePlanKeys, err := client.GetUsagePlanKeys(
+			context.TODO(),
+			&apigateway.GetUsagePlanKeysInput{
+				UsagePlanId: &usagePlanID,
+				Position:    PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return usagePlanKeys, err
+		}
+
+		usagePlanKeys = append(usagePlanKeys, GetUsagePlanKeys.Items...)
+
+		//pagination
+		if GetUsagePlanKeys.Position == nil {
+			break
+		}
+		PaginationControl = GetUsagePlanKeys.Position
+	}
+
+	internal.Cache.Set(cacheKey, usagePlanKeys, cache.DefaultExpiration)
+	return usagePlanKeys, nil
+}

aws/sdk/apigateway_mocks.go

@@ -0,0 +1,142 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apigateway"
+	apiGatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+)
+
+type MockedAWSAPIGatewayClient struct {
+}
+
+func (m *MockedAWSAPIGatewayClient) GetRestApis(ctx context.Context, input *apigateway.GetRestApisInput, options ...func(*apigateway.Options)) (*apigateway.GetRestApisOutput, error) {
+	return &apigateway.GetRestApisOutput{
+		Items: []apiGatewayTypes.RestApi{
+			{
+				Id:   aws.String("abcdefg"),
+				Name: aws.String("api1"),
+				EndpointConfiguration: &apiGatewayTypes.EndpointConfiguration{
+					Types: []apiGatewayTypes.EndpointType{
+						apiGatewayTypes.EndpointTypePrivate,
+					},
+				},
+			},
+			{
+				Id:   aws.String("qwerty"),
+				Name: aws.String("api2"),
+				EndpointConfiguration: &apiGatewayTypes.EndpointConfiguration{
+					Types: []apiGatewayTypes.EndpointType{
+						apiGatewayTypes.EndpointTypeRegional,
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetStages(ctx context.Context, input *apigateway.GetStagesInput, options ...func(*apigateway.Options)) (*apigateway.GetStagesOutput, error) {
+	return &apigateway.GetStagesOutput{
+		Item: []apiGatewayTypes.Stage{
+			{
+				StageName: aws.String("stage1"),
+			},
+			{
+				StageName: aws.String("stage2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetResources(ctx context.Context, input *apigateway.GetResourcesInput, options ...func(*apigateway.Options)) (*apigateway.GetResourcesOutput, error) {
+	return &apigateway.GetResourcesOutput{
+		Items: []apiGatewayTypes.Resource{
+			{
+				Id:   aws.String("resource1"),
+				Path: aws.String("/path1"),
+				ResourceMethods: map[string]apiGatewayTypes.Method{
+					"GET": {
+						ApiKeyRequired: aws.Bool(true),
+						AuthorizerId:   aws.String("authorizer1"),
+						OperationName:  aws.String("operation1"),
+					},
+				},
+			},
+			{
+				Id:   aws.String("resource2"),
+				Path: aws.String("/path2"),
+				ResourceMethods: map[string]apiGatewayTypes.Method{
+					"ANY": {
+						ApiKeyRequired: aws.Bool(true),
+						AuthorizerId:   aws.String("authorizer2"),
+						OperationName:  aws.String("operation2"),
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetDomainNames(ctx context.Context, input *apigateway.GetDomainNamesInput, options ...func(*apigateway.Options)) (*apigateway.GetDomainNamesOutput, error) {
+	return &apigateway.GetDomainNamesOutput{
+		Items: []apiGatewayTypes.DomainName{},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetBasePathMappings(ctx context.Context, input *apigateway.GetBasePathMappingsInput, options ...func(*apigateway.Options)) (*apigateway.GetBasePathMappingsOutput, error) {
+	return &apigateway.GetBasePathMappingsOutput{
+		Items: []apiGatewayTypes.BasePathMapping{
+			{
+				BasePath:  aws.String("basepath1"),
+				RestApiId: aws.String("abcdefg"),
+				Stage:     aws.String("stage1"),
+			},
+			{
+				BasePath:  aws.String("basepath2"),
+				RestApiId: aws.String("qwerty"),
+				Stage:     aws.String("stage2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetMethod(ctx context.Context, input *apigateway.GetMethodInput, options ...func(*apigateway.Options)) (*apigateway.GetMethodOutput, error) {
+	return &apigateway.GetMethodOutput{
+		ApiKeyRequired: aws.Bool(true),
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetUsagePlans(ctx context.Context, input *apigateway.GetUsagePlansInput, options ...func(*apigateway.Options)) (*apigateway.GetUsagePlansOutput, error) {
+	return &apigateway.GetUsagePlansOutput{
+		Items: []apiGatewayTypes.UsagePlan{
+			{
+				Id:   aws.String("usageplan1"),
+				Name: aws.String("usageplan1"),
+				ApiStages: []apiGatewayTypes.ApiStage{
+					{
+						ApiId: aws.String("abcdefg"),
+						Stage: aws.String("stage2"),
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayClient) GetUsagePlanKeys(ctx context.Context, input *apigateway.GetUsagePlanKeysInput, options ...func(*apigateway.Options)) (*apigateway.GetUsagePlanKeysOutput, error) {
+	return &apigateway.GetUsagePlanKeysOutput{
+		Items: []apiGatewayTypes.UsagePlanKey{
+			{
+				Id:    aws.String("usageplankey1"),
+				Type:  aws.String("API_KEY"),
+				Value: aws.String("23oieuwefo3rfs"),
+			},
+			{
+				Id:    aws.String("usageplankey2"),
+				Type:  aws.String("API_KEY"),
+				Value: aws.String("982yf98fdv8dlds"),
+			},
+		},
+	}, nil
+}

aws/sdk/apigatewayv2.go

@@ -14,10 +14,22 @@ import (
 
 type APIGatewayv2ClientInterface interface {
 	GetApis(context.Context, *apigatewayv2.GetApisInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApisOutput, error)
+	GetDomainNames(context.Context, *apigatewayv2.GetDomainNamesInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetDomainNamesOutput, error)
+	GetApiMappings(context.Context, *apigatewayv2.GetApiMappingsInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApiMappingsOutput, error)
+	GetStages(context.Context, *apigatewayv2.GetStagesInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetStagesOutput, error)
+	GetRoutes(context.Context, *apigatewayv2.GetRoutesInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetRoutesOutput, error)
 }
 
-func RegisterApiGatewayV2Types() {
+type domainName apiGatwayV2Types.DomainName
+type stage apiGatwayV2Types.Stage
+
+func init() {
 	gob.Register([]apiGatwayV2Types.Api{})
+	//need to do this to avoid conflicts with the Instance type in the ec2 package
+	gob.Register([]domainName{})
+	gob.Register([]apiGatwayV2Types.ApiMapping{})
+	gob.Register([]stage{})
+	gob.Register([]apiGatwayV2Types.Route{})
 }
 
 func CachedAPIGatewayv2GetAPIs(client APIGatewayv2ClientInterface, accountID string, region string) ([]apiGatwayV2Types.Api, error) {
@@ -55,3 +67,154 @@ func CachedAPIGatewayv2GetAPIs(client APIGatewayv2ClientInterface, accountID str
 	internal.Cache.Set(cacheKey, apis, cache.DefaultExpiration)
 	return apis, nil
 }
+
+func CachedAPIGatewayv2GetDomainNames(client APIGatewayv2ClientInterface, accountID string, region string) ([]domainName, error) {
+	var PaginationControl *string
+	var domainNames []domainName
+	cacheKey := fmt.Sprintf("%s-apigatewayv2-GetDomainNames-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]domainName), nil
+	}
+	for {
+		GetDomainNames, err := client.GetDomainNames(
+			context.TODO(),
+			&apigatewayv2.GetDomainNamesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *apigatewayv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return domainNames, err
+		}
+		// convert []apiGatwayV2Types.DomainName to []domainName
+
+		// Convert each element to domainName before appending to avoid conflicting with apigateway's domainname type
+		for _, item := range GetDomainNames.Items {
+			domainNames = append(domainNames, domainName(item))
+		}
+
+		//pagination
+		if GetDomainNames.NextToken == nil {
+			break
+		}
+		PaginationControl = GetDomainNames.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, domainNames, cache.DefaultExpiration)
+	return domainNames, nil
+}
+
+func CachedAPIGatewayv2GetApiMappings(client APIGatewayv2ClientInterface, accountID string, region string, domain string) ([]apiGatwayV2Types.ApiMapping, error) {
+	var PaginationControl *string
+	var apiMappings []apiGatwayV2Types.ApiMapping
+	cacheKey := fmt.Sprintf("%s-apigatewayv2-GetApiMappings-%s-%s", accountID, region, domain)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatwayV2Types.ApiMapping), nil
+	}
+	for {
+		GetApiMappings, err := client.GetApiMappings(
+			context.TODO(),
+			&apigatewayv2.GetApiMappingsInput{
+				DomainName: &domain,
+				NextToken:  PaginationControl,
+			},
+			func(o *apigatewayv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return apiMappings, err
+		}
+
+		apiMappings = append(apiMappings, GetApiMappings.Items...)
+
+		//pagination
+		if GetApiMappings.NextToken == nil {
+			break
+		}
+		PaginationControl = GetApiMappings.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, apiMappings, cache.DefaultExpiration)
+	return apiMappings, nil
+}
+
+func CachedAPIGatewayv2GetStages(client APIGatewayv2ClientInterface, accountID string, region string, apiID string) ([]apiGatwayV2Types.Stage, error) {
+	var PaginationControl *string
+	var stages []apiGatwayV2Types.Stage
+	cacheKey := fmt.Sprintf("%s-apigatewayv2-GetStages-%s-%s", accountID, region, apiID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatwayV2Types.Stage), nil
+	}
+	for {
+		GetStages, err := client.GetStages(
+			context.TODO(),
+			&apigatewayv2.GetStagesInput{
+				ApiId:     &apiID,
+				NextToken: PaginationControl,
+			},
+			func(o *apigatewayv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return stages, err
+		}
+
+		stages = append(stages, GetStages.Items...)
+
+		//pagination
+		if GetStages.NextToken == nil {
+			break
+		}
+		PaginationControl = GetStages.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, stages, cache.DefaultExpiration)
+	return stages, nil
+}
+
+func CachedAPIGatewayv2GetRoutes(client APIGatewayv2ClientInterface, accountID string, region string, apiID string) ([]apiGatwayV2Types.Route, error) {
+	var PaginationControl *string
+	var routes []apiGatwayV2Types.Route
+	cacheKey := fmt.Sprintf("%s-apigatewayv2-GetRoutes-%s-%s", accountID, region, apiID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatwayV2Types.Route), nil
+	}
+	for {
+		GetRoutes, err := client.GetRoutes(
+			context.TODO(),
+			&apigatewayv2.GetRoutesInput{
+				ApiId:     &apiID,
+				NextToken: PaginationControl,
+			},
+			func(o *apigatewayv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return routes, err
+		}
+
+		routes = append(routes, GetRoutes.Items...)
+
+		//pagination
+		if GetRoutes.NextToken == nil {
+			break
+		}
+		PaginationControl = GetRoutes.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, routes, cache.DefaultExpiration)
+	return routes, nil
+}

aws/sdk/apigatewayv2_mocks.go

@@ -0,0 +1,83 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apigatewayv2"
+	apiGatwayV2Types "github.com/aws/aws-sdk-go-v2/service/apigatewayv2/types"
+)
+
+type MockedAWSAPIGatewayv2Client struct {
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetApis(ctx context.Context, input *apigatewayv2.GetApisInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApisOutput, error) {
+	return &apigatewayv2.GetApisOutput{
+		Items: []apiGatwayV2Types.Api{
+			{
+				ApiId:       aws.String("asdfsdfasdf"),
+				Name:        aws.String("api1"),
+				ApiEndpoint: aws.String("https://asdfsdfasdf.execute-api.us-east-1.amazonaws.com"),
+			},
+			{
+				ApiId:       aws.String("qwertyqwerty"),
+				Name:        aws.String("api2"),
+				ApiEndpoint: aws.String("https://qwertyqwerty.execute-api.us-east-1.amazonaws.com"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetDomainNames(ctx context.Context, input *apigatewayv2.GetDomainNamesInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetDomainNamesOutput, error) {
+	return &apigatewayv2.GetDomainNamesOutput{
+		Items: []apiGatwayV2Types.DomainName{
+			{
+				DomainName: aws.String("domain1"),
+			},
+			{
+				DomainName: aws.String("domain2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetApiMappings(ctx context.Context, input *apigatewayv2.GetApiMappingsInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApiMappingsOutput, error) {
+	return &apigatewayv2.GetApiMappingsOutput{
+		Items: []apiGatwayV2Types.ApiMapping{
+			{
+				ApiMappingId: aws.String("apiMapping1"),
+			},
+			{
+				ApiMappingId: aws.String("apiMapping2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetStages(ctx context.Context, input *apigatewayv2.GetStagesInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetStagesOutput, error) {
+	return &apigatewayv2.GetStagesOutput{
+		Items: []apiGatwayV2Types.Stage{
+			{
+				StageName: aws.String("stage1"),
+			},
+			{
+				StageName: aws.String("stage2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetRoutes(ctx context.Context, input *apigatewayv2.GetRoutesInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetRoutesOutput, error) {
+	return &apigatewayv2.GetRoutesOutput{
+		Items: []apiGatwayV2Types.Route{
+			{
+				RouteId:  aws.String("route1"),
+				RouteKey: aws.String("POST /route1"),
+			},
+			{
+				RouteId:  aws.String("route2"),
+				RouteKey: aws.String("GET /route2"),
+			},
+		},
+	}, nil
+}

aws/sdk/apprunner.go

@@ -15,7 +15,7 @@ type AppRunnerClientInterface interface {
 	ListServices(context.Context, *apprunner.ListServicesInput, ...func(*apprunner.Options)) (*apprunner.ListServicesOutput, error)
 }
 
