Merge pull request #49 from BishopFox/seth-dev

bumped version to fix another local filesystem write

.github/workflows/autorelease.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
 
-      - name: Go 1.18
+      - name: Go 1.20
         uses: actions/setup-go@v2
         with:
-          go-version: ^1.18
+          go-version: ^1.20
         id: go
 
       - id: install-secret-key

.gitignore

@@ -66,4 +66,8 @@ output/*
 cloudfox
 *.log
 *.bak
-table_output.txt
+*.txt
+*.json
+*.csv
+*.log
+dist/

README.md

@@ -39,7 +39,7 @@ For the full documentation please refer to our [wiki](https://github.com/BishopF
 
 | Provider| CloudFox Commands |
 | - | - |
-| AWS | 26 | 
+| AWS | 30 | 
 | Azure | 4 | 
 | GCP | Support Planned |
 | Kubernetes | Support Planned | 

aws/access-keys.go

@@ -1,22 +1,21 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
 )
 
 type AccessKeysModule struct {
 	// General configuration data
-	IAMClient      *iam.Client
+	IAMClient      sdk.AWSIAMClientInterface
 	Caller         sts.GetCallerIdentityOutput
 	AWSProfile     string
 	OutputFormat   string
@@ -79,12 +78,27 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
 		fmt.Printf("[%s][%s] Only active access keys are shown.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 		//fmt.Printf("[%s][%s] Preparing output.\n\n")
 
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
+		//m.writeLoot(m.output.FilePath, verbosity)
 		fmt.Printf("[%s][%s] %s access keys found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No  access keys found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -116,50 +130,30 @@ func (m *AccessKeysModule) writeLoot(outputDirectory string, verbosity int) {
 
 func (m *AccessKeysModule) getAccessKeysForAllUsers() {
 
-	// The "PaginationControl" value remains true until all data is received (default is 100 results per page).
-	// "" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationMarker *string
-	PaginationControl := true
+	ListUsers, err := sdk.CachedIamListUsers(m.IAMClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
-	for PaginationControl {
+	// added this to break out if there no users
+	if len(ListUsers) != 0 {
+		for _, user := range ListUsers {
 
-		IAMQuery, err := m.IAMClient.ListUsers(context.TODO(), &iam.ListUsersInput{Marker: PaginationMarker})
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
+			results, err := sdk.CachedIamListAccessKeys(m.IAMClient, aws.ToString(m.Caller.Account), aws.ToString(user.UserName))
+			if err != nil {
+				m.modLog.Error(err.Error())
+				m.CommandCounter.Error++
+				break
+			}
 
-		// added this to break out if there no users
-		if len(IAMQuery.Users) == 0 {
-			break
-		}
+			// This for loop extracts relevant information for each access key and adds to output array
+			for _, key := range results {
 
-		// This for loop iterates through all users.
-		for PaginationControl {
-			PaginationMarker = nil
-			for _, user := range IAMQuery.Users {
-
-				results, err := m.IAMClient.ListAccessKeys(context.TODO(), &iam.ListAccessKeysInput{UserName: user.UserName, Marker: PaginationMarker})
-				if err != nil {
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
+				if key.Status == "Active" {
+					m.AnalyzedUsers = append(m.AnalyzedUsers, UserKeys{Username: *user.UserName, Key: *key.AccessKeyId})
 				}
-
-				// This for loop extracts relevant information for each access key and adds to output array
-				for _, key := range results.AccessKeyMetadata {
-
-					if key.Status == "Active" {
-						m.AnalyzedUsers = append(m.AnalyzedUsers, UserKeys{Username: *user.UserName, Key: *key.AccessKeyId})
-					}
-				}
-				PaginationControl = results.IsTruncated
-				PaginationMarker = results.Marker
 			}
 		}
-
-		PaginationControl = IAMQuery.IsTruncated
-		PaginationMarker = IAMQuery.Marker
 	}
 }

aws/buckets.go

@@ -1,7 +1,6 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -10,37 +9,24 @@ import (
 	"sync"
 	"unicode/utf8"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
 )
 
-type AWSS3Client interface {
-	ListBuckets(ctx context.Context, params *s3.ListBucketsInput, optFns ...func(*s3.Options)) (*s3.ListBucketsOutput, error)
-	GetBucketPolicy(ctx context.Context, params *s3.GetBucketPolicyInput, optFns ...func(*s3.Options)) (*s3.GetBucketPolicyOutput, error)
-	GetBucketLocation(ctx context.Context, params *s3.GetBucketLocationInput, optFns ...func(*s3.Options)) (*s3.GetBucketLocationOutput, error)
-	GetPublicAccessBlock(ctx context.Context, params *s3.GetPublicAccessBlockInput, optFns ...func(*s3.Options)) (*s3.GetPublicAccessBlockOutput, error)
-}
-
 type BucketsModule struct {
 	// General configuration data
-	S3Client AWSS3Client
+	//BucketsS3Client CloudFoxS3Client
+	S3Client   sdk.AWSS3ClientInterface
+	AWSRegions []string
+	AWSProfile string
+	Caller     sts.GetCallerIdentityOutput
 
-	// This interface is used for unit testing
-	// S3ClientListBucketsInterface          AWSS3Client
-	// S3ClientGetBucketPolicyInterface      AWSS3Client
-	// S3ClientGetBucketLocationInterface    AWSS3Client
-	// S3ClientGetPublicAccessBlockInterface AWSS3Client
-
-	Caller       sts.GetCallerIdentityOutput
-	AWSRegions   []string
 	OutputFormat string
 	Goroutines   int
-	AWSProfile   string
 	WrapTable    bool
 
 	// Main module data
@@ -75,11 +61,11 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
 		"module": m.output.CallingModule,
 	})
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
 
 	if m.AWSProfile == "" {
 		m.AWSProfile = internal.BuildAWSPath(m.Caller)
 	}
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 
 	fmt.Printf("[%s][%s] Enumerating buckets for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 
@@ -134,8 +120,25 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
 
 	}
 	if len(m.output.Body) > 0 {
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity, m.AWSProfile)
+
 		fmt.Printf("[%s][%s] %s buckets found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 		fmt.Printf("[%s][%s] Bucket policies written to: %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.getLootDir())
 
@@ -225,7 +228,9 @@ func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, sem
 	}()
 	var region string = "Global"
 	var name string
-	ListBuckets, err := m.listBuckets()
+
+	ListBuckets, err := sdk.CachedListBuckets(m.S3Client, aws.ToString(m.Caller.Account))
+
 	if err != nil {
 		m.modLog.Error(err.Error())
 		return
@@ -236,13 +241,13 @@ func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, sem
 			Name:       aws.ToString(b.Name),
 			AWSService: "S3",
 		}
-		region, err = m.getBucketRegion(aws.ToString(b.Name))
+		region, err = sdk.CachedGetBucketLocation(m.S3Client, aws.ToString(m.Caller.Account), aws.ToString(b.Name))
 		if err != nil {
 			m.modLog.Error(err.Error())
 		}
 		bucket.Region = region
 
-		policyJSON, err := m.getBucketPolicy(aws.ToString(b.Name))
+		policyJSON, err := sdk.CachedGetBucketPolicy(m.S3Client, aws.ToString(m.Caller.Account), region, aws.ToString(b.Name))
 		if err != nil {
 			m.modLog.Error(err.Error())
 		} else {
@@ -270,86 +275,8 @@ func (m *BucketsModule) createBucketsRows(verbosity int, wg *sync.WaitGroup, sem
 
 }
 
-func (m *BucketsModule) listBuckets() ([]types.Bucket, error) {
-
-	var buckets []types.Bucket
-	ListBuckets, err := m.S3Client.ListBuckets(
-		context.TODO(),
-		&s3.ListBucketsInput{},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		return buckets, err
-	}
-
-	buckets = append(buckets, ListBuckets.Buckets...)
-	return buckets, nil
-
-}
-
-func (m *BucketsModule) getBucketRegion(bucketName string) (string, error) {
-	GetBucketRegion, err := m.S3Client.GetBucketLocation(
-		context.TODO(),
-		&s3.GetBucketLocationInput{
-			Bucket: &bucketName,
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		return "", err
-	}
-	location := string(GetBucketRegion.LocationConstraint)
-	if location == "" {
-		location = "us-east-1"
-	}
-	return location, err
-}
-
-func (m *BucketsModule) getBucketPolicy(bucketName string) (string, error) {
-
-	r, err := m.getBucketRegion(bucketName)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		return "", err
-	}
-	BucketPolicyObject, err := m.S3Client.GetBucketPolicy(
-		context.TODO(),
-		&s3.GetBucketPolicyInput{
-			Bucket: &bucketName,
-		},
-		func(o *s3.Options) {
-			o.Region = r
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		return "", err
-	}
-
-	return *BucketPolicyObject.Policy, nil
-
-}
-
-func (m *BucketsModule) getPublicAccessBlock(bucketName string) (*types.PublicAccessBlockConfiguration, error) {
-	r, err := m.getBucketRegion(bucketName)
-	PublicAccessBlock, err := m.S3Client.GetPublicAccessBlock(
-		context.TODO(),
-		&s3.GetPublicAccessBlockInput{
-			Bucket: &bucketName,
-		},
-		func(o *s3.Options) {
-			o.Region = r
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		return nil, err
-	}
-	return PublicAccessBlock.PublicAccessBlockConfiguration, err
-}
-
-func (m *BucketsModule) isPublicAccessBlocked(bucketName string) bool {
-	publicAccessBlock, err := m.getPublicAccessBlock(bucketName)
+func (m *BucketsModule) isPublicAccessBlocked(bucketName string, r string) bool {
+	publicAccessBlock, err := sdk.CachedGetPublicAccessBlock(m.S3Client, aws.ToString(m.Caller.Account), r, bucketName)
 	if err != nil {
 		return false
 	}
@@ -360,7 +287,7 @@ func (m *BucketsModule) isPublicAccessBlocked(bucketName string) bool {
 func (m *BucketsModule) analyseBucketPolicy(bucket *Bucket, dataReceiver chan Bucket) {
 	m.storeAccessPolicy(bucket)
 
-	if bucket.Policy.IsPublic() && !bucket.Policy.IsConditionallyPublic() && !m.isPublicAccessBlocked(bucket.Name) {
+	if bucket.Policy.IsPublic() && !bucket.Policy.IsConditionallyPublic() && !m.isPublicAccessBlocked(bucket.Name, bucket.Region) {
 		bucket.IsPublic = "YES"
 	}
 

aws/buckets_test.go

@@ -16,11 +16,10 @@ import (
 	"github.com/spf13/afero"
 )
 
-type MockedS3Buckets struct {
-	AWSRegions []string
+type MockedS3Client struct {
 }
 
-func (m *MockedS3Buckets) ListBuckets(ctx context.Context, params *s3.ListBucketsInput, optFns ...func(*s3.Options)) (*s3.ListBucketsOutput, error) {
+func (m *MockedS3Client) ListBuckets(ctx context.Context, params *s3.ListBucketsInput, optFns ...func(*s3.Options)) (*s3.ListBucketsOutput, error) {
 	buckets := make([]types.Bucket, 1)
 	mockBucket := types.Bucket{
 		CreationDate: aws.Time(time.Now()),
@@ -34,7 +33,7 @@ func (m *MockedS3Buckets) ListBuckets(ctx context.Context, params *s3.ListBucket
 
 }
 
-func (m *MockedS3Buckets) GetBucketPolicy(ctx context.Context, params *s3.GetBucketPolicyInput, optFns ...func(*s3.Options)) (*s3.GetBucketPolicyOutput, error) {
+func (m *MockedS3Client) GetBucketPolicy(ctx context.Context, params *s3.GetBucketPolicyInput, optFns ...func(*s3.Options)) (*s3.GetBucketPolicyOutput, error) {
 	bucketPolicy := `{
 		"Version": "2012-10-17",
 		"Statement": [
@@ -53,7 +52,7 @@ func (m *MockedS3Buckets) GetBucketPolicy(ctx context.Context, params *s3.GetBuc
 	return output, nil
 }
 
-func (m *MockedS3Buckets) GetBucketLocation(ctx context.Context, params *s3.GetBucketLocationInput, optFns ...func(*s3.Options)) (*s3.GetBucketLocationOutput, error) {
+func (m *MockedS3Client) GetBucketLocation(ctx context.Context, params *s3.GetBucketLocationInput, optFns ...func(*s3.Options)) (*s3.GetBucketLocationOutput, error) {
 	locationConstraint := types.BucketLocationConstraint("us-east-2")
 	output := &s3.GetBucketLocationOutput{
 		LocationConstraint: locationConstraint,
@@ -61,7 +60,7 @@ func (m *MockedS3Buckets) GetBucketLocation(ctx context.Context, params *s3.GetB
 	return output, nil
 }
 
-func (m *MockedS3Buckets) GetPublicAccessBlock(ctx context.Context, params *s3.GetPublicAccessBlockInput, optFns ...func(*s3.Options)) (*s3.GetPublicAccessBlockOutput, error) {
+func (m *MockedS3Client) GetPublicAccessBlock(ctx context.Context, params *s3.GetPublicAccessBlockInput, optFns ...func(*s3.Options)) (*s3.GetPublicAccessBlockOutput, error) {
 	output := &s3.GetPublicAccessBlockOutput{
 		PublicAccessBlockConfiguration: &types.PublicAccessBlockConfiguration{
 			BlockPublicAcls:       true,
@@ -74,6 +73,19 @@ func (m *MockedS3Buckets) GetPublicAccessBlock(ctx context.Context, params *s3.G
 }
 
 func TestListBuckets(t *testing.T) {
+
+	m := BucketsModule{
+
+		S3Client: &MockedS3Client{},
+		Caller: sts.GetCallerIdentityOutput{
+			Arn:     aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests"),
+			Account: aws.String("123456789012"),
+		},
+		AWSRegions: []string{"us-east-1", "us-west-1", "us-west-2"},
+		AWSProfile: "unittesting",
+		Goroutines: 3,
+	}
+
 	subtests := []struct {
 		name            string
 		outputDirectory string
@@ -85,17 +97,7 @@ func TestListBuckets(t *testing.T) {
 			name:            "test1",
 			outputDirectory: ".",
 			verbosity:       2,
-			testModule: BucketsModule{
-				S3Client: &MockedS3Buckets{},
-				Caller: sts.GetCallerIdentityOutput{
-					Arn:     aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests"),
-					Account: aws.String("123456789012"),
-				},
-				OutputFormat: "table",
-				AWSProfile:   "unittesting",
-				Goroutines:   30,
-				AWSRegions:   []string{"us-east-1", "us-west-1", "us-west-2"},
-			},
+			testModule:      m,
 			expectedResult: []Bucket{{
 				Name: "mockBucket123",
 			}},
@@ -110,7 +112,7 @@ func TestListBuckets(t *testing.T) {
 		t.Run(subtest.name, func(t *testing.T) {
 			subtest.testModule.PrintBuckets(subtest.testModule.OutputFormat, subtest.outputDirectory, subtest.verbosity)
 			for index, expectedBucket := range subtest.expectedResult {
-				resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting/table/buckets.txt")
+				resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/buckets.txt")
 				resultsFile, err := afero.ReadFile(fs, resultsFilePath)
 				if err != nil {
 					t.Fatalf("Cannot read output file at %s: %s", resultsFilePath, err)

aws/client-initializers.go

@@ -0,0 +1,126 @@
+package aws
+
+import (
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codebuild"
+	"github.com/aws/aws-sdk-go-v2/service/ecr"
+	"github.com/aws/aws-sdk-go-v2/service/efs"
+	"github.com/aws/aws-sdk-go-v2/service/fsx"
+	"github.com/aws/aws-sdk-go-v2/service/lambda"
+	"github.com/aws/aws-sdk-go-v2/service/organizations"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+)
+
+func initIAMSimClient(iamSimPPClient sdk.AWSIAMClientInterface, caller sts.GetCallerIdentityOutput, AWSProfile string, Goroutines int) IamSimulatorModule {
+
+	iamSimMod := IamSimulatorModule{
+		IAMClient:  iamSimPPClient,
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		Goroutines: Goroutines,
+	}
+
+	return iamSimMod
+
+}
+
+func InitCloudFoxSNSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int, AWSWrapTable bool) SNSModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	cloudFoxSNSClient := SNSModule{
+		SNSClient:  sns.NewFromConfig(AWSConfig),
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		Goroutines: Goroutines,
+		WrapTable:  AWSWrapTable,
+	}
+	return cloudFoxSNSClient
+
+}
+
+func initCloudFoxS3Client(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string) BucketsModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	cloudFoxS3Client := BucketsModule{
+		S3Client:   s3.NewFromConfig(AWSConfig),
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return cloudFoxS3Client
+
+}
+
+func InitSQSClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) SQSModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	sqsClient := SQSModule{
+		SQSClient: sqs.NewFromConfig(AWSConfig),
+
+		Caller:     caller,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+		AWSProfile: AWSProfile,
+		Goroutines: Goroutines,
+	}
+
+	return sqsClient
+
+}
+
+func InitLambdaClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) LambdasModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	lambdaClient := LambdasModule{
+		LambdaClient: lambda.NewFromConfig(AWSConfig),
+		Caller:       caller,
+		AWSProfile:   AWSProfile,
+		AWSRegions:   internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return lambdaClient
+}
+
+func InitCodeBuildClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) CodeBuildModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	codeBuildClient := CodeBuildModule{
+		CodeBuildClient: codebuild.NewFromConfig(AWSConfig),
+		Caller:          caller,
+		AWSProfile:      AWSProfile,
+		AWSRegions:      internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return codeBuildClient
+}
+
+func InitECRClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) ECRModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	ecrClient := ECRModule{
+		ECRClient:  ecr.NewFromConfig(AWSConfig),
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return ecrClient
+}
+
+func InitFileSystemsClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) FilesystemsModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	fileSystemsClient := FilesystemsModule{
+		EFSClient:  efs.NewFromConfig(AWSConfig),
+		FSxClient:  fsx.NewFromConfig(AWSConfig),
+		Caller:     caller,
+		AWSProfile: AWSProfile,
+		AWSRegions: internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return fileSystemsClient
+}
+
+func InitOrgClient(caller sts.GetCallerIdentityOutput, AWSProfile string, cfVersion string, Goroutines int) OrgModule {
+	var AWSConfig = internal.AWSConfigFileLoader(AWSProfile, cfVersion)
+	orgClient := OrgModule{
+		OrganizationsClient: organizations.NewFromConfig(AWSConfig),
+		Caller:              caller,
+		AWSProfile:          AWSProfile,
+		AWSRegions:          internal.GetEnabledRegions(AWSProfile, cfVersion),
+	}
+	return orgClient
+}

aws/cloudformation.go

@@ -1,29 +1,24 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
 	"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
 	"github.com/sirupsen/logrus"
 )
 
-type CloudFormationGetTemplateAPIClient interface {
-	GetTemplate(context.Context, *cloudformation.GetTemplateInput, ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error)
-}
 type CloudformationModule struct {
 	// General configuration data
-	CloudFormationDescribeStacksInterface cloudformation.DescribeStacksAPIClient
-	CloudFormationGetTemplateInterface    CloudFormationGetTemplateAPIClient
+	CloudFormationClient sdk.CloudFormationClientInterface
 
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
@@ -135,11 +130,27 @@ func (m *CloudformationModule) PrintCloudformationStacks(outputFormat string, ou
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		//	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s cloudformation stacks found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No cloudformation stacks found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -251,7 +262,7 @@ func (m *CloudformationModule) createCFStackRowsPerRegion(r string, wg *sync.Wai
 	}()
 	var stackTemplateBody string = ""
 
-	DescribeStacks, err := m.describeStacks(r)
+	DescribeStacks, err := sdk.CachedCloudFormationDescribeStacks(m.CloudFormationClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
@@ -263,7 +274,7 @@ func (m *CloudformationModule) createCFStackRowsPerRegion(r string, wg *sync.Wai
 		stackOutputs := stack.Outputs
 		stackParameters := stack.Parameters
 
-		stackTemplateBody, err = m.getTemplateBody(r, stackName)
+		stackTemplateBody, err = sdk.CachedCloudFormationGetTemplate(m.CloudFormationClient, aws.ToString(m.Caller.Account), r, stackName)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
@@ -281,61 +292,3 @@ func (m *CloudformationModule) createCFStackRowsPerRegion(r string, wg *sync.Wai
 	}
 
 }
-
-func (m *CloudformationModule) describeStacks(r string) ([]types.Stack, error) {
-
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
-	var stacks []types.Stack
-
-	for {
-		DescribeStacks, err := m.CloudFormationDescribeStacksInterface.DescribeStacks(
-			context.TODO(),
-			&cloudformation.DescribeStacksInput{
-				NextToken: PaginationControl,
-			},
-			func(o *cloudformation.Options) {
-				o.Region = r
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			return stacks, err
-		}
-
-		stacks = append(stacks, DescribeStacks.Stacks...)
-
-		// The "NextToken" value is nil when there's no more data to return.
-		if DescribeStacks.NextToken != nil {
-			PaginationControl = DescribeStacks.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-	}
-	return stacks, nil
-}
-
-func (m *CloudformationModule) getTemplateBody(r string, stackName string) (string, error) {
-
-	var stackTemplateBody string
-	GetTemplate, err := m.CloudFormationGetTemplateInterface.GetTemplate(
-		context.TODO(),
-		&cloudformation.GetTemplateInput{
-			StackName: &stackName,
-		},
-		func(o *cloudformation.Options) {
-			o.Region = r
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		return stackTemplateBody, err
-	}
-
-	stackTemplateBody = aws.ToString(GetTemplate.TemplateBody)
-
-	return stackTemplateBody, nil
-}

aws/cloudformation_test.go

@@ -1,80 +1,15 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
 	"log"
 	"testing"
-	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
-	"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-const DESCRIBE_STACKS_TEST_FILE = "./test-data/cloudformation-describestacks.json"
-const TEMPLATE_BODY_TEST_FILE = "./test-data/cloudformation-getTemplate.json"
-
-type Stacks struct {
-	Stacks []struct {
-		StackID           string            `json:"StackId"`
-		Description       string            `json:"Description"`
-		Tags              []interface{}     `json:"Tags"`
-		Outputs           []types.Output    `json:"Outputs"`
-		Parameters        []types.Parameter `json:"Parameters"`
-		StackStatusReason interface{}       `json:"StackStatusReason"`
-		CreationTime      time.Time         `json:"CreationTime"`
-		Capabilities      []interface{}     `json:"Capabilities"`
-		StackName         string            `json:"StackName"`
-		RoleArn           string            `json:"RoleArn"`
-		StackStatus       string            `json:"StackStatus"`
-		DisableRollback   bool              `json:"DisableRollback"`
-	} `json:"Stacks"`
-}
-
-type TemplateBody struct {
-	TemplateBody string `json:"TemplateBody"`
-}
-
-type MockedCloudformationClientDescribeStacks struct {
-	describeStacks Stacks
-}
-
-type MockedCloudformationClientGetTemplate struct {
-	getTemplateBody TemplateBody
-}
-
-func (m *MockedCloudformationClientDescribeStacks) DescribeStacks(ctx context.Context, params *cloudformation.DescribeStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.DescribeStacksOutput, error) {
-
-	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.describeStacks)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_STACKS_TEST_FILE)
-	}
-	var stacks []types.Stack
-	for _, stack := range m.describeStacks.Stacks {
-		stacks = append(stacks, types.Stack{
-			StackName:  &stack.StackName,
-			RoleARN:    &stack.RoleArn,
-			Outputs:    stack.Outputs,
-			Parameters: stack.Parameters,
-		})
-
-	}
-
-	return &cloudformation.DescribeStacksOutput{Stacks: stacks}, nil
-}
-
-func (m *MockedCloudformationClientGetTemplate) GetTemplate(ctx context.Context, params *cloudformation.GetTemplateInput, optFns ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error) {
-	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.getTemplateBody)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", TEMPLATE_BODY_TEST_FILE)
-	}
-
-	return &cloudformation.GetTemplateOutput{TemplateBody: &m.getTemplateBody.TemplateBody}, nil
-}
-
 func TestCloudFormation(t *testing.T) {
 	subtests := []struct {
 		name            string
@@ -88,13 +23,12 @@ func TestCloudFormation(t *testing.T) {
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule: CloudformationModule{
-				CloudFormationDescribeStacksInterface: &MockedCloudformationClientDescribeStacks{},
-				CloudFormationGetTemplateInterface:    &MockedCloudformationClientGetTemplate{},
-				Caller:                                sts.GetCallerIdentityOutput{Arn: aws.String("test")},
-				OutputFormat:                          "table",
-				AWSProfile:                            "test",
-				Goroutines:                            30,
-				AWSRegions:                            AWSRegions,
+				CloudFormationClient: &sdk.MockedCloudformationClient{},
+				Caller:               sts.GetCallerIdentityOutput{Arn: aws.String("test")},
+				OutputFormat:         "table",
+				AWSProfile:           "test",
+				Goroutines:           30,
+				AWSRegions:           AWSRegions,
 			},
 			expectedResult: []CFStack{{
 				Name: "myteststack",