-func RegisterApprunnerTypes() {
+func init() {
 	gob.Register([]apprunnerTypes.Service{})
 	gob.Register([]apprunnerTypes.ServiceSummary{})
 }

aws/sdk/apprunner_mocks.go

@@ -0,0 +1,25 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apprunner"
+	apprunnerTypes "github.com/aws/aws-sdk-go-v2/service/apprunner/types"
+)
+
+type MockedAppRunnerClient struct {
+}
+
+func (m *MockedAppRunnerClient) ListServices(ctx context.Context, input *apprunner.ListServicesInput, options ...func(*apprunner.Options)) (*apprunner.ListServicesOutput, error) {
+	return &apprunner.ListServicesOutput{
+		ServiceSummaryList: []apprunnerTypes.ServiceSummary{
+			{
+				ServiceName: aws.String("service1"),
+			},
+			{
+				ServiceName: aws.String("service2"),
+			},
+		},
+	}, nil
+}

aws/sdk/athena.go

@@ -0,0 +1,96 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/athena"
+	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSAthenaClientInterface interface {
+	ListDataCatalogs(context.Context, *athena.ListDataCatalogsInput, ...func(*athena.Options)) (*athena.ListDataCatalogsOutput, error)
+	ListDatabases(context.Context, *athena.ListDatabasesInput, ...func(*athena.Options)) (*athena.ListDatabasesOutput, error)
+}
+
+func init() {
+	gob.Register([]athenaTypes.DataCatalogSummary{})
+}
+
+func CachedAthenaListDataCatalogs(client AWSAthenaClientInterface, accountID string, region string) ([]athenaTypes.DataCatalogSummary, error) {
+	var PaginationControl *string
+	var dataCatalogs []athenaTypes.DataCatalogSummary
+	cacheKey := fmt.Sprintf("%s-athena-ListDataCatalogs-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]athenaTypes.DataCatalogSummary), nil
+	}
+	for {
+		ListDataCatalogs, err := client.ListDataCatalogs(
+			context.TODO(),
+			&athena.ListDataCatalogsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *athena.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return dataCatalogs, err
+		}
+
+		dataCatalogs = append(dataCatalogs, ListDataCatalogs.DataCatalogsSummary...)
+
+		//pagination
+		if ListDataCatalogs.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDataCatalogs.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, dataCatalogs, cache.DefaultExpiration)
+	return dataCatalogs, nil
+}
+
+func CachedAthenaListDatabases(client AWSAthenaClientInterface, accountID string, region string, catalogName string) ([]string, error) {
+	var PaginationControl *string
+	var databases []string
+	cacheKey := fmt.Sprintf("%s-athena-ListDatabases-%s-%s", accountID, region, catalogName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDatabases, err := client.ListDatabases(
+			context.TODO(),
+			&athena.ListDatabasesInput{
+				CatalogName: &catalogName,
+				NextToken:   PaginationControl,
+			},
+			func(o *athena.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return databases, err
+		}
+
+		for _, database := range ListDatabases.DatabaseList {
+			databases = append(databases, *database.Name)
+		}
+
+		//pagination
+		if ListDatabases.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDatabases.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, databases, cache.DefaultExpiration)
+	return databases, nil
+}

aws/sdk/athena_mocks.go

@@ -0,0 +1,38 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/athena"
+	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+)
+
+type MockedAWSAthenaClient struct {
+}
+
+func (m *MockedAWSAthenaClient) ListDatabases(ctx context.Context, input *athena.ListDatabasesInput, options ...func(*athena.Options)) (*athena.ListDatabasesOutput, error) {
+	return &athena.ListDatabasesOutput{
+		DatabaseList: []athenaTypes.Database{
+			{
+				Name: aws.String("db1"),
+			},
+			{
+				Name: aws.String("db2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAthenaClient) ListDataCatalogs(ctx context.Context, input *athena.ListDataCatalogsInput, options ...func(*athena.Options)) (*athena.ListDataCatalogsOutput, error) {
+	return &athena.ListDataCatalogsOutput{
+		DataCatalogsSummary: []athenaTypes.DataCatalogSummary{
+			{
+				CatalogName: aws.String("catalog1"),
+			},
+			{
+				CatalogName: aws.String("catalog2"),
+			},
+		},
+	}, nil
+}

aws/sdk/cloud9.go

@@ -0,0 +1,86 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/cloud9"
+	cloud9Types "github.com/aws/aws-sdk-go-v2/service/cloud9/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCloud9ClientInterface interface {
+	ListEnvironments(context.Context, *cloud9.ListEnvironmentsInput, ...func(*cloud9.Options)) (*cloud9.ListEnvironmentsOutput, error)
+	DescribeEnvironments(context.Context, *cloud9.DescribeEnvironmentsInput, ...func(*cloud9.Options)) (*cloud9.DescribeEnvironmentsOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+}
+
+func CachedCloud9ListEnvironments(client AWSCloud9ClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var environments []string
+	cacheKey := "cloud9-ListEnvironments-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListEnvironments, err := client.ListEnvironments(
+			context.TODO(),
+			&cloud9.ListEnvironmentsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *cloud9.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return environments, err
+		}
+
+		environments = append(environments, ListEnvironments.EnvironmentIds...)
+
+		//pagination
+		if ListEnvironments.NextToken == nil {
+			break
+		}
+		PaginationControl = ListEnvironments.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, environments, cache.DefaultExpiration)
+	return environments, nil
+}
+
+func CachedCloud9DescribeEnvironments(client AWSCloud9ClientInterface, accountID string, region string, environmentIDs []string) ([]cloud9Types.Environment, error) {
+	var environments []cloud9Types.Environment
+	cacheKey := "cloud9-DescribeEnvironments-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]cloud9Types.Environment), nil
+	}
+	for _, environmentID := range environmentIDs {
+		DescribeEnvironments, err := client.DescribeEnvironments(
+			context.TODO(),
+			&cloud9.DescribeEnvironmentsInput{
+				EnvironmentIds: []string{environmentID},
+			},
+			func(o *cloud9.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return environments, err
+		}
+
+		environments = append(environments, DescribeEnvironments.Environments...)
+
+	}
+
+	internal.Cache.Set(cacheKey, environments, cache.DefaultExpiration)
+	return environments, nil
+}

aws/sdk/cloud9_mocks.go

@@ -0,0 +1,36 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloud9"
+	"github.com/aws/aws-sdk-go-v2/service/cloud9/types"
+)
+
+type MockedAWSCloud9Client struct {
+}
+
+func (m *MockedAWSCloud9Client) ListEnvironments(ctx context.Context, input *cloud9.ListEnvironmentsInput, options ...func(*cloud9.Options)) (*cloud9.ListEnvironmentsOutput, error) {
+	return &cloud9.ListEnvironmentsOutput{
+		EnvironmentIds: []string{
+			"env1",
+			"env2",
+		},
+	}, nil
+}
+
+func (m *MockedAWSCloud9Client) DescribeEnvironments(ctx context.Context, input *cloud9.DescribeEnvironmentsInput, options ...func(*cloud9.Options)) (*cloud9.DescribeEnvironmentsOutput, error) {
+	return &cloud9.DescribeEnvironmentsOutput{
+		Environments: []types.Environment{
+			{
+				Name: aws.String("env1"),
+				Arn:  aws.String("arn:aws:cloud9:us-east-1:123456789012:environment/env1"),
+			},
+			{
+				Name: aws.String("env2"),
+				Arn:  aws.String("arn:aws:cloud9:us-east-1:123456789012:environment/env2"),
+			},
+		},
+	}, nil
+}

aws/sdk/cloudformation.go

@@ -18,7 +18,7 @@ type CloudFormationClientInterface interface {
 	ListStacks(context.Context, *cloudformation.ListStacksInput, ...func(*cloudformation.Options)) (*cloudformation.ListStacksOutput, error)
 }
 
-func RegisterCloudFormationTypes() {
+func init() {
 	gob.Register([]cloudFormationTypes.Stack{})
 	gob.Register([]cloudFormationTypes.StackSummary{})
 }

aws/sdk/cloudformation_mocks.go

@@ -0,0 +1,73 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
+	"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
+)
+
+const DESCRIBE_STACKS_TEST_FILE = "./test-data/cloudformation-describestacks.json"
+const TEMPLATE_BODY_TEST_FILE = "./test-data/cloudformation-getTemplate.json"
+
+type Stacks struct {
+	Stacks []struct {
+		StackID           string            `json:"StackId"`
+		Description       string            `json:"Description"`
+		Tags              []interface{}     `json:"Tags"`
+		Outputs           []types.Output    `json:"Outputs"`
+		Parameters        []types.Parameter `json:"Parameters"`
+		StackStatusReason interface{}       `json:"StackStatusReason"`
+		CreationTime      time.Time         `json:"CreationTime"`
+		Capabilities      []interface{}     `json:"Capabilities"`
+		StackName         string            `json:"StackName"`
+		RoleArn           string            `json:"RoleArn"`
+		StackStatus       string            `json:"StackStatus"`
+		DisableRollback   bool              `json:"DisableRollback"`
+	} `json:"Stacks"`
+}
+
+type TemplateBody struct {
+	TemplateBody string `json:"TemplateBody"`
+}
+
+type MockedCloudformationClient struct {
+	describeStacks  Stacks
+	getTemplateBody TemplateBody
+}
+
+func (m *MockedCloudformationClient) DescribeStacks(ctx context.Context, params *cloudformation.DescribeStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.DescribeStacksOutput, error) {
+
+	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.describeStacks)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_STACKS_TEST_FILE)
+	}
+	var stacks []types.Stack
+	for _, stack := range m.describeStacks.Stacks {
+		stacks = append(stacks, types.Stack{
+			StackName:  &stack.StackName,
+			RoleARN:    &stack.RoleArn,
+			Outputs:    stack.Outputs,
+			Parameters: stack.Parameters,
+		})
+
+	}
+
+	return &cloudformation.DescribeStacksOutput{Stacks: stacks}, nil
+}
+
+func (m *MockedCloudformationClient) GetTemplate(ctx context.Context, params *cloudformation.GetTemplateInput, optFns ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error) {
+	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.getTemplateBody)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", TEMPLATE_BODY_TEST_FILE)
+	}
+
+	return &cloudformation.GetTemplateOutput{TemplateBody: &m.getTemplateBody.TemplateBody}, nil
+}
+
+func (m *MockedCloudformationClient) ListStacks(ctx context.Context, params *cloudformation.ListStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.ListStacksOutput, error) {
+	return &cloudformation.ListStacksOutput{}, nil
+}

aws/sdk/cloudfront.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/cloudfront"
+	cloudfrontTypes "github.com/aws/aws-sdk-go-v2/service/cloudfront/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCloudFrontClientInterface interface {
+	ListDistributions(ctx context.Context, params *cloudfront.ListDistributionsInput, optFns ...func(*cloudfront.Options)) (*cloudfront.ListDistributionsOutput, error)
+}
+
+func init() {
+	gob.Register([]cloudfrontTypes.DistributionSummary{})
+	gob.Register(cloudfrontTypes.DistributionSummary{})
+}
+
+func CachedCloudFrontListDistributions(CloudFrontClient AWSCloudFrontClientInterface, accountID string) ([]cloudfrontTypes.DistributionSummary, error) {
+	var PaginationControl *string
+	var distributions []cloudfrontTypes.DistributionSummary
+	cacheKey := "cloudfront-ListDistributions-" + accountID
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached CloudFront distributions data")
+		return cached.([]cloudfrontTypes.DistributionSummary), nil
+	}
+
+	for {
+		ListDistributions, err := CloudFrontClient.ListDistributions(
+			context.TODO(),
+			&cloudfront.ListDistributionsInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		distributions = append(distributions, ListDistributions.DistributionList.Items...)
+
+		// Pagination control.
+		if ListDistributions.DistributionList.NextMarker != nil {
+			PaginationControl = ListDistributions.DistributionList.NextMarker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, distributions, cache.DefaultExpiration)
+	return distributions, nil
+}

aws/sdk/cloudfront_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudfront"
+	cloudfrontTypes "github.com/aws/aws-sdk-go-v2/service/cloudfront/types"
+)
+
+type MockedAWSCloudFrontClient struct {
+}
+
+func (m *MockedAWSCloudFrontClient) ListDistributions(ctx context.Context, input *cloudfront.ListDistributionsInput, options ...func(*cloudfront.Options)) (*cloudfront.ListDistributionsOutput, error) {
+	return &cloudfront.ListDistributionsOutput{
+		DistributionList: &cloudfrontTypes.DistributionList{
+			Items: []cloudfrontTypes.DistributionSummary{
+				{
+					Id: aws.String("distribution1"),
+				},
+				{
+					Id: aws.String("distribution2"),
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/codeartifact.go

@@ -0,0 +1,94 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codeartifact"
+	codeArtifactTypes "github.com/aws/aws-sdk-go-v2/service/codeartifact/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeArtifactClientInterface interface {
+	ListDomains(context.Context, *codeartifact.ListDomainsInput, ...func(*codeartifact.Options)) (*codeartifact.ListDomainsOutput, error)
+	ListRepositories(context.Context, *codeartifact.ListRepositoriesInput, ...func(*codeartifact.Options)) (*codeartifact.ListRepositoriesOutput, error)
+}
+
+func init() {
+	gob.Register([]codeArtifactTypes.DomainSummary{})
+	gob.Register([]codeArtifactTypes.RepositorySummary{})
+}
+
+func CachedCodeArtifactListDomains(client AWSCodeArtifactClientInterface, accountID string, region string) ([]codeArtifactTypes.DomainSummary, error) {
+	var PaginationControl *string
+	var domains []codeArtifactTypes.DomainSummary
+	cacheKey := fmt.Sprintf("%s-codeartifact-ListDomains-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeArtifactTypes.DomainSummary), nil
+	}
+	for {
+		ListDomains, err := client.ListDomains(
+			context.TODO(),
+			&codeartifact.ListDomainsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codeartifact.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return domains, err
+		}
+
+		domains = append(domains, ListDomains.Domains...)
+
+		//pagination
+		if ListDomains.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDomains.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, domains, cache.DefaultExpiration)
+	return domains, nil
+}
+
+func CachedCodeArtifactListRepositories(client AWSCodeArtifactClientInterface, accountID string, region string) ([]codeArtifactTypes.RepositorySummary, error) {
+	var PaginationControl *string
+	var repositories []codeArtifactTypes.RepositorySummary
+	cacheKey := fmt.Sprintf("%s-codeartifact-ListRepositories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeArtifactTypes.RepositorySummary), nil
+	}
+	for {
+		ListRepositories, err := client.ListRepositories(
+			context.TODO(),
+			&codeartifact.ListRepositoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codeartifact.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return repositories, err
+		}
+
+		repositories = append(repositories, ListRepositories.Repositories...)
+
+		//pagination
+		if ListRepositories.NextToken == nil {
+			break
+		}
+		PaginationControl = ListRepositories.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, repositories, cache.DefaultExpiration)
+	return repositories, nil
+}

aws/sdk/codeartifact_mocks.go

@@ -0,0 +1,46 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codeartifact"
+	codeArtifactTypes "github.com/aws/aws-sdk-go-v2/service/codeartifact/types"
+)
+
+type MockedAWSCodeArtifactClient struct {
+}
+
+func (m *MockedAWSCodeArtifactClient) ListRepositories(ctx context.Context, input *codeartifact.ListRepositoriesInput, options ...func(*codeartifact.Options)) (*codeartifact.ListRepositoriesOutput, error) {
+	return &codeartifact.ListRepositoriesOutput{
+		NextToken: nil,
+		Repositories: []codeArtifactTypes.RepositorySummary{
+			{
+				Name:       aws.String("repo1"),
+				Arn:        aws.String("arn:aws:codeartifact:us-east-1:123456789012:repository/repo1"),
+				DomainName: aws.String("domain1"),
+			},
+			{
+				Name:       aws.String("repo2"),
+				Arn:        aws.String("arn:aws:codeartifact:us-east-1:123456789012:repository/repo2"),
+				DomainName: aws.String("domain1"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSCodeArtifactClient) ListDomains(ctx context.Context, input *codeartifact.ListDomainsInput, options ...func(*codeartifact.Options)) (*codeartifact.ListDomainsOutput, error) {
+	return &codeartifact.ListDomainsOutput{
+		NextToken: nil,
+		Domains: []codeArtifactTypes.DomainSummary{
+			{
+				Name: aws.String("domain1"),
+				Arn:  aws.String("arn:aws:codeartifact:us-east-1:123456789012:domain/domain1"),
+			},
+			{
+				Name: aws.String("domain2"),
+				Arn:  aws.String("arn:aws:codeartifact:us-east-1:123456789012:domain/domain2"),
+			},
+		},
+	}, nil
+}

aws/sdk/codebuild.go

@@ -18,8 +18,9 @@ type CodeBuildClientInterface interface {
 	GetResourcePolicy(ctx context.Context, params *codebuild.GetResourcePolicyInput, optFns ...func(*codebuild.Options)) (*codebuild.GetResourcePolicyOutput, error)
 }
 
-func RegisterCodeBuildTypes() {
+func init() {
 	gob.Register(codeBuildTypes.Project{})
+	gob.Register([]codeBuildTypes.Project{})
 
 }
 
@@ -87,7 +88,7 @@ func CachedCodeBuildBatchGetProjects(CodeBuildClient CodeBuildClientInterface, a
 		return project, err
 	}
 
-	internal.Cache.Set(cacheKey, BatchGetProjects.Projects[0], cache.DefaultExpiration)
+	internal.Cache.Set(cacheKey, BatchGetProjects.Projects, cache.DefaultExpiration)
 	return BatchGetProjects.Projects[0], nil
 }
 

aws/sdk/codebuild_mocks.go

@@ -0,0 +1,39 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codebuild"
+)
+
+type MockedCodeBuildClient struct {
+}
+
+func (m *MockedCodeBuildClient) ListProjects(ctx context.Context, input *codebuild.ListProjectsInput, options ...func(*codebuild.Options)) (*codebuild.ListProjectsOutput, error) {
+	return &codebuild.ListProjectsOutput{
+		Projects: []string{
+			"project1",
+			"project2",
+		},
+	}, nil
+}
+
+func (m *MockedCodeBuildClient) GetResourcePolicy(ctx context.Context, input *codebuild.GetResourcePolicyInput, options ...func(*codebuild.Options)) (*codebuild.GetResourcePolicyOutput, error) {
+	return &codebuild.GetResourcePolicyOutput{
+		Policy: aws.String(`{
+			"Version": "2012-10-17",
+			"Statement": [
+			  {
+				"Effect": "Allow",
+				"Action": "codebuild:BatchGetProjects",
+				"Resource": "*",
+				"Principal": {
+					"AWS": "arn:aws:iam::123456789012:root"
+				},
+			  }
+			]
+		  }
+		`),
+	}, nil
+}

aws/sdk/codecommit.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codecommit"
+	codeCommitTypes "github.com/aws/aws-sdk-go-v2/service/codecommit/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeCommitClientInterface interface {
+	ListRepositories(context.Context, *codecommit.ListRepositoriesInput, ...func(*codecommit.Options)) (*codecommit.ListRepositoriesOutput, error)
+}
+
+func init() {
+	gob.Register([]codeCommitTypes.RepositoryNameIdPair{})
+}
+
+func CachedCodeCommitListRepositories(client AWSCodeCommitClientInterface, accountID string, region string) ([]codeCommitTypes.RepositoryNameIdPair, error) {
+	var PaginationControl *string
+	var repositories []codeCommitTypes.RepositoryNameIdPair
+	cacheKey := fmt.Sprintf("%s-codecommit-ListRepositories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeCommitTypes.RepositoryNameIdPair), nil
+	}
+	for {
+		ListRepositories, err := client.ListRepositories(
+			context.TODO(),
+			&codecommit.ListRepositoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codecommit.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return repositories, err
+		}
+
+		repositories = append(repositories, ListRepositories.Repositories...)
+
+		//pagination
+		if ListRepositories.NextToken == nil {
+			break
+		}
+		PaginationControl = ListRepositories.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, repositories, cache.DefaultExpiration)
+	return repositories, nil
+}

aws/sdk/codecommit_mocks.go

@@ -0,0 +1,30 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecommit"
+	codeCommitTypes "github.com/aws/aws-sdk-go-v2/service/codecommit/types"
+)
+
+// create mocks for codecommit ListRepositories
+
+type MockedAWSCodeCommitClient struct {
+}
+
+func (m *MockedAWSCodeCommitClient) ListRepositories(ctx context.Context, input *codecommit.ListRepositoriesInput, options ...func(*codecommit.Options)) (*codecommit.ListRepositoriesOutput, error) {
+	return &codecommit.ListRepositoriesOutput{
+		NextToken: nil,
+		Repositories: []codeCommitTypes.RepositoryNameIdPair{
+			{
+				RepositoryId:   aws.String("repo1"),
+				RepositoryName: aws.String("repo1"),
+			},
+			{
+				RepositoryId:   aws.String("repo2"),
+				RepositoryName: aws.String("repo2"),
+			},
+		},
+	}, nil
+}

aws/sdk/codedeploy.go

@@ -0,0 +1,212 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codedeploy"
+	codeDeployTypes "github.com/aws/aws-sdk-go-v2/service/codedeploy/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeDeployClientInterface interface {
+	ListApplications(context.Context, *codedeploy.ListApplicationsInput, ...func(*codedeploy.Options)) (*codedeploy.ListApplicationsOutput, error)
+	GetApplication(context.Context, *codedeploy.GetApplicationInput, ...func(*codedeploy.Options)) (*codedeploy.GetApplicationOutput, error)
+	ListDeployments(context.Context, *codedeploy.ListDeploymentsInput, ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentsOutput, error)
+	GetDeployment(context.Context, *codedeploy.GetDeploymentInput, ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentOutput, error)
+	ListDeploymentConfigs(context.Context, *codedeploy.ListDeploymentConfigsInput, ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentConfigsOutput, error)
+	GetDeploymentConfig(context.Context, *codedeploy.GetDeploymentConfigInput, ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentConfigOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register([]codeDeployTypes.ApplicationInfo{})
+	gob.Register([]codeDeployTypes.DeploymentConfigInfo{})
+	gob.Register([]codeDeployTypes.DeploymentInfo{})
+
+}
+
+func CachedCodeDeployListApplications(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var applications []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListApplications-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListApplications, err := client.ListApplications(
+			context.TODO(),
+			&codedeploy.ListApplicationsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return applications, err
+		}
+
+		applications = append(applications, ListApplications.Applications...)
+
+		//pagination
+		if ListApplications.NextToken == nil {
+			break
+		}
+		PaginationControl = ListApplications.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, applications, cache.DefaultExpiration)
+	return applications, nil
+}
+
+func CachedCodeDeployListDeploymentConfigs(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var deploymentConfigs []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListDeploymentConfigs-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDeploymentConfigs, err := client.ListDeploymentConfigs(
+			context.TODO(),
+			&codedeploy.ListDeploymentConfigsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return deploymentConfigs, err
+		}
+
+		deploymentConfigs = append(deploymentConfigs, ListDeploymentConfigs.DeploymentConfigsList...)
+
+		//pagination
+		if ListDeploymentConfigs.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDeploymentConfigs.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, deploymentConfigs, cache.DefaultExpiration)
+	return deploymentConfigs, nil
+}
+
+func CachedCodeDeployListDeployments(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var deployments []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListDeployments-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDeployments, err := client.ListDeployments(
+			context.TODO(),
+			&codedeploy.ListDeploymentsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return deployments, err
+		}
+
+		deployments = append(deployments, ListDeployments.Deployments...)
+
+		//pagination
+		if ListDeployments.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDeployments.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, deployments, cache.DefaultExpiration)
+	return deployments, nil
+}
+
+func CachedCodeDeployGetApplication(client AWSCodeDeployClientInterface, accountID string, region string, applicationName string) (codeDeployTypes.ApplicationInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetApplication-%s-%s", accountID, region, applicationName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.ApplicationInfo), nil
+	}
+	GetApplication, err := client.GetApplication(
+		context.TODO(),
+		&codedeploy.GetApplicationInput{
+			ApplicationName: &applicationName,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetApplication.Application, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetApplication.Application, cache.DefaultExpiration)
+
+	return *GetApplication.Application, nil
+}
+
+func CachedCodeDeployGetDeploymentConfig(client AWSCodeDeployClientInterface, accountID string, region string, deploymentConfigName string) (codeDeployTypes.DeploymentConfigInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetDeploymentConfig-%s-%s", accountID, region, deploymentConfigName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.DeploymentConfigInfo), nil
+	}
+	GetDeploymentConfig, err := client.GetDeploymentConfig(
+		context.TODO(),
+		&codedeploy.GetDeploymentConfigInput{
+			DeploymentConfigName: &deploymentConfigName,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetDeploymentConfig.DeploymentConfigInfo, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetDeploymentConfig.DeploymentConfigInfo, cache.DefaultExpiration)
+
+	return *GetDeploymentConfig.DeploymentConfigInfo, nil
+}
+
+func CachedCodeDeployGetDeployment(client AWSCodeDeployClientInterface, accountID string, region string, deploymentID string) (codeDeployTypes.DeploymentInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetDeployment-%s-%s", accountID, region, deploymentID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.DeploymentInfo), nil
+	}
+	GetDeployment, err := client.GetDeployment(
+		context.TODO(),
+		&codedeploy.GetDeploymentInput{
+			DeploymentId: &deploymentID,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetDeployment.DeploymentInfo, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetDeployment.DeploymentInfo, cache.DefaultExpiration)
+
+	return *GetDeployment.DeploymentInfo, nil
+}