aws/codebuild.go

@@ -0,0 +1,252 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/awsservicemap"
+	"github.com/sirupsen/logrus"
+)
+
+type CodeBuildModule struct {
+	// General configuration data
+	CodeBuildClient sdk.CodeBuildClientInterface
+	IAMClient       sdk.AWSIAMClientInterface
+
+	Caller         sts.GetCallerIdentityOutput
+	AWSRegions     []string
+	OutputFormat   string
+	Goroutines     int
+	AWSProfile     string
+	SkipAdminCheck bool
+	WrapTable      bool
+	pmapperMod     PmapperModule
+	pmapperError   error
+	iamSimClient   IamSimulatorModule
+
+	// Main module data
+	Projects       []Project
+	CommandCounter internal.CommandCounter
+	// Used to store output data for pretty printing
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type Project struct {
+	Region     string
+	Name       string
+	Arn        string
+	Role       string
+	Admin      string
+	CanPrivEsc string
+}
+
+func (m *CodeBuildModule) PrintCodeBuildProjects(outputFormat string, outputDirectory string, verbosity int) {
+	// These stuct values are used by the output module
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "codebuild"
+	localAdminMap := make(map[string]bool)
+
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	fmt.Printf("[%s][%s] Enumerating CodeBuild projects for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
+
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "regions")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan Project)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+
+	go m.Receiver(dataReceiver, receiverDone)
+
+	for _, region := range m.AWSRegions {
+		wg.Add(1)
+		m.CommandCounter.Pending++
+		go m.executeChecks(region, wg, semaphore, dataReceiver)
+
+	}
+
+	wg.Wait()
+
+	// Send a message to the spinner goroutine to close the channel and stop
+	spinnerDone <- true
+	<-spinnerDone
+	receiverDone <- true
+	<-receiverDone
+
+	// Perform role analysis
+	if m.pmapperError == nil {
+		for i := range m.Projects {
+			m.Projects[i].Admin, m.Projects[i].CanPrivEsc = GetPmapperResults(m.SkipAdminCheck, m.pmapperMod, &m.Projects[i].Role)
+		}
+	} else {
+		for i := range m.Projects {
+			m.Projects[i].Admin, m.Projects[i].CanPrivEsc = GetIamSimResult(m.SkipAdminCheck, &m.Projects[i].Role, m.iamSimClient, localAdminMap)
+		}
+	}
+
+	// add - if struct is not empty do this. otherwise, dont write anything.
+	if m.pmapperError == nil {
+		m.output.Headers = []string{
+			"Region",
+			"Name",
+			"Role",
+			"IsAdminRole?",
+			"CanPrivEscToAdmin?",
+		}
+	} else {
+		m.output.Headers = []string{
+			"Region",
+			"Name",
+			"Role",
+			"IsAdminRole?",
+			//"CanPrivEscToAdmin?",
+		}
+	}
+
+	// Table rows
+
+	for i := range m.Projects {
+		if m.pmapperError == nil {
+			m.output.Body = append(
+				m.output.Body,
+				[]string{
+					m.Projects[i].Region,
+					m.Projects[i].Name,
+					m.Projects[i].Role,
+					m.Projects[i].Admin,
+					m.Projects[i].CanPrivEsc,
+				},
+			)
+		} else {
+			m.output.Body = append(
+				m.output.Body,
+				[]string{
+					m.Projects[i].Region,
+					m.Projects[i].Name,
+					m.Projects[i].Role,
+					m.Projects[i].Admin,
+				},
+			)
+
+		}
+	}
+
+	var seen []string
+	for _, project := range m.Projects {
+		if !internal.Contains(project.Name, seen) {
+			seen = append(seen, project.Name)
+		}
+	}
+
+	if len(m.output.Body) > 0 {
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		//m.output.OutputSelector(outputFormat)
+		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		//fmt.Printf("[%s][%s] %d projects with a total of %d node groups found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), len(seen), len(m.output.Body))
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
+		fmt.Printf("[%s][%s] %d projects found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), len(m.output.Body))
+		fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+
+	} else {
+		fmt.Printf("[%s][%s] No projects found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+
+}
+
+func (m *CodeBuildModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Project) {
+	defer wg.Done()
+
+	servicemap := &awsservicemap.AwsServiceMap{
+		JsonFileSource: "DOWNLOAD_FROM_AWS",
+	}
+	res, err := servicemap.IsServiceInRegion("codebuild", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getcodeBuildProjectsPerRegion(r, wg, semaphore, dataReceiver)
+	}
+}
+
+func (m *CodeBuildModule) Receiver(receiver chan Project, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Projects = append(m.Projects, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+
+func (m *CodeBuildModule) getcodeBuildProjectsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Project) {
+	defer wg.Done()
+
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	projects, err := sdk.CachedCodeBuildListProjects(m.CodeBuildClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+	}
+
+	for _, project := range projects {
+		details, err := sdk.CachedCodeBuildBatchGetProjects(m.CodeBuildClient, aws.ToString(m.Caller.Account), r, project)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+		}
+
+		dataReceiver <- Project{
+			Name:       aws.ToString(details.Name),
+			Region:     r,
+			Role:       aws.ToString(details.ServiceRole),
+			Admin:      "",
+			CanPrivEsc: "",
+		}
+
+	}
+
+}

aws/codebuild_test.go

@@ -0,0 +1,150 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codebuild"
+	"github.com/aws/aws-sdk-go-v2/service/codebuild/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/spf13/afero"
+)
+
+type mockedCodeBuildClient struct {
+}
+
+func (m *mockedCodeBuildClient) ListProjects(ctx context.Context, params *codebuild.ListProjectsInput, optFns ...func(*codebuild.Options)) (*codebuild.ListProjectsOutput, error) {
+	out := codebuild.ListProjectsOutput{
+		Projects: []string{"test1", "test2"},
+	}
+
+	return &out, nil
+}
+
+func (m *mockedCodeBuildClient) BatchGetProjects(ctx context.Context, params *codebuild.BatchGetProjectsInput, optFns ...func(*codebuild.Options)) (*codebuild.BatchGetProjectsOutput, error) {
+	project1out := codebuild.BatchGetProjectsOutput{
+		Projects: []types.Project{
+			{
+				Name: aws.String("test1"),
+				Environment: &types.ProjectEnvironment{
+					Image: aws.String("aws/codebuild/standard:4.0"),
+				},
+				ServiceRole: aws.String("arn:aws:iam::123456789012:role/test1"),
+				Source: &types.ProjectSource{
+					Type:     "CODECOMMIT",
+					Location: aws.String("https://git-codecommit.us-east-1.amazonaws.com/v1/repos/test1"),
+				},
+				Artifacts: &types.ProjectArtifacts{
+					Type:     "S3",
+					Location: aws.String("s3://test1"),
+				},
+				TimeoutInMinutes: aws.Int32(60),
+			},
+		},
+	}
+
+	project2out := codebuild.BatchGetProjectsOutput{
+		Projects: []types.Project{
+			{
+				Name: aws.String("test2"),
+				Environment: &types.ProjectEnvironment{
+					Image: aws.String("aws/codebuild/standard:4.0"),
+				},
+				ServiceRole: aws.String("arn:aws:iam::123456789012:role/test2"),
+				Source: &types.ProjectSource{
+					Type:     "GITHUB",
+					Location: aws.String("https://test.github.com/test2"),
+				},
+				Artifacts: &types.ProjectArtifacts{
+					Type:     "S3",
+					Location: aws.String("s3://test2"),
+				},
+				TimeoutInMinutes: aws.Int32(60),
+			},
+		},
+	}
+
+	if params.Names[0] == "test1" {
+		return &project1out, nil
+	} else if params.Names[0] == "test2" {
+		return &project2out, nil
+	} else {
+		return nil, nil
+	}
+}
+
+func (m *mockedCodeBuildClient) GetResourcePolicy(ctx context.Context, params *codebuild.GetResourcePolicyInput, optFns ...func(*codebuild.Options)) (*codebuild.GetResourcePolicyOutput, error) {
+	out := codebuild.GetResourcePolicyOutput{
+		Policy: aws.String(`{
+			"Version": "2012-10-17",
+			"Statement": [
+				{
+					"Effect": "Allow",
+					"Principal": {
+						"AWS": "*"
+					},
+					"Action": [
+					"codebuild:StartBuild",
+					"codebuild:BatchGetBuilds",
+					"codebuild:StopBuild",
+					"codebuild:ListProjects",
+					"codebuild:BatchGetProjects"
+					],
+					"Resource": "*"
+				}
+			]
+		}`),
+	}
+
+	return &out, nil
+}
+
+func TestCodeBuildProjects(t *testing.T) {
+
+	m := CodeBuildModule{
+		CodeBuildClient: &mockedCodeBuildClient{},
+		AWSProfile:      "unittesting",
+		AWSRegions:      []string{"us-west-1"},
+		Caller: sts.GetCallerIdentityOutput{
+			Arn:     aws.String("arn:aws:iam::123456789012:user/Alice"),
+			Account: aws.String("123456789012"),
+		},
+		Goroutines:     3,
+		WrapTable:      true,
+		SkipAdminCheck: true,
+	}
+
+	fs := internal.MockFileSystem(true)
+	defer internal.MockFileSystem(false)
+	tmpDir := "."
+
+	// execute the module with verbosity set to 2
+	m.PrintCodeBuildProjects("table", tmpDir, 2)
+
+	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/codebuild.txt")
+	resultsFile, err := afero.ReadFile(fs, resultsFilePath)
+	if err != nil {
+		t.Fatalf("Cannot read output file at %s: %s", resultsFilePath, err)
+	}
+
+	expectedResults := strings.TrimLeft(`
+╭───────────┬───────┬──────────────────────────────────────┬──────────────╮
+│  Region   │ Name  │                 Role                 │ IsAdminRole? │
+├───────────┼───────┼──────────────────────────────────────┼──────────────┤
+│ us-west-1 │ test1 │ arn:aws:iam::123456789012:role/test1 │ Skipped      │
+│ us-west-1 │ test2 │ arn:aws:iam::123456789012:role/test2 │ Skipped      │
+╰───────────┴───────┴──────────────────────────────────────┴──────────────╯
+`, "\n")
+	fmt.Println(expectedResults)
+	fmt.Println("results file")
+	fmt.Println(string(resultsFile))
+
+	if string(resultsFile) != expectedResults {
+		t.Fatalf("Unexpected results:\n%s\n", resultsFile)
+	}
+}

aws/databases.go

@@ -0,0 +1,451 @@
+package aws
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/awsservicemap"
+	"github.com/sirupsen/logrus"
+)
+
+type DatabasesModule struct {
+	RDSClient      sdk.RDSClientInterface
+	RedshiftClient sdk.AWSRedShiftClientInterface
+	DynamoDBClient sdk.DynamoDBClientInterface
+	DocDBClient    sdk.DocDBClientInterface
+
+	Caller       sts.GetCallerIdentityOutput
+	AWSRegions   []string
+	OutputFormat string
+	Goroutines   int
+	AWSProfile   string
+	WrapTable    bool
+
+	Databases      []Database
+	CommandCounter internal.CommandCounter
+	Errors         []string
+	// Used to store output data for pretty printing
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type Database struct {
+	AWSService string
+	Region     string
+	Engine     string
+	Name       string
+	Arn        string
+	UserName   string
+	Endpoint   string
+	Port       int32
+	Protocol   string
+	Public     string
+	Size       string
+}
+
+func (m *DatabasesModule) PrintDatabases(outputFormat string, outputDirectory string, verbosity int) {
+	// These stuct values are used by the output module
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "databases"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	fmt.Printf("[%s][%s] Enumerating databases for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	fmt.Printf("[%s][%s] Supported Services: RDS, DynamoDB\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan Database)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+
+	go m.Receiver(dataReceiver, receiverDone)
+
+	//execute regional checks
+	for _, region := range m.AWSRegions {
+		wg.Add(1)
+		go m.executeChecks(region, wg, semaphore, dataReceiver)
+	}
+
+	wg.Wait()
+
+	// Send a message to the spinner goroutine to close the channel and stop
+	spinnerDone <- true
+	<-spinnerDone
+	receiverDone <- true
+	<-receiverDone
+
+	sort.Slice(m.Databases, func(i, j int) bool {
+		return m.Databases[i].AWSService < m.Databases[j].AWSService
+	})
+
+	m.output.Headers = []string{
+		"Service",
+		"Engine",
+		"Region",
+		"Name",
+		"Size",
+		"UserName",
+		"Endpoint",
+		//"Port",
+		//"Protocol",
+		//"Public",
+
+	}
+
+	// Table rows
+	for i := range m.Databases {
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				m.Databases[i].AWSService,
+				m.Databases[i].Engine,
+				m.Databases[i].Region,
+				m.Databases[i].Name,
+				m.Databases[i].Size,
+				m.Databases[i].UserName,
+				m.Databases[i].Endpoint,
+				// strconv.Itoa(int(m.Databases[i].Port)),
+				// m.Databases[i].Protocol,
+				// m.Databases[i].Public,
+			},
+		)
+
+	}
+	if len(m.output.Body) > 0 {
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		//m.output.OutputSelector(outputFormat)
+		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
+		fmt.Printf("[%s][%s] %s databases found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+	} else {
+		fmt.Printf("[%s][%s] No databases found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+
+}
+
+func (m *DatabasesModule) Receiver(receiver chan Database, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Databases = append(m.Databases, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+
+func (m *DatabasesModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer wg.Done()
+
+	servicemap := &awsservicemap.AwsServiceMap{
+		JsonFileSource: "DOWNLOAD_FROM_AWS",
+	}
+	res, err := servicemap.IsServiceInRegion("rds", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		go m.getRdsClustersPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("redshift", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getRedshiftDatabasesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("dynamodb", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getDynamoDBTablesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("docdb", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getDocDBTablesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+
+}
+
+func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
+	path := filepath.Join(outputDirectory, "loot")
+	err := os.MkdirAll(path, os.ModePerm)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		panic(err.Error())
+	}
+	f := filepath.Join(path, "databases-UrlsOnly.txt")
+
+	var out string
+
+	for _, database := range m.Databases {
+		out = out + fmt.Sprintln(database.Endpoint)
+	}
+
+	err = os.WriteFile(f, []byte(out), 0644)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		panic(err.Error())
+	}
+
+	if verbosity > 2 {
+		fmt.Println()
+		fmt.Printf("[%s][%s] %s \n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("Feed this databases into nmap and something like gowitness/aquatone for screenshots."))
+		fmt.Print(out)
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("End of loot file."))
+	}
+
+	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), f)
+
+}
+
+func (m *DatabasesModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+
+	DBInstances, err := sdk.CachedRDSDescribeDBInstances(m.RDSClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	var public string
+	for _, instance := range DBInstances {
+		if instance.Endpoint != nil {
+			name := aws.ToString(instance.DBInstanceIdentifier)
+			port := instance.Endpoint.Port
+			endpoint := aws.ToString(instance.Endpoint.Address)
+			engine := aws.ToString(instance.Engine)
+
+			if instance.PubliclyAccessible {
+				public = "True"
+			} else {
+				public = "False"
+			}
+
+			dataReceiver <- Database{
+				AWSService: "RDS",
+				Region:     r,
+				Name:       name,
+				Engine:     engine,
+				Endpoint:   endpoint,
+				UserName:   aws.ToString(instance.MasterUsername),
+				Port:       port,
+				Protocol:   aws.ToString(instance.Engine),
+				Public:     public,
+			}
+		}
+
+	}
+
+}
+
+func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	awsService := "Redshift"
+	protocol := "https"
+
+	Clusters, err := sdk.CachedRedShiftDescribeClusters(m.RedshiftClient, aws.ToString(m.Caller.Account), r)
+
+	if err != nil {
+		if errors.As(err, &oe) {
+			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+		}
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	var public string
+	for _, cluster := range Clusters {
+		name := aws.ToString(cluster.DBName)
+		//id := workspace.Id
+		endpoint := aws.ToString(cluster.Endpoint.Address)
+
+		if cluster.PubliclyAccessible {
+			public = "True"
+		} else {
+			public = "False"
+		}
+		port := cluster.Endpoint.Port
+		dataReceiver <- Database{
+			AWSService: awsService,
+			Region:     r,
+			Name:       name,
+			Endpoint:   endpoint,
+			Port:       port,
+			Protocol:   protocol,
+			Public:     public,
+		}
+	}
+}
+
+func (m *DatabasesModule) getDynamoDBTablesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	awsService := "DynamoDB"
+
+	Tables, err := sdk.CachedDynamoDBListTables(m.DynamoDBClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, table := range Tables {
+		//get size of dynamodb table
+		TableOutput, err := sdk.CachedDynamoDBDescribeTable(m.DynamoDBClient, aws.ToString(m.Caller.Account), r, table)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			return
+		}
+		size := aws.ToInt64(TableOutput.TableSizeBytes)
+
+		dataReceiver <- Database{
+			AWSService: awsService,
+			Region:     r,
+			Name:       table,
+			Size:       strconv.Itoa(int(size)),
+			UserName:   "N/A",
+			Endpoint:   "N/A",
+		}
+	}
+
+}
+
+func (m *DatabasesModule) getDocDBTablesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() {
+		<-semaphore
+	}()
+	// m.CommandCounter.Total++
+	m.CommandCounter.Pending--
+	m.CommandCounter.Executing++
+	awsService := "DocDB"
+
+	Clusters, err := sdk.CachedDocDBDescribeDBClusters(m.DocDBClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, cluster := range Clusters {
+		name := aws.ToString(cluster.DBClusterIdentifier)
+
+		endpoint := aws.ToString(cluster.Endpoint)
+		port := aws.ToInt32(cluster.Port)
+		//size := aws.ToInt64(TableOutput.Table.TableSizeBytes)
+		userName := aws.ToString(cluster.MasterUsername)
+
+		dataReceiver <- Database{
+			AWSService: awsService,
+			Region:     r,
+			Name:       name,
+			Endpoint:   endpoint,
+			Port:       port,
+			UserName:   userName,
+			//Size:       strconv.Itoa(int(size)),
+		}
+	}
+}

aws/ecr.go

@@ -1,7 +1,6 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -10,9 +9,10 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ecr"
 	"github.com/aws/aws-sdk-go-v2/service/ecr/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
@@ -21,11 +21,7 @@ import (
 
 type ECRModule struct {
 	// General configuration data
-	ECRClient *ecr.Client
-	// These interfaces are used for unit testing
-	ECRClientDescribeReposInterface  ecr.DescribeRepositoriesAPIClient
-	ECRClientDescribeImagesInterface ecr.DescribeImagesAPIClient
-
+	ECRClient    sdk.AWSECRClientInterface
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
 	OutputFormat string
@@ -49,6 +45,8 @@ type Repository struct {
 	PushedAt   string
 	ImageTags  string
 	ImageSize  int64
+	Policy     policy.Policy
+	PolicyJSON string
 }
 
 func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbosity int) {
@@ -125,11 +123,27 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s repositories found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No repositories found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -224,107 +238,104 @@ func (m *ECRModule) getECRRecordsPerRegion(r string, wg *sync.WaitGroup, semapho
 	defer func() {
 		<-semaphore
 	}()
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
-	var PaginationControl2 *string
 
-	for {
-		DescribeRepositories, err := m.ECRClientDescribeReposInterface.DescribeRepositories(
-			context.TODO(),
-			&ecr.DescribeRepositoriesInput{
-				NextToken: PaginationControl,
-			},
-			func(o *ecr.Options) {
-				o.Region = r
-			},
-		)
+	var allImages []types.ImageDetail
+	var repoURI string
+	var repoName string
+
+	DescribeRepositories, err := m.describeRepositories(r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, repo := range DescribeRepositories {
+		repoName = aws.ToString(repo.RepositoryName)
+		repoURI = aws.ToString(repo.RepositoryUri)
+		//created := *repo.CreatedAt
+		//fmt.Printf("%s, %s, %s", repoName, repoURI, created)
+
+		images, err := m.describeImages(r, repoName)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
-			break
-		}
-
-		for _, repo := range DescribeRepositories.Repositories {
-			repoName := aws.ToString(repo.RepositoryName)
-			repoURI := aws.ToString(repo.RepositoryUri)
-			//created := *repo.CreatedAt
-			//fmt.Printf("%s, %s, %s", repoName, repoURI, created)
-			var images []types.ImageDetail
-			for {
-				DescribeImages, err := m.ECRClientDescribeImagesInterface.DescribeImages(
-					context.TODO(),
-					&ecr.DescribeImagesInput{
-						RepositoryName: &repoName,
-						NextToken:      PaginationControl2,
-					},
-					func(o *ecr.Options) {
-						o.Region = r
-					},
-				)
-				if err != nil {
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
-				}
-
-				//images := DescribeImages.ImageDetails
-				images = append(images, DescribeImages.ImageDetails...)
-
-				if DescribeImages.NextToken != nil {
-					PaginationControl2 = DescribeImages.NextToken
-				} else {
-
-					// not sure if this is the right way to do this, but adding this code here was the only way i could
-					// sort the results from all pages to look for the latest push.
-					PaginationControl2 = nil
-
-					sort.Slice(images, func(i, j int) bool {
-						return images[i].ImagePushedAt.Format("2006-01-02 15:04:05") < images[j].ImagePushedAt.Format("2006-01-02 15:04:05")
-					})
-
-					var image types.ImageDetail
-					var imageTags string
-
-					if len(images) > 1 {
-						image = images[len(images)-1]
-					} else if len(images) == 1 {
-						image = images[0]
-					} else {
-
-						break
-					}
-
-					if len(image.ImageTags) > 0 {
-						imageTags = image.ImageTags[0]
-					}
-					//imageTags := image.ImageTags[0]
-					pushedAt := image.ImagePushedAt.Format("2006-01-02 15:04:05")
-					imageSize := aws.ToInt64(image.ImageSizeInBytes)
-					pullURI := fmt.Sprintf("%s:%s", repoURI, imageTags)
-
-					dataReceiver <- Repository{
-						AWSService: "ECR",
-						Name:       repoName,
-						Region:     r,
-						URI:        pullURI,
-						PushedAt:   pushedAt,
-						ImageTags:  imageTags,
-						ImageSize:  imageSize,
-					}
-
-					// }
-					break
-				}
-
-			}
-		}
-
-		// The "NextToken" value is nil when there's no more data to return.
-		if DescribeRepositories.NextToken != nil {
-			PaginationControl = DescribeRepositories.NextToken
-		} else {
-			PaginationControl = nil
-			break
+			return
 		}
+		allImages = append(allImages, images...)
 	}
+
+	sort.Slice(allImages, func(i, j int) bool {
+		return allImages[i].ImagePushedAt.Format("2006-01-02 15:04:05") < allImages[j].ImagePushedAt.Format("2006-01-02 15:04:05")
+	})
+
+	var image types.ImageDetail
+	var imageTags string
+
+	if len(allImages) > 1 {
+		image = allImages[len(allImages)-1]
+	} else if len(allImages) == 1 {
+		image = allImages[0]
+	} else {
+		return
+	}
+
+	if len(image.ImageTags) > 0 {
+		imageTags = image.ImageTags[0]
+	}
+	//imageTags := image.ImageTags[0]
+	pushedAt := image.ImagePushedAt.Format("2006-01-02 15:04:05")
+	imageSize := aws.ToInt64(image.ImageSizeInBytes)
+	pullURI := fmt.Sprintf("%s:%s", repoURI, imageTags)
+
+	dataReceiver <- Repository{
+		AWSService: "ECR",
+		Name:       repoName,
+		Region:     r,
+		URI:        pullURI,
+		PushedAt:   pushedAt,
+		ImageTags:  imageTags,
+		ImageSize:  imageSize,
+	}
+
+}
+
+func (m *ECRModule) describeRepositories(r string) ([]types.Repository, error) {
+
+	var repositories []types.Repository
+	Repositories, err := sdk.CachedECRDescribeRepositories(m.ECRClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		m.CommandCounter.Error++
+		return nil, err
+	}
+
+	repositories = append(repositories, Repositories...)
+
+	return repositories, nil
+}
+
+func (m *ECRModule) describeImages(r string, repoName string) ([]types.ImageDetail, error) {
+	var images []types.ImageDetail
+
+	ImageDetails, err := sdk.CachedECRDescribeImages(m.ECRClient, aws.ToString(m.Caller.Account), r, repoName)
+	if err != nil {
+		m.CommandCounter.Error++
+		return nil, err
+	}
+	images = append(images, ImageDetails...)
+	return images, nil
+}
+
+func (m *ECRModule) getECRRepositoryPolicy(r string, repository string) (policy.Policy, error) {
+	var repoPolicy policy.Policy
+	Policy, err := sdk.CachedECRGetRepositoryPolicy(m.ECRClient, aws.ToString(m.Caller.Account), r, repository)
+	if err != nil {
+		m.CommandCounter.Error++
+		return repoPolicy, err
+	}
+	repoPolicy, err = policy.ParseJSONPolicy([]byte(Policy))
+	if err != nil {
+		return repoPolicy, fmt.Errorf("parsing policy (%s) as JSON: %s", repository, err)
+	}
+	return repoPolicy, nil
 }

aws/ecr_test.go

@@ -15,15 +15,10 @@ import (
 
 var AWSRegions = []string{"us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-1", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ca-central-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-north-1", "me-south-1", "sa-east-1"}
 
-type MockedECRClientDescribeRepos struct {
-	AWSRegions []string
+type MockedECRClient struct {
 }
 
-type MockedECRClientDescribeImages struct {
-	AWSRegions []string
-}
-
-func (m *MockedECRClientDescribeRepos) DescribeRepositories(ctx context.Context, params *ecr.DescribeRepositoriesInput, optFns ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error) {
+func (m *MockedECRClient) DescribeRepositories(ctx context.Context, params *ecr.DescribeRepositoriesInput, optFns ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error) {
 	return &ecr.DescribeRepositoriesOutput{
 		Repositories: []types.Repository{
 			{
@@ -34,7 +29,7 @@ func (m *MockedECRClientDescribeRepos) DescribeRepositories(ctx context.Context,
 	}, nil
 }
 
-func (m *MockedECRClientDescribeImages) DescribeImages(context.Context, *ecr.DescribeImagesInput, ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error) {
+func (m *MockedECRClient) DescribeImages(context.Context, *ecr.DescribeImagesInput, ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error) {
 	return &ecr.DescribeImagesOutput{
 		ImageDetails: []types.ImageDetail{
 			{
@@ -46,7 +41,14 @@ func (m *MockedECRClientDescribeImages) DescribeImages(context.Context, *ecr.Des
 	}, nil
 }
 
+func (m *MockedECRClient) GetRepositoryPolicy(context.Context, *ecr.GetRepositoryPolicyInput, ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error) {
+	return &ecr.GetRepositoryPolicyOutput{
+		PolicyText: aws.String("policyText"),
+	}, nil
+}
+
 func TestDescribeRepos(t *testing.T) {
+
 	subtests := []struct {
 		name            string
 		outputDirectory string
@@ -59,13 +61,15 @@ func TestDescribeRepos(t *testing.T) {
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule: ECRModule{
-				ECRClientDescribeReposInterface:  &MockedECRClientDescribeRepos{},
-				ECRClientDescribeImagesInterface: &MockedECRClientDescribeImages{},
-				Caller:                           sts.GetCallerIdentityOutput{Arn: aws.String("test")},
-				OutputFormat:                     "table",
-				AWSProfile:                       "test",
-				Goroutines:                       30,
-				AWSRegions:                       AWSRegions,
+				ECRClient: &MockedECRClient{},
+				Caller: sts.GetCallerIdentityOutput{
+					Arn:     aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests"),
+					Account: aws.String("123456789012"),
+				},
+				OutputFormat: "table",
+				AWSProfile:   "test",
+				Goroutines:   30,
+				AWSRegions:   AWSRegions,
 			},
 			expectedResult: []Repository{{
 				Name:      "test1",

aws/ecs-tasks.go

@@ -2,6 +2,7 @@ package aws
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -9,27 +10,20 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ecs"
 	"github.com/aws/aws-sdk-go-v2/service/ecs/types"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
 	"github.com/sirupsen/logrus"
 )
 
-type DescribeTasksDefinitionAPIClient interface {
-	DescribeTaskDefinition(context.Context, *ecs.DescribeTaskDefinitionInput, ...func(*ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error)
-}
 type ECSTasksModule struct {
-	DescribeTaskDefinitionClient     DescribeTasksDefinitionAPIClient
-	DescribeTasksClient              ecs.DescribeTasksAPIClient
-	ListTasksClient                  ecs.ListTasksAPIClient
-	ListClustersClient               ecs.ListClustersAPIClient
-	DescribeNetworkInterfacesClient  ec2.DescribeNetworkInterfacesAPIClient
-	IAMSimulatePrincipalPolicyClient iam.SimulatePrincipalPolicyAPIClient
+	ECSClient sdk.AWSECSClientInterface
+	EC2Client sdk.AWSEC2ClientInterface
+	IAMClient sdk.AWSIAMClientInterface
 