aws/sdk/codedeploy_mocks.go

@@ -0,0 +1,85 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codedeploy"
+	codedeployTypes "github.com/aws/aws-sdk-go-v2/service/codedeploy/types"
+)
+
+type MockedCodedeployClient struct {
+}
+
+func (m *MockedCodedeployClient) ListApplications(ctx context.Context, input *codedeploy.ListApplicationsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListApplicationsOutput, error) {
+	return &codedeploy.ListApplicationsOutput{
+		Applications: []string{
+			"app1",
+			"app2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) ListDeployments(ctx context.Context, input *codedeploy.ListDeploymentsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentsOutput, error) {
+	return &codedeploy.ListDeploymentsOutput{
+		Deployments: []string{
+			"deployment1",
+			"deployment2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) ListDeploymentConfigs(ctx context.Context, input *codedeploy.ListDeploymentConfigsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentConfigsOutput, error) {
+	return &codedeploy.ListDeploymentConfigsOutput{
+		DeploymentConfigsList: []string{
+			"deploymentConfig1",
+			"deploymentConfig2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetApplication(ctx context.Context, input *codedeploy.GetApplicationInput, options ...func(*codedeploy.Options)) (*codedeploy.GetApplicationOutput, error) {
+	return &codedeploy.GetApplicationOutput{
+		Application: &codedeployTypes.ApplicationInfo{
+			ApplicationName:   aws.String("application1"),
+			ApplicationId:     aws.String("application1"),
+			CreateTime:        aws.Time(time.Now()),
+			GitHubAccountName: aws.String("github"),
+			LinkedToGitHub:    true,
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetDeployment(ctx context.Context, input *codedeploy.GetDeploymentInput, options ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentOutput, error) {
+	return &codedeploy.GetDeploymentOutput{
+		DeploymentInfo: &codedeployTypes.DeploymentInfo{
+			ApplicationName: aws.String("application1"),
+			CreateTime:      aws.Time(time.Now()),
+			DeploymentId:    aws.String("deployment1"),
+			DeploymentOverview: &codedeployTypes.DeploymentOverview{
+				Failed:     0,
+				InProgress: 0,
+				Pending:    0,
+				Ready:      0,
+				Skipped:    0,
+				Succeeded:  0,
+			},
+			DeploymentConfigName: aws.String("deploymentConfig1"),
+			Status:               codedeployTypes.DeploymentStatusSucceeded,
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetDeploymentConfig(ctx context.Context, input *codedeploy.GetDeploymentConfigInput, options ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentConfigOutput, error) {
+	return &codedeploy.GetDeploymentConfigOutput{
+		DeploymentConfigInfo: &codedeployTypes.DeploymentConfigInfo{
+			DeploymentConfigName: aws.String("deploymentConfig1"),
+			ComputePlatform:      codedeployTypes.ComputePlatformServer,
+			MinimumHealthyHosts: &codedeployTypes.MinimumHealthyHosts{
+				Type:  codedeployTypes.MinimumHealthyHostsTypeFleetPercent,
+				Value: 100,
+			},
+		},
+	}, nil
+}

aws/sdk/datapipeline.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/datapipeline"
+	dataPipelineTypes "github.com/aws/aws-sdk-go-v2/service/datapipeline/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSDataPipelineClientInterface interface {
+	ListPipelines(ctx context.Context, input *datapipeline.ListPipelinesInput, opts ...func(*datapipeline.Options)) (*datapipeline.ListPipelinesOutput, error)
+}
+
+func init() {
+	gob.Register([]dataPipelineTypes.PipelineIdName{})
+}
+
+func CachedDataPipelineListPipelines(client AWSDataPipelineClientInterface, accountID string, region string) ([]dataPipelineTypes.PipelineIdName, error) {
+	var PaginationControl *string
+	var pipelines []dataPipelineTypes.PipelineIdName
+	cacheKey := fmt.Sprintf("%s-datapipeline-ListPipelines-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]dataPipelineTypes.PipelineIdName), nil
+	}
+	for {
+		ListPipelines, err := client.ListPipelines(
+			context.TODO(),
+			&datapipeline.ListPipelinesInput{
+				Marker: PaginationControl,
+			},
+			func(o *datapipeline.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return pipelines, err
+		}
+
+		pipelines = append(pipelines, ListPipelines.PipelineIdList...)
+
+		//pagination
+		if ListPipelines.Marker == nil {
+			break
+		}
+		PaginationControl = ListPipelines.Marker
+	}
+
+	internal.Cache.Set(cacheKey, pipelines, cache.DefaultExpiration)
+	return pipelines, nil
+}

aws/sdk/datapipeline_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/datapipeline"
+	dataPipelineTypes "github.com/aws/aws-sdk-go-v2/service/datapipeline/types"
+)
+
+type MockedDataPipelineClient struct {
+}
+
+func (m *MockedDataPipelineClient) ListPipelines(ctx context.Context, input *datapipeline.ListPipelinesInput, options ...func(*datapipeline.Options)) (*datapipeline.ListPipelinesOutput, error) {
+	return &datapipeline.ListPipelinesOutput{
+		PipelineIdList: []dataPipelineTypes.PipelineIdName{
+			{
+				Id:   aws.String("pipeline1"),
+				Name: aws.String("pipeline1"),
+			},
+			{
+				Id:   aws.String("pipeline2"),
+				Name: aws.String("pipeline2"),
+			},
+		},
+	}, nil
+}

aws/sdk/docdb.go

@@ -19,9 +19,9 @@ type DocDBClientInterface interface {
 	DescribeDBInstances(context.Context, *docdb.DescribeDBInstancesInput, ...func(*docdb.Options)) (*docdb.DescribeDBInstancesOutput, error)
 }
 
-func RegisterDocDBTypes() {
+func init() {
 	gob.Register([]docdbTypes.GlobalCluster{})
-	gob.Register([]docdbTypes.DBCluster{})
+	//gob.Register([]docdbTypes.DBCluster{})
 	//gob.Register([]docdbTypes.DBInstance{})
 
 }

aws/sdk/docsdb_mocks.go

@@ -0,0 +1,25 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/docdb"
+	docdbTypes "github.com/aws/aws-sdk-go-v2/service/docdb/types"
+)
+
+type MockedAWSDocsDBClient struct {
+}
+
+func (m *MockedAWSDocsDBClient) DescribeDBClusters(ctx context.Context, input *docdb.DescribeDBClustersInput, options ...func(*docdb.Options)) (*docdb.DescribeDBClustersOutput, error) {
+	return &docdb.DescribeDBClustersOutput{
+		DBClusters: []docdbTypes.DBCluster{
+			{
+				DBClusterIdentifier: aws.String("cluster1"),
+			},
+			{
+				DBClusterIdentifier: aws.String("cluster2"),
+			},
+		},
+	}, nil
+}

aws/sdk/ds.go

@@ -0,0 +1,95 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/patrickmn/go-cache"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/directoryservice"
+	dsTypes "github.com/aws/aws-sdk-go-v2/service/directoryservice/types"
+)
+
+type AWSDSClientInterface interface {
+	DescribeDirectories(context.Context, *directoryservice.DescribeDirectoriesInput, ...func(*directoryservice.Options)) (*directoryservice.DescribeDirectoriesOutput, error)
+	DescribeTrusts(context.Context, *directoryservice.DescribeTrustsInput, ...func(*directoryservice.Options)) (*directoryservice.DescribeTrustsOutput, error)
+}
+
+func init() {
+	gob.Register([]dsTypes.DirectoryDescription{})
+	gob.Register([]dsTypes.Trust{})
+
+}
+
+func CachedDSDescribeDirectories(client AWSDSClientInterface, accountID string, region string) ([]dsTypes.DirectoryDescription, error) {
+	var PaginationControl *string
+	var directories []dsTypes.DirectoryDescription
+	cacheKey := fmt.Sprintf("%s-ds-DescribeDirectories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]dsTypes.DirectoryDescription), nil
+	}
+	for {
+		DescribeDirectories, err := client.DescribeDirectories(
+			context.TODO(),
+			&directoryservice.DescribeDirectoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *directoryservice.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return directories, err
+		}
+
+		directories = append(directories, DescribeDirectories.DirectoryDescriptions...)
+
+		//pagination
+		if DescribeDirectories.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeDirectories.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, directories, cache.DefaultExpiration)
+	return directories, nil
+}
+
+func CachedDSDescribeTrusts(client AWSDSClientInterface, accountID string, region string, directoryId string) ([]dsTypes.Trust, error) {
+	var PaginationControl *string
+	var trusts []dsTypes.Trust
+	cacheKey := fmt.Sprintf("%s-ds-DescribeTrusts-%s-%s", accountID, region, directoryId)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]dsTypes.Trust), nil
+	}
+	for {
+		DescribeDirectoryTrusts, err := client.DescribeTrusts(
+			context.TODO(),
+			&directoryservice.DescribeTrustsInput{
+				DirectoryId: &directoryId,
+				NextToken: PaginationControl,
+			},
+			func(o *directoryservice.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return trusts, err
+		}
+
+		trusts = append(trusts, DescribeDirectoryTrusts.Trusts...)
+
+		//pagination
+		if DescribeDirectoryTrusts.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeDirectoryTrusts.NextToken
+	}
+	internal.Cache.Set(cacheKey, trusts, cache.DefaultExpiration)
+
+	return trusts, nil
+}

aws/sdk/dynamodb.go

@@ -16,7 +16,7 @@ type DynamoDBClientInterface interface {
 	DescribeTable(context.Context, *dynamodb.DescribeTableInput, ...func(*dynamodb.Options)) (*dynamodb.DescribeTableOutput, error)
 }
 
-func RegisterDynamoDBTypes() {
+func init() {
 	gob.Register([]string{})
 	gob.Register(dynamoDBTypes.TableDescription{})
 }

aws/sdk/dynamodb_mocks.go

@@ -0,0 +1,25 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	dynamodbTypes "github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+)
+
+type MockedAWSDynamoDBClient struct {
+}
+
+func (m *MockedAWSDynamoDBClient) DescribeTable(ctx context.Context, input *dynamodb.DescribeTableInput, options ...func(*dynamodb.Options)) (*dynamodb.DescribeTableOutput, error) {
+	return &dynamodb.DescribeTableOutput{
+		Table: &dynamodbTypes.TableDescription{
+			TableName: input.TableName,
+		},
+	}, nil
+}
+
+func (m *MockedAWSDynamoDBClient) ListTables(ctx context.Context, input *dynamodb.ListTablesInput, options ...func(*dynamodb.Options)) (*dynamodb.ListTablesOutput, error) {
+	return &dynamodb.ListTablesOutput{
+		TableNames: []string{"table1", "table2"},
+	}, nil
+}

aws/sdk/ec2.go

@@ -6,20 +6,31 @@ import (
 	"fmt"
 
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	ec2Types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/patrickmn/go-cache"
 )
 