 	Caller         sts.GetCallerIdentityOutput
 	AWSRegions     []string
@@ -50,15 +44,16 @@ type ECSTasksModule struct {
 }
 
 type MappedECSTask struct {
-	Cluster        string
-	TaskDefinition string
-	LaunchType     string
-	ID             string
-	ExternalIP     string
-	PrivateIP      string
-	Role           string
-	Admin          string
-	CanPrivEsc     string
+	Cluster               string
+	TaskDefinitionName    string
+	TaskDefinitionContent string
+	LaunchType            string
+	ID                    string
+	ExternalIP            string
+	PrivateIP             string
+	Role                  string
+	Admin                 string
+	CanPrivEsc            string
 }
 
 func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, verbosity int) {
@@ -77,7 +72,7 @@ func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, v
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMSimulatePrincipalPolicyClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -124,7 +119,7 @@ func (m *ECSTasksModule) ECSTasks(outputFormat string, outputDirectory string, v
 	receiverDone <- true
 	<-receiverDone
 
-	m.printECSTaskData(outputFormat, outputDirectory, dataReceiver)
+	m.printECSTaskData(outputFormat, outputDirectory, dataReceiver, verbosity)
 
 }
 
@@ -141,7 +136,7 @@ func (m *ECSTasksModule) Receiver(receiver chan MappedECSTask, receiverDone chan
 	}
 }
 
-func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory string, dataReceiver chan MappedECSTask) {
+func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory string, dataReceiver chan MappedECSTask, verbosity int) {
 	if m.pmapperError == nil {
 		m.output.Headers = []string{
 			"Cluster",
@@ -174,7 +169,7 @@ func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory s
 				m.output.Body,
 				[]string{
 					ecsTask.Cluster,
-					ecsTask.TaskDefinition,
+					ecsTask.TaskDefinitionName,
 					ecsTask.LaunchType,
 					ecsTask.ID,
 					ecsTask.ExternalIP,
@@ -191,7 +186,7 @@ func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory s
 				m.output.Body,
 				[]string{
 					ecsTask.Cluster,
-					ecsTask.TaskDefinition,
+					ecsTask.TaskDefinitionName,
 					ecsTask.LaunchType,
 					ecsTask.ID,
 					ecsTask.ExternalIP,
@@ -205,11 +200,26 @@ func (m *ECSTasksModule) printECSTaskData(outputFormat string, outputDirectory s
 	}
 
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-
-		m.writeLoot(m.output.FilePath)
+		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName)
 		fmt.Printf("[%s][%s] %s ECS tasks found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -250,6 +260,24 @@ func (m *ECSTasksModule) writeLoot(outputDirectory string) {
 		m.CommandCounter.Error++
 	}
 
+	for _, task := range m.MappedECSTasks {
+		if task.TaskDefinitionContent != "" {
+			path := filepath.Join(path, "task-definitions")
+			err := os.MkdirAll(path, os.ModePerm)
+			if err != nil {
+				m.modLog.Error(err.Error())
+				m.CommandCounter.Error++
+			}
+			taskDefinitionFilename := filepath.Join(path, task.TaskDefinitionName+".json")
+
+			err = os.WriteFile(taskDefinitionFilename, []byte(task.TaskDefinitionContent), 0644)
+			if err != nil {
+				m.modLog.Error(err.Error())
+				m.CommandCounter.Error++
+			}
+		}
+	}
+
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), privateIPsFilename)
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), publicIPsFilename)
 
@@ -278,75 +306,37 @@ func (m *ECSTasksModule) executeChecks(r string, wg *sync.WaitGroup, dataReceive
 
 func (m *ECSTasksModule) getListClusters(region string, dataReceiver chan MappedECSTask) {
 
-	var PaginationControl *string
-	for {
-		ListClusters, err := m.ListClustersClient.ListClusters(
-			context.TODO(),
-			&(ecs.ListClustersInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *ecs.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		for _, clusterARN := range ListClusters.ClusterArns {
-			m.getListTasks(clusterARN, region, dataReceiver)
-		}
-
-		if ListClusters.NextToken != nil {
-			PaginationControl = ListClusters.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
+	ClusterArns, err := sdk.CachedECSListClusters(m.ECSClient, aws.ToString(m.Caller.Account), region)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	for _, clusterARN := range ClusterArns {
+		m.getListTasks(clusterARN, region, dataReceiver)
+	}
+
 }
 
 func (m *ECSTasksModule) getListTasks(clusterARN string, region string, dataReceiver chan MappedECSTask) {
-	var PaginationControl *string
-	for {
-
-		ListTasks, err := m.ListTasksClient.ListTasks(
-			context.TODO(),
-			&(ecs.ListTasksInput{
-				Cluster:   aws.String(clusterARN),
-				NextToken: PaginationControl,
-			}),
-			func(o *ecs.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		batchSize := 100 // maximum value: https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html#API_DescribeTasks_RequestSyntax
-		for i := 0; i < len(ListTasks.TaskArns); i += batchSize {
-			j := i + batchSize
-			if j > len(ListTasks.TaskArns) {
-				j = len(ListTasks.TaskArns)
-			}
-
-			m.loadTasksData(clusterARN, ListTasks.TaskArns[i:j], region, dataReceiver)
-		}
-
-		if ListTasks.NextToken != nil {
-			PaginationControl = ListTasks.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
+	TaskArns, err := sdk.CachedECSListTasks(m.ECSClient, aws.ToString(m.Caller.Account), region, clusterARN)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	batchSize := 100 // maximum value: https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html#API_DescribeTasks_RequestSyntax
+	for i := 0; i < len(TaskArns); i += batchSize {
+		j := i + batchSize
+		if j > len(TaskArns) {
+			j = len(TaskArns)
+		}
+
+		m.loadTasksData(clusterARN, TaskArns[i:j], region, dataReceiver)
+	}
+
 }
 
 func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, region string, dataReceiver chan MappedECSTask) {
@@ -355,16 +345,7 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 		return
 	}
 
-	DescribeTasks, err := m.DescribeTasksClient.DescribeTasks(
-		context.TODO(),
-		&(ecs.DescribeTasksInput{
-			Cluster: aws.String(clusterARN),
-			Tasks:   taskARNs,
-		}),
-		func(o *ecs.Options) {
-			o.Region = region
-		},
-	)
+	Tasks, err := sdk.CachedECSDescribeTasks(m.ECSClient, aws.ToString(m.Caller.Account), region, clusterARN, taskARNs)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
@@ -372,7 +353,7 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 	}
 
 	eniIDs := []string{}
-	for _, task := range DescribeTasks.Tasks {
+	for _, task := range Tasks {
 		eniID := getElasticNetworkInterfaceIDOfECSTask(task)
 		if eniID != "" {
 			eniIDs = append(eniIDs, eniID)
@@ -385,14 +366,22 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 		return
 	}
 
-	for _, task := range DescribeTasks.Tasks {
+	for _, task := range Tasks {
+		//taskDefinition, err := m.describeTaskDefinition(aws.ToString(task.TaskDefinitionArn), region)
+		taskDefinition, err := sdk.CachedECSDescribeTaskDefinition(m.ECSClient, aws.ToString(m.Caller.Account), region, aws.ToString(task.TaskDefinitionArn))
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			return
+		}
 		mappedTask := MappedECSTask{
-			Cluster:        getNameFromARN(clusterARN),
-			TaskDefinition: getNameFromARN(aws.ToString(task.TaskDefinitionArn)),
-			LaunchType:     string(task.LaunchType),
-			ID:             getIDFromECSTask(aws.ToString(task.TaskArn)),
-			PrivateIP:      getPrivateIPv4AddressFromECSTask(task),
-			Role:           m.getTaskRole(aws.ToString(task.TaskDefinitionArn), region),
+			Cluster:               getNameFromARN(clusterARN),
+			TaskDefinitionName:    getNameFromARN(aws.ToString(task.TaskDefinitionArn)),
+			TaskDefinitionContent: getTaskDefinitionContent(taskDefinition),
+			LaunchType:            string(task.LaunchType),
+			ID:                    getIDFromECSTask(aws.ToString(task.TaskArn)),
+			PrivateIP:             getPrivateIPv4AddressFromECSTask(task),
+			Role:                  getTaskRole(taskDefinition),
 		}
 
 		eniID := getElasticNetworkInterfaceIDOfECSTask(task)
@@ -404,8 +393,22 @@ func (m *ECSTasksModule) loadTasksData(clusterARN string, taskARNs []string, reg
 	}
 }
 
-func (m *ECSTasksModule) getTaskRole(taskDefinitionArn string, region string) string {
-	DescribeTaskDefinition, err := m.DescribeTaskDefinitionClient.DescribeTaskDefinition(
+func getTaskRole(taskDefinition types.TaskDefinition) string {
+	return aws.ToString(taskDefinition.TaskRoleArn)
+}
+
+func getTaskDefinitionContent(taskDefinition types.TaskDefinition) string {
+	// return taskDefinition as a json string
+
+	taskDefinitionContent, err := json.Marshal(taskDefinition)
+	if err != nil {
+		return ""
+	}
+	return string(taskDefinitionContent)
+}
+
+func (m *ECSTasksModule) describeTaskDefinition(taskDefinitionArn string, region string) (types.TaskDefinition, error) {
+	DescribeTaskDefinition, err := m.ECSClient.DescribeTaskDefinition(
 		context.TODO(),
 		&ecs.DescribeTaskDefinitionInput{
 			TaskDefinition: &taskDefinitionArn,
@@ -417,9 +420,9 @@ func (m *ECSTasksModule) getTaskRole(taskDefinitionArn string, region string) st
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
-		return ""
+		return types.TaskDefinition{}, err
 	}
-	return aws.ToString(DescribeTaskDefinition.TaskDefinition.TaskRoleArn)
+	return *DescribeTaskDefinition.TaskDefinition, nil
 }
 
 /* UNUSED CODE BLOCK - PLEASE REVIEW AND DELETE IF NOT NEEDED
@@ -455,20 +458,13 @@ func (m *ECSTasksModule) loadPublicIPs(eniIDs []string, region string) (map[stri
 	if len(eniIDs) == 0 {
 		return eniPublicIPs, nil
 	}
-	DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
-		context.TODO(),
-		&(ec2.DescribeNetworkInterfacesInput{
-			NetworkInterfaceIds: eniIDs,
-		}),
-		func(o *ec2.Options) {
-			o.Region = region
-		},
-	)
+
+	NetworkInterfaces, err := sdk.CachedEC2DescribeNetworkInterfaces(m.EC2Client, aws.ToString(m.Caller.Account), region)
 	if err != nil {
 		return nil, fmt.Errorf("getting elastic network interfaces: %s", err)
 	}
 
-	for _, eni := range DescribeNetworkInterfaces.NetworkInterfaces {
+	for _, eni := range NetworkInterfaces {
 		eniPublicIPs[aws.ToString(eni.NetworkInterfaceId)] = getPublicIPOfElasticNetworkInterface(eni)
 	}
 

aws/ecs-tasks_test.go

@@ -1,249 +1,15 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
 	"log"
-	"os"
 	"testing"
-	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
-	"github.com/aws/aws-sdk-go-v2/service/ecs"
-	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-const DESCRIBE_TASKS_TEST_FILE = "./test-data/describe-tasks.json"
-const DESCRIBE_NETWORK_INTEFACES_TEST_FILE = "./test-data/describe-network-interfaces.json"
-
-type ListTasks struct {
-	TaskArns []string `json:"taskArns"`
-}
-
-type DescribeTasks struct {
-	Tasks []struct {
-		Attachments []struct {
-			ID      string `json:"id"`
-			Type    string `json:"type"`
-			Status  string `json:"status"`
-			Details []struct {
-				Name  string `json:"name"`
-				Value string `json:"value"`
-			} `json:"details"`
-		} `json:"attachments"`
-		Attributes []struct {
-			Name  string `json:"name"`
-			Value string `json:"value"`
-		} `json:"attributes"`
-		AvailabilityZone string `json:"availabilityZone"`
-		ClusterArn       string `json:"clusterArn"`
-		Connectivity     string `json:"connectivity"`
-		ConnectivityAt   string `json:"connectivityAt"`
-		Containers       []struct {
-			ContainerArn      string        `json:"containerArn"`
-			TaskArn           string        `json:"taskArn"`
-			Name              string        `json:"name"`
-			Image             string        `json:"image"`
-			RuntimeID         string        `json:"runtimeId"`
-			LastStatus        string        `json:"lastStatus"`
-			NetworkBindings   []interface{} `json:"networkBindings"`
-			NetworkInterfaces []struct {
-				AttachmentID       string `json:"attachmentId"`
-				PrivateIpv4Address string `json:"privateIpv4Address"`
-			} `json:"networkInterfaces"`
-			HealthStatus string `json:"healthStatus"`
-			CPU          string `json:"cpu"`
-			Memory       string `json:"memory"`
-		} `json:"containers"`
-		CPU                  string `json:"cpu"`
-		CreatedAt            string `json:"createdAt"`
-		DesiredStatus        string `json:"desiredStatus"`
-		EnableExecuteCommand bool   `json:"enableExecuteCommand"`
-		Group                string `json:"group"`
-		HealthStatus         string `json:"healthStatus"`
-		LastStatus           string `json:"lastStatus"`
-		LaunchType           string `json:"launchType"`
-		Memory               string `json:"memory"`
-		Overrides            struct {
-			ContainerOverrides []struct {
-				Name string `json:"name"`
-			} `json:"containerOverrides"`
-			InferenceAcceleratorOverrides []interface{} `json:"inferenceAcceleratorOverrides"`
-		} `json:"overrides"`
-		PlatformVersion   string        `json:"platformVersion"`
-		PlatformFamily    string        `json:"platformFamily"`
-		PullStartedAt     string        `json:"pullStartedAt"`
-		PullStoppedAt     string        `json:"pullStoppedAt"`
-		StartedAt         string        `json:"startedAt"`
-		StartedBy         string        `json:"startedBy"`
-		Tags              []interface{} `json:"tags"`
-		TaskArn           string        `json:"taskArn"`
-		TaskDefinitionArn string        `json:"taskDefinitionArn"`
-		Version           int           `json:"version"`
-		EphemeralStorage  struct {
-			SizeInGiB int `json:"sizeInGiB"`
-		} `json:"ephemeralStorage"`
-	} `json:"tasks"`
-	Failures []interface{} `json:"failures"`
-}
-
-type DescribeNetworkInterfaces struct {
-	NetworkInterfaces []struct {
-		Status          string `json:"Status"`
-		MacAddress      string `json:"MacAddress"`
-		SourceDestCheck bool   `json:"SourceDestCheck"`
-		VpcID           string `json:"VpcId"`
-		Description     string `json:"Description"`
-		Association     struct {
-			PublicIP      string `json:"PublicIp"`
-			AssociationID string `json:"AssociationId"`
-			PublicDNSName string `json:"PublicDnsName"`
-			IPOwnerID     string `json:"IpOwnerId"`
-		} `json:"Association"`
-		NetworkInterfaceID string `json:"NetworkInterfaceId"`
-		PrivateIPAddresses []struct {
-			PrivateDNSName string `json:"PrivateDnsName"`
-			Association    struct {
-				PublicIP      string `json:"PublicIp"`
-				AssociationID string `json:"AssociationId"`
-				PublicDNSName string `json:"PublicDnsName"`
-				IPOwnerID     string `json:"IpOwnerId"`
-			} `json:"Association"`
-			Primary          bool   `json:"Primary"`
-			PrivateIPAddress string `json:"PrivateIpAddress"`
-		} `json:"PrivateIpAddresses"`
-		RequesterManaged bool          `json:"RequesterManaged"`
-		Ipv6Addresses    []interface{} `json:"Ipv6Addresses"`
-		PrivateDNSName   string        `json:"PrivateDnsName,omitempty"`
-		AvailabilityZone string        `json:"AvailabilityZone"`
-		Attachment       struct {
-			Status              string    `json:"Status"`
-			DeviceIndex         int       `json:"DeviceIndex"`
-			AttachTime          time.Time `json:"AttachTime"`
-			InstanceID          string    `json:"InstanceId"`
-			DeleteOnTermination bool      `json:"DeleteOnTermination"`
-			AttachmentID        string    `json:"AttachmentId"`
-			InstanceOwnerID     string    `json:"InstanceOwnerId"`
-		} `json:"Attachment"`
-		Groups []struct {
-			GroupName string `json:"GroupName"`
-			GroupID   string `json:"GroupId"`
-		} `json:"Groups"`
-		SubnetID         string        `json:"SubnetId"`
-		OwnerID          string        `json:"OwnerId"`
-		TagSet           []interface{} `json:"TagSet"`
-		PrivateIPAddress string        `json:"PrivateIpAddress"`
-	} `json:"NetworkInterfaces"`
-}
-
-func readTestFile(testFile string) []byte {
-	file, err := os.ReadFile(testFile)
-	if err != nil {
-		log.Fatalf("can't read file %s", testFile)
-	}
-	return file
-}
-
-type mockedListclustersClient struct {
-}
-
-func (c *mockedListclustersClient) ListClusters(context.Context, *ecs.ListClustersInput, ...func(*ecs.Options)) (*ecs.ListClustersOutput, error) {
-	return &ecs.ListClustersOutput{ClusterArns: []string{
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster",
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster2",
-		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster3",
-	}}, nil
-}
-
-type mockedListTasksClient struct{}
-
-func (c *mockedListTasksClient) ListTasks(ctx context.Context, input *ecs.ListTasksInput, f ...func(*ecs.Options)) (*ecs.ListTasksOutput, error) {
-	return &ecs.ListTasksOutput{TaskArns: []string{
-		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/74de0355a10a4f979ac495c14EXAMPLE",
-		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/d789e94343414c25b9f6bd59eEXAMPLE",
-	}}, nil
-}
-
-type mockedDescribeTasksClient struct {
-	describeTasks DescribeTasks
-}
-
-func (c *mockedDescribeTasksClient) DescribeTasks(ctx context.Context, input *ecs.DescribeTasksInput, f ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error) {
-	err := json.Unmarshal(readTestFile(DESCRIBE_TASKS_TEST_FILE), &c.describeTasks)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_TASKS_TEST_FILE)
-	}
-	var tasks []ecsTypes.Task
-	for _, mockedTask := range c.describeTasks.Tasks {
-		if mockedTask.ClusterArn == aws.ToString(input.Cluster) {
-			for _, inputTask := range input.Tasks {
-				if mockedTask.TaskArn == inputTask {
-					var attachments []ecsTypes.Attachment
-					for _, a := range mockedTask.Attachments {
-						var deets []ecsTypes.KeyValuePair
-						for _, detail := range a.Details {
-							deets = append(deets, ecsTypes.KeyValuePair{
-								Name:  aws.String(detail.Name),
-								Value: aws.String(detail.Value)})
-						}
-						attachments = append(attachments, ecsTypes.Attachment{
-							Type:    aws.String(a.Type),
-							Details: deets,
-							Id:      aws.String(a.ID),
-							Status:  aws.String(a.Status),
-						})
-					}
-					tasks = append(tasks, ecsTypes.Task{
-						ClusterArn:        aws.String(mockedTask.ClusterArn),
-						TaskDefinitionArn: aws.String(mockedTask.TaskDefinitionArn),
-						LaunchType:        ecsTypes.LaunchType(*aws.String(mockedTask.LaunchType)),
-						TaskArn:           aws.String(mockedTask.TaskArn),
-						Attachments:       attachments,
-					})
-				}
-			}
-		}
-	}
-	return &ecs.DescribeTasksOutput{Tasks: tasks}, nil
-}
-
-type mockedDescribeNetworkInterfacesClient struct {
-	describeNetworkInterfaces DescribeNetworkInterfaces
-}
-
-func (c *mockedDescribeNetworkInterfacesClient) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
-	var nics []ec2types.NetworkInterface
-	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
-	}
-	for _, mockedNic := range c.describeNetworkInterfaces.NetworkInterfaces {
-		for _, inputNicID := range input.NetworkInterfaceIds {
-			if mockedNic.NetworkInterfaceID == inputNicID {
-				nics = append(nics, ec2types.NetworkInterface{
-					Association: &ec2types.NetworkInterfaceAssociation{
-						PublicIp: aws.String(mockedNic.Association.PublicIP),
-					},
-					NetworkInterfaceId: aws.String(mockedNic.NetworkInterfaceID)})
-			}
-		}
-	}
-	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
-}
-
-type mockedDescribeTaskDefinitionInterface struct {
-}
-
-func (c *mockedDescribeTaskDefinitionInterface) DescribeTaskDefinition(ctx context.Context, input *ecs.DescribeTaskDefinitionInput, f ...func(o *ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error) {
-	testTaskDefinition := ecsTypes.TaskDefinition{}
-	testTaskDefinition.TaskRoleArn = aws.String("test123")
-	return &ecs.DescribeTaskDefinitionOutput{TaskDefinition: &testTaskDefinition}, nil
-}
-
 func TestECSTasks(t *testing.T) {
 	subtests := []struct {
 		name            string
@@ -258,17 +24,13 @@ func TestECSTasks(t *testing.T) {
 			verbosity:       2,
 			testModule: ECSTasksModule{
 
-				AWSProfile:                      "default",
-				AWSRegions:                      []string{"us-east-1", "us-west-1"},
-				Caller:                          sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
-				SkipAdminCheck:                  true,
-				Goroutines:                      30,
-				DescribeNetworkInterfacesClient: &mockedDescribeNetworkInterfacesClient{},
-				DescribeTasksClient:             &mockedDescribeTasksClient{},
-				ListTasksClient:                 &mockedListTasksClient{},
-				ListClustersClient:              &mockedListclustersClient{},
-				DescribeTaskDefinitionClient:    &mockedDescribeTaskDefinitionInterface{},
-				//IAMSimulatePrincipalPolicyClient: &mockedDescribeTaskDefinitionsClient{},
+				AWSProfile:     "default",
+				AWSRegions:     []string{"us-east-1", "us-west-1"},
+				Caller:         sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
+				SkipAdminCheck: true,
+				Goroutines:     30,
+				EC2Client:      &sdk.MockedEC2Client2{},
+				ECSClient:      &sdk.MockedECSClient{},
 			},
 			expectedResult: []MappedECSTask{{
 				Cluster:    "MyCluster",

aws/eks.go

@@ -1,18 +1,15 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/eks"
-	"github.com/aws/aws-sdk-go-v2/service/eks/types"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
 	"github.com/sirupsen/logrus"
@@ -21,11 +18,8 @@ import (
 type EKSModule struct {
 	// General configuration data
 	// These interfaces are used for unit testing
-	EKSClientListClustersInterface      eks.ListClustersAPIClient
-	EKSClientDescribeClusterInterface   eks.DescribeClusterAPIClient
-	EKSClientListNodeGroupsInterface    eks.ListNodegroupsAPIClient
-	EKSClientDescribeNodeGroupInterface eks.DescribeNodegroupAPIClient
-	IAMSimulatePrincipalPolicyClient    iam.SimulatePrincipalPolicyAPIClient
+	EKSClient sdk.EKSClientInterface
+	IAMClient sdk.AWSIAMClientInterface
 
 	Caller         sts.GetCallerIdentityOutput
 	AWSRegions     []string
@@ -76,7 +70,7 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMSimulatePrincipalPolicyClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -204,11 +198,27 @@ func (m *EKSModule) EKS(outputFormat string, outputDirectory string, verbosity i
 	}
 
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %d clusters with a total of %d node groups found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), len(seen), len(m.output.Body))
 	} else {
 		fmt.Printf("[%s][%s] No clusters found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -304,16 +314,19 @@ func (m *EKSModule) getEKSRecordsPerRegion(r string, wg *sync.WaitGroup, semapho
 		<-semaphore
 	}()
 	var clusters []string
-	var role string
 
-	clusters, err := m.listClusters(r)
+	clusters, err := sdk.CachedEKSListClusters(m.EKSClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
+		return
 	}
 
 	for _, clusterName := range clusters {
-		clusterDetails, err := m.describeCluster(clusterName, r)
+		var role string
+		var oidc string = ""
+		var publicEndpoint = ""
+		clusterDetails, err := sdk.CachedEKSDescribeCluster(m.EKSClient, aws.ToString(m.Caller.Account), clusterName, r)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
@@ -321,20 +334,25 @@ func (m *EKSModule) getEKSRecordsPerRegion(r string, wg *sync.WaitGroup, semapho
 
 		//nodeGroups = append(nodeGroups, DescribeCluster.Cluster.)
 		endpoint := aws.ToString(clusterDetails.Endpoint)
-		oidc := aws.ToString(clusterDetails.Identity.Oidc.Issuer)
-		publicEndpoint := strconv.FormatBool(clusterDetails.ResourcesVpcConfig.EndpointPublicAccess)
+		if clusterDetails.Identity != nil && clusterDetails.Identity.Oidc != nil {
+			oidc = aws.ToString(clusterDetails.Identity.Oidc.Issuer)
+
+		}
+		if clusterDetails.ResourcesVpcConfig != nil {
+			publicEndpoint = strconv.FormatBool(clusterDetails.ResourcesVpcConfig.EndpointPublicAccess)
+		}
 		// if DescribeCluster.Cluster.ResourcesVpcConfig.PublicAccessCidrs[0] == "0.0.0.0/0" {
 		// 	publicCIDRs := "0.0.0.0/0"
 		// } else {
 		// 	publicCIDRs := "specific IPs"
 		// }
 
-		ListNodeGroups := m.listNodeGroups(clusterName, r)
+		ListNodeGroups, err := sdk.CachedEKSListNodeGroups(m.EKSClient, aws.ToString(m.Caller.Account), clusterName, r)
 
 		if len(ListNodeGroups) > 0 {
 			for _, nodeGroup := range ListNodeGroups {
 
-				nodeGroupDetails, err := m.describeNodegroup(clusterName, nodeGroup, r)
+				nodeGroupDetails, err := sdk.CachedEKSDescribeNodeGroup(m.EKSClient, aws.ToString(m.Caller.Account), clusterName, nodeGroup, r)
 				if err != nil {
 					m.modLog.Error(err.Error())
 					m.CommandCounter.Error++
@@ -375,109 +393,3 @@ func (m *EKSModule) getEKSRecordsPerRegion(r string, wg *sync.WaitGroup, semapho
 	}
 
 }
-
-func (m *EKSModule) listClusters(r string) ([]string, error) {
-	var PaginationControl *string
-	var clusters []string
-
-	for {
-		ListClusters, err := m.EKSClientListClustersInterface.ListClusters(
-			context.TODO(),
-			&eks.ListClustersInput{
-				NextToken: PaginationControl,
-			},
-			func(o *eks.Options) {
-				o.Region = r
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			return clusters, err
-		}
-
-		clusters = append(clusters, ListClusters.Clusters...)
-		// The "NextToken" value is nil when there's no more data to return.
-		if ListClusters.NextToken != nil {
-			PaginationControl = ListClusters.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
-	}
-	return clusters, nil
-}
-
-func (m *EKSModule) listNodeGroups(clusterName string, r string) []string {
-	var PaginationControl *string
-	var nodeGroups []string
-	for {
-		ListNodeGroups, err := m.EKSClientListNodeGroupsInterface.ListNodegroups(
-			context.TODO(),
-			&eks.ListNodegroupsInput{
-				ClusterName: &clusterName,
-				NextToken:   PaginationControl,
-			},
-			func(o *eks.Options) {
-				o.Region = r
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		nodeGroups = append(nodeGroups, ListNodeGroups.Nodegroups...)
-		if ListNodeGroups.NextToken != nil {
-			PaginationControl = ListNodeGroups.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
-
-	}
-	return nodeGroups
-}
-
-func (m *EKSModule) describeCluster(clusterName string, r string) (*types.Cluster, error) {
-
-	var err error
-	//var clusterDetails types.Cluster
-	DescribeCluster, err := m.EKSClientDescribeClusterInterface.DescribeCluster(
-		context.TODO(),
-		&eks.DescribeClusterInput{
-			Name: &clusterName,
-		},
-		func(o *eks.Options) {
-			o.Region = r
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-	}
-
-	return DescribeCluster.Cluster, err
-
-}
-
-func (m *EKSModule) describeNodegroup(clusterName string, nodeGroup string, r string) (*types.Nodegroup, error) {
-	DescribeNodegroup, err := m.EKSClientDescribeNodeGroupInterface.DescribeNodegroup(
-		context.TODO(),
-		&eks.DescribeNodegroupInput{
-			ClusterName:   &clusterName,
-			NodegroupName: &nodeGroup,
-		},
-		func(o *eks.Options) {
-			o.Region = r
-		},
-	)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-
-	}
-	return DescribeNodegroup.Nodegroup, err
-}

aws/eks_test.go

@@ -12,22 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-type MockedEKSClientListClusters struct {
+type MockedEKSClientInterface struct {
 }
 
-type MockedEKSClientDescribeCluster struct {
-}
-
-type MockedEKSClientListNodegroups struct {
-}
-
-type MockedEKSClientDescribeNodegroup struct {
-}
-
-type MockedIAMSimulatePrincipalPolicy struct {
-}
-
-func (m *MockedEKSClientListClusters) ListClusters(ctx context.Context, params *eks.ListClustersInput, optFns ...func(*eks.Options)) (*eks.ListClustersOutput, error) {
+func (m *MockedEKSClientInterface) ListClusters(ctx context.Context, params *eks.ListClustersInput, optFns ...func(*eks.Options)) (*eks.ListClustersOutput, error) {
 	testClusters := []string{}
 	testClusters = append(testClusters, "test1")
 
@@ -38,7 +26,7 @@ func (m *MockedEKSClientListClusters) ListClusters(ctx context.Context, params *
 	return testListClustersOutput, nil
 }
 
-func (m *MockedEKSClientDescribeCluster) DescribeCluster(context.Context, *eks.DescribeClusterInput, ...func(*eks.Options)) (*eks.DescribeClusterOutput, error) {
+func (m *MockedEKSClientInterface) DescribeCluster(context.Context, *eks.DescribeClusterInput, ...func(*eks.Options)) (*eks.DescribeClusterOutput, error) {
 	testIdentity := types.Identity{
 		Oidc: &types.OIDC{
 			Issuer: aws.String("abc123"),
@@ -61,7 +49,7 @@ func (m *MockedEKSClientDescribeCluster) DescribeCluster(context.Context, *eks.D
 	return testDescribeClusterOutput, nil
 }
 
-func (m *MockedEKSClientListNodegroups) ListNodegroups(ctx context.Context, params *eks.ListNodegroupsInput, optFns ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error) {
+func (m *MockedEKSClientInterface) ListNodegroups(ctx context.Context, params *eks.ListNodegroupsInput, optFns ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error) {
 	testNodegroups := []string{}
 	testNodegroups = append(testNodegroups, "test1")
 
@@ -72,7 +60,7 @@ func (m *MockedEKSClientListNodegroups) ListNodegroups(ctx context.Context, para
 	return testListNodegroupsOutput, nil
 }
 
-func (m *MockedEKSClientDescribeNodegroup) DescribeNodegroup(context.Context, *eks.DescribeNodegroupInput, ...func(*eks.Options)) (*eks.DescribeNodegroupOutput, error) {
+func (m *MockedEKSClientInterface) DescribeNodegroup(context.Context, *eks.DescribeNodegroupInput, ...func(*eks.Options)) (*eks.DescribeNodegroupOutput, error) {
 	testNodegroup := types.Nodegroup{}
 	testNodegroup.NodeRole = aws.String("roleABC")
 	testDescribeNodegroupOutput := &eks.DescribeNodegroupOutput{
@@ -95,10 +83,7 @@ func TestEks(t *testing.T) {
 			outputDirectory: ".",
 			verbosity:       2,
 			testModule: EKSModule{
-				EKSClientListClustersInterface:      &MockedEKSClientListClusters{},
-				EKSClientDescribeClusterInterface:   &MockedEKSClientDescribeCluster{},
-				EKSClientListNodeGroupsInterface:    &MockedEKSClientListNodegroups{},
-				EKSClientDescribeNodeGroupInterface: &MockedEKSClientDescribeNodegroup{},
+				EKSClient: &MockedEKSClientInterface{},
 				//IAMSimulatePrincipalPolicyClient:    iam.SimulatePrincipalPolicyAPIClient,
 				Caller:         sts.GetCallerIdentityOutput{Arn: aws.String("test")},
 				OutputFormat:   "table",

aws/elastic-network-interfaces.go

@@ -1,16 +1,15 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
@@ -18,8 +17,7 @@ import (
 )
 
 type ElasticNetworkInterfacesModule struct {
-	//EC2Client                       *ec2.Client
-	DescribeNetworkInterfacesClient ec2.DescribeNetworkInterfacesAPIClient
+	EC2Client sdk.AWSEC2ClientInterface
 
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
@@ -84,7 +82,7 @@ func (m *ElasticNetworkInterfacesModule) ElasticNetworkInterfaces(outputFormat s
 	receiverDone <- true
 	<-receiverDone
 
-	m.printENIsData(outputFormat, outputDirectory, dataReceiver)
+	m.printENIsData(outputFormat, outputDirectory, dataReceiver, verbosity)
 
 }
 
@@ -101,7 +99,7 @@ func (m *ElasticNetworkInterfacesModule) Receiver(receiver chan MappedENI, recei
 	}
 }
 
-func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outputDirectory string, dataReceiver chan MappedENI) {
+func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outputDirectory string, dataReceiver chan MappedENI, verbosity int) {
 	m.output.Headers = []string{
 		"ID",
 		"Type",
@@ -126,11 +124,27 @@ func (m *ElasticNetworkInterfacesModule) printENIsData(outputFormat string, outp
 		)
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 
-		m.writeLoot(m.output.FilePath)
+		//m.writeLoot(m.output.FilePath)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName)
 		fmt.Printf("[%s][%s] %s elastic network interfaces found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -197,50 +211,45 @@ func (m *ElasticNetworkInterfacesModule) executeChecks(r string, wg *sync.WaitGr
 }
 
 func (m *ElasticNetworkInterfacesModule) getDescribeNetworkInterfaces(region string, dataReceiver chan MappedENI) {
-	var PaginationControl *string
-	for {
-		DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
-			context.TODO(),
-			&(ec2.DescribeNetworkInterfacesInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *ec2.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
 
-		for _, eni := range DescribeNetworkInterfaces.NetworkInterfaces {
-			status := string(eni.Status)
-			if status == "available" {
-				continue // unused ENI
-			}
-
-			mappedENI := MappedENI{
-				ID:               aws.ToString(eni.NetworkInterfaceId),
-				Type:             string(eni.InterfaceType),
-				ExternalIP:       getPublicIPOfElasticNetworkInterface(eni),
-				PrivateIP:        aws.ToString(eni.PrivateIpAddress),
-				VPCID:            aws.ToString(eni.VpcId),
-				AttachedInstance: getAttachmentInstanceOfElasticNetworkInterface(eni),
-				Description:      aws.ToString(eni.Description),
-			}
-
-			dataReceiver <- mappedENI
-		}
-
-		if DescribeNetworkInterfaces.NextToken != nil {
-			PaginationControl = DescribeNetworkInterfaces.NextToken
-		} else {
-			PaginationControl = nil
-			break
-		}
+	NetworkInterfaces, err := sdk.CachedEC2DescribeNetworkInterfaces(m.EC2Client, aws.ToString(m.Caller.Account), region)
 
+	// var PaginationControl *string
+	// for {
+	// 	DescribeNetworkInterfaces, err := m.DescribeNetworkInterfacesClient.DescribeNetworkInterfaces(
+	// 		context.TODO(),
+	// 		&(ec2.DescribeNetworkInterfacesInput{
+	// 			NextToken: PaginationControl,
+	// 		}),
+	// 		func(o *ec2.Options) {
+	// 			o.Region = region
+	// 		},
+	// 	)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	for _, eni := range NetworkInterfaces {
+		status := string(eni.Status)
+		if status == "available" {
+			continue // unused ENI
+		}
+
+		mappedENI := MappedENI{
+			ID:               aws.ToString(eni.NetworkInterfaceId),
+			Type:             string(eni.InterfaceType),
+			ExternalIP:       getPublicIPOfElasticNetworkInterface(eni),
+			PrivateIP:        aws.ToString(eni.PrivateIpAddress),
+			VPCID:            aws.ToString(eni.VpcId),
+			AttachedInstance: getAttachmentInstanceOfElasticNetworkInterface(eni),
+			Description:      aws.ToString(eni.Description),
+		}
+
+		dataReceiver <- mappedENI
+	}
+
 }
 
 func getPublicIPOfElasticNetworkInterface(elasticNetworkInterface types.NetworkInterface) string {

aws/elastic-network-interfaces_test.go

@@ -1,48 +1,59 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
-	"log"
 	"testing"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/ec2"
-	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
-type mockedDescribeNetworkInterfacesClient2 struct {
-	describeNetworkInterfaces DescribeNetworkInterfaces
-}
+func TestElasticNetworkInterfaces(t *testing.T) {
 
-func (c *mockedDescribeNetworkInterfacesClient2) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
-	var nics []ec2types.NetworkInterface
-	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
-	if err != nil {
-		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
+	m := ElasticNetworkInterfacesModule{
+		AWSProfile: "default",
+		AWSRegions: []string{"us-east-1", "us-west-1"},
+		Caller:     sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
+		EC2Client:  &sdk.MockedEC2Client2{},
 	}
-	for _, mockednic := range c.describeNetworkInterfaces.NetworkInterfaces {
-		nics = append(nics, ec2types.NetworkInterface{
-			Association: &ec2types.NetworkInterfaceAssociation{
-				PublicIp: aws.String(mockednic.Association.PublicIP),
+
+	//m.ElasticNetworkInterfaces("table", ".", 3)
+	subtests := []struct {
+		name           string
+		testModule     ElasticNetworkInterfacesModule
+		expectedResult []MappedENI
+	}{
+		{
+			name:       "Test ElasticNetworkInterfaces",
+			testModule: m,
+			expectedResult: []MappedENI{
+				{
+					PrivateIP:  "10.0.1.17",
+					ExternalIP: "203.0.113.12",
+				},
+				{
+					PrivateIP:  "10.0.1.149",
+					ExternalIP: "198.51.100.0",
+				},
 			},
-			NetworkInterfaceId: aws.String(mockednic.NetworkInterfaceID),
-			PrivateIpAddress:   aws.String(mockednic.PrivateIPAddress),
-			VpcId:              aws.String(mockednic.VpcID),
-			Attachment:         &ec2types.NetworkInterfaceAttachment{InstanceId: aws.String(mockednic.Attachment.InstanceID)},
-			Description:        aws.String(mockednic.Description),
+		},
+	}
+	internal.MockFileSystem(true)
+	for _, subtest := range subtests {
+		t.Run(subtest.name, func(t *testing.T) {
+			subtest.testModule.ElasticNetworkInterfaces("table", ".", 3)
+			for index, expectedTask := range subtest.expectedResult {
+				if expectedTask.ExternalIP != subtest.testModule.MappedENIs[index].ExternalIP {
+					t.Errorf("expected %s, got %s", expectedTask.ExternalIP, subtest.testModule.MappedENIs[index].ExternalIP)
+				}
+				if expectedTask.PrivateIP != subtest.testModule.MappedENIs[index].PrivateIP {
+					t.Errorf("expected %s, got %s", expectedTask.PrivateIP, subtest.testModule.MappedENIs[index].PrivateIP)
+				}
+
+			}
 		})
 	}
-	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
-}
-
-func TestElasticNetworkInterfaces(t *testing.T) {
-	m := ElasticNetworkInterfacesModule{
-		AWSProfile:                      "default",
-		AWSRegions:                      []string{"us-east-1", "us-west-1"},
-		Caller:                          sts.GetCallerIdentityOutput{Arn: aws.String("arn:aws:iam::123456789012:user/cloudfox_unit_tests")},
-		DescribeNetworkInterfacesClient: &mockedDescribeNetworkInterfacesClient2{},
-	}
-	m.ElasticNetworkInterfaces("table", ".", 3)
 }

aws/env-vars.go

@@ -8,6 +8,7 @@ import (
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/apprunner"
@@ -139,10 +140,25 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
 	}
 	if len(m.output.Body) > 0 {
 
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
 		fmt.Printf("[%s][%s] %s environment variables found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -328,38 +344,18 @@ func (m *EnvsModule) getLambdaEnvironmentVariablesPerRegion(region string, wg *s
 	// m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationMarker *string
 
-	// This for loop exits at the end dependeding on whether the output hits its last page (see pagination control block at the end of the loop).
-	for {
-		functions, err := m.LambdaClient.ListFunctions(
-			context.TODO(),
-			&lambda.ListFunctionsInput{
-				Marker: PaginationMarker,
-			},
-			func(o *lambda.Options) {
-				o.Region = region
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		for _, function := range functions.Functions {
-			m.getLambdaEnvironmentVariablesPerFunction(function, region, dataReceiver)
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if functions.NextMarker != nil {
-			PaginationMarker = functions.NextMarker
-		} else {
-			PaginationMarker = nil
-			break
-		}
+	Functions, err := sdk.CachedLambdaListFunctions(m.LambdaClient, aws.ToString(m.Caller.Account), region)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	for _, function := range Functions {
+		m.getLambdaEnvironmentVariablesPerFunction(function, region, dataReceiver)
+	}
+
 }
 
 func (m *EnvsModule) getLambdaEnvironmentVariablesPerFunction(function lambdaTypes.FunctionConfiguration, region string, dataReceiver chan EnvironmentVariable) {
@@ -390,69 +386,51 @@ func (m *EnvsModule) getAppRunnerEnvironmentVariablesPerRegion(r string, wg *syn
 	// m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
 
-	for {
-		ListServices, err := m.AppRunnerClient.ListServices(
-			context.TODO(),
-			&(apprunner.ListServicesInput{
-				NextToken: PaginationControl,
-			}),
-			func(o *apprunner.Options) {
-				o.Region = r
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-		if len(ListServices.ServiceSummaryList) > 0 {
+	ServiceSummaryList, err := sdk.CachedAppRunnerListServices(m.AppRunnerClient, aws.ToString(m.Caller.Account), r)
 
-			for _, service := range ListServices.ServiceSummaryList {
-				name := aws.ToString(service.ServiceName)
-				arn := aws.ToString(service.ServiceArn)
-				awsService := "App Runner"
+	if err != nil {
+		//modLog.Error(err.Error())
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+	if len(ServiceSummaryList) > 0 {
 
-				DescribeService, err := m.AppRunnerClient.DescribeService(
-					context.TODO(),
-					&apprunner.DescribeServiceInput{
-						ServiceArn: &arn,
-					},
-					func(o *apprunner.Options) {
-						o.Region = r
-					},
-				)
-				if err != nil {
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
+		for _, service := range ServiceSummaryList {
+			name := aws.ToString(service.ServiceName)
+			arn := aws.ToString(service.ServiceArn)
+			awsService := "App Runner"
 
-				}
-
-				if len(DescribeService.Service.SourceConfiguration.ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables) > 0 {
-					for k, v := range DescribeService.Service.SourceConfiguration.ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables {
-						//fmt.Printf("%s - %s", k, v)
-						dataReceiver <- EnvironmentVariable{
-							service:             awsService,
-							name:                name,
-							region:              r,
-							environmentVarName:  k,
-							environmentVarValue: v,
-						}
-					}
-				}
+			DescribeService, err := m.AppRunnerClient.DescribeService(
+				context.TODO(),
+				&apprunner.DescribeServiceInput{
+					ServiceArn: &arn,
+				},
+				func(o *apprunner.Options) {
+					o.Region = r
+				},
+			)
+			if err != nil {
+				m.modLog.Error(err.Error())
+				m.CommandCounter.Error++
+				break
 
 			}
-		}
 
-		// The "NextToken" value is nil when there's no more data to return.
-		if ListServices.NextToken != nil {
-			PaginationControl = ListServices.NextToken
-		} else {
-			PaginationControl = nil
-			break
+			if len(DescribeService.Service.SourceConfiguration.ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables) > 0 {
+				for k, v := range DescribeService.Service.SourceConfiguration.ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables {
+					//fmt.Printf("%s - %s", k, v)
+					dataReceiver <- EnvironmentVariable{
+						service:             awsService,
+						name:                name,
+						region:              r,
+						environmentVarName:  k,
+						environmentVarValue: v,
+					}
+				}
+			}
+
 		}
 	}
 }
@@ -473,13 +451,7 @@ func (m *EnvsModule) getLightsailEnvironmentVariablesPerRegion(r string, wg *syn
 	m.CommandCounter.Executing++
 	awsService := "Lightsail [Container]"
 
-	GetContainerServices, err := m.LightsailClient.GetContainerServices(
-		context.TODO(),
-		&(lightsail.GetContainerServicesInput{}),
-		func(o *lightsail.Options) {
-			o.Region = r
-		},
-	)
+	ContainerServices, err := sdk.CachedLightsailGetContainerServices(m.LightsailClient, aws.ToString(m.Caller.Account), r)
 
 	if err != nil {
 		m.modLog.Error(err.Error())
@@ -489,9 +461,9 @@ func (m *EnvsModule) getLightsailEnvironmentVariablesPerRegion(r string, wg *syn
 
 	if err == nil {
 
-		if len(GetContainerServices.ContainerServices) > 0 {
+		if len(ContainerServices) > 0 {
 
-			for _, containerService := range GetContainerServices.ContainerServices {
+			for _, containerService := range ContainerServices {
 				for _, container := range containerService.CurrentDeployment.Containers {
 					for k, v := range container.Environment {
 						name := aws.ToString(containerService.ContainerServiceName)

aws/filesystems.go

@@ -9,19 +9,18 @@ import (
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/efs"
+	"github.com/aws/aws-sdk-go-v2/service/efs/types"
 	"github.com/aws/aws-sdk-go-v2/service/fsx"
 	fsxTypes "github.com/aws/aws-sdk-go-v2/service/fsx/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/awsservicemap"
-	"github.com/fatih/color"
 	"github.com/sirupsen/logrus"
 )
 
-var green = color.New(color.FgGreen).SprintFunc()
-
 type FilesystemsModule struct {
 	// General configuration data
 
@@ -53,6 +52,7 @@ type FilesystemObject struct {
 	IP          string
 	Policy      string
 	MountTarget string
+	Permissions string
 }
 
 func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirectory string, verbosity int) {
@@ -114,6 +114,7 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 		//"IP",
 		"Mount Target",
 		"Policy",
+		"Permissions",
 	}
 
 	// Table rows
@@ -128,17 +129,34 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
 				//m.Filesystems[i].IP,
 				m.Filesystems[i].MountTarget,
 				m.Filesystems[i].Policy,
+				m.Filesystems[i].Permissions,
 			},
 		)
 
 	}
 	if len(m.output.Body) > 0 {
 
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s filesystems found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -183,7 +201,8 @@ func (m *FilesystemsModule) writeLoot(outputDirectory string, verbosity int) {
 	path := filepath.Join(outputDirectory, "loot")
 	err := os.MkdirAll(path, os.ModePerm)
 	if err != nil {
-		m.modLog.Error(err.Error())
+		sharedLogger.Error(err.Error())
+
 		m.CommandCounter.Error++
 	}
 	f := filepath.Join(path, "filesystems-mount-commands.txt")
@@ -194,8 +213,8 @@ func (m *FilesystemsModule) writeLoot(outputDirectory string, verbosity int) {
 		switch m.Filesystems[i].AWSService {
 		case "EFS":
 			out = out + fmt.Sprintf("##########  Mount instructions for %s - %s ##########\n", m.Filesystems[i].AWSService, m.Filesystems[i].Name)
-			out = out + fmt.Sprintf("mkdir -p /efs/%s/\n", m.Filesystems[i].MountTarget)
-			out = out + fmt.Sprintf("sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport %s:/ /efs/%s\n\n", m.Filesystems[i].DnsName, m.Filesystems[i].MountTarget)
+			out = out + fmt.Sprintf("mkdir -p /efs%s/\n", m.Filesystems[i].MountTarget)
+			out = out + fmt.Sprintf("sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport %s:/ /efs%s\n\n", m.Filesystems[i].DnsName, m.Filesystems[i].MountTarget)
 		case "FSx [LUSTRE]":
 			out = out + fmt.Sprintf("##########  Mount instructions for %s - %s ##########\n", m.Filesystems[i].AWSService, m.Filesystems[i].Name)
 			out = out + fmt.Sprintln("#sudo amazon-linux-extras install -y lustre2.10")
@@ -220,7 +239,8 @@ func (m *FilesystemsModule) writeLoot(outputDirectory string, verbosity int) {
 
 	err = os.WriteFile(f, []byte(out), 0644)
 	if err != nil {
-		m.modLog.Error(err.Error())
+		sharedLogger.Error(err.Error())
+
 		m.CommandCounter.Error++
 	}
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), f)
@@ -243,94 +263,75 @@ func (m *FilesystemsModule) getEFSSharesPerRegion(r string, wg *sync.WaitGroup,
 	m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationMarker *string
-	var PaginationMarker2 *string
-
 	var policy string
-	// This for loop exits at the end dependeding on whether the output hits its last page (see pagination control block at the end of the loop).
-	for {
-		DescribeFileSystems, err := m.EFSClient.DescribeFileSystems(
+
+	DescribeFileSystems, err := sdk.CachedDescribeFileSystems(m.EFSClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, filesystem := range DescribeFileSystems {
+		name := filesystem.Name
+		id := aws.ToString(filesystem.FileSystemId)
+
+		_, err := m.EFSClient.DescribeFileSystemPolicy(
 			context.TODO(),
-			&efs.DescribeFileSystemsInput{
-				Marker: PaginationMarker,
+			&efs.DescribeFileSystemPolicyInput{
+				FileSystemId: filesystem.FileSystemId,
 			},
 			func(o *efs.Options) {
 				o.Region = r
 			},
 		)
 		if err != nil {
-			m.modLog.Error(err.Error())
+			policy = "Default (No IAM auth)"
+		} else {
+			policy = "IAM Authenticated"
+		}
+
+		DescribeMountTargets, err := sdk.CachedDescribeMountTargets(m.EFSClient, aws.ToString(m.Caller.Account), r, id)
+		if err != nil {
+			sharedLogger.Error(err.Error())
 			m.CommandCounter.Error++
 			break
 		}
 
-		for _, filesystem := range DescribeFileSystems.FileSystems {
-			name := filesystem.Name
-			id := filesystem.FileSystemId
-			//dnsName := fmt.Sprintf("%s.efs.%s.amazonaws.com", *id, r)
+		for _, mountTarget := range DescribeMountTargets {
+			ip := *mountTarget.IpAddress
+			mountTarget := aws.ToString(mountTarget.MountTargetId)
+			awsService := "EFS"
 
-			_, err := m.EFSClient.DescribeFileSystemPolicy(
-				context.TODO(),
-				&efs.DescribeFileSystemPolicyInput{
-					FileSystemId: id,
-				},
-				func(o *efs.Options) {
-					o.Region = r
-				},
-			)
+			accessPoints, err := sdk.CachedDescribeAccessPoints(m.EFSClient, aws.ToString(m.Caller.Account), r, id)
 			if err != nil {
-				policy = "Default (No IAM auth)"
-			}
+				sharedLogger.Error(err.Error())
 
-			for {
-				DescribeMountTargets, err := m.EFSClient.DescribeMountTargets(
-					context.TODO(),
-					&efs.DescribeMountTargetsInput{
-						FileSystemId: id,
-						Marker:       PaginationMarker2,
-					},
-					func(o *efs.Options) {
-						o.Region = r
-					},
-				)
-				if err != nil {
-					m.modLog.Error(err.Error())
-					m.CommandCounter.Error++
-					break
-				}
-				for _, mountTarget := range DescribeMountTargets.MountTargets {
-					mountTargetId := mountTarget.MountTargetId
-					ip := *mountTarget.IpAddress
-					awsService := "EFS"
-
-					dataReceiver <- FilesystemObject{
-						AWSService:  awsService,
-						Region:      r,
-						Name:        aws.ToString(name),
-						DnsName:     ip,
-						Policy:      policy,
-						MountTarget: aws.ToString(mountTargetId),
-					}
-				}
-				if DescribeMountTargets.NextMarker != nil {
-					PaginationMarker2 = DescribeMountTargets.NextMarker
-				} else {
-					PaginationMarker2 = nil
-					break
+				m.CommandCounter.Error++
+				dataReceiver <- FilesystemObject{
+					AWSService:  awsService,
+					Region:      r,
+					Name:        aws.ToString(name),
+					DnsName:     ip,
+					Policy:      policy,
+					MountTarget: mountTarget,
+					Permissions: "access denied",
 				}
 			}
 
-			//awsService := fmt.Sprintf("EFS [%s]", fsType)
+			for _, accessPoint := range accessPoints {
+				path, permissions := m.getEFSfilesystemPermissions(accessPoint)
+				dataReceiver <- FilesystemObject{
+					AWSService:  awsService,
+					Region:      r,
+					Name:        aws.ToString(name),
+					DnsName:     ip,
+					Policy:      policy,
+					MountTarget: path,
+					Permissions: permissions,
+				}
 
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if DescribeFileSystems.NextMarker != nil {
-			PaginationMarker = DescribeFileSystems.NextMarker
-		} else {
-			PaginationMarker = nil
-			break
+			}
 		}
 	}
 
@@ -365,7 +366,8 @@ func (m *FilesystemsModule) getFSxSharesPerRegion(r string, wg *sync.WaitGroup,
 			},
 		)
 		if err != nil {
-			m.modLog.Error(err.Error())
+			sharedLogger.Error(err.Error())
+
 			m.CommandCounter.Error++
 			break
 		}
@@ -480,3 +482,16 @@ func (m *FilesystemsModule) getFSxSharesPerRegion(r string, wg *sync.WaitGroup,
 	}
 
 }
+
+func (m *FilesystemsModule) getEFSfilesystemPermissions(accessPoint types.AccessPointDescription) (string, string) {
+	var path string
+	var permissions string
+
+	if accessPoint.AccessPointId != nil && accessPoint.RootDirectory != nil && accessPoint.RootDirectory.CreationInfo != nil {
+		path = aws.ToString(accessPoint.RootDirectory.Path)
+		permissions = aws.ToString(accessPoint.RootDirectory.CreationInfo.Permissions)
+		return path, permissions
+	}
+	return "", ""
+
+}

aws/iam-simulator.go

@@ -10,6 +10,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
@@ -19,10 +20,7 @@ import (
 
 type IamSimulatorModule struct {
 	// General configuration data
-	IAMSimulatePrincipalPolicyClient iam.SimulatePrincipalPolicyAPIClient
-	IAMListUsersClient               iam.ListUsersAPIClient
-	IAMListRolesClient               iam.ListRolesAPIClient
-
+	IAMClient    sdk.AWSIAMClientInterface
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
 	OutputFormat string
@@ -75,7 +73,7 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
 		"module": m.output.CallingModule,
 	})
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 	var actionList []string
 	var pmapperCommands []string
 	var pmapperOutFileName string
@@ -173,15 +171,30 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
 		fmt.Printf("[%s][%s] We suggest running the pmapper commands in the loot file to get the same information but taking privesc paths into account.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 		// fmt.Printf("[%s]\t\tpmapper --profile %s graph create\n", cyan(m.output.CallingModule),  cyan(m.AWSProfile), m.AWSProfile)
 		// for _, line := range pmapperCommands {
 		// 	fmt.Printf("[%s]\t\t%s", cyan(m.output.CallingModule),  cyan(m.AWSProfile), line)
 		// }
-		m.writeLoot(m.output.FilePath, verbosity, pmapperCommands)
+		m.writeLoot(o.Table.DirectoryName, verbosity, pmapperCommands)
 