-type EC2ClientInterface interface {
+type AWSEC2ClientInterface interface {
 	DescribeInstances(context.Context, *ec2.DescribeInstancesInput, ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error)
+	DescribeNetworkInterfaces(context.Context, *ec2.DescribeNetworkInterfacesInput, ...func(*ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error)
+	DescribeSnapshots(context.Context, *ec2.DescribeSnapshotsInput, ...func(*ec2.Options)) (*ec2.DescribeSnapshotsOutput, error)
+	DescribeVolumes(context.Context, *ec2.DescribeVolumesInput, ...func(*ec2.Options)) (*ec2.DescribeVolumesOutput, error)
+	DescribeImages(context.Context, *ec2.DescribeImagesInput, ...func(*ec2.Options)) (*ec2.DescribeImagesOutput, error)
+	DescribeInstanceAttribute(context.Context, *ec2.DescribeInstanceAttributeInput, ...func(*ec2.Options)) (*ec2.DescribeInstanceAttributeOutput, error)
 }
 
-func RegisterEC2Types() {
+func init() {
 	gob.Register([]ec2Types.Instance{})
+	gob.Register([]ec2Types.NetworkInterface{})
+	gob.Register([]ec2Types.Snapshot{})
+	gob.Register([]ec2Types.Volume{})
+	gob.Register([]ec2Types.Image{})
+
 }
 
-func CachedEC2DescribeInstances(client EC2ClientInterface, accountID string, region string) ([]ec2Types.Instance, error) {
+func CachedEC2DescribeInstances(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Instance, error) {
 	var PaginationControl *string
 	var instances []ec2Types.Instance
 	cacheKey := fmt.Sprintf("%s-ec2-DescribeInstances-%s", accountID, region)
@@ -56,3 +67,162 @@ func CachedEC2DescribeInstances(client EC2ClientInterface, accountID string, reg
 	internal.Cache.Set(cacheKey, instances, cache.DefaultExpiration)
 	return instances, nil
 }
+
+func CachedEC2DescribeInstanceAttributeUserData(client AWSEC2ClientInterface, accountID string, region string, instanceID string) (string, error) {
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeInstanceAttributeUserData-%s-%s", accountID, region, instanceID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(string), nil
+	}
+	DescribeInstanceAttribute, err := client.DescribeInstanceAttribute(
+		context.TODO(),
+		&ec2.DescribeInstanceAttributeInput{
+			Attribute:  ec2Types.InstanceAttributeNameUserData,
+			InstanceId: &instanceID,
+		},
+		func(o *ec2.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		return "", err
+	}
+	internal.Cache.Set(cacheKey, aws.ToString(DescribeInstanceAttribute.UserData.Value), cache.DefaultExpiration)
+
+	return aws.ToString(DescribeInstanceAttribute.UserData.Value), nil
+}
+
+func CachedEC2DescribeNetworkInterfaces(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.NetworkInterface, error) {
+	var PaginationControl *string
+	var NetworkInterfaces []ec2Types.NetworkInterface
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeNetworkInterfaces-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.NetworkInterface), nil
+	}
+	for {
+		DescribeNetworkInterfaces, err := client.DescribeNetworkInterfaces(
+			context.TODO(),
+			&(ec2.DescribeNetworkInterfacesInput{
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return NetworkInterfaces, err
+		}
+		NetworkInterfaces = append(NetworkInterfaces, DescribeNetworkInterfaces.NetworkInterfaces...)
+
+		if DescribeNetworkInterfaces.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeNetworkInterfaces.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, NetworkInterfaces, cache.DefaultExpiration)
+	return NetworkInterfaces, nil
+}
+
+func CachedEC2DescribeSnapshots(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Snapshot, error) {
+	var PaginationControl *string
+	var Snapshots []ec2Types.Snapshot
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeSnapshots-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Snapshot), nil
+	}
+	for {
+		DescribeSnapshots, err := client.DescribeSnapshots(
+			context.TODO(),
+			&(ec2.DescribeSnapshotsInput{
+				NextToken: PaginationControl,
+				OwnerIds:  []string{accountID},
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Snapshots, err
+		}
+		Snapshots = append(Snapshots, DescribeSnapshots.Snapshots...)
+
+		if DescribeSnapshots.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeSnapshots.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Snapshots, cache.DefaultExpiration)
+	return Snapshots, nil
+}
+
+func CachedEC2DescribeVolumes(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Volume, error) {
+	var PaginationControl *string
+	var Volumes []ec2Types.Volume
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeVolumes-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Volume), nil
+	}
+	for {
+		DescribeVolumes, err := client.DescribeVolumes(
+			context.TODO(),
+			&(ec2.DescribeVolumesInput{
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Volumes, err
+		}
+		Volumes = append(Volumes, DescribeVolumes.Volumes...)
+
+		if DescribeVolumes.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeVolumes.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Volumes, cache.DefaultExpiration)
+	return Volumes, nil
+}
+
+func CachedEC2DescribeImages(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Image, error) {
+	var PaginationControl *string
+	var Images []ec2Types.Image
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeImages-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Image), nil
+	}
+	for {
+		DescribeImages, err := client.DescribeImages(
+			context.TODO(),
+			&(ec2.DescribeImagesInput{
+				Owners:    []string{accountID},
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Images, err
+		}
+		Images = append(Images, DescribeImages.Images...)
+
+		if DescribeImages.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeImages.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Images, cache.DefaultExpiration)
+	return Images, nil
+
+}

aws/sdk/ec2_mocks.go

@@ -0,0 +1,388 @@
+package sdk
+
+// create test for the Cached EC2 functions.  Create a mocked client and mocked functions for each of the methods used in the ec2.go file
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+)
+
+const DESCRIBE_NETWORK_INTEFACES_TEST_FILE = "./test-data/describe-network-interfaces.json"
+const DESCRIBE_INSTANCES_TEST_FILE = "./test-data/ec2-describeInstances.json"
+const DESCRIBE_SNAPSHOTS_TEST_FILE = "./test-data/ec2-describeSnapshots.json"
+const DESCRIBE_VOLUMES_TEST_FILE = "./test-data/ec2-describeVolumes.json"
+const DESCRIBE_IMAGES_TEST_FILE = "./test-data/ec2-describeImages.json"
+
+type MockedEC2Client2 struct {
+	describeNetworkInterfaces DescribeNetworkInterfaces
+	describeInstances         DescribeInstances
+	describeSnapshots         DescribeSnapshots
+	describeVolumes           DescribeVolumes
+	describeImages            DescribeImages
+}
+
+type DescribeNetworkInterfaces struct {
+	NetworkInterfaces []struct {
+		Status          string `json:"Status"`
+		MacAddress      string `json:"MacAddress"`
+		SourceDestCheck bool   `json:"SourceDestCheck"`
+		VpcID           string `json:"VpcId"`
+		Description     string `json:"Description"`
+		Association     struct {
+			PublicIP      string `json:"PublicIp"`
+			AssociationID string `json:"AssociationId"`
+			PublicDNSName string `json:"PublicDnsName"`
+			IPOwnerID     string `json:"IpOwnerId"`
+		} `json:"Association"`
+		NetworkInterfaceID string `json:"NetworkInterfaceId"`
+		PrivateIPAddresses []struct {
+			PrivateDNSName string `json:"PrivateDnsName"`
+			Association    struct {
+				PublicIP      string `json:"PublicIp"`
+				AssociationID string `json:"AssociationId"`
+				PublicDNSName string `json:"PublicDnsName"`
+				IPOwnerID     string `json:"IpOwnerId"`
+			} `json:"Association"`
+			Primary          bool   `json:"Primary"`
+			PrivateIPAddress string `json:"PrivateIpAddress"`
+		} `json:"PrivateIpAddresses"`
+		RequesterManaged bool          `json:"RequesterManaged"`
+		Ipv6Addresses    []interface{} `json:"Ipv6Addresses"`
+		PrivateDNSName   string        `json:"PrivateDnsName,omitempty"`
+		AvailabilityZone string        `json:"AvailabilityZone"`
+		Attachment       struct {
+			Status              string    `json:"Status"`
+			DeviceIndex         int       `json:"DeviceIndex"`
+			AttachTime          time.Time `json:"AttachTime"`
+			InstanceID          string    `json:"InstanceId"`
+			DeleteOnTermination bool      `json:"DeleteOnTermination"`
+			AttachmentID        string    `json:"AttachmentId"`
+			InstanceOwnerID     string    `json:"InstanceOwnerId"`
+		} `json:"Attachment"`
+		Groups []struct {
+			GroupName string `json:"GroupName"`
+			GroupID   string `json:"GroupId"`
+		} `json:"Groups"`
+		SubnetID         string        `json:"SubnetId"`
+		OwnerID          string        `json:"OwnerId"`
+		TagSet           []interface{} `json:"TagSet"`
+		PrivateIPAddress string        `json:"PrivateIpAddress"`
+	} `json:"NetworkInterfaces"`
+}
+
+type DescribeInstances struct {
+	Reservations []struct {
+		Instances []struct {
+			AmiLaunchIndex int    `json:"AmiLaunchIndex"`
+			ImageID        string `json:"ImageId"`
+			InstanceID     string `json:"InstanceId"`
+			InstanceType   string `json:"InstanceType"`
+			KernelID       string `json:"KernelId"`
+			KeyName        string `json:"KeyName"`
+			LaunchTime     string `json:"LaunchTime"`
+			Monitoring     struct {
+				State string `json:"State"`
+			} `json:"Monitoring"`
+			Placement struct {
+				AvailabilityZone string `json:"AvailabilityZone"`
+				GroupName        string `json:"GroupName"`
+				Tenancy          string `json:"Tenancy"`
+			} `json:"Placement"`
+			Platform            string `json:"Platform"`
+			PrivateDNS          string `json:"PrivateDnsName"`
+			PrivateIP           string `json:"PrivateIpAddress"`
+			PublicDNS           string `json:"PublicDnsName"`
+			PublicIP            string `json:"PublicIpAddress"`
+			State               string `json:"State"`
+			SubnetID            string `json:"SubnetId"`
+			VpcID               string `json:"VpcId"`
+			Architecture        string `json:"Architecture"`
+			BlockDeviceMappings []struct {
+				DeviceName string `json:"DeviceName"`
+				Ebs        struct {
+					AttachTime          time.Time `json:"AttachTime"`
+					DeleteOnTermination bool      `json:"DeleteOnTermination"`
+					Status              string    `json:"Status"`
+					VolumeID            string    `json:"VolumeId"`
+				} `json:"Ebs"`
+			} `json:"BlockDeviceMappings"`
+			ClientToken        string `json:"ClientToken"`
+			EbsOptimized       bool   `json:"EbsOptimized"`
+			Hypervisor         string `json:"Hypervisor"`
+			IamInstanceProfile struct {
+				Arn string `json:"Arn"`
+				ID  string `json:"Id"`
+			} `json:"IamInstanceProfile"`
+			NetworkInterfaces []struct {
+				Attachment struct {
+					AttachTime          time.Time `json:"AttachTime"`
+					AttachmentID        string    `json:"AttachmentId"`
+					DeleteOnTermination bool      `json:"DeleteOnTermination"`
+					DeviceIndex         int       `json:"DeviceIndex"`
+					Status              string    `json:"Status"`
+				} `json:"Attachment"`
+				Description string `json:"Description"`
+				Groups      []struct {
+					GroupName string `json:"GroupName"`
+					GroupID   string `json:"GroupId"`
+				} `json:"Groups"`
+				MacAddress         string `json:"MacAddress"`
+				NetworkInterfaceID string `json:"NetworkInterfaceId"`
+				OwnerID            string `json:"OwnerId"`
+				PrivateDNSName     string `json:"PrivateDnsName"`
+				PrivateIPAddress   string `json:"PrivateIpAddress"`
+				PrivateIPAddresses []struct {
+					Association struct {
+						IPOwnerID     string `json:"IpOwnerId"`
+						PublicDNSName string `json:"PublicDnsName"`
+						PublicIP      string `json:"PublicIp"`
+					} `json:"Association"`
+					Primary          bool   `json:"Primary"`
+					PrivateDNSName   string `json:"PrivateDnsName"`
+					PrivateIPAddress string `json:"PrivateIpAddress"`
+				} `json:"PrivateIpAddresses"`
+				SourceDestCheck bool   `json:"SourceDestCheck"`
+				Status          string `json:"Status"`
+				SubnetID        string `json:"SubnetId"`
+				VpcID           string `json:"VpcId"`
+			} `json:"NetworkInterfaces"`
+			RootDeviceName string `json:"RootDeviceName"`
+			RootDeviceType string `json:"RootDeviceType"`
+			SecurityGroups []struct {
+				GroupName string `json:"GroupName"`
+				GroupID   string `json:"GroupId"`
+			} `json:"SecurityGroups"`
+			SourceDestCheck bool `json:"SourceDestCheck"`
+			StateReason     struct {
+				Code    string `json:"Code"`
+				Message string `json:"Message"`
+			} `json:"StateReason"`
+			Tags []struct {
+				Key   string `json:"Key"`
+				Value string `json:"Value"`
+			} `json:"Tags"`
+			VirtualizationType string `json:"VirtualizationType"`
+		} `json:"Instances"`
+		OwnerID       string `json:"OwnerId"`
+		RequesterID   string `json:"RequesterId"`
+		ReservationID string `json:"ReservationId"`
+	} `json:"Reservations"`
+}
+
+type DescribeImages struct {
+	Images []struct {
+		Architecture        string `json:"Architecture"`
+		BlockDeviceMappings []struct {
+			DeviceName string `json:"DeviceName"`
+			Ebs        struct {
+				DeleteOnTermination bool   `json:"DeleteOnTermination"`
+				SnapshotID          string `json:"SnapshotId"`
+				VolumeSize          int    `json:"VolumeSize"`
+				VolumeType          string `json:"VolumeType"`
+			} `json:"Ebs"`
+		} `json:"BlockDeviceMappings"`
+		CreationDate  string `json:"CreationDate"`
+		Description   string `json:"Description"`
+		EnaSupport    bool   `json:"EnaSupport"`
+		Hypervisor    string `json:"Hypervisor"`
+		ImageID       string `json:"ImageId"`
+		ImageLocation string `json:"ImageLocation"`
+		ImageType     string `json:"ImageType"`
+		KernelID      string `json:"KernelId"`
+		Name          string `json:"Name"`
+		OwnerAlias    string `json:"OwnerAlias"`
+		OwnerID       string `json:"OwnerId"`
+		Platform      string `json:"Platform"`
+		ProductCodes  []struct {
+			ProductCodeID   string `json:"ProductCodeId"`
+			ProductCodeType string `json:"ProductCodeType"`
+		} `json:"ProductCodes"`
+		Public          bool   `json:"Public"`
+		RamdiskID       string `json:"RamdiskId"`
+		RootDeviceName  string `json:"RootDeviceName"`
+		RootDeviceType  string `json:"RootDeviceType"`
+		SriovNetSupport string `json:"SriovNetSupport"`
+		State           string `json:"State"`
+		StateReason     struct {
+			Code    string `json:"Code"`
+			Message string `json:"Message"`
+		} `json:"StateReason"`
+		Tags []struct {
+			Key   string `json:"Key"`
+			Value string `json:"Value"`
+		} `json:"Tags"`
+		VirtualizationType string `json:"VirtualizationType"`
+	} `json:"Images"`
+	NextToken string `json:"NextToken"`
+}
+
+type DescribeSnapshots struct {
+	Snapshots []struct {
+		DataEncryptionKeyID string    `json:"DataEncryptionKeyId"`
+		Description         string    `json:"Description"`
+		Encrypted           bool      `json:"Encrypted"`
+		KMSKeyID            string    `json:"KmsKeyId"`
+		OwnerAlias          string    `json:"OwnerAlias"`
+		OwnerID             string    `json:"OwnerId"`
+		Progress            string    `json:"Progress"`
+		SnapshotID          string    `json:"SnapshotId"`
+		StartTime           time.Time `json:"StartTime"`
+		State               string    `json:"State"`
+		StateMessage        string    `json:"StateMessage"`
+		TagSet              []struct {
+			Key   string `json:"Key"`
+			Value string `json:"Value"`
+		} `json:"Tags"`
+		VolumeID   string `json:"VolumeId"`
+		VolumeSize int    `json:"VolumeSize"`
+	} `json:"Snapshots"`
+}
+
+type DescribeVolumes struct {
+	Volumes []struct {
+		Attachments []struct {
+			AttachTime          time.Time `json:"AttachTime"`
+			DeleteOnTermination bool      `json:"DeleteOnTermination"`
+			Device              string    `json:"Device"`
+			InstanceID          string    `json:"InstanceId"`
+			State               string    `json:"State"`
+			VolumeID            string    `json:"VolumeId"`
+		} `json:"Attachments"`
+		AvailabilityZone string `json:"AvailabilityZone"`
+		CreateTime       string `json:"CreateTime"`
+		Encrypted        bool   `json:"Encrypted"`
+		KMSKeyID         string `json:"KmsKeyId"`
+		Size             int    `json:"Size"`
+		SnapshotID       string `json:"SnapshotId"`
+		State            string `json:"State"`
+		VolumeID         string `json:"VolumeId"`
+	} `json:"Volumes"`
+}
+
+// DescribeInstanceAttribute is a struct for the DescribeInstanceAttribute function - include userdata
+type DescribeInstanceAttribute struct {
+	UserData   string `json:"UserData"`
+	InstanceID string `json:"InstanceId"`
+}
+
+func (c *MockedEC2Client2) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
+	var nics []ec2types.NetworkInterface
+	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
+	}
+	for _, mockednic := range c.describeNetworkInterfaces.NetworkInterfaces {
+		nics = append(nics, ec2types.NetworkInterface{
+			Association: &ec2types.NetworkInterfaceAssociation{
+				PublicIp: aws.String(mockednic.Association.PublicIP),
+			},
+			NetworkInterfaceId: aws.String(mockednic.NetworkInterfaceID),
+			PrivateIpAddress:   aws.String(mockednic.PrivateIPAddress),
+			VpcId:              aws.String(mockednic.VpcID),
+			Attachment:         &ec2types.NetworkInterfaceAttachment{InstanceId: aws.String(mockednic.Attachment.InstanceID)},
+			Description:        aws.String(mockednic.Description),
+		})
+	}
+	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
+}
+
+func (c *MockedEC2Client2) DescribeInstances(ctx context.Context, input *ec2.DescribeInstancesInput, f ...func(o *ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
+	var instances []ec2types.Instance
+	err := json.Unmarshal(readTestFile(DESCRIBE_INSTANCES_TEST_FILE), &c.describeInstances)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_INSTANCES_TEST_FILE)
+	}
+	for _, mockedReservation := range c.describeInstances.Reservations {
+		for _, mockedInstance := range mockedReservation.Instances {
+			for _, inputInstanceID := range input.InstanceIds {
+				if mockedInstance.InstanceID == inputInstanceID {
+					instances = append(instances, ec2types.Instance{
+						InstanceId:   aws.String(mockedInstance.InstanceID),
+						InstanceType: ec2types.InstanceType(mockedInstance.InstanceType),
+						ImageId:      aws.String(mockedInstance.ImageID),
+					})
+				}
+			}
+		}
+	}
+	return &ec2.DescribeInstancesOutput{Reservations: []ec2types.Reservation{
+		{Instances: instances},
+	}}, nil
+}
+
+func (c *MockedEC2Client2) DescribeVolumes(ctx context.Context, input *ec2.DescribeVolumesInput, f ...func(o *ec2.Options)) (*ec2.DescribeVolumesOutput, error) {
+	var volumes []ec2types.Volume
+	err := json.Unmarshal(readTestFile(DESCRIBE_VOLUMES_TEST_FILE), &c.describeVolumes)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_VOLUMES_TEST_FILE)
+	}
+	for _, mockedVolume := range c.describeVolumes.Volumes {
+		for _, inputVolumeID := range input.VolumeIds {
+			if mockedVolume.VolumeID == inputVolumeID {
+				volumes = append(volumes, ec2types.Volume{
+					VolumeId: aws.String(mockedVolume.VolumeID),
+					Size:     aws.Int32(int32(mockedVolume.Size)),
+					Attachments: []ec2types.VolumeAttachment{
+						{
+							InstanceId: aws.String(mockedVolume.Attachments[0].InstanceID),
+						},
+					},
+				})
+			}
+		}
+	}
+	return &ec2.DescribeVolumesOutput{Volumes: volumes}, nil
+}
+
+func (c *MockedEC2Client2) DescribeSnapshots(ctx context.Context, input *ec2.DescribeSnapshotsInput, f ...func(o *ec2.Options)) (*ec2.DescribeSnapshotsOutput, error) {
+	var snapshots []ec2types.Snapshot
+	err := json.Unmarshal(readTestFile(DESCRIBE_SNAPSHOTS_TEST_FILE), &c.describeSnapshots)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_SNAPSHOTS_TEST_FILE)
+	}
+	for _, mockedSnapshot := range c.describeSnapshots.Snapshots {
+		for _, inputSnapshotID := range input.SnapshotIds {
+			if mockedSnapshot.SnapshotID == inputSnapshotID {
+				snapshots = append(snapshots, ec2types.Snapshot{
+					SnapshotId: aws.String(mockedSnapshot.SnapshotID),
+					VolumeId:   aws.String(mockedSnapshot.VolumeID),
+					State:      ec2types.SnapshotState(mockedSnapshot.State),
+				})
+			}
+		}
+	}
+	return &ec2.DescribeSnapshotsOutput{Snapshots: snapshots}, nil
+}
+
+func (c *MockedEC2Client2) DescribeImages(ctx context.Context, input *ec2.DescribeImagesInput, f ...func(o *ec2.Options)) (*ec2.DescribeImagesOutput, error) {
+	var images []ec2types.Image
+	err := json.Unmarshal(readTestFile(DESCRIBE_IMAGES_TEST_FILE), &c.describeImages)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_IMAGES_TEST_FILE)
+	}
+	for _, mockedImage := range c.describeImages.Images {
+		for _, inputImageID := range input.ImageIds {
+			if mockedImage.ImageID == inputImageID {
+				images = append(images, ec2types.Image{
+					ImageId: aws.String(mockedImage.ImageID),
+					Name:    aws.String(mockedImage.Name),
+				})
+			}
+		}
+	}
+	return &ec2.DescribeImagesOutput{Images: images}, nil
+}
+
+func (c *MockedEC2Client2) DescribeInstanceAttribute(ctx context.Context, input *ec2.DescribeInstanceAttributeInput, f ...func(o *ec2.Options)) (*ec2.DescribeInstanceAttributeOutput, error) {
+	return &ec2.DescribeInstanceAttributeOutput{
+		UserData: &ec2types.AttributeValue{
+			Value: aws.String("userdata"),
+		},
+	}, nil
+}

aws/sdk/ecr.go

@@ -19,9 +19,10 @@ type AWSECRClientInterface interface {
 	GetRepositoryPolicy(ctx context.Context, params *ecr.GetRepositoryPolicyInput, optFns ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error)
 }
 
-func RegisterECRTypes() {
+func init() {
 	gob.Register([]ecrTypes.Repository{})
 	gob.Register([]ecrTypes.ImageDetail{})
+	gob.Register(ecrTypes.Repository{})
 
 }
 
@@ -69,7 +70,7 @@ func CachedECRDescribeRepositories(ECRClient AWSECRClientInterface, accountID st
 func CachedECRDescribeImages(ECRClient AWSECRClientInterface, accountID string, region string, repositoryName string) ([]ecrTypes.ImageDetail, error) {
 	var PaginationControl *string
 	var images []ecrTypes.ImageDetail
-	cacheKey := fmt.Sprintf("%s-efs-DescribImages-%s-%s", accountID, region, strings.ReplaceAll(repositoryName, "/", "-"))
+	cacheKey := fmt.Sprintf("%s-ecr-DescribeImages-%s-%s", accountID, region, strings.ReplaceAll(repositoryName, "/", "-"))
 	cached, found := internal.Cache.Get(cacheKey)
 	if found {
 		sharedLogger.Debug("Using cached Images data")