 	} else if principal != "" || action != "" {
 		fmt.Printf("[%s][%s] No allowed permissions identified, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -249,47 +262,31 @@ func (m *IamSimulatorModule) getIAMUsers(wg *sync.WaitGroup, actions []string, r
 	m.CommandCounter.Total++
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
 
-	for {
-		ListUsers, err := m.IAMListUsersClient.ListUsers(
-			context.TODO(),
-			&iam.ListUsersInput{
-				Marker: PaginationControl,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
+	ListUsers, err := sdk.CachedIamListUsers(m.IAMClient, aws.ToString(m.Caller.Account))
 
-		for _, user := range ListUsers.Users {
-			//name := user.UserName
-			principal := user.Arn
-			adminCheckResult := m.isPrincipalAnAdmin(principal)
-			if adminCheckResult {
-				query := "Appears to be an administrator"
-				dataReceiver <- SimulatorResult{
-					AWSService: "IAM",
-					Principal:  aws.ToString(principal),
-					Query:      query,
-					Decision:   "",
-				}
-			} else {
-				m.getPolicySimulatorResult(principal, actions, resource, dataReceiver)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	for _, user := range ListUsers {
+		//name := user.UserName
+		principal := user.Arn
+		adminCheckResult := m.isPrincipalAnAdmin(principal)
+		if adminCheckResult {
+			query := "Appears to be an administrator"
+			dataReceiver <- SimulatorResult{
+				AWSService: "IAM",
+				Principal:  aws.ToString(principal),
+				Query:      query,
+				Decision:   "",
 			}
-
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if ListUsers.Marker != nil {
-			PaginationControl = ListUsers.Marker
 		} else {
-			PaginationControl = nil
-			break
+			m.getPolicySimulatorResult(principal, actions, resource, dataReceiver)
 		}
+
 	}
 
 }
@@ -304,99 +301,66 @@ func (m *IamSimulatorModule) getIAMRoles(wg *sync.WaitGroup, actions []string, r
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
 	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
 
-	for {
-		ListRoles, err := m.IAMListRolesClient.ListRoles(
-			context.TODO(),
-			&iam.ListRolesInput{
-				Marker: PaginationControl,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
+	ListRoles, err := sdk.CachedIamListRoles(m.IAMClient, aws.ToString(m.Caller.Account))
 
-		for _, role := range ListRoles.Roles {
-			//name := user.UserName
-			principal := role.Arn
-			adminCheckResult := m.isPrincipalAnAdmin(principal)
-			if adminCheckResult {
-				query := "Appears to be an administrator"
-				dataReceiver <- SimulatorResult{
-					AWSService: "IAM",
-					Principal:  aws.ToString(principal),
-					Query:      query,
-					Decision:   "",
-				}
-			} else {
-				m.getPolicySimulatorResult(principal, actions, resource, dataReceiver)
-			}
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if ListRoles.Marker != nil {
-			PaginationControl = ListRoles.Marker
-		} else {
-			PaginationControl = nil
-			break
-		}
 	}
+
+	for _, role := range ListRoles {
+		//name := user.UserName
+		principal := role.Arn
+		adminCheckResult := m.isPrincipalAnAdmin(principal)
+		if adminCheckResult {
+			query := "Appears to be an administrator"
+			dataReceiver <- SimulatorResult{
+				AWSService: "IAM",
+				Principal:  aws.ToString(principal),
+				Query:      query,
+				Decision:   "",
+			}
+		} else {
+			m.getPolicySimulatorResult(principal, actions, resource, dataReceiver)
+		}
+
+	}
+
 }
 
 func (m *IamSimulatorModule) getPolicySimulatorResult(principal *string, actionNames []string, resource string, dataReceiver chan SimulatorResult) {
-	var PaginationControl2 *string
-
 	//var policySourceArn = "*"
 	//var arn *string
 	var resourceArns []string
 	resourceArns = append(resourceArns, resource)
 	//var resourceArns = []string{"*"}
 
-	for {
-		SimulatePrincipalPolicy, err := m.IAMSimulatePrincipalPolicyClient.SimulatePrincipalPolicy(
-			context.TODO(),
-			&iam.SimulatePrincipalPolicyInput{
-				Marker:          PaginationControl2,
-				ActionNames:     actionNames,
-				PolicySourceArn: principal,
-				ResourceArns:    resourceArns,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			m.modLog.Error(fmt.Sprintf("Failed to query actions for %s\n\n", aws.ToString(principal)))
+	EvaluationResults, err := sdk.CachedIamSimulatePrincipalPolicy(m.IAMClient, aws.ToString(m.Caller.Account), principal, actionNames, resourceArns)
 
-			break
-		}
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		m.modLog.Error(fmt.Sprintf("Failed to query actions for %s\n\n", aws.ToString(principal)))
+		return
+	}
 
-		for _, result := range SimulatePrincipalPolicy.EvaluationResults {
-			evalName := result.EvalActionName
-			query := fmt.Sprintf("can %s on %s", *evalName, resource)
-			decision := result.EvalDecision
-			if decision == "allowed" {
-				dataReceiver <- SimulatorResult{
-					AWSService: "IAM",
-					Principal:  aws.ToString(principal),
-					Query:      query,
-					Decision:   string(decision),
-				}
+	for _, result := range EvaluationResults {
+		evalName := result.EvalActionName
+		query := fmt.Sprintf("can %s on %s", *evalName, resource)
+		decision := result.EvalDecision
+		if decision == "allowed" {
+			dataReceiver <- SimulatorResult{
+				AWSService: "IAM",
+				Principal:  aws.ToString(principal),
+				Query:      query,
+				Decision:   string(decision),
 			}
 		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if SimulatePrincipalPolicy.Marker != nil {
-			PaginationControl2 = SimulatePrincipalPolicy.Marker
-		} else {
-			PaginationControl2 = nil
-			break
-		}
-
 	}
+
 }
 
 func (m *IamSimulatorModule) isPrincipalAnAdmin(principal *string) bool {
@@ -412,7 +376,7 @@ func (m *IamSimulatorModule) isPrincipalAnAdmin(principal *string) bool {
 		"ssm:GetDocument",
 	}
 	for {
-		SimulatePrincipalPolicy, err := m.IAMSimulatePrincipalPolicyClient.SimulatePrincipalPolicy(
+		SimulatePrincipalPolicy, err := m.IAMClient.SimulatePrincipalPolicy(
 			context.TODO(),
 			&iam.SimulatePrincipalPolicyInput{
 				Marker:          PaginationControl2,

aws/instances.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
@@ -23,21 +24,20 @@ import (
 
 type InstancesModule struct {
 	// General configuration data
-	EC2Client                        *ec2.Client
-	IAMSimulatePrincipalPolicyClient iam.SimulatePrincipalPolicyAPIClient
-	IAMListInstanceProfilesClient    iam.ListInstanceProfilesAPIClient
-	Caller                           sts.GetCallerIdentityOutput
-	AWSRegions                       []string
-	OutputFormat                     string
-	Goroutines                       int
-	UserDataAttributesOnly           bool
-	AWSProfile                       string
-	WrapTable                        bool
-	InstanceProfileToRolesMap        map[string][]iamTypes.Role
-	SkipAdminCheck                   bool
-	pmapperMod                       PmapperModule
-	pmapperError                     error
-	iamSimClient                     IamSimulatorModule
+	EC2Client                 *ec2.Client
+	IAMClient                 sdk.AWSIAMClientInterface
+	Caller                    sts.GetCallerIdentityOutput
+	AWSRegions                []string
+	OutputFormat              string
+	Goroutines                int
+	UserDataAttributesOnly    bool
+	AWSProfile                string
+	WrapTable                 bool
+	InstanceProfileToRolesMap map[string][]iamTypes.Role
+	SkipAdminCheck            bool
+	pmapperMod                PmapperModule
+	pmapperError              error
+	iamSimClient              IamSimulatorModule
 
 	// Module's Results
 	MappedInstances []MappedInstance
@@ -93,7 +93,7 @@ func (m *InstancesModule) Instances(filter string, outputFormat string, outputDi
 	// Initialized the tools we'll need to check if any workload roles are admin or can privesc to admin
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMSimulatePrincipalPolicyClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -149,7 +149,7 @@ func (m *InstancesModule) Instances(filter string, outputFormat string, outputDi
 	if m.UserDataAttributesOnly {
 		m.printInstancesUserDataAttributesOnly(outputFormat, outputDirectory, dataReceiver)
 	} else {
-		m.printGeneralInstanceData(outputFormat, outputDirectory, dataReceiver)
+		m.printGeneralInstanceData(outputFormat, outputDirectory, dataReceiver, verbosity)
 	}
 
 }
@@ -173,7 +173,7 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
 	}()
 
 	m.output.CallingModule = "instance-userdata"
-	path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
+	path := filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)), "loot")
 	err := os.MkdirAll(path, os.ModePerm)
 	if err != nil {
 		m.modLog.Error(err.Error())
@@ -203,7 +203,7 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
 	}
 	// only create a file if if there is at least one instance AND at least one instance had user-data.
 	if (len(m.MappedInstances) > 0) && (userDataOut != "=============================================\n") {
-		if m.output.Verbosity > 1 {
+		if m.output.Verbosity > 2 {
 			fmt.Printf("%s", userDataOut)
 		}
 		err = os.WriteFile(userDataFileName, []byte(userDataOut), 0644)
@@ -217,7 +217,7 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
 	}
 }
 
-func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDirectory string, dataReceiver chan MappedInstance) {
+func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDirectory string, dataReceiver chan MappedInstance, verbosity int) {
 	// Prepare Table headers
 	//m.output.Headers = table.Row{
 	if m.pmapperError == nil {
@@ -296,12 +296,28 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
 	}
 
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		////m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
 
-		m.writeLoot(m.output.FilePath)
+		//m.writeLoot(m.output.FilePath)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s instances found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -309,7 +325,7 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
 	}
 }
 
-func (m *InstancesModule) writeLoot(outputDirectory string) {
+func (m *InstancesModule) writeLoot(outputDirectory string, verbosity int) {
 	path := filepath.Join(outputDirectory, "loot")
 	err := os.MkdirAll(path, os.ModePerm)
 	if err != nil {
@@ -318,9 +334,14 @@ func (m *InstancesModule) writeLoot(outputDirectory string) {
 	}
 	privateIPsFilename := filepath.Join(path, "instances-ec2PrivateIPs.txt")
 	publicIPsFilename := filepath.Join(path, "instances-ec2PublicIPs.txt")
+	ssmCommandsFilename := filepath.Join(path, "instances-ssmCommands.txt")
+	ec2InstanceConnectCommandsFilename := filepath.Join(path, "instances-ec2InstanceConnectCommands.txt")
 
 	var publicIPs string
 	var privateIPs string
+	var ssmCommands string
+	var ec2InstanceConnectCommands string
+	var headlineName string
 
 	for _, instance := range m.MappedInstances {
 		if instance.ExternalIP != "NoExternalIP" {
@@ -330,6 +351,32 @@ func (m *InstancesModule) writeLoot(outputDirectory string) {
 			privateIPs = privateIPs + fmt.Sprintln(instance.PrivateIP)
 		}
 
+		if instance.Name != "" {
+			headlineName = fmt.Sprintf("%s/%s", instance.Name, instance.ID)
+		} else {
+			headlineName = fmt.Sprintf("%s", instance.ID)
+		}
+
+		ssmCommands = ssmCommands + fmt.Sprintf("-----------------------------------------------------------------------\n")
+		ssmCommands = ssmCommands + fmt.Sprintf("############## Instance: %s  ##############\n", headlineName)
+		ssmCommands = ssmCommands + fmt.Sprintf("-----------------------------------------------------------------------\n")
+
+		ssmCommands = ssmCommands + fmt.Sprintf("### SSM start-session to %s ###\n", headlineName)
+		ssmCommands = ssmCommands + fmt.Sprintf("# You'll need the AWS CLI session manager plugin installed: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html\n")
+		ssmCommands = ssmCommands + fmt.Sprintf("aws --profile $profile --region %s ssm start-session --target %s\n\n", instance.Region, instance.ID)
+		ssmCommands = ssmCommands + fmt.Sprintf("### SSM send-command to %s ###\n", headlineName)
+		ssmCommands = ssmCommands + fmt.Sprintf("# If you just want to run one command you can use send-command, but really, start-session is way easier\n")
+		ssmCommands = ssmCommands + fmt.Sprintf("aws --profile $profile --region %s ssm send-command --instance-ids %s --document-name AWS-RunShellScript --parameters commands=\"aws sts get-caller-identity\" \n", instance.Region, instance.ID)
+		ssmCommands = ssmCommands + fmt.Sprintf("aws --profile $profile --region %s ssm get-command-invocation --output text --instance-id %s --command-id <command-id-from-previous-command>\n\n", instance.Region, instance.ID)
+
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("-----------------------------------------------------------------------\n")
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("############## Instance: %s  ##############\n", headlineName)
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("-----------------------------------------------------------------------\n")
+
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("### EC2 Instance Connect to %s ###\n", instance.ID)
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("# You'll need to change the --instance-os-user and --ssh-public-key parameters to match your own setup\n")
+		ec2InstanceConnectCommands = ec2InstanceConnectCommands + fmt.Sprintf("aws --profile $profile --region %s ec2-instance-connect send-ssh-public-key --instance-id %s --instance-os-user ec2-user --ssh-public-key file://~/.ssh/id_rsa.pub\n\n", instance.Region, instance.ID)
+
 	}
 	err = os.WriteFile(privateIPsFilename, []byte(privateIPs), 0644)
 	if err != nil {
@@ -341,9 +388,35 @@ func (m *InstancesModule) writeLoot(outputDirectory string) {
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
 	}
+	err = os.WriteFile(ssmCommandsFilename, []byte(ssmCommands), 0644)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
+	err = os.WriteFile(ec2InstanceConnectCommandsFilename, []byte(ec2InstanceConnectCommands), 0644)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), privateIPsFilename)
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), publicIPsFilename)
+	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), ssmCommandsFilename)
+	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), ec2InstanceConnectCommandsFilename)
+
+	if verbosity > 2 {
+		fmt.Println()
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("Loot file for instance command:"))
+		fmt.Printf("Private IPs:\n\n")
+		fmt.Print(privateIPs)
+		fmt.Printf("Public IPs:\n\n")
+		fmt.Print(publicIPs)
+		fmt.Printf("SSM Commands:\n\n")
+		fmt.Print(ssmCommands)
+		fmt.Printf("EC2 Instance Connect Commands:\n\n")
+		fmt.Print(ec2InstanceConnectCommands)
+		fmt.Printf("[%s][%s] %s \n\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), green("End of loot file."))
+	}
 
 }
 
@@ -479,6 +552,7 @@ func (m *InstancesModule) loadInstanceData(instance types.Instance, region strin
 	dataReceiver <- MappedInstance{
 		ID:               aws.ToString(instance.InstanceId),
 		Name:             aws.ToString(&name),
+		Arn:              fmt.Sprintf("arn:aws:ec2:%s:%s:instance/%s", region, aws.ToString(accountId), aws.ToString(instance.InstanceId)),
 		AvailabilityZone: aws.ToString(instance.Placement.AvailabilityZone),
 		State:            string(instance.State.Name),
 		ExternalIP:       externalIP,
@@ -500,7 +574,7 @@ func (m *InstancesModule) getRolesFromInstanceProfiles() {
 	m.InstanceProfileToRolesMap = map[string][]iamTypes.Role{}
 
 	for PaginationControl {
-		ListInstanceProfiles, err := m.IAMListInstanceProfilesClient.ListInstanceProfiles(
+		ListInstanceProfiles, err := m.IAMClient.ListInstanceProfiles(
 			context.TODO(),
 			&(iam.ListInstanceProfilesInput{
 				Marker: PaginationMarker,

aws/lambda.go

@@ -9,9 +9,10 @@ import (
 	"strconv"
 	"sync"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
 	"github.com/aws/aws-sdk-go-v2/service/lambda/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
@@ -21,8 +22,8 @@ import (
 
 type LambdasModule struct {
 	// General configuration data
-	LambdaClient                     *lambda.Client
-	IAMSimulatePrincipalPolicyClient iam.SimulatePrincipalPolicyAPIClient
+	LambdaClient *lambda.Client
+	IAMClient    sdk.AWSIAMClientInterface
 
 	Caller         sts.GetCallerIdentityOutput
 	AWSRegions     []string
@@ -55,6 +56,7 @@ type Lambda struct {
 }
 
 func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string, verbosity int) {
+
 	// These stuct values are used by the output module
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
@@ -70,7 +72,7 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 	fmt.Printf("[%s][%s] Enumerating lambdas for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	//fmt.Printf("[%s][%s] Attempting to build a PrivEsc graph in memory using local pmapper data if it exists on the filesystem.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMSimulatePrincipalPolicyClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -125,8 +127,7 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 		m.output.Headers = []string{
 			"Service",
 			"Region",
-			//"Type",
-			"Resource Arn",
+			"Resource",
 			"Role",
 			"IsAdminRole?",
 			"CanPrivEscToAdmin?",
@@ -135,7 +136,7 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 		m.output.Headers = []string{
 			"Service",
 			"Region",
-			"Resource Arn",
+			"Resource",
 			"Role",
 			"IsAdminRole?",
 		}
@@ -180,10 +181,25 @@ func (m *LambdasModule) PrintLambdas(outputFormat string, outputDirectory string
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s lambdas found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No lambdas found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -245,7 +261,7 @@ func (m *LambdasModule) writeLoot(outputDirectory string, verbosity int) {
 		out = out + fmt.Sprintf("aws --profile $profile --region %s lambda get-function --function-name %s\n", function.Region, function.Name)
 		out = out + "# Download function code to to disk (requires jq and curl) \n"
 		out = out + fmt.Sprintf("mkdir -p ./lambdas/%s\n", function.Name)
-		out = out + fmt.Sprintf("url=`aws --profile $profile lambda get-function --region %s --function-name %s | jq .Code.Location | sed s/\"//g` && curl \"$url\" -o ./lambdas/%s.zip\n", function.Region, function.Name, function.Name)
+		out = out + fmt.Sprintf("url=`aws --profile $profile lambda get-function --region %s --function-name %s | jq .Code.Location | sed s/\\\"//g` && curl \"$url\" -o ./lambdas/%s.zip\n", function.Region, function.Name, function.Name)
 	}
 	err = os.WriteFile(pullFile, []byte(out), 0644)
 	if err != nil {
@@ -319,7 +335,7 @@ func (m *LambdasModule) listFunctions(r string) ([]types.FunctionConfiguration,
 			},
 		)
 		if err != nil {
-			m.modLog.Error(err.Error())
+			sharedLogger.Error(err.Error())
 			m.CommandCounter.Error++
 			return functions, err
 		}
@@ -334,3 +350,29 @@ func (m *LambdasModule) listFunctions(r string) ([]types.FunctionConfiguration,
 	}
 	return functions, nil
 }
+
+func (m *LambdasModule) getResourcePolicy(r string, functionName string) (policy.Policy, error) {
+	var projectPolicy policy.Policy
+	var policyJSON string
+	Policy, err := m.LambdaClient.GetPolicy(
+		context.TODO(),
+		&lambda.GetPolicyInput{
+			FunctionName: &functionName,
+		},
+		func(options *lambda.Options) {
+			options.Region = r
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		m.CommandCounter.Error++
+		return projectPolicy, err
+	}
+
+	policyJSON = aws.ToString(Policy.Policy)
+	projectPolicy, err = policy.ParseJSONPolicy([]byte(policyJSON))
+	if err != nil {
+		return projectPolicy, fmt.Errorf("parsing policy (%s) as JSON: %s", functionName, err)
+	}
+	return projectPolicy, nil
+}

aws/network-ports.go

@@ -210,10 +210,26 @@ func (m *NetworkPortsModule) PrintNetworkPorts(outputFormat string, outputDirect
 	}
 
 	if len(m.IPv4_Private) > 0 || len(m.IPv4_Public) > 0 || len(m.IPv6) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
-		internal.OutputSelector(m.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath)
+		//internal.OutputSelector(m.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath)
+		o := internal.OutputClient{
+			Verbosity:     m.Verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName)
 		fmt.Printf("[%s][%s] %s network services found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {

aws/org.go

@@ -0,0 +1,290 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/organizations/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/kyokomi/emoji"
+	"github.com/sirupsen/logrus"
+)
+
+type OrgModule struct {
+	OrganizationsClient sdk.OrganizationsClientInterface
+	Caller              sts.GetCallerIdentityOutput
+	AWSRegions          []string
+	OutputFormat        string
+	Goroutines          int
+	AWSProfile          string
+	SkipAdminCheck      bool
+	WrapTable           bool
+	DescribeOrgOutput   *types.Organization
+
+	// Main module data
+	Accounts       []Account
+	Orgs           map[string]Org
+	CommandCounter internal.CommandCounter
+	// Used to store output data for pretty printing
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type Org struct {
+	OrgId         string
+	MgmtAccount   string
+	ChildAccounts []Account
+}
+
+type Account struct {
+	ProfileName         string
+	isManagementAccount bool
+	Name                string
+	Id                  string
+	Email               string
+	Arn                 string
+	Status              string
+	OrgId               string
+}
+
+func (m *OrgModule) PrintOrgAccounts(outputFormat string, outputDirectory string, verbosity int) {
+	// These stuct values are used by the output module
+	var err error
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "org"
+
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	fmt.Printf("[%s][%s] Checking if account %s is the management account in an organization.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	m.DescribeOrgOutput, err = sdk.CachedOrganizationsDescribeOrganization(m.OrganizationsClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Errorf("Failed to describe organization: %s", err)
+		return
+	}
+	if err != nil {
+		m.modLog.Errorf("Failed to describe organization: %s", err)
+		fmt.Printf("[%s][%s] Account %s is either not associated with an organization, or you do not have the organizations:DescribeOrganization permission.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	} else {
+
+		if m.IsManagementAccount(m.DescribeOrgOutput, aws.ToString(m.Caller.Account)) {
+			m.addOrgAccounts()
+		} else {
+			m.addOrgAccount()
+			//fmt.Printf("[%s][%s] Account %s is not the management account in an organization %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+		}
+
+		m.output.Headers = []string{
+			"Name",
+			"ID",
+			"isManagementAccount?",
+			"Status",
+			"Email",
+		}
+
+		// Table rows
+
+		for i := range m.Accounts {
+			m.output.Body = append(
+				m.output.Body,
+				[]string{
+					m.Accounts[i].Name,
+					m.Accounts[i].Id,
+					strconv.FormatBool(m.Accounts[i].isManagementAccount),
+					m.Accounts[i].Status,
+					m.Accounts[i].Email,
+				},
+			)
+		}
+
+		if len(m.output.Body) > 0 {
+			m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+			//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+			//m.writeLoot(m.output.FilePath, verbosity)
+			o := internal.OutputClient{
+				Verbosity:     verbosity,
+				CallingModule: m.output.CallingModule,
+				Table: internal.TableClient{
+					Wrap: m.WrapTable,
+				},
+			}
+			o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+				Header: m.output.Headers,
+				Body:   m.output.Body,
+				Name:   m.output.CallingModule,
+			})
+			o.PrefixIdentifier = m.AWSProfile
+			o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+			o.WriteFullOutput(o.Table.TableFiles, nil)
+			//m.writeLoot(o.Table.DirectoryName, verbosity)
+			fmt.Printf("[%s][%s] %d accounts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), len(m.output.Body))
+			fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+
+		}
+	}
+}
+
+func (m *OrgModule) ProcessMultipleAccounts(AWSProfiles []string, version string) {
+	var seenOrgs []string
+
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan Account)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+
+	// Create a channel to signal to stop
+	go m.Receiver(dataReceiver, receiverDone)
+
+	for _, profile := range AWSProfiles {
+		wg.Add(1)
+		m.CommandCounter.Pending++
+		go m.FindMgmtAccounts(profile, version, wg, semaphore, dataReceiver)
+
+		wg.Wait()
+
+		// Send a message to the spinner goroutine to close the channel and stop
+		spinnerDone <- true
+		<-spinnerDone
+		receiverDone <- true
+		<-receiverDone
+
+		orgId := aws.ToString(m.DescribeOrgOutput.Id)
+		// if this orgId is not in seenOrgs, add it to seenOrgs
+		if !internal.Contains(orgId, seenOrgs) {
+			seenOrgs = append(seenOrgs, orgId)
+			// add this org to the Orgs map
+			Org := Org{
+				OrgId: orgId,
+			}
+			m.Orgs[orgId] = Org
+
+		} else {
+			continue
+		}
+
+		isMgmtAccount := m.IsManagementAccount(m.DescribeOrgOutput, aws.ToString(m.Caller.Account))
+		if isMgmtAccount {
+			mgmtAccount := aws.ToString(m.Caller.Account)
+			fmt.Printf("[%s] Found an Organization Management Account: %s\n", cyan(emoji.Sprintf(":fox:cloudfox v%s :fox:", version)), mgmtAccount)
+			//mgmtAccounts[mgmtAccount] = append(mgmtAccounts[mgmtAccount], profile)
+		}
+	}
+}
+
+func (m *OrgModule) Receiver(receiver chan Account, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Accounts = append(m.Accounts, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+
+func (m *OrgModule) FindMgmtAccounts(profile string, version string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Account) {
+	var err error
+
+	DescribeOrganization, err := sdk.CachedOrganizationsDescribeOrganization(m.OrganizationsClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Errorf("Failed to describe organization: %s", err)
+		m.CommandCounter.Error++
+		return
+	}
+
+	dataReceiver <- Account{
+		isManagementAccount: m.IsManagementAccount(DescribeOrganization, aws.ToString(m.Caller.Account)),
+		Name:                aws.ToString(m.Caller.Account),
+		Id:                  aws.ToString(m.Caller.Account),
+		Status:              "ACTIVE",
+		Email:               aws.ToString(m.Caller.Account),
+		OrgId:               aws.ToString(DescribeOrganization.Id),
+		Arn:                 aws.ToString(m.Caller.Account),
+	}
+
+}
+
+func (m *OrgModule) IsManagementAccount(Organization *types.Organization, account string) bool {
+	// Check if the account is the management account
+	// https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganization.html
+	if aws.ToString(Organization.MasterAccountId) == account {
+		return true
+	}
+	return false
+}
+
+func (m *OrgModule) addOrgAccounts() {
+	accounts, err := sdk.CachedOrganizationsListAccounts(m.OrganizationsClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+	for _, account := range accounts {
+		m.Accounts = append(m.Accounts, Account{
+			isManagementAccount: m.IsManagementAccount(m.DescribeOrgOutput, aws.ToString(account.Id)),
+			Name:                aws.ToString(account.Name),
+			Id:                  aws.ToString(account.Id),
+			Email:               aws.ToString(account.Email),
+			Arn:                 aws.ToString(account.Arn),
+			Status:              string(account.Status),
+		})
+	}
+}
+
+func (m *OrgModule) addOrgAccount() {
+	DescribeOrganization, err := sdk.CachedOrganizationsDescribeOrganization(m.OrganizationsClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		sharedLogger.Errorf("Failed to describe organization: %s", err)
+		m.CommandCounter.Error++
+		return
+	}
+	m.Accounts = append(m.Accounts, Account{
+		isManagementAccount: true,
+		Name:                "Mgmt Account",
+		Id:                  aws.ToString(DescribeOrganization.MasterAccountId),
+		Email:               aws.ToString(DescribeOrganization.MasterAccountEmail),
+		Arn:                 aws.ToString(DescribeOrganization.MasterAccountArn),
+		Status:              "ACTIVE",
+	})
+	m.Accounts = append(m.Accounts, Account{
+		isManagementAccount: false,
+		Name:                "This account",
+		Id:                  aws.ToString(m.Caller.Account),
+		Email:               "Unkonwn",
+		Arn:                 aws.ToString(m.Caller.Arn),
+		Status:              "ACTIVE",
+	})
+}
+
+func (m *OrgModule) IsCallerAccountPartOfAnOrg() bool {
+	DescribeOrgOutput, err := sdk.CachedOrganizationsDescribeOrganization(m.OrganizationsClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		sharedLogger.Errorf("Failed to describe organization: %s", err)
+		return false
+	} else {
+		m.DescribeOrgOutput = DescribeOrgOutput
+	}
+	return true
+}

aws/outbound-assumed-roles.go

@@ -190,10 +190,26 @@ func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFor
 	}
 	if len(m.output.Body) > 0 {
 