aws/sdk/ecr_mocks.go

@@ -0,0 +1,109 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ecr"
+	ecrTypes "github.com/aws/aws-sdk-go-v2/service/ecr/types"
+)
+
+type MockedECRClient struct {
+}
+
+func (m *MockedECRClient) DescribeRepositories(ctx context.Context, input *ecr.DescribeRepositoriesInput, options ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error) {
+	return &ecr.DescribeRepositoriesOutput{
+		Repositories: []ecrTypes.Repository{
+			{
+				RepositoryName: aws.String("repo1"),
+				RepositoryUri:  aws.String("11111111111111.dkr.ecr.us-east-1.amazonaws.com/repo1"),
+			},
+			{
+				RepositoryName: aws.String("repo2"),
+				RepositoryUri:  aws.String("11111111111111.dkr.ecr.us-east-1.amazonaws.com/repo2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedECRClient) DescribeImages(ctx context.Context, input *ecr.DescribeImagesInput, options ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error) {
+	if aws.ToString(input.RepositoryName) == "repo1" {
+		return &ecr.DescribeImagesOutput{
+			ImageDetails: []ecrTypes.ImageDetail{
+				{
+					ImageTags: []string{
+						"customtag",
+						"tag2",
+					},
+					ImagePushedAt:    aws.Time(time.Date(2022, 10, 25, 15, 14, 0, 0, time.UTC)),
+					ImageSizeInBytes: aws.Int64(123456),
+				},
+			},
+		}, nil
+	} else if aws.ToString(input.RepositoryName) == "repo2" {
+		return &ecr.DescribeImagesOutput{
+			ImageDetails: []ecrTypes.ImageDetail{
+				{
+					ImageTags: []string{
+						"latest",
+					},
+					ImagePushedAt:    aws.Time(time.Date(2021, 10, 15, 11, 14, 0, 0, time.UTC)),
+					ImageSizeInBytes: aws.Int64(2222222),
+				},
+			},
+		}, nil
+	} else {
+		return &ecr.DescribeImagesOutput{
+			ImageDetails: []ecrTypes.ImageDetail{
+				{
+					ImageTags: []string{
+						"customtag",
+						"tag2",
+					},
+					ImagePushedAt:    aws.Time(time.Date(2022, 10, 25, 15, 14, 0, 0, time.UTC)),
+					ImageSizeInBytes: aws.Int64(111),
+				},
+				{
+					ImageTags: []string{
+						"latest",
+					},
+					ImagePushedAt:    aws.Time(time.Date(2021, 10, 15, 11, 14, 0, 0, time.UTC)),
+					ImageSizeInBytes: aws.Int64(333),
+				},
+			},
+		}, nil
+	}
+
+}
+
+func (m *MockedECRClient) GetRepositoryPolicy(ctx context.Context, input *ecr.GetRepositoryPolicyInput, options ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error) {
+	return &ecr.GetRepositoryPolicyOutput{
+		PolicyText: aws.String(`{
+			"Version": "2008-10-17",
+			"Statement": [
+			  {
+				"Sid": "AllowPushPull",
+				"Effect": "Allow",
+				"Principal": {
+				  "AWS": [
+					"arn:aws:iam::123456789012:root",
+					"arn:aws:iam::123456789012:user/MyUser"
+					]
+				},
+				"Action": [
+										
+				  "ecr:GetDownloadUrlForLayer",
+				  "ecr:BatchGetImage",
+				  "ecr:BatchCheckLayerAvailability",
+				  "ecr:PutImage",
+				  "ecr:InitiateLayerUpload",
+				  "ecr:UploadLayerPart",
+				  "ecr:CompleteLayerUpload"
+				]
+										
+			}
+			]
+		}`),
+	}, nil
+}

aws/sdk/ecs.go

@@ -0,0 +1,222 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSECSClientInterface interface {
+	ListClusters(ctx context.Context, params *ecs.ListClustersInput, optFns ...func(*ecs.Options)) (*ecs.ListClustersOutput, error)
+	ListTasks(ctx context.Context, params *ecs.ListTasksInput, optFns ...func(*ecs.Options)) (*ecs.ListTasksOutput, error)
+	ListServices(ctx context.Context, params *ecs.ListServicesInput, optFns ...func(*ecs.Options)) (*ecs.ListServicesOutput, error)
+	DescribeTasks(ctx context.Context, params *ecs.DescribeTasksInput, optFns ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error)
+	DescribeTaskDefinition(ctx context.Context, params *ecs.DescribeTaskDefinitionInput, optFns ...func(*ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register(ecsTypes.Task{})
+	gob.Register([]ecsTypes.Task{})
+	gob.Register(ecsTypes.TaskDefinition{})
+
+}
+
+func CachedECSListClusters(ECSClient AWSECSClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var clusters []string
+	cacheKey := fmt.Sprintf("%s-ecs-ListClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS clusters data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListClusters, err := ECSClient.ListClusters(
+			context.TODO(),
+			&ecs.ListClustersInput{
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		clusters = append(clusters, ListClusters.ClusterArns...)
+
+		// Pagination control.
+		if ListClusters.NextToken != nil {
+			PaginationControl = ListClusters.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}
+
+func CachedECSListTasks(ECSClient AWSECSClientInterface, accountID string, region string, cluster string) ([]string, error) {
+	var PaginationControl *string
+	var tasks []string
+	//grab cluster name from AWS ARN
+	clusterName := cluster[strings.LastIndex(cluster, "/")+1:]
+
+	cacheKey := fmt.Sprintf("%s-ecs-ListTasks-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS tasks data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListTasks, err := ECSClient.ListTasks(
+			context.TODO(),
+			&ecs.ListTasksInput{
+				Cluster:   &cluster,
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		tasks = append(tasks, ListTasks.TaskArns...)
+
+		// Pagination control.
+		if ListTasks.NextToken != nil {
+			PaginationControl = ListTasks.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, tasks, cache.DefaultExpiration)
+	return tasks, nil
+}
+
+func CachedECSDescribeTasks(ECSClient AWSECSClientInterface, accountID string, region string, cluster string, tasks []string) ([]ecsTypes.Task, error) {
+	var taskDetails []ecsTypes.Task
+	//replace semi-colons with underscores in task definition name
+	clusterFileSystemSafe := strings.ReplaceAll(cluster, ":", "_")
+	clusterFileSystemSafe = strings.ReplaceAll(clusterFileSystemSafe, "/", "_")
+	cacheKey := fmt.Sprintf("%s-ecs-DescribeTasks-%s-%s", accountID, region, clusterFileSystemSafe)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS task details data")
+		return cached.([]ecsTypes.Task), nil
+	}
+
+	DescribeTasks, err := ECSClient.DescribeTasks(
+		context.TODO(),
+		&ecs.DescribeTasksInput{
+			Cluster: &cluster,
+			Tasks:   tasks,
+		},
+		func(o *ecs.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return []ecsTypes.Task{}, err
+	}
+
+	taskDetails = append(taskDetails, DescribeTasks.Tasks...)
+
+	internal.Cache.Set(cacheKey, taskDetails, cache.DefaultExpiration)
+	return taskDetails, nil
+}
+
+func CachedECSDescribeTaskDefinition(ECSClient AWSECSClientInterface, accountID string, region string, taskDefinition string) (ecsTypes.TaskDefinition, error) {
+	var taskDefinitionDetails ecsTypes.TaskDefinition
+	//replace semi-colons with underscores in task definition name
+	taskDefinitionFileSystemSafe := strings.ReplaceAll(taskDefinition, ":", "_")
+	taskDefinitionFileSystemSafe = strings.ReplaceAll(taskDefinitionFileSystemSafe, "/", "_")
+	cacheKey := fmt.Sprintf("%s-ecs-DescribeTaskDefinition-%s-%s", accountID, region, taskDefinitionFileSystemSafe)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS task definition details data")
+		return cached.(ecsTypes.TaskDefinition), nil
+	}
+
+	DescribeTaskDefinition, err := ECSClient.DescribeTaskDefinition(
+		context.TODO(),
+		&ecs.DescribeTaskDefinitionInput{
+			TaskDefinition: &taskDefinition,
+		},
+		func(o *ecs.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return ecsTypes.TaskDefinition{}, err
+	}
+
+	taskDefinitionDetails = *DescribeTaskDefinition.TaskDefinition
+
+	internal.Cache.Set(cacheKey, taskDefinitionDetails, cache.DefaultExpiration)
+	return taskDefinitionDetails, nil
+}
+
+func CachedECSListServices(ECSClient AWSECSClientInterface, accountID string, region string, cluster string) ([]string, error) {
+	var PaginationControl *string
+	var services []string
+	//grab cluster name from AWS ARN
+	clusterName := cluster[strings.LastIndex(cluster, "/")+1:]
+
+	cacheKey := fmt.Sprintf("%s-ecs-ListServices-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS services data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListServices, err := ECSClient.ListServices(
+			context.TODO(),
+			&ecs.ListServicesInput{
+				Cluster:   &cluster,
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		services = append(services, ListServices.ServiceArns...)
+
+		// Pagination control.
+		if ListServices.NextToken != nil {
+			PaginationControl = ListServices.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, services, cache.DefaultExpiration)
+	return services, nil
+}

aws/sdk/ecs_mocks.go

@@ -0,0 +1,156 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+)
+
+const DESCRIBE_TASKS_TEST_FILE = "./test-data/describe-tasks.json"
+
+type MockedECSClient struct {
+	describeTasks DescribeTasks
+}
+
+type ListTasks struct {
+	TaskArns []string `json:"taskArns"`
+}
+
+type DescribeTasks struct {
+	Tasks []struct {
+		Attachments []struct {
+			ID      string `json:"id"`
+			Type    string `json:"type"`
+			Status  string `json:"status"`
+			Details []struct {
+				Name  string `json:"name"`
+				Value string `json:"value"`
+			} `json:"details"`
+		} `json:"attachments"`
+		Attributes []struct {
+			Name  string `json:"name"`
+			Value string `json:"value"`
+		} `json:"attributes"`
+		AvailabilityZone string `json:"availabilityZone"`
+		ClusterArn       string `json:"clusterArn"`
+		Connectivity     string `json:"connectivity"`
+		ConnectivityAt   string `json:"connectivityAt"`
+		Containers       []struct {
+			ContainerArn      string        `json:"containerArn"`
+			TaskArn           string        `json:"taskArn"`
+			Name              string        `json:"name"`
+			Image             string        `json:"image"`
+			RuntimeID         string        `json:"runtimeId"`
+			LastStatus        string        `json:"lastStatus"`
+			NetworkBindings   []interface{} `json:"networkBindings"`
+			NetworkInterfaces []struct {
+				AttachmentID       string `json:"attachmentId"`
+				PrivateIpv4Address string `json:"privateIpv4Address"`
+			} `json:"networkInterfaces"`
+			HealthStatus string `json:"healthStatus"`
+			CPU          string `json:"cpu"`
+			Memory       string `json:"memory"`
+		} `json:"containers"`
+		CPU                  string `json:"cpu"`
+		CreatedAt            string `json:"createdAt"`
+		DesiredStatus        string `json:"desiredStatus"`
+		EnableExecuteCommand bool   `json:"enableExecuteCommand"`
+		Group                string `json:"group"`
+		HealthStatus         string `json:"healthStatus"`
+		LastStatus           string `json:"lastStatus"`
+		LaunchType           string `json:"launchType"`
+		Memory               string `json:"memory"`
+		Overrides            struct {
+			ContainerOverrides []struct {
+				Name string `json:"name"`
+			} `json:"containerOverrides"`
+			InferenceAcceleratorOverrides []interface{} `json:"inferenceAcceleratorOverrides"`
+		} `json:"overrides"`
+		PlatformVersion   string        `json:"platformVersion"`
+		PlatformFamily    string        `json:"platformFamily"`
+		PullStartedAt     string        `json:"pullStartedAt"`
+		PullStoppedAt     string        `json:"pullStoppedAt"`
+		StartedAt         string        `json:"startedAt"`
+		StartedBy         string        `json:"startedBy"`
+		Tags              []interface{} `json:"tags"`
+		TaskArn           string        `json:"taskArn"`
+		TaskDefinitionArn string        `json:"taskDefinitionArn"`
+		Version           int           `json:"version"`
+		EphemeralStorage  struct {
+			SizeInGiB int `json:"sizeInGiB"`
+		} `json:"ephemeralStorage"`
+	} `json:"tasks"`
+	Failures []interface{} `json:"failures"`
+}
+
+func (c *MockedECSClient) ListClusters(context.Context, *ecs.ListClustersInput, ...func(*ecs.Options)) (*ecs.ListClustersOutput, error) {
+	return &ecs.ListClustersOutput{ClusterArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster",
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster2",
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster3",
+	}}, nil
+}
+
+func (c *MockedECSClient) ListTasks(ctx context.Context, input *ecs.ListTasksInput, f ...func(*ecs.Options)) (*ecs.ListTasksOutput, error) {
+	return &ecs.ListTasksOutput{TaskArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/74de0355a10a4f979ac495c14EXAMPLE",
+		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/d789e94343414c25b9f6bd59eEXAMPLE",
+	}}, nil
+}
+
+func (c *MockedECSClient) ListServices(ctx context.Context, input *ecs.ListServicesInput, f ...func(*ecs.Options)) (*ecs.ListServicesOutput, error) {
+	return &ecs.ListServicesOutput{ServiceArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService",
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService2",
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService3",
+	}}, nil
+}
+
+func (c *MockedECSClient) DescribeTasks(ctx context.Context, input *ecs.DescribeTasksInput, f ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error) {
+	err := json.Unmarshal(readTestFile(DESCRIBE_TASKS_TEST_FILE), &c.describeTasks)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_TASKS_TEST_FILE)
+	}
+	var tasks []ecsTypes.Task
+	for _, mockedTask := range c.describeTasks.Tasks {
+		if mockedTask.ClusterArn == aws.ToString(input.Cluster) {
+			for _, inputTask := range input.Tasks {
+				if mockedTask.TaskArn == inputTask {
+					var attachments []ecsTypes.Attachment
+					for _, a := range mockedTask.Attachments {
+						var deets []ecsTypes.KeyValuePair
+						for _, detail := range a.Details {
+							deets = append(deets, ecsTypes.KeyValuePair{
+								Name:  aws.String(detail.Name),
+								Value: aws.String(detail.Value)})
+						}
+						attachments = append(attachments, ecsTypes.Attachment{
+							Type:    aws.String(a.Type),
+							Details: deets,
+							Id:      aws.String(a.ID),
+							Status:  aws.String(a.Status),
+						})
+					}
+					tasks = append(tasks, ecsTypes.Task{
+						ClusterArn:        aws.String(mockedTask.ClusterArn),
+						TaskDefinitionArn: aws.String(mockedTask.TaskDefinitionArn),
+						LaunchType:        ecsTypes.LaunchType(*aws.String(mockedTask.LaunchType)),
+						TaskArn:           aws.String(mockedTask.TaskArn),
+						Attachments:       attachments,
+					})
+				}
+			}
+		}
+	}
+	return &ecs.DescribeTasksOutput{Tasks: tasks}, nil
+}
+
+func (c *MockedECSClient) DescribeTaskDefinition(ctx context.Context, input *ecs.DescribeTaskDefinitionInput, f ...func(o *ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error) {
+	testTaskDefinition := ecsTypes.TaskDefinition{}
+	testTaskDefinition.TaskRoleArn = aws.String("test123")
+	return &ecs.DescribeTaskDefinitionOutput{TaskDefinition: &testTaskDefinition}, nil
+}

aws/sdk/efs.go

@@ -20,7 +20,7 @@ type AWSEFSClientInterface interface {
 	DescribeFileSystemPolicy(ctx context.Context, params *efs.DescribeFileSystemPolicyInput, optFns ...func(*efs.Options)) (*efs.DescribeFileSystemPolicyOutput, error)
 }
 
-func RegisterEFSTypes() {
+func init() {
 	gob.Register([]efsTypes.FileSystemDescription{})
 	gob.Register([]efsTypes.MountTargetDescription{})
 	gob.Register([]efsTypes.AccessPointDescription{})

aws/sdk/efs_mocks.go

@@ -0,0 +1,67 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/efs"
+	efsTypes "github.com/aws/aws-sdk-go-v2/service/efs/types"
+)
+
+type MockedEfsClient struct {
+}
+
+func (m *MockedEfsClient) DescribeFileSystems(ctx context.Context, input *efs.DescribeFileSystemsInput, options ...func(*efs.Options)) (*efs.DescribeFileSystemsOutput, error) {
+	return &efs.DescribeFileSystemsOutput{
+		FileSystems: []efsTypes.FileSystemDescription{
+			{
+				FileSystemId: aws.String("fs-12345678"),
+			},
+			{
+				FileSystemId: aws.String("fs-87654321"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedEfsClient) DescribeMountTargets(ctx context.Context, input *efs.DescribeMountTargetsInput, options ...func(*efs.Options)) (*efs.DescribeMountTargetsOutput, error) {
+	return &efs.DescribeMountTargetsOutput{
+		MountTargets: []efsTypes.MountTargetDescription{
+			{
+				MountTargetId: aws.String("fsmt-12345678"),
+				FileSystemId:  aws.String("fs-12345678"),
+				IpAddress:     aws.String("10.1.1.1"),
+			},
+			{
+				MountTargetId: aws.String("fsmt-87654321"),
+				FileSystemId:  aws.String("fs-87654321"),
+				IpAddress:     aws.String("10.2.2.2.2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedEfsClient) DescribeAccessPoints(ctx context.Context, input *efs.DescribeAccessPointsInput, options ...func(*efs.Options)) (*efs.DescribeAccessPointsOutput, error) {
+	return &efs.DescribeAccessPointsOutput{
+		AccessPoints: []efsTypes.AccessPointDescription{
+			{
+				AccessPointId: aws.String("fsap-12345678"),
+				FileSystemId:  aws.String("fs-12345678"),
+				Name:          aws.String("fsap-12345678"),
+				PosixUser: &efsTypes.PosixUser{
+					Gid: aws.Int64(1000),
+					Uid: aws.Int64(1000),
+				},
+			},
+			{
+				AccessPointId: aws.String("fsap-87654321"),
+				FileSystemId:  aws.String("fs-87654321"),
+				Name:          aws.String("fsap-12345679"),
+				PosixUser: &efsTypes.PosixUser{
+					Gid: aws.Int64(1000),
+					Uid: aws.Int64(1000),
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/eks.go

@@ -18,7 +18,7 @@ type EKSClientInterface interface {
 	ListNodegroups(context.Context, *eks.ListNodegroupsInput, ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error)
 }
 
-func RegisterEKSTypes() {
+func init() {
 	gob.Register([]string{})
 	gob.Register(eksTypes.Cluster{})
 	gob.Register(eksTypes.Nodegroup{})
@@ -126,7 +126,7 @@ func CachedEKSListNodeGroups(client EKSClientInterface, accountID string, region
 
 func CachedEKSDescribeNodeGroup(client EKSClientInterface, accountID string, region string, clusterName string, nodeGroupName string) (eksTypes.Nodegroup, error) {
 	var nodeGroup eksTypes.Nodegroup
-	cacheKey := fmt.Sprintf("%s-eks-DescribeNodeGroup-%s-%s-%s", accountID, region, nodeGroupName)
+	cacheKey := fmt.Sprintf("%s-eks-DescribeNodeGroup-%s-%s-%s", accountID, region, clusterName, nodeGroupName)
 	cached, found := internal.Cache.Get(cacheKey)
 	if found {
 		return cached.(eksTypes.Nodegroup), nil

aws/sdk/eks_mocks.go

@@ -0,0 +1,54 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/eks"
+	eksTypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
+)
+
+type MockedAWSEksClient struct {
+}
+
+func (m *MockedAWSEksClient) ListClusters(ctx context.Context, input *eks.ListClustersInput, options ...func(*eks.Options)) (*eks.ListClustersOutput, error) {
+	return &eks.ListClustersOutput{
+		Clusters: []string{
+			"cluster1",
+			"cluster2",
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) DescribeCluster(ctx context.Context, input *eks.DescribeClusterInput, options ...func(*eks.Options)) (*eks.DescribeClusterOutput, error) {
+	return &eks.DescribeClusterOutput{
+		Cluster: &eksTypes.Cluster{
+			Arn:             aws.String("arn:aws:eks:us-east-1:123456789012:cluster/cluster1"),
+			Endpoint:        aws.String("https://cluster1.us-east-1.eks.amazonaws.com"),
+			Name:            aws.String("cluster1"),
+			PlatformVersion: aws.String("eks.1"),
+			Version:         aws.String("1.18"),
+			RoleArn:         aws.String("arn:aws:iam::123456789012:role/eks-role"),
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) ListNodegroups(ctx context.Context, input *eks.ListNodegroupsInput, options ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error) {
+	return &eks.ListNodegroupsOutput{
+		Nodegroups: []string{
+			"nodegroup1",
+			"nodegroup2",
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) DescribeNodegroup(ctx context.Context, input *eks.DescribeNodegroupInput, options ...func(*eks.Options)) (*eks.DescribeNodegroupOutput, error) {
+	return &eks.DescribeNodegroupOutput{
+		Nodegroup: &eksTypes.Nodegroup{
+			ClusterName:   aws.String("cluster1"),
+			NodeRole:      aws.String("arn:aws:iam::123456789012:role/eks-role"),
+			NodegroupName: aws.String("nodegroup1"),
+			NodegroupArn:  aws.String("arn:aws:eks:us-east-1:123456789012:nodegroup/cluster1/nodegroup1"),
+		},
+	}, nil
+}

aws/sdk/elasticache.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/elasticache"
+	elasticacheTypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSElastiCacheClientInterface interface {
+	DescribeCacheClusters(context.Context, *elasticache.DescribeCacheClustersInput, ...func(*elasticache.Options)) (*elasticache.DescribeCacheClustersOutput, error)
+}
+
+func init() {
+	gob.Register([]elasticacheTypes.CacheCluster{})
+
+}
+
+func CachedElastiCacheDescribeCacheClusters(client AWSElastiCacheClientInterface, accountID string, region string) ([]elasticacheTypes.CacheCluster, error) {
+	var PaginationControl *string
+	var clusters []elasticacheTypes.CacheCluster
+	cacheKey := fmt.Sprintf("%s-elasticache-DescribeCacheClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]elasticacheTypes.CacheCluster), nil
+	}
+	for {
+		DescribeCacheClusters, err := client.DescribeCacheClusters(
+			context.TODO(),
+			&elasticache.DescribeCacheClustersInput{
+				Marker: PaginationControl,
+			},
+			func(o *elasticache.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return clusters, err
+		}
+
+		clusters = append(clusters, DescribeCacheClusters.CacheClusters...)
+
+		//pagination
+		if DescribeCacheClusters.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeCacheClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}

aws/sdk/elasticache_mocks.go

@@ -0,0 +1,40 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticache"
+	elasticacheTypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+)
+
+type MockedElasticacheClient struct {
+}
+
+func (m *MockedElasticacheClient) DescribeCacheClusters(ctx context.Context, input *elasticache.DescribeCacheClustersInput, options ...func(*elasticache.Options)) (*elasticache.DescribeCacheClustersOutput, error) {
+	return &elasticache.DescribeCacheClustersOutput{
+		CacheClusters: []elasticacheTypes.CacheCluster{
+			{
+				CacheClusterId:            aws.String("test"),
+				ARN:                       aws.String("arn:aws:elasticache:us-east-1:123456789012:cluster:myCluster"),
+				Engine:                    aws.String("redis"),
+				EngineVersion:             aws.String("6.x"),
+				CacheNodeType:             aws.String("cache.t3.micro"),
+				NumCacheNodes:             aws.Int32(1),
+				CacheClusterStatus:        aws.String("available"),
+				PreferredAvailabilityZone: aws.String("us-east-1a"),
+				CacheSubnetGroupName:      aws.String("default"),
+				ReplicationGroupId:        aws.String("test"),
+				SecurityGroups: []elasticacheTypes.SecurityGroupMembership{
+					{
+						SecurityGroupId: aws.String("test"),
+						Status:          aws.String("active"),
+					},
+				},
+
+				AutoMinorVersionUpgrade:    aws.Bool(true),
+				PreferredMaintenanceWindow: aws.String("sun:05:00-sun:06:00"),
+			},
+		},
+	}, nil
+}

aws/sdk/elasticbeanstalk.go

@@ -0,0 +1,35 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk"
+	elasticbeanstalkTypes "github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk/types"
+)
+
+type AWSElasticBeanstalkClientInterface interface {
+	DescribeApplications(context.Context, *elasticbeanstalk.DescribeApplicationsInput, ...func(*elasticbeanstalk.Options)) (*elasticbeanstalk.DescribeApplicationsOutput, error)
+}
+
+func init() {
+	gob.Register([]elasticbeanstalkTypes.ApplicationDescription{})
+}
+
+func CachedElasticBeanstalkDescribeApplications(client AWSElasticBeanstalkClientInterface, accountID string, region string) ([]elasticbeanstalkTypes.ApplicationDescription, error) {
+	var applications []elasticbeanstalkTypes.ApplicationDescription
+	DescribeApplications, err := client.DescribeApplications(
+		context.TODO(),
+		&elasticbeanstalk.DescribeApplicationsInput{},
+		func(o *elasticbeanstalk.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return applications, err
+	}
+
+	applications = append(applications, DescribeApplications.Applications...)
+	return applications, nil
+}

aws/sdk/elasticbeanstalk_mocks.go

@@ -0,0 +1,33 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk"
+	elasticbeanstalkTypes "github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk/types"
+)
+
+type MockedElasticBeanstalkClient struct {
+}
+
+func (m *MockedElasticBeanstalkClient) DescribeApplications(ctx context.Context, input *elasticbeanstalk.DescribeApplicationsInput, options ...func(*elasticbeanstalk.Options)) (*elasticbeanstalk.DescribeApplicationsOutput, error) {
+	return &elasticbeanstalk.DescribeApplicationsOutput{
+		Applications: []elasticbeanstalkTypes.ApplicationDescription{
+			{
+				ApplicationName: aws.String("app1"),
+				ApplicationArn:  aws.String("arn:aws:elasticbeanstalk:us-east-1:123456789012:application/app1"),
+				ConfigurationTemplates: []string{
+					"template1",
+				},
+			},
+			{
+				ApplicationName: aws.String("app2"),
+				ApplicationArn:  aws.String("arn:aws:elasticbeanstalk:us-east-1:123456789012:application/app2"),
+				ConfigurationTemplates: []string{
+					"template2",
+				},
+			},
+		},
+	}, nil
+}