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s log entries found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 		//m.writeLoot()

aws/permissions.go

@@ -1,18 +1,17 @@
 package aws
 
 import (
-	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"net/url"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"time"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
@@ -20,7 +19,7 @@ import (
 
 type IamPermissionsModule struct {
 	// General configuration data
-	IAMClient *iam.Client
+	IAMClient sdk.AWSIAMClientInterface
 
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
@@ -80,6 +79,7 @@ type PermissionsRow struct {
 	Effect     string
 	Action     string
 	Resource   string
+	Condition  string
 }
 
 func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDirectory string, verbosity int, principal string) {
@@ -94,26 +94,27 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 	if m.AWSProfile == "" {
 		m.AWSProfile = internal.BuildAWSPath(m.Caller)
 	}
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 	fmt.Printf("[%s][%s] Enumerating IAM permissions for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 
 	if principal != "" {
 		m.output.FullFilename = filepath.Join(fmt.Sprintf("%s-custom-%s", m.output.CallingModule, strconv.FormatInt((time.Now().Unix()), 10)))
 	}
 
-	m.getGAAD(principal)
-	m.parsePermissions()
+	m.getGAAD()
+	m.parsePermissions(principal)
 
 	m.output.Headers = []string{
-		"Service",
-		"Principal Type",
+		//"Service",
+		"Type",
 		"Name",
 		//"Arn",
-		"Policy Type",
+		"Policy",
 		"Policy Name",
 		"Effect",
 		"Action",
 		"Resource",
+		"Condition",
 	}
 
 	//Table rows
@@ -121,7 +122,7 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 		m.output.Body = append(
 			m.output.Body,
 			[]string{
-				m.Rows[i].AWSService,
+				//m.Rows[i].AWSService,
 				m.Rows[i].Type,
 				m.Rows[i].Name,
 				//m.Rows[i].Arn,
@@ -130,16 +131,33 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 				m.Rows[i].Effect,
 				m.Rows[i].Action,
 				m.Rows[i].Resource,
+				m.Rows[i].Condition,
 			},
 		)
 
 	}
 
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector3(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s unique permissions identified.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -148,178 +166,233 @@ func (m *IamPermissionsModule) PrintIamPermissions(outputFormat string, outputDi
 	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
 }
 
-func (m *IamPermissionsModule) getGAAD(principal string) {
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
-	//var totalRoles int
-
-	// var attachedPolicies []types.AttachedPolicy
-	// var inlinePolicies []types.PolicyDetail
-
-	for {
-		GAAD, err := m.IAMClient.GetAccountAuthorizationDetails(
-			context.TODO(),
-			&iam.GetAccountAuthorizationDetailsInput{
-				Marker: PaginationControl,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-
-		for _, policy := range GAAD.Policies {
-			//var IAMtype = "Role"
-			arn := aws.ToString(policy.Arn)
-			name := aws.ToString(policy.PolicyName)
-
-			m.Policies = append(m.Policies, GAADPolicy{
-				Arn:               arn,
-				Name:              name,
-				PolicyVersionList: policy.PolicyVersionList,
-			})
-
-		}
-
-		for _, role := range GAAD.RoleDetailList {
-			arn := aws.ToString(role.Arn)
-			name := aws.ToString(role.RoleName)
-			if principal == "" {
-				m.Roles = append(m.Roles, GAADRole{
-					Arn:              arn,
-					Name:             name,
-					AttachedPolicies: role.AttachedManagedPolicies,
-					InlinePolicies:   role.RolePolicyList,
-				})
-			} else {
-				if arn == principal {
-					m.Roles = append(m.Roles, GAADRole{
-						Arn:              arn,
-						Name:             name,
-						AttachedPolicies: role.AttachedManagedPolicies,
-						InlinePolicies:   role.RolePolicyList,
-					})
-				}
-
-			}
-		}
-
-		// i think the error here is pagination!!
-
-		for _, user := range GAAD.UserDetailList {
-			//var IAMtype = "User"
-			arn := aws.ToString(user.Arn)
-			name := aws.ToString(user.UserName)
-			groupList := user.GroupList
-			if principal == "" {
-				m.Users = append(m.Users, GAADUser{
-					Arn:              arn,
-					Name:             name,
-					AttachedPolicies: user.AttachedManagedPolicies,
-					InlinePolicies:   user.UserPolicyList,
-					GroupList:        groupList,
-				})
-			} else {
-				if arn == principal {
-					m.Users = append(m.Users, GAADUser{
-						Arn:              arn,
-						Name:             name,
-						AttachedPolicies: user.AttachedManagedPolicies,
-						InlinePolicies:   user.UserPolicyList,
-						GroupList:        groupList,
-					})
-				}
-			}
-		}
-
-		for _, group := range GAAD.GroupDetailList {
-			arn := aws.ToString(group.Arn)
-			name := aws.ToString(group.GroupName)
-			if principal == "" {
-				m.Groups = append(m.Groups, GAADGroup{
-					Arn:              arn,
-					Name:             name,
-					AttachedPolicies: group.AttachedManagedPolicies,
-					InlinePolicies:   group.GroupPolicyList,
-				})
-			} else {
-				if arn == principal {
-					m.Groups = append(m.Groups, GAADGroup{
-						Arn:              arn,
-						Name:             name,
-						AttachedPolicies: group.AttachedManagedPolicies,
-						InlinePolicies:   group.GroupPolicyList,
-					})
-				}
-			}
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if GAAD.Marker != nil {
-			PaginationControl = GAAD.Marker
-		} else {
-			PaginationControl = nil
-			break
-		}
+func (m *IamPermissionsModule) getGAAD() {
+	GAAD, err := sdk.CachedIAMGetAccountAuthorizationDetails(m.IAMClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
 	}
+
+	// // if user supplied a principal name without the arn, try to create the arn
+	// if !strings.Contains(principal, "arn:") {
+	// 	principal = fmt.Sprintf("arn:aws:iam::%s:user/%s", aws.ToString(m.Caller.Account), principal)
+	// }
+
+	for _, policy := range GAAD.Policies {
+		//var IAMtype = "Role"
+		arn := aws.ToString(policy.Arn)
+		name := aws.ToString(policy.PolicyName)
+
+		m.Policies = append(m.Policies, GAADPolicy{
+			Arn:               arn,
+			Name:              name,
+			PolicyVersionList: policy.PolicyVersionList,
+		})
+
+	}
+
+	for _, role := range GAAD.RoleDetailList {
+		arn := aws.ToString(role.Arn)
+		name := aws.ToString(role.RoleName)
+		m.Roles = append(m.Roles, GAADRole{
+			Arn:              arn,
+			Name:             name,
+			AttachedPolicies: role.AttachedManagedPolicies,
+			InlinePolicies:   role.RolePolicyList,
+		})
+
+	}
+
+	for _, user := range GAAD.UserDetailList {
+		//var IAMtype = "User"
+		arn := aws.ToString(user.Arn)
+		name := aws.ToString(user.UserName)
+		groupList := user.GroupList
+		m.Users = append(m.Users, GAADUser{
+			Arn:              arn,
+			Name:             name,
+			AttachedPolicies: user.AttachedManagedPolicies,
+			InlinePolicies:   user.UserPolicyList,
+			GroupList:        groupList,
+		})
+	}
+
+	for _, group := range GAAD.GroupDetailList {
+		arn := aws.ToString(group.Arn)
+		name := aws.ToString(group.GroupName)
+
+		m.Groups = append(m.Groups, GAADGroup{
+			Arn:              arn,
+			Name:             name,
+			AttachedPolicies: group.AttachedManagedPolicies,
+			InlinePolicies:   group.GroupPolicyList,
+		})
+
+	}
+
 }
 
-func (m *IamPermissionsModule) parsePermissions() {
+// create a function that will take a principal name and try to see if it is a role, user, or group and return the arn of the principal
+func (m *IamPermissionsModule) getPrincipalArn(principal string) string {
+	var arn string
+	for _, role := range m.Roles {
+		if role.Name == principal {
+			arn = role.Arn
+		}
+	}
 
+	for _, user := range m.Users {
+		if user.Name == principal {
+			arn = user.Arn
+		}
+	}
+
+	for _, group := range m.Groups {
+		if group.Name == principal {
+			arn = group.Arn
+		}
+	}
+
+	return arn
+}
+
+func (m *IamPermissionsModule) parsePermissions(principal string) {
+	var inputArn string
 	for i := range m.Roles {
+		if principal == "" {
+			for _, attachedPolicy := range m.Roles[i].AttachedPolicies {
+				m.getPermissionsFromAttachedPolicy(m.Roles[i].Arn, attachedPolicy, "Role", m.Roles[i].Name)
+			}
 
-		for _, attachedPolicy := range m.Roles[i].AttachedPolicies {
-			m.getPermissionsFromAttachedPolicy(m.Roles[i].Arn, attachedPolicy, "Role", m.Roles[i].Name)
+			for _, inlinePolicy := range m.Roles[i].InlinePolicies {
+				m.getPermissionsFromInlinePolicy(m.Roles[i].Arn, inlinePolicy, "Role", m.Roles[i].Name)
+			}
+		} else {
+			// if user supplied a principal name without the arn, try to create the arn
+			if !strings.Contains(principal, "arn:") {
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:role/%s", aws.ToString(m.Caller.Account), principal)
+			} else {
+				inputArn = principal
+			}
+
+			if strings.ToLower(m.Roles[i].Arn) == strings.ToLower(inputArn) {
+				for _, attachedPolicy := range m.Roles[i].AttachedPolicies {
+					m.getPermissionsFromAttachedPolicy(m.Roles[i].Arn, attachedPolicy, "Role", m.Roles[i].Name)
+				}
+
+				for _, inlinePolicy := range m.Roles[i].InlinePolicies {
+					m.getPermissionsFromInlinePolicy(m.Roles[i].Arn, inlinePolicy, "Role", m.Roles[i].Name)
+				}
+			}
 		}
 
-		for _, inlinePolicy := range m.Roles[i].InlinePolicies {
-			m.getPermissionsFromInlinePolicy(m.Roles[i].Arn, inlinePolicy, "Role", m.Roles[i].Name)
-		}
 	}
 
 	for i := range m.Users {
-		for _, attachedPolicy := range m.Users[i].AttachedPolicies {
-			m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+		if principal == "" {
+			for _, attachedPolicy := range m.Users[i].AttachedPolicies {
+				m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+			}
+
+			for _, inlinePolicy := range m.Users[i].InlinePolicies {
+				m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+			}
+		} else {
+			// if user supplied a principal name without the arn, try to create the arn
+			if !strings.Contains(principal, "arn:") {
+				inputArn = fmt.Sprintf("arn:aws:iam::%s:user/%s", aws.ToString(m.Caller.Account), principal)
+			} else {
+				inputArn = principal
+			}
+			if strings.ToLower(m.Users[i].Arn) == strings.ToLower(inputArn) {
+				for _, attachedPolicy := range m.Users[i].AttachedPolicies {
+					m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+				}
+
+				for _, inlinePolicy := range m.Users[i].InlinePolicies {
+					m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+				}
+			}
 		}
 
-		for _, inlinePolicy := range m.Users[i].InlinePolicies {
-			m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
-		}
-
-		for j, group := range m.Users[i].GroupList {
-			for _, gaadGroup := range m.Groups {
-				if gaadGroup.Name == group {
-					for _, attachedPolicy := range m.Groups[j].AttachedPolicies {
-						m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+		// for each group in the user's group list, get the attached and inline policy names, and then get the permissions from those policies
+		for g := range m.Users[i].GroupList {
+			if principal == "" {
+				for _, group := range m.Groups {
+					if group.Name == m.Users[i].GroupList[g] {
+						for _, attachedPolicy := range group.AttachedPolicies {
+							m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+						}
+						for _, inlinePolicy := range group.InlinePolicies {
+							m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+						}
 					}
-					for _, inlinePolicy := range m.Groups[j].InlinePolicies {
-						m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+				}
+			} else {
+				// if user supplied a principal name without the arn, try to create the arn
+				if !strings.Contains(principal, "arn:") {
+					inputArn = fmt.Sprintf("arn:aws:iam::%s:user/%s", aws.ToString(m.Caller.Account), principal)
+				} else {
+					inputArn = principal
+				}
+				if strings.ToLower(m.Users[i].Arn) == strings.ToLower(inputArn) {
+					for _, group := range m.Groups {
+						if group.Name == m.Users[i].GroupList[g] {
+							for _, attachedPolicy := range group.AttachedPolicies {
+								m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+							}
+							for _, inlinePolicy := range group.InlinePolicies {
+								m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+							}
+						}
 					}
 				}
 			}
 
 		}
+
+		// for group := range m.Users[i].GroupList {
+		// 	for _, gaadGroup := range m.Groups {
+		// 		if gaadGroup.Name == group {
+		// 			for _, attachedPolicy := range m.Groups[j].AttachedPolicies {
+		// 				m.getPermissionsFromAttachedPolicy(m.Users[i].Arn, attachedPolicy, "User", m.Users[i].Name)
+		// 			}
+		// 			for _, inlinePolicy := range m.Groups[j].InlinePolicies {
+		// 				m.getPermissionsFromInlinePolicy(m.Users[i].Arn, inlinePolicy, "User", m.Users[i].Name)
+		// 			}
+		// 		}
+		// 	}
+
+		// }
 	}
 
 }
 
 func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, attachedPolicy types.AttachedPolicy, IAMtype string, name string) {
 	//var policies []types.ManagedPolicyDetail
-	var s StatementEntry
+	var s policy.PolicyStatement
 	var AWSService = "IAM"
+	var hasConditions string
 
 	for _, p := range m.Policies {
 		if p.Name == aws.ToString(attachedPolicy.PolicyName) {
 			for _, d := range p.PolicyVersionList {
 				if d.IsDefaultVersion {
-					parsedPolicyDocument, _ := parsePolicyDocument(d.Document)
+					//parsedPolicyDocument, _ := parsePolicyDocument(d.Document)
+					document, _ := url.QueryUnescape(aws.ToString(d.Document))
+					parsedPolicyDocument, _ := policy.ParseJSONPolicy([]byte(document))
 					for _, s = range parsedPolicyDocument.Statement {
 						//version := parsedPolicyDocument.Version
 						effect := s.Effect
 						if s.Action != nil {
 							for _, action := range s.Action {
 								for _, resource := range s.Resource {
+									if s.Condition != nil {
+										hasConditions = "Yes"
+									} else {
+										hasConditions = "No"
+									}
 									m.Rows = append(
 										m.Rows,
 										PermissionsRow{
@@ -332,6 +405,7 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 											Effect:     effect,
 											Action:     action,
 											Resource:   resource,
+											Condition:  hasConditions,
 										})
 								}
 							}
@@ -340,6 +414,11 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 						if s.NotAction != nil {
 							for _, action := range s.NotAction {
 								for _, resource := range s.Resource {
+									if s.Condition != nil {
+										hasConditions = "Yes"
+									} else {
+										hasConditions = "No"
+									}
 									m.Rows = append(
 										m.Rows,
 										PermissionsRow{
@@ -352,6 +431,7 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 											Effect:     effect,
 											Action:     "[NotAction] " + action,
 											Resource:   resource,
+											Condition:  hasConditions,
 										})
 								}
 							}
@@ -366,16 +446,24 @@ func (m *IamPermissionsModule) getPermissionsFromAttachedPolicy(arn string, atta
 
 func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inlinePolicy types.PolicyDetail, IAMtype string, name string) {
 	//var policies []types.ManagedPolicyDetail
-	var s StatementEntry
+	var s policy.PolicyStatement
 	var AWSService = "IAM"
+	var hasConditions string
+
+	//parsedPolicyDocument, _ := parsePolicyDocument(inlinePolicy.PolicyDocument)
+	document, _ := url.QueryUnescape(aws.ToString(inlinePolicy.PolicyDocument))
+	parsedPolicyDocument, _ := policy.ParseJSONPolicy([]byte(document))
 
-	parsedPolicyDocument, _ := parsePolicyDocument(inlinePolicy.PolicyDocument)
 	for _, s = range parsedPolicyDocument.Statement {
-		//version := parsedPolicyDocument.Version
 		effect := s.Effect
 		if s.Action != nil {
 			for _, action := range s.Action {
 				for _, resource := range s.Resource {
+					if s.Condition != nil {
+						hasConditions = "Yes"
+					} else {
+						hasConditions = "No"
+					}
 					m.Rows = append(
 						m.Rows,
 						PermissionsRow{
@@ -388,6 +476,7 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 							Effect:     effect,
 							Action:     action,
 							Resource:   resource,
+							Condition:  hasConditions,
 						})
 				}
 			}
@@ -395,6 +484,11 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 		if s.NotAction != nil {
 			for _, action := range s.NotAction {
 				for _, resource := range s.Resource {
+					if s.Condition != nil {
+						hasConditions = "Yes"
+					} else {
+						hasConditions = "No"
+					}
 					m.Rows = append(
 						m.Rows,
 						PermissionsRow{
@@ -405,8 +499,9 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 							PolicyType: "Inline",
 							PolicyName: aws.ToString(inlinePolicy.PolicyName),
 							Effect:     effect,
-							Action:     "notaction" + action,
+							Action:     "[NotAction] " + action,
 							Resource:   resource,
+							Condition:  hasConditions,
 						})
 				}
 			}
@@ -414,41 +509,3 @@ func (m *IamPermissionsModule) getPermissionsFromInlinePolicy(arn string, inline
 
 	}
 }
-
-type policyDocument struct {
-	Version   string           `json:"Version"`
-	Statement []StatementEntry `json:"Statement"`
-}
-
-type StatementEntry struct {
-	Effect    string      `json:"Effect"`
-	Action    ListOfItems `json:"Action,omitempty"`
-	NotAction ListOfItems `json:"NotAction,omitempty"`
-	Resource  ListOfItems `json:"Resource"`
-	Condition ListOfItems `json:"Condition"`
-}
-
-func parsePolicyDocument(doc *string) (policyDocument, error) {
-	document, _ := url.QueryUnescape(aws.ToString(doc))
-	var parsedDocumentToJSON policyDocument
-	_ = json.Unmarshal([]byte(document), &parsedDocumentToJSON)
-	return parsedDocumentToJSON, nil
-}
-
-// A custom unmarshaller is necessary because the list of principals can be an array of strings or a string.
-// https://stackoverflow.com/questions/65854778/parsing-arn-from-iam-policy-using-regex
-type ListOfItems []string
-
-func (r *ListOfItems) UnmarshalJSON(b []byte) error {
-	var s string
-	if err := json.Unmarshal(b, &s); err == nil {
-		*r = append(*r, s)
-		return nil
-	}
-	var ss []string
-	if err := json.Unmarshal(b, &ss); err == nil {
-		*r = ss
-		return nil
-	}
-	return errors.New("cannot unmarshal neither to a string nor a slice of strings")
-}

aws/pmapper.go

@@ -71,16 +71,7 @@ func (m *PmapperModule) initPmapperGraph() error {
 		return err
 	}
 
-	m.pmapperGraph = graph.New(graph.StringHash, graph.Directed())
-
-	for _, node := range m.Nodes {
-		_ = m.pmapperGraph.AddVertex(node.Arn)
-
-	}
-
-	for _, edge := range m.Edges {
-		_ = m.pmapperGraph.AddEdge(edge.Source, edge.Destination)
-	}
+	m.pmapperGraph = m.createAndPopulateGraph()
 
 	for i := range m.Nodes {
 		if m.doesNodeHavePathToAdmin(m.Nodes[i]) {
@@ -89,12 +80,38 @@ func (m *PmapperModule) initPmapperGraph() error {
 		} else {
 			m.Nodes[i].PathToAdmin = false
 		}
-
 	}
 
 	return nil
 }
 
+func (m *PmapperModule) createAndPopulateGraph() graph.Graph[string, string] {
+
+	pmapperGraph := graph.New(graph.StringHash, graph.Directed())
+
+	// having issues with caching the graph. will have to swing back and try again later
+
+	// gob.Register(pmapperGraph)
+	// cacheKey := fmt.Sprintf("%s-pmapperGraph", aws.ToString(m.Caller.Account))
+	// cached, found := internal.Cache.Get(cacheKey)
+	// if found {
+	// 	return cached.(graph.Graph[string, string])
+	// }
+
+	for _, node := range m.Nodes {
+		_ = pmapperGraph.AddVertex(node.Arn)
+
+	}
+
+	for _, edge := range m.Edges {
+		_ = pmapperGraph.AddEdge(edge.Source, edge.Destination)
+	}
+
+	//internal.Cache.Set(cacheKey, pmapperGraph, cache.DefaultExpiration)
+	return pmapperGraph
+
+}
+
 func (m *PmapperModule) DoesPrincipalHavePathToAdmin(principal string) bool {
 	for i := range m.Nodes {
 		if m.Nodes[i].Arn == principal {
@@ -131,7 +148,7 @@ func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory st
 	if m.AWSProfile == "" {
 		m.AWSProfile = internal.BuildAWSPath(m.Caller)
 	}
-	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 	fmt.Printf("[%s][%s] Looking for pmapper data for this account and building a PrivEsc graph in golang if it exists.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	pmapperError := m.initPmapperGraph()
 	if pmapperError != nil {
@@ -178,9 +195,25 @@ func (m *PmapperModule) PrintPmapperData(outputFormat string, outputDirectory st
 	}
 
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
 
 		fmt.Printf("[%s][%s] %s principals who are admin or have a path to admin identified.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 

aws/principals.go

@@ -1,21 +1,20 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"path/filepath"
 	"strconv"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/iam"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
 )
 
 type IamPrincipalsModule struct {
 	// General configuration data
-	IAMClient *iam.Client
+	IAMClient sdk.AWSIAMClientInterface
 
 	Caller       sts.GetCallerIdentityOutput
 	AWSRegions   []string
@@ -87,8 +86,8 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 	// done <- true
 	// <-done
 
-	m.getIAMUsers()
-	m.getIAMRoles()
+	m.addIAMUsersToTable()
+	m.addIAMRolesToTable()
 
 	//fmt.Printf("\nAnalyzed Resources by Region\n\n")
 
@@ -135,10 +134,26 @@ func (m *IamPrincipalsModule) PrintIamPrincipals(outputFormat string, outputDire
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s IAM principals found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -160,100 +175,64 @@ func (m *IamPrincipalsModule) executeChecks(wg *sync.WaitGroup) {
 }
 */
 
-func (m *IamPrincipalsModule) getIAMUsers() {
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
+func (m *IamPrincipalsModule) addIAMUsersToTable() {
 	var AWSService = "IAM"
-
 	var IAMtype = "User"
 	var attachedPolicies []string
 	var inlinePolicies []string
 
-	for {
-		ListUsers, err := m.IAMClient.ListUsers(
-			context.TODO(),
-			&iam.ListUsersInput{
-				Marker: PaginationControl,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
+	ListUsers, err := sdk.CachedIamListUsers(m.IAMClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
-		for _, user := range ListUsers.Users {
-			arn := user.Arn
-			name := user.UserName
+	for _, user := range ListUsers {
+		arn := user.Arn
+		name := user.UserName
 
-			m.Users = append(
-				m.Users,
-				User{
-					AWSService:       AWSService,
-					Arn:              aws.ToString(arn),
-					Name:             aws.ToString(name),
-					Type:             IAMtype,
-					AttachedPolicies: attachedPolicies,
-					InlinePolicies:   inlinePolicies,
-				})
-		}
-
-		// Pagination control. After the last page of output, the for loop exits.
-		if ListUsers.Marker != nil {
-			PaginationControl = ListUsers.Marker
-		} else {
-			PaginationControl = nil
-			break
-		}
+		m.Users = append(
+			m.Users,
+			User{
+				AWSService:       AWSService,
+				Arn:              aws.ToString(arn),
+				Name:             aws.ToString(name),
+				Type:             IAMtype,
+				AttachedPolicies: attachedPolicies,
+				InlinePolicies:   inlinePolicies,
+			})
 	}
 
 }
 
-func (m *IamPrincipalsModule) getIAMRoles() {
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
+func (m *IamPrincipalsModule) addIAMRolesToTable() {
+
 	//var totalRoles int
 	var AWSService = "IAM"
 	var IAMtype = "Role"
 	var attachedPolicies []string
 	var inlinePolicies []string
 
-	for {
-		ListRoles, err := m.IAMClient.ListRoles(
-			context.TODO(),
-			&iam.ListRolesInput{
-				Marker: PaginationControl,
-			},
-		)
-		if err != nil {
-			m.modLog.Error(err.Error())
-			m.CommandCounter.Error++
-			break
-		}
-		for _, role := range ListRoles.Roles {
-			arn := role.Arn
-			name := role.RoleName
+	ListRoles, err := sdk.CachedIamListRoles(m.IAMClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
-			m.Roles = append(
-				m.Roles,
-				Role{
-					AWSService:       AWSService,
-					Arn:              aws.ToString(arn),
-					Name:             aws.ToString(name),
-					Type:             IAMtype,
-					AttachedPolicies: attachedPolicies,
-					InlinePolicies:   inlinePolicies,
-				})
-		}
+	for _, role := range ListRoles {
+		arn := role.Arn
+		name := role.RoleName
 
-		// Pagination control. After the last page of output, the for loop exits.
-		if ListRoles.Marker != nil {
-			PaginationControl = ListRoles.Marker
-		} else {
-			PaginationControl = nil
-			//fmt.Printf("IAM Roles: %d\n\n", totalRoles)
-			break
-		}
+		m.Roles = append(
+			m.Roles,
+			Role{
+				AWSService:       AWSService,
+				Arn:              aws.ToString(arn),
+				Name:             aws.ToString(name),
+				Type:             IAMtype,
+				AttachedPolicies: attachedPolicies,
+				InlinePolicies:   inlinePolicies,
+			})
 	}
 
 }

aws/ram.go

@@ -115,10 +115,26 @@ func (m *RAMModule) PrintRAM(outputFormat string, outputDirectory string, verbos
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s resources found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No resources found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))

aws/resource-trusts.go

@@ -0,0 +1,739 @@
+package aws
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/bishopfox/awsservicemap"
+	"github.com/sirupsen/logrus"
+)
+
+type ResourceTrustsModule struct {
+	// General configuration data
+	Caller          sts.GetCallerIdentityOutput
+	AWSRegions      []string
+	Goroutines      int
+	WrapTable       bool
+	AWSProfile      string
+	CloudFoxVersion string
+
+	Resources2     []Resource2
+	CommandCounter internal.CommandCounter
+
+	output internal.OutputData2
+	modLog *logrus.Entry
+}
+
+type Resource2 struct {
+	AccountID             string
+	Name                  string
+	ARN                   string
+	Region                string
+	Policy                policy.Policy
+	PolicyJSON            string
+	ResourcePolicySummary string
+	Public                string
+	Interesting           string
+}
+
+func (m *ResourceTrustsModule) PrintResources(outputFormat string, outputDirectory string, verbosity int) {
+	// These stuct values are used by the output module
+	m.output.Verbosity = verbosity
+	m.output.Directory = outputDirectory
+	m.output.CallingModule = "resource-trusts"
+	m.modLog = internal.TxtLog.WithFields(logrus.Fields{
+		"module": m.output.CallingModule,
+	})
+	m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+	if m.AWSProfile == "" {
+		m.AWSProfile = internal.BuildAWSPath(m.Caller)
+	}
+
+	fmt.Printf("[%s][%s] Enumerating Resources with resource policies for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
+	fmt.Printf("[%s][%s] Supported Services: CodeBuild, ECR, EFS, Lambda, S3, SNS, SQS\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	wg := new(sync.WaitGroup)
+	semaphore := make(chan struct{}, m.Goroutines)
+
+	// Create a channel to signal the spinner aka task status goroutine to finish
+	spinnerDone := make(chan bool)
+	//fire up the the task status spinner/updated
+	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
+
+	//create a channel to receive the objects
+	dataReceiver := make(chan Resource2)
+
+	// Create a channel to signal to stop
+	receiverDone := make(chan bool)
+	go m.Receiver(dataReceiver, receiverDone)
+
+	for _, region := range m.AWSRegions {
+		wg.Add(1)
+		m.CommandCounter.Pending++
+		go m.executeChecks(region, wg, semaphore, dataReceiver)
+
+	}
+	wg.Add(1)
+	go m.getS3Buckets(wg, semaphore, dataReceiver)
+
+	wg.Wait()
+	// Send a message to the spinner goroutine to close the channel and stop
+	spinnerDone <- true
+	<-spinnerDone
+	// Send a message to the data receiver goroutine to close the channel and stop
+	receiverDone <- true
+	<-receiverDone
+
+	// add - if struct is not empty do this. otherwise, dont write anything.
+	m.output.Headers = []string{
+		//"Account ID",
+		"ARN",
+		"Public",
+		"Interesting",
+		"Resource Policy Summary",
+	}
+
+	// sort the table roles by Interesting
+	sort.Slice(m.Resources2, func(i, j int) bool {
+		return m.Resources2[j].Interesting > m.Resources2[i].Interesting
+	})
+
+	// Table rows
+	for i := range m.Resources2 {
+		m.output.Body = append(
+			m.output.Body,
+			[]string{
+				//m.Resources2[i].AccountID,
+				m.Resources2[i].ARN,
+				m.Resources2[i].Public,
+				m.Resources2[i].Interesting,
+				m.Resources2[i].ResourcePolicySummary,
+			},
+		)
+
+	}
+	if len(m.output.Body) > 0 {
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
+		fmt.Printf("[%s][%s] %s resource policies found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+		//fmt.Printf("[%s][%s] Resource policies stored to: %s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.getLootDir())
+	} else {
+		fmt.Printf("[%s][%s] No resource policies found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+
+}
+
+func (m *ResourceTrustsModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer wg.Done()
+
+	servicemap := &awsservicemap.AwsServiceMap{
+		JsonFileSource: "DOWNLOAD_FROM_AWS",
+	}
+	res, err := servicemap.IsServiceInRegion("sns", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getSNSTopicsPerRegion(r, wg, semaphore, dataReceiver)
+	}
+
+	res, err = servicemap.IsServiceInRegion("sqs", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getSQSQueuesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+
+	res, err = servicemap.IsServiceInRegion("ecr", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getECRRecordsPerRegion(r, wg, semaphore, dataReceiver)
+	}
+
+	res, err = servicemap.IsServiceInRegion("codebuild", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getCodeBuildResourcePoliciesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("lambda", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getLambdaPolicyPerRegion(r, wg, semaphore, dataReceiver)
+	}
+	res, err = servicemap.IsServiceInRegion("efs", r)
+	if err != nil {
+		m.modLog.Error(err)
+	}
+	if res {
+		m.CommandCounter.Total++
+		wg.Add(1)
+		m.getEFSfilesystemPoliciesPerRegion(r, wg, semaphore, dataReceiver)
+	}
+
+}
+
+func (m *ResourceTrustsModule) Receiver(receiver chan Resource2, receiverDone chan bool) {
+	defer close(receiverDone)
+	for {
+		select {
+		case data := <-receiver:
+			m.Resources2 = append(m.Resources2, data)
+		case <-receiverDone:
+			receiverDone <- true
+			return
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getSNSTopicsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxSNSClient := InitCloudFoxSNSClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines, m.WrapTable)
+
+	ListTopics, err := cloudFoxSNSClient.listTopics(r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		return
+	}
+
+	for _, t := range ListTopics {
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		topic, err := cloudFoxSNSClient.getTopicWithAttributes(aws.ToString(t.TopicArn), r)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+		parsedArn, err := arn.Parse(aws.ToString(t.TopicArn))
+		if err != nil {
+			topic.Name = aws.ToString(t.TopicArn)
+		}
+		topic.Name = parsedArn.Resource
+		topic.Region = parsedArn.Region
+
+		// check if topic is public or not
+		if topic.Policy.IsPublic() {
+			topic.IsPublic = magenta("Yes")
+			isInteresting = magenta("Yes")
+		} else {
+			topic.IsPublic = "No"
+		}
+
+		// If there is a resouce policy, convert the resource policy into plain english
+		if !topic.Policy.IsEmpty() {
+
+			for i, statement := range topic.Policy.Statement {
+				var prefix string = ""
+				if len(topic.Policy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = statementSummaryInEnglish + prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+
+			}
+			statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+			if isResourcePolicyInteresting(statementSummaryInEnglish) {
+				//magenta(statementSummaryInEnglish)
+				isInteresting = magenta("Yes")
+			}
+
+			dataReceiver <- Resource2{
+				AccountID:             aws.ToString(m.Caller.Account),
+				ARN:                   aws.ToString(t.TopicArn),
+				ResourcePolicySummary: statementSummaryInEnglish,
+				Public:                topic.IsPublic,
+				Region:                parsedArn.Region,
+				Name:                  topic.Name,
+				Interesting:           isInteresting,
+			}
+
+		}
+	}
+
+}
+
+func (m *ResourceTrustsModule) getS3Buckets(wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxS3Client := initCloudFoxS3Client(m.Caller, m.AWSProfile, m.CloudFoxVersion)
+
+	ListBuckets, err := sdk.CachedListBuckets(cloudFoxS3Client.S3Client, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		return
+	}
+
+	for _, b := range ListBuckets {
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		bucket := &Bucket{
+			Arn: fmt.Sprintf("arn:aws:s3:::%s", aws.ToString(b.Name)),
+		}
+		name := aws.ToString(b.Name)
+		region, err := sdk.CachedGetBucketLocation(cloudFoxS3Client.S3Client, aws.ToString(m.Caller.Account), name)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			continue
+		}
+
+		policyJSON, err := sdk.CachedGetBucketPolicy(cloudFoxS3Client.S3Client, aws.ToString(m.Caller.Account), region, aws.ToString(b.Name))
+		if err != nil {
+			m.modLog.Error(err.Error())
+			continue
+		} else {
+			bucket.PolicyJSON = policyJSON
+		}
+
+		policy, err := policy.ParseJSONPolicy([]byte(policyJSON))
+		if err != nil {
+			m.modLog.Error(fmt.Sprintf("parsing bucket access policy (%s) as JSON: %s", name, err))
+		} else {
+			bucket.Policy = policy
+		}
+		// easier to just set the default state to be no and only flip it to yes if we have a case that matches
+		if policy.IsPublic() {
+			bucket.IsPublic = magenta("Yes")
+			isInteresting = magenta("Yes")
+		} else {
+			bucket.IsPublic = "No"
+		}
+
+		// If there is a resouce policy, convert the resource policy into plain english
+		if !bucket.Policy.IsEmpty() {
+			for i, statement := range bucket.Policy.Statement {
+				var prefix string = ""
+				if len(bucket.Policy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = statementSummaryInEnglish + prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+			}
+			statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+			if isResourcePolicyInteresting(statementSummaryInEnglish) {
+				//magenta(statementSummaryInEnglish)
+				isInteresting = magenta("Yes")
+			}
+
+			dataReceiver <- Resource2{
+				AccountID:             aws.ToString(m.Caller.Account),
+				ARN:                   bucket.Arn,
+				ResourcePolicySummary: statementSummaryInEnglish,
+				Public:                bucket.IsPublic,
+				Region:                region,
+				Name:                  name,
+				Interesting:           isInteresting,
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getSQSQueuesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxSQSClient := InitSQSClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+
+	ListQueues, err := cloudFoxSQSClient.listQueues(r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		return
+	}
+
+	for _, q := range ListQueues {
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		var isPublic string = "No"
+		queue, err := cloudFoxSQSClient.getQueueWithAttributes(q, r)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		if !queue.Policy.IsEmpty() {
+			if queue.Policy.IsPublic() {
+				isPublic = magenta("Yes")
+				isInteresting = magenta("Yes")
+			}
+			for i, statement := range queue.Policy.Statement {
+				prefix := ""
+				if len(queue.Policy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(&queue.Arn),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  q,
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getECRRecordsPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxECRClient := InitECRClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+
+	DescribeRepositories, err := cloudFoxECRClient.describeRepositories(r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		return
+	}
+
+	for _, repo := range DescribeRepositories {
+		var isPublic string
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		repoPolicy, err := cloudFoxECRClient.getECRRepositoryPolicy(r, aws.ToString(repo.RepositoryName))
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		if !repoPolicy.IsEmpty() {
+			if repoPolicy.IsPublic() {
+				isPublic = magenta("Yes")
+				isInteresting = magenta("Yes")
+			} else {
+				isPublic = "No"
+			}
+			for i, statement := range repoPolicy.Statement {
+				prefix := ""
+				if len(repoPolicy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(repo.RepositoryArn),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  aws.ToString(repo.RepositoryName),
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getCodeBuildResourcePoliciesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxCodeBuildClient := InitCodeBuildClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+
+	ListProjects, err := sdk.CachedCodeBuildListProjects(cloudFoxCodeBuildClient.CodeBuildClient, aws.ToString(cloudFoxCodeBuildClient.Caller.Account), r)
+	if err != nil {
+		m.modLog.Error(err.Error())
+		return
+	}
+
+	for _, p := range ListProjects {
+		var projectPolicy policy.Policy
+		var statementSummaryInEnglish string
+		var isPublic string
+		var isInteresting string = "No"
+		project, err := sdk.CachedCodeBuildBatchGetProjects(cloudFoxCodeBuildClient.CodeBuildClient, aws.ToString(cloudFoxCodeBuildClient.Caller.Account), r, p)
+		if err != nil {
+			m.modLog.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		policyJSON, err := sdk.CachedCodeBuildGetResourcePolicy(cloudFoxCodeBuildClient.CodeBuildClient, aws.ToString(cloudFoxCodeBuildClient.Caller.Account), r, p)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			continue
+		}
+
+		projectPolicy, err = policy.ParseJSONPolicy([]byte(policyJSON))
+
+		if !projectPolicy.IsEmpty() {
+			if projectPolicy.IsPublic() {
+				isPublic = magenta("Yes")
+				isInteresting = magenta("Yes")
+
+			} else {
+				isPublic = "No"
+			}
+			for i, statement := range projectPolicy.Statement {
+				prefix := ""
+				if len(projectPolicy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(project.Arn),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  aws.ToString(project.Name),
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getLambdaPolicyPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxLambdaClient := InitLambdaClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+
+	ListFunctions, err := cloudFoxLambdaClient.listFunctions(r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return
+	}
+
+	for _, f := range ListFunctions {
+		var isPublic string
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		functionPolicy, err := cloudFoxLambdaClient.getResourcePolicy(r, aws.ToString(f.FunctionName))
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		if !functionPolicy.IsEmpty() {
+			if functionPolicy.IsPublic() {
+				isPublic = magenta("Yes")
+				isInteresting = magenta("Yes")
+
+			} else {
+				isPublic = "No"
+			}
+			for i, statement := range functionPolicy.Statement {
+				prefix := ""
+				if len(functionPolicy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(f.FunctionArn),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  aws.ToString(f.FunctionName),
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func (m *ResourceTrustsModule) getEFSfilesystemPoliciesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Resource2) {
+	defer func() {
+		m.CommandCounter.Executing--
+		m.CommandCounter.Complete++
+		wg.Done()
+
+	}()
+	semaphore <- struct{}{}
+	defer func() { <-semaphore }()
+
+	cloudFoxEFSClient := InitFileSystemsClient(m.Caller, m.AWSProfile, m.CloudFoxVersion, m.Goroutines)
+
+	ListFileSystems, err := sdk.CachedDescribeFileSystems(cloudFoxEFSClient.EFSClient, aws.ToString(m.Caller.Account), r)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return
+	}
+
+	for _, fs := range ListFileSystems {
+		var isPublic string
+		var statementSummaryInEnglish string
+		var isInteresting string = "No"
+		fsPolicy, err := sdk.CachedDescribeFileSystemPolicy(cloudFoxEFSClient.EFSClient, aws.ToString(fs.FileSystemId), r, aws.ToString(m.Caller.Account))
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			m.CommandCounter.Error++
+			continue
+		}
+
+		if fsPolicy.IsPublic() {
+			isPublic = magenta("Yes")
+			isInteresting = magenta("Yes")
+
+		} else {
+			isPublic = "No"
+		}
+
+		if !fsPolicy.IsEmpty() {
+			for i, statement := range fsPolicy.Statement {
+				prefix := ""
+				if len(fsPolicy.Statement) > 1 {
+					prefix = fmt.Sprintf("Statement %d says: ", i)
+					statementSummaryInEnglish = prefix + statement.GetStatementSummaryInEnglish(*m.Caller.Account) + "\n"
+				} else {
+					statementSummaryInEnglish = statement.GetStatementSummaryInEnglish(*m.Caller.Account)
+				}
+				statementSummaryInEnglish = strings.TrimSuffix(statementSummaryInEnglish, "\n")
+				if isResourcePolicyInteresting(statementSummaryInEnglish) {
+					//magenta(statementSummaryInEnglish)
+					isInteresting = magenta("Yes")
+				}
+
+				dataReceiver <- Resource2{
+					AccountID:             aws.ToString(m.Caller.Account),
+					ARN:                   aws.ToString(fs.FileSystemArn),
+					ResourcePolicySummary: statementSummaryInEnglish,
+					Public:                isPublic,
+					Name:                  aws.ToString(fs.Name),
+					Region:                r,
+					Interesting:           isInteresting,
+				}
+			}
+		}
+	}
+}
+
+func isResourcePolicyInteresting(statementSummaryInEnglish string) bool {
+	// check if the statement has any of the following items, but make sure the check is case insensitive
+	// if it does, then return true
+	// if it doesn't, then return false
+
+	if //(strings.Contains(strings.ToLower(statementSummaryInEnglish), "*") && !strings.Contains(strings.ToLower(statementSummaryInEnglish), "denied")) ||
+	(strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("Everyone")) && !strings.Contains(strings.ToLower(statementSummaryInEnglish), "denied")) ||
+		strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("aws:PrincipalOrgID")) ||
+		strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("aws:PrincipalAccount")) ||
+		strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("aws:PrincipalOrgPaths")) ||
+		strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("role")) ||
+		strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("root")) ||
+		(strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("aws:arn")) && !strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("SourceArn"))) ||
+		(strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("aws:arn")) && !strings.Contains(strings.ToLower(statementSummaryInEnglish), strings.ToLower("SourceAccount"))) {
+
+		return true
+	}
+	return false
+}

aws/role-trusts.go

@@ -1,7 +1,6 @@
 package aws
 
 import (
-	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -12,6 +11,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
@@ -22,8 +22,7 @@ import (
 
 type RoleTrustsModule struct {
 	// General configuration data
-	IAMClientListRoles               iam.ListRolesAPIClient
-	IAMClient                        *iam.Client
+	IAMClient                        sdk.AWSIAMClientInterface
 	IAMSimulatePrincipalPolicyClient iam.SimulatePrincipalPolicyAPIClient
 
 	Caller         sts.GetCallerIdentityOutput
@@ -101,7 +100,7 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 	fmt.Printf("[%s][%s] Enumerating role trusts for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
 	//fmt.Printf("[%s][%s] Looking for pmapper data for this account and building a PrivEsc graph in golang if it exists.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	m.pmapperMod, m.pmapperError = initPmapperGraph(m.Caller, m.AWSProfile, m.Goroutines)
-	m.iamSimClient = initIAMSimClient(m.IAMSimulatePrincipalPolicyClient, m.Caller, m.AWSProfile, m.Goroutines)
+	m.iamSimClient = initIAMSimClient(m.IAMClient, m.Caller, m.AWSProfile, m.Goroutines)
 	// if m.pmapperError != nil {
 	// 	fmt.Printf("[%s][%s] No pmapper data found for this account. Using cloudfox's iam-simulator for role analysis\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	// } else {
@@ -119,19 +118,67 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputFormat string, outputDirectory
 
 		}
 	}
+	o := internal.OutputClient{
+		Verbosity:     verbosity,
+		CallingModule: m.output.CallingModule,
+		Table: internal.TableClient{
+			Wrap: m.WrapTable,
+		},
+	}
+
+	o.PrefixIdentifier = m.AWSProfile
+	o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+
+	principalsHeader, principalsBody := m.printPrincipalTrusts(outputFormat, outputDirectory)
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header: principalsHeader,
+		Body:   principalsBody,
+		Name:   "role-trusts-principals",
+	})
+
+	servicesHeader, servicesBody := m.printServiceTrusts(outputFormat, outputDirectory)
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header: servicesHeader,
+		Body:   servicesBody,
+		Name:   "role-trusts-services",
+	})
+
+	federatedHeader, federatedBody := m.printFederatedTrusts(outputFormat, outputDirectory)
+	o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+		Header: federatedHeader,
+		Body:   federatedBody,
+		Name:   "role-trusts-federated",
+	})
+
+	o.WriteFullOutput(o.Table.TableFiles, nil)
+	if len(principalsBody) > 0 {
+		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(principalsBody)))
+	} else {
+		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+	if len(servicesBody) > 0 {
+		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(servicesBody)))
+	} else {
+		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
+	if len(federatedBody) > 0 {
+		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(federatedBody)))
+	} else {
+		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	}
 
-	m.printPrincipalTrusts(outputFormat, outputDirectory)
-	m.printServiceTrusts(outputFormat, outputDirectory)
-	m.printFederatedTrusts(outputFormat, outputDirectory)
 }
 
-func (m *RoleTrustsModule) printPrincipalTrusts(outputFormat string, outputDirectory string) {
+func (m *RoleTrustsModule) printPrincipalTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+	var header []string
+	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-principals"
+	var column1 string
 	if m.pmapperError == nil {
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Principal",
 			"ExternalID",
@@ -139,7 +186,7 @@ func (m *RoleTrustsModule) printPrincipalTrusts(outputFormat string, outputDirec
 			"CanPrivEscToAdmin?",
 		}
 	} else {
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Principal",
 			"ExternalID",
@@ -152,41 +199,49 @@ func (m *RoleTrustsModule) printPrincipalTrusts(outputFormat string, outputDirec
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			for _, principal := range statement.Principal.AWS {
-				column1 := aws.ToString(role.roleARN)
+				if outputFormat == "wide" {
+					column1 = aws.ToString(role.roleARN)
+				} else {
+					column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
+				}
 				column2 := principal
 				column3 := statement.Condition.StringEquals.StsExternalID
 				column4 := role.Admin
 				column5 := role.CanPrivEsc
 				if m.pmapperError == nil {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4, column5})
+					body = append(body, []string{column1, column2, column3, column4, column5})
 				} else {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4})
+					body = append(body, []string{column1, column2, column3, column4})
 				}
 
 			}
 		}
 	}
 	m.sortTrustsTablePerTrustedPrincipal()
-	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
-		////m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+	return header, body
+	// if len(m.output.Body) > 0 {
+	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
+	// 	////m.output.OutputSelector(outputFormat)
+	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
+	// 	//internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
-	} else {
-		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	}
-	fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
+	// } else {
+	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	// }
+	// fmt.Printf("[%s][%s] For context and next steps: https://github.com/BishopFox/cloudfox/wiki/AWS-Commands#%s\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), m.output.CallingModule)
 }
 
-func (m *RoleTrustsModule) printServiceTrusts(outputFormat string, outputDirectory string) {
+func (m *RoleTrustsModule) printServiceTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+	var header []string
+	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-services"
+	var column1 string
 	if m.pmapperError == nil {
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Service",
 			"ExternalID",
@@ -194,7 +249,7 @@ func (m *RoleTrustsModule) printServiceTrusts(outputFormat string, outputDirecto
 			"CanPrivEscToAdmin?",
 		}
 	} else {
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Service",
 			"ExternalID",
@@ -206,42 +261,55 @@ func (m *RoleTrustsModule) printServiceTrusts(outputFormat string, outputDirecto
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			for _, service := range statement.Principal.Service {
-				column1 := aws.ToString(role.roleARN)
+				if outputFormat == "wide" {
+					column1 = aws.ToString(role.roleARN)
+				} else {
+					column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
+				}
 				column2 := service
 				column3 := statement.Condition.StringEquals.StsExternalID
 				column4 := role.Admin
 				column5 := role.CanPrivEsc
 				if m.pmapperError == nil {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4, column5})
+					body = append(body, []string{column1, column2, column3, column4, column5})
 				} else {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4})
+					body = append(body, []string{column1, column2, column3, column4})
 				}
 			}
 		}
 	}
 
-	m.sortTrustsTablePerTrustedPrincipal()
-	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+	// sort the rows based on column 2 (service)
+	sort.SliceStable(body, func(i, j int) bool {
+		return body[i][1] < body[j][1]
+	})
 
-	} else {
-		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	}
+	//m.sortTrustsTablePerTrustedPrincipal()
+	return header, body
+
+	// if len(m.output.Body) > 0 {
+	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
+	// 	//m.output.OutputSelector(outputFormat)
+	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
+	// 	internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+
+	// } else {
+	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	// }
 }
 
-func (m *RoleTrustsModule) printFederatedTrusts(outputFormat string, outputDirectory string) {
+func (m *RoleTrustsModule) printFederatedTrusts(outputFormat string, outputDirectory string) ([]string, [][]string) {
+	var header []string
+	var body [][]string
 	m.output.FullFilename = ""
 	m.output.Body = nil
 	m.output.CallingModule = "role-trusts"
 	m.output.FullFilename = "role-trusts-federated"
-	var column3, column2 string
+	var column1, column3, column2 string
 	if m.pmapperError == nil {
 
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Provider",
 			"Trusted Subject",
@@ -249,7 +317,7 @@ func (m *RoleTrustsModule) printFederatedTrusts(outputFormat string, outputDirec
 			"CanPrivEscToAdmin?",
 		}
 	} else {
-		m.output.Headers = []string{
+		header = []string{
 			"Role",
 			"Trusted Provider",
 			"Trusted Subject",
@@ -259,39 +327,44 @@ func (m *RoleTrustsModule) printFederatedTrusts(outputFormat string, outputDirec
 	}
 
 	for _, role := range m.AnalyzedRoles {
-		column1 := aws.ToString(role.roleARN)
-
+		if outputFormat == "wide" {
+			column1 = aws.ToString(role.roleARN)
+		} else {
+			column1 = GetResourceNameFromArn(aws.ToString(role.roleARN))
+		}
 		for _, statement := range role.trustsDoc.Statement {
 			if len(statement.Principal.Federated) > 0 {
 				column2, column3 = parseFederatedTrustPolicy(statement)
 				column4 := role.Admin
 				column5 := role.CanPrivEsc
 				if m.pmapperError == nil {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4, column5})
+					body = append(body, []string{column1, column2, column3, column4, column5})
 				} else {
-					m.output.Body = append(m.output.Body, []string{column1, column2, column3, column4})
+					body = append(body, []string{column1, column2, column3, column4})
 				}
 			}
 		}
 	}
 
 	m.sortTrustsTablePerTrustedPrincipal()
-	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
-		//m.output.OutputSelector(outputFormat)
-		//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
-		internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+	return header, body
 
-	} else {
-		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
-	}
+	// if len(m.output.Body) > 0 {
+	// 		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account),m.AWSProfile))
+	// 	//m.output.OutputSelector(outputFormat)
+	// 	//utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
+	// 	internal.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+	// 	fmt.Printf("[%s][%s] %s role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
+
+	// } else {
+	// 	fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	// }
 }
 
 func parseFederatedTrustPolicy(statement RoleTrustStatementEntry) (string, string) {
 	var column2, column3 string
 	if statement.Condition.StringLike.TokenActionsGithubusercontentComAud != "" || len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
-		column2 = "GitHub Actions  (" + statement.Principal.Federated[0] + ")"
+		column2 = "GitHub Actions" //  (" + statement.Principal.Federated[0] + ")"
 		trustedRepos := strings.Join(statement.Condition.StringLike.TokenActionsGithubusercontentComSub, "\n")
 		if trustedRepos == "" {
 			column3 = "ALL REPOS!!!"
@@ -300,13 +373,13 @@ func parseFederatedTrustPolicy(statement RoleTrustStatementEntry) (string, strin
 		}
 	} else if statement.Condition.StringEquals.SAMLAud == "https://signin.aws.amazon.com/saml" {
 		if strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO (" + statement.Principal.Federated[0] + ")"
+			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
 		} else if strings.Contains(statement.Principal.Federated[0], "Okta") {
-			column2 = "Okta  (" + statement.Principal.Federated[0] + ")"
+			column2 = "Okta" //  (" + statement.Principal.Federated[0] + ")"
 		}
 		column3 = "Not applicable"
 	} else if statement.Condition.StringEquals.OidcEksAud != "" || statement.Condition.StringEquals.OidcEksSub != "" || statement.Condition.StringLike.OidcEksAud != "" || statement.Condition.StringLike.OidcEksSub != "" {
-		column2 = "EKS (" + statement.Principal.Federated[0] + ")"
+		column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
 		if statement.Condition.StringEquals.OidcEksSub != "" {
 			column3 = statement.Condition.StringEquals.OidcEksSub
 		} else if statement.Condition.StringLike.OidcEksSub != "" {
@@ -315,16 +388,16 @@ func parseFederatedTrustPolicy(statement RoleTrustStatementEntry) (string, strin
 			column3 = "ALL SERVICE ACCOUNTS!"
 		}
 	} else if statement.Principal.Federated[0] == "cognito-identity.amazonaws.com" {
-		column2 = "Cognito (" + statement.Principal.Federated[0] + ")"
+		column2 = "Cognito" // (" + statement.Principal.Federated[0] + ")"
 		if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
 			column3 = statement.Condition.ForAnyValueStringLike.CognitoAMR
 		}
 	} else {
 		if column2 == "" && strings.Contains(statement.Principal.Federated[0], "oidc.eks") {
-			column2 = "EKS (" + statement.Principal.Federated[0] + ")"
+			column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
 			column3 = "ALL SERVICE ACCOUNTS!"
 		} else if column2 == "" && strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO (" + statement.Principal.Federated[0] + ")"
+			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
 		}
 
 	}
@@ -341,50 +414,31 @@ func (m *RoleTrustsModule) sortTrustsTablePerTrustedPrincipal() {
 }
 
 func (m *RoleTrustsModule) getAllRoleTrusts() {
-	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationMarker *string
+	ListRoles, err := sdk.CachedIamListRoles(m.IAMClient, aws.ToString(m.Caller.Account))
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+	}
 
-	// This for loop exits at the end depending on whether the output hits its last page (see pagination control block at the end of the loop).
-	for {
-		results, err := m.IAMClientListRoles.ListRoles(
-			context.TODO(),
-			&iam.ListRolesInput{
-				Marker: PaginationMarker,
-			},
-		)
+	for _, role := range ListRoles {
+		trustsdoc, err := parseRoleTrustPolicyDocument(role)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
 			break
 		}
 
-		for _, role := range results.Roles {
-			trustsdoc, err := parseRoleTrustPolicyDocument(role)
-			if err != nil {
-				m.modLog.Error(err.Error())
-				m.CommandCounter.Error++
-				break
-			}
-
-			if role.Arn != nil {
-				m.AnalyzedRoles = append(m.AnalyzedRoles, AnalyzedRole{
-					roleARN:    role.Arn,
-					trustsDoc:  trustsdoc,
-					Admin:      "",
-					CanPrivEsc: "",
-				})
-			}
-
+		if role.Arn != nil {
+			m.AnalyzedRoles = append(m.AnalyzedRoles, AnalyzedRole{
+				roleARN:    role.Arn,
+				trustsDoc:  trustsdoc,
+				Admin:      "",
+				CanPrivEsc: "",
+			})
 		}
 
-		// Pagination control. After the last page of output, the for loop exits.
-		if results.IsTruncated {
-			PaginationMarker = results.Marker
-		} else {
-			PaginationMarker = nil
-			break
-		}
 	}
+
 }
 
 func parseRoleTrustPolicyDocument(role types.Role) (trustPolicyDocument, error) {

aws/route53.go

@@ -1,22 +1,21 @@
 package aws
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 
+	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/route53"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/sirupsen/logrus"
 )
 
 type Route53Module struct {
 	// General configuration data
-	Route53Client *route53.Client
+	Route53Client sdk.AWSRoute53ClientInterface
 
 	Caller         sts.GetCallerIdentityOutput
 	AWSRegions     []string
@@ -83,11 +82,27 @@ func (m *Route53Module) PrintRoute53(outputFormat string, outputDirectory string
 	}
 	if len(m.output.Body) > 0 {
 
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
+		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 		//m.output.OutputSelector(outputFormat)
 		//utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
-		internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
-		m.writeLoot(m.output.FilePath, verbosity)
+		//internal.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule, m.WrapTable, m.AWSProfile)
+		//m.writeLoot(m.output.FilePath, verbosity)
+		o := internal.OutputClient{
+			Verbosity:     verbosity,
+			CallingModule: m.output.CallingModule,
+			Table: internal.TableClient{
+				Wrap: m.WrapTable,
+			},
+		}
+		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
+			Header: m.output.Headers,
+			Body:   m.output.Body,
+			Name:   m.output.CallingModule,
+		})
+		o.PrefixIdentifier = m.AWSProfile
+		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		o.WriteFullOutput(o.Table.TableFiles, nil)
+		m.writeLoot(o.Table.DirectoryName, verbosity)
 		fmt.Printf("[%s][%s] %s DNS records found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 
 	} else {
@@ -111,7 +126,7 @@ func (m *Route53Module) writeLoot(outputDirectory string, verbosity int) {
 	var route53APublicRecords string
 
 	for _, record := range m.Records {
-		if record.Type == "A" || record.Type == "AAAA" {
+		if record.Type == "A" || record.Type == "AAAA" || record.Type == "CNAME" {
 			if record.PrivateZone == "True" {
 				route53APrivateRecords = route53APrivateRecords + fmt.Sprintln(record.Name)
 			} else {
@@ -160,71 +175,51 @@ func (m *Route53Module) writeLoot(outputDirectory string, verbosity int) {
 
 func (m *Route53Module) getRoute53Records() {
 	// "PaginationMarker" is a control variable used for output continuity, as AWS return the output in pages.
-	var PaginationControl *string
 	var recordName string
 	var recordType string
 
-	for {
-		ListHostedZones, err := m.Route53Client.ListHostedZones(
-			context.TODO(),
-			&route53.ListHostedZonesInput{
-				Marker: PaginationControl,
-			},
-		)
+	HostedZones, err := sdk.CachedRoute53ListHostedZones(m.Route53Client, aws.ToString(m.Caller.Account))
+
+	if err != nil {
+		m.modLog.Error(err.Error())
+		m.CommandCounter.Error++
+		return
+	}
+
+	var privateZone string
+	for _, zone := range HostedZones {
+		if zone.Config.PrivateZone {
+			privateZone = "True"
+		} else {
+			privateZone = "False"
+		}
+
+		Records, err := sdk.CachedRoute53ListResourceRecordSets(m.Route53Client, aws.ToString(m.Caller.Account), aws.ToString(zone.Id))
 
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
 			break
 		}
+		for _, record := range Records {
+			recordName = aws.ToString(record.Name)
+			recordType = string(record.Type)
+
+			for _, resourceRecord := range record.ResourceRecords {
+				recordValue := resourceRecord.Value
+				m.Records = append(
+					m.Records,
+					Record{
+						AWSService:  "Route53",
+						Name:        recordName,
+						Type:        recordType,
+						Value:       aws.ToString(recordValue),
+						PrivateZone: privateZone,
+					})
 
-		var privateZone string
-		for _, zone := range ListHostedZones.HostedZones {
-			id := aws.ToString(zone.Id)
-			if zone.Config.PrivateZone {
-				privateZone = "True"
-			} else {
-				privateZone = "False"
 			}
-
-			ListResourceRecordSets, err := m.Route53Client.ListResourceRecordSets(
-				context.TODO(),
-				&route53.ListResourceRecordSetsInput{
-					HostedZoneId: &id,
-				},
-			)
-			if err != nil {
-				m.modLog.Error(err.Error())
-				m.CommandCounter.Error++
-				break
-			}
-			for _, record := range ListResourceRecordSets.ResourceRecordSets {
-				recordName = aws.ToString(record.Name)
-				recordType = string(record.Type)
-
-				for _, resourceRecord := range record.ResourceRecords {
-					recordValue := resourceRecord.Value
-					m.Records = append(
-						m.Records,
-						Record{
-							AWSService:  "Route53",
-							Name:        recordName,
-							Type:        recordType,
-							Value:       aws.ToString(recordValue),
-							PrivateZone: privateZone,
-						})
-
-				}
-			}
-
 		}
 
-		// The "NextToken" value is nil when there's no more data to return.
-		if ListHostedZones.NextMarker != nil {
-			PaginationControl = ListHostedZones.NextMarker
-		} else {
-			PaginationControl = nil
-			break
-		}
 	}
+
 }

aws/sdk/apigateway.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/apigateway"
+	apiGatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+)
+
+type APIGatewayClientInterface interface {
+	GetRestApis(context.Context, *apigateway.GetRestApisInput, ...func(*apigateway.Options)) (*apigateway.GetRestApisOutput, error)
+}
+
+func init() {
+	gob.Register([]apiGatewayTypes.RestApi{})
+}
+
+// create a CachedApiGatewayGetRestAPIs function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination
+func CachedApiGatewayGetRestAPIs(client APIGatewayClientInterface, accountID string, region string) ([]apiGatewayTypes.RestApi, error) {
+	var PaginationControl *string
+	var restAPIs []apiGatewayTypes.RestApi
+	cacheKey := fmt.Sprintf("%s-apigateway-GetRestApis-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatewayTypes.RestApi), nil
+	}
+
+	for {
+		GetRestApis, err := client.GetRestApis(
+			context.TODO(),
+			&apigateway.GetRestApisInput{
+				Position: PaginationControl,
+			},
+			func(o *apigateway.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return restAPIs, err
+		}
+
+		restAPIs = append(restAPIs, GetRestApis.Items...)
+
+		//pagination
+		if GetRestApis.Position == nil {
+			break
+		}
+		PaginationControl = GetRestApis.Position
+	}
+
+	return restAPIs, nil
+}

aws/sdk/apigateway_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apigateway"
+	apiGatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+)
+
+type MockedAWSAPIGatewayClient struct {
+}
+
+func (m *MockedAWSAPIGatewayClient) GetRestApis(ctx context.Context, input *apigateway.GetRestApisInput, options ...func(*apigateway.Options)) (*apigateway.GetRestApisOutput, error) {
+	return &apigateway.GetRestApisOutput{
+		Items: []apiGatewayTypes.RestApi{
+			{
+				Id:   aws.String("api1"),
+				Name: aws.String("api1"),
+			},
+			{
+				Id:   aws.String("api2"),
+				Name: aws.String("api2"),
+			},
+		},
+	}, nil
+}

aws/sdk/apigatewayv2.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/apigatewayv2"
+	apiGatwayV2Types "github.com/aws/aws-sdk-go-v2/service/apigatewayv2/types"
+
+	"github.com/patrickmn/go-cache"
+)
+
+type APIGatewayv2ClientInterface interface {
+	GetApis(context.Context, *apigatewayv2.GetApisInput, ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApisOutput, error)
+}
+
+func init() {
+	gob.Register([]apiGatwayV2Types.Api{})
+}
+
+func CachedAPIGatewayv2GetAPIs(client APIGatewayv2ClientInterface, accountID string, region string) ([]apiGatwayV2Types.Api, error) {
+	var PaginationControl *string
+	var apis []apiGatwayV2Types.Api
+	cacheKey := fmt.Sprintf("%s-apigatewayv2-GetApis-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apiGatwayV2Types.Api), nil
+	}
+	for {
+		GetApis, err := client.GetApis(
+			context.TODO(),
+			&apigatewayv2.GetApisInput{
+				NextToken: PaginationControl,
+			},
+			func(o *apigatewayv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return apis, err
+		}
+
+		apis = append(apis, GetApis.Items...)
+
+		//pagination
+		if GetApis.NextToken == nil {
+			break
+		}
+		PaginationControl = GetApis.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, apis, cache.DefaultExpiration)
+	return apis, nil
+}

aws/sdk/apigatewayv2_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apigatewayv2"
+	apiGatwayV2Types "github.com/aws/aws-sdk-go-v2/service/apigatewayv2/types"
+)
+
+type MockedAWSAPIGatewayv2Client struct {
+}
+
+func (m *MockedAWSAPIGatewayv2Client) GetApis(ctx context.Context, input *apigatewayv2.GetApisInput, options ...func(*apigatewayv2.Options)) (*apigatewayv2.GetApisOutput, error) {
+	return &apigatewayv2.GetApisOutput{
+		Items: []apiGatwayV2Types.Api{
+			{
+				ApiId: aws.String("api1"),
+				Name:  aws.String("api1"),
+			},
+			{
+				ApiId: aws.String("api2"),
+				Name:  aws.String("api2"),
+			},
+		},
+	}, nil
+}

aws/sdk/apprunner.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/apprunner"
+	apprunnerTypes "github.com/aws/aws-sdk-go-v2/service/apprunner/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AppRunnerClientInterface interface {
+	ListServices(context.Context, *apprunner.ListServicesInput, ...func(*apprunner.Options)) (*apprunner.ListServicesOutput, error)
+}
+
+func init() {
+	gob.Register([]apprunnerTypes.Service{})
+	gob.Register([]apprunnerTypes.ServiceSummary{})
+}
+
+func CachedAppRunnerListServices(client AppRunnerClientInterface, accountID string, region string) ([]apprunnerTypes.ServiceSummary, error) {
+	var PaginationControl *string
+	var services []apprunnerTypes.ServiceSummary
+	cacheKey := fmt.Sprintf("%s-apprunner-ListServices-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]apprunnerTypes.ServiceSummary), nil
+	}
+	for {
+		ListServices, err := client.ListServices(
+			context.TODO(),
+			&apprunner.ListServicesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *apprunner.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return services, err
+		}
+
+		services = append(services, ListServices.ServiceSummaryList...)
+
+		//pagination
+		if ListServices.NextToken == nil {
+			break
+		}
+		PaginationControl = ListServices.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, services, cache.DefaultExpiration)
+	return services, nil
+}

aws/sdk/apprunner_mocks.go

@@ -0,0 +1,25 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/apprunner"
+	apprunnerTypes "github.com/aws/aws-sdk-go-v2/service/apprunner/types"
+)
+
+type MockedAppRunnerClient struct {
+}
+
+func (m *MockedAppRunnerClient) ListServices(ctx context.Context, input *apprunner.ListServicesInput, options ...func(*apprunner.Options)) (*apprunner.ListServicesOutput, error) {
+	return &apprunner.ListServicesOutput{
+		ServiceSummaryList: []apprunnerTypes.ServiceSummary{
+			{
+				ServiceName: aws.String("service1"),
+			},
+			{
+				ServiceName: aws.String("service2"),
+			},
+		},
+	}, nil
+}

aws/sdk/athena.go

@@ -0,0 +1,96 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/athena"
+	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSAthenaClientInterface interface {
+	ListDataCatalogs(context.Context, *athena.ListDataCatalogsInput, ...func(*athena.Options)) (*athena.ListDataCatalogsOutput, error)
+	ListDatabases(context.Context, *athena.ListDatabasesInput, ...func(*athena.Options)) (*athena.ListDatabasesOutput, error)
+}
+
+func init() {
+	gob.Register([]athenaTypes.DataCatalogSummary{})
+}
+
+func CachedAthenaListDataCatalogs(client AWSAthenaClientInterface, accountID string, region string) ([]athenaTypes.DataCatalogSummary, error) {
+	var PaginationControl *string
+	var dataCatalogs []athenaTypes.DataCatalogSummary
+	cacheKey := fmt.Sprintf("%s-athena-ListDataCatalogs-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]athenaTypes.DataCatalogSummary), nil
+	}
+	for {
+		ListDataCatalogs, err := client.ListDataCatalogs(
+			context.TODO(),
+			&athena.ListDataCatalogsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *athena.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return dataCatalogs, err
+		}
+
+		dataCatalogs = append(dataCatalogs, ListDataCatalogs.DataCatalogsSummary...)
+
+		//pagination
+		if ListDataCatalogs.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDataCatalogs.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, dataCatalogs, cache.DefaultExpiration)
+	return dataCatalogs, nil
+}
+
+func CachedAthenaListDatabases(client AWSAthenaClientInterface, accountID string, region string, catalogName string) ([]string, error) {
+	var PaginationControl *string
+	var databases []string
+	cacheKey := fmt.Sprintf("%s-athena-ListDatabases-%s-%s", accountID, region, catalogName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDatabases, err := client.ListDatabases(
+			context.TODO(),
+			&athena.ListDatabasesInput{
+				CatalogName: &catalogName,
+				NextToken:   PaginationControl,
+			},
+			func(o *athena.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return databases, err
+		}
+
+		for _, database := range ListDatabases.DatabaseList {
+			databases = append(databases, *database.Name)
+		}
+
+		//pagination
+		if ListDatabases.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDatabases.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, databases, cache.DefaultExpiration)
+	return databases, nil
+}

aws/sdk/athena_mocks.go

@@ -0,0 +1,38 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/athena"
+	athenaTypes "github.com/aws/aws-sdk-go-v2/service/athena/types"
+)
+
+type MockedAWSAthenaClient struct {
+}
+
+func (m *MockedAWSAthenaClient) ListDatabases(ctx context.Context, input *athena.ListDatabasesInput, options ...func(*athena.Options)) (*athena.ListDatabasesOutput, error) {
+	return &athena.ListDatabasesOutput{
+		DatabaseList: []athenaTypes.Database{
+			{
+				Name: aws.String("db1"),
+			},
+			{
+				Name: aws.String("db2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSAthenaClient) ListDataCatalogs(ctx context.Context, input *athena.ListDataCatalogsInput, options ...func(*athena.Options)) (*athena.ListDataCatalogsOutput, error) {
+	return &athena.ListDataCatalogsOutput{
+		DataCatalogsSummary: []athenaTypes.DataCatalogSummary{
+			{
+				CatalogName: aws.String("catalog1"),
+			},
+			{
+				CatalogName: aws.String("catalog2"),
+			},
+		},
+	}, nil
+}

aws/sdk/cloudformation.go

@@ -0,0 +1,119 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
+	cloudFormationTypes "github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type CloudFormationClientInterface interface {
+	GetTemplate(context.Context, *cloudformation.GetTemplateInput, ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error)
+	DescribeStacks(context.Context, *cloudformation.DescribeStacksInput, ...func(*cloudformation.Options)) (*cloudformation.DescribeStacksOutput, error)
+	ListStacks(context.Context, *cloudformation.ListStacksInput, ...func(*cloudformation.Options)) (*cloudformation.ListStacksOutput, error)
+}
+
+func init() {
+	gob.Register([]cloudFormationTypes.Stack{})
+	gob.Register([]cloudFormationTypes.StackSummary{})
+}
+
+func CachedCloudFormationDescribeStacks(client CloudFormationClientInterface, accountID string, region string) ([]cloudFormationTypes.Stack, error) {
+	var PaginationControl *string
+	var stacks []cloudFormationTypes.Stack
+	cacheKey := fmt.Sprintf("%s-cloudformation-DescribeStacks-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]cloudFormationTypes.Stack), nil
+	}
+	for {
+		DescribeStacks, err := client.DescribeStacks(
+			context.TODO(),
+			&cloudformation.DescribeStacksInput{
+				NextToken: PaginationControl,
+			},
+			func(o *cloudformation.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return stacks, err
+		}
+
+		stacks = append(stacks, DescribeStacks.Stacks...)
+		//pagination
+		if DescribeStacks.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeStacks.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, stacks, cache.DefaultExpiration)
+	return stacks, nil
+}
+
+func CachedCloudFormationGetTemplate(client CloudFormationClientInterface, accountID string, region string, stackName string) (string, error) {
+	var stackTemplateBody string
+	cacheKey := fmt.Sprintf("%s-cloudformation-GetTemplate-%s-%s", accountID, region, stackName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(string), nil
+	}
+
+	GetTemplate, err := client.GetTemplate(
+		context.TODO(),
+		&cloudformation.GetTemplateInput{
+			StackName: &stackName,
+		}, func(o *cloudformation.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return stackTemplateBody, err
+	}
+	stackTemplateBody = aws.ToString(GetTemplate.TemplateBody)
+	internal.Cache.Set(cacheKey, *GetTemplate.TemplateBody, cache.DefaultExpiration)
+	return stackTemplateBody, nil
+}
+
+func CachedCloudFormationListStacks(client CloudFormationClientInterface, accountID string, region string) ([]cloudFormationTypes.StackSummary, error) {
+	var PaginationControl *string
+	var stacks []cloudFormationTypes.StackSummary
+	cacheKey := fmt.Sprintf("%s-cloudformation-ListStacks-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]cloudFormationTypes.StackSummary), nil
+	}
+	for {
+		ListStacks, err := client.ListStacks(
+			context.TODO(),
+			&cloudformation.ListStacksInput{
+				NextToken: PaginationControl,
+			},
+			func(o *cloudformation.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return stacks, err
+		}
+
+		stacks = append(stacks, ListStacks.StackSummaries...)
+		//pagination
+		if ListStacks.NextToken == nil {
+			break
+		}
+		PaginationControl = ListStacks.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, stacks, cache.DefaultExpiration)
+	return stacks, nil
+}

aws/sdk/cloudformation_mocks.go

@@ -0,0 +1,73 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudformation"
+	"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
+)
+
+const DESCRIBE_STACKS_TEST_FILE = "./test-data/cloudformation-describestacks.json"
+const TEMPLATE_BODY_TEST_FILE = "./test-data/cloudformation-getTemplate.json"
+
+type Stacks struct {
+	Stacks []struct {
+		StackID           string            `json:"StackId"`
+		Description       string            `json:"Description"`
+		Tags              []interface{}     `json:"Tags"`
+		Outputs           []types.Output    `json:"Outputs"`
+		Parameters        []types.Parameter `json:"Parameters"`
+		StackStatusReason interface{}       `json:"StackStatusReason"`
+		CreationTime      time.Time         `json:"CreationTime"`
+		Capabilities      []interface{}     `json:"Capabilities"`
+		StackName         string            `json:"StackName"`
+		RoleArn           string            `json:"RoleArn"`
+		StackStatus       string            `json:"StackStatus"`
+		DisableRollback   bool              `json:"DisableRollback"`
+	} `json:"Stacks"`
+}
+
+type TemplateBody struct {
+	TemplateBody string `json:"TemplateBody"`
+}
+
+type MockedCloudformationClient struct {
+	describeStacks  Stacks
+	getTemplateBody TemplateBody
+}
+
+func (m *MockedCloudformationClient) DescribeStacks(ctx context.Context, params *cloudformation.DescribeStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.DescribeStacksOutput, error) {
+
+	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.describeStacks)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_STACKS_TEST_FILE)
+	}
+	var stacks []types.Stack
+	for _, stack := range m.describeStacks.Stacks {
+		stacks = append(stacks, types.Stack{
+			StackName:  &stack.StackName,
+			RoleARN:    &stack.RoleArn,
+			Outputs:    stack.Outputs,
+			Parameters: stack.Parameters,
+		})
+
+	}
+
+	return &cloudformation.DescribeStacksOutput{Stacks: stacks}, nil
+}
+
+func (m *MockedCloudformationClient) GetTemplate(ctx context.Context, params *cloudformation.GetTemplateInput, optFns ...func(*cloudformation.Options)) (*cloudformation.GetTemplateOutput, error) {
+	err := json.Unmarshal(readTestFile(DESCRIBE_STACKS_TEST_FILE), &m.getTemplateBody)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", TEMPLATE_BODY_TEST_FILE)
+	}
+
+	return &cloudformation.GetTemplateOutput{TemplateBody: &m.getTemplateBody.TemplateBody}, nil
+}
+
+func (m *MockedCloudformationClient) ListStacks(ctx context.Context, params *cloudformation.ListStacksInput, optFns ...func(*cloudformation.Options)) (*cloudformation.ListStacksOutput, error) {
+	return &cloudformation.ListStacksOutput{}, nil
+}

aws/sdk/cloudfront.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/cloudfront"
+	cloudfrontTypes "github.com/aws/aws-sdk-go-v2/service/cloudfront/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCloudFrontClientInterface interface {
+	ListDistributions(ctx context.Context, params *cloudfront.ListDistributionsInput, optFns ...func(*cloudfront.Options)) (*cloudfront.ListDistributionsOutput, error)
+}
+
+func init() {
+	gob.Register([]cloudfrontTypes.DistributionSummary{})
+	gob.Register(cloudfrontTypes.DistributionSummary{})
+}
+
+func CachedCloudFrontListDistributions(CloudFrontClient AWSCloudFrontClientInterface, accountID string) ([]cloudfrontTypes.DistributionSummary, error) {
+	var PaginationControl *string
+	var distributions []cloudfrontTypes.DistributionSummary
+	cacheKey := "cloudfront-ListDistributions-" + accountID
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached CloudFront distributions data")
+		return cached.([]cloudfrontTypes.DistributionSummary), nil
+	}
+
+	for {
+		ListDistributions, err := CloudFrontClient.ListDistributions(
+			context.TODO(),
+			&cloudfront.ListDistributionsInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		distributions = append(distributions, ListDistributions.DistributionList.Items...)
+
+		// Pagination control.
+		if ListDistributions.DistributionList.NextMarker != nil {
+			PaginationControl = ListDistributions.DistributionList.NextMarker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, distributions, cache.DefaultExpiration)
+	return distributions, nil
+}

aws/sdk/cloudfront_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudfront"
+	cloudfrontTypes "github.com/aws/aws-sdk-go-v2/service/cloudfront/types"
+)
+
+type MockedAWSCloudFrontClient struct {
+}
+
+func (m *MockedAWSCloudFrontClient) ListDistributions(ctx context.Context, input *cloudfront.ListDistributionsInput, options ...func(*cloudfront.Options)) (*cloudfront.ListDistributionsOutput, error) {
+	return &cloudfront.ListDistributionsOutput{
+		DistributionList: &cloudfrontTypes.DistributionList{
+			Items: []cloudfrontTypes.DistributionSummary{
+				{
+					Id: aws.String("distribution1"),
+				},
+				{
+					Id: aws.String("distribution2"),
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/codeartifact.go

@@ -0,0 +1,94 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codeartifact"
+	codeArtifactTypes "github.com/aws/aws-sdk-go-v2/service/codeartifact/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeArtifactClientInterface interface {
+	ListDomains(context.Context, *codeartifact.ListDomainsInput, ...func(*codeartifact.Options)) (*codeartifact.ListDomainsOutput, error)
+	ListRepositories(context.Context, *codeartifact.ListRepositoriesInput, ...func(*codeartifact.Options)) (*codeartifact.ListRepositoriesOutput, error)
+}
+
+func init() {
+	gob.Register([]codeArtifactTypes.DomainSummary{})
+	gob.Register([]codeArtifactTypes.RepositorySummary{})
+}
+
+func CachedCodeArtifactListDomains(client AWSCodeArtifactClientInterface, accountID string, region string) ([]codeArtifactTypes.DomainSummary, error) {
+	var PaginationControl *string
+	var domains []codeArtifactTypes.DomainSummary
+	cacheKey := fmt.Sprintf("%s-codeartifact-ListDomains-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeArtifactTypes.DomainSummary), nil
+	}
+	for {
+		ListDomains, err := client.ListDomains(
+			context.TODO(),
+			&codeartifact.ListDomainsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codeartifact.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return domains, err
+		}
+
+		domains = append(domains, ListDomains.Domains...)
+
+		//pagination
+		if ListDomains.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDomains.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, domains, cache.DefaultExpiration)
+	return domains, nil
+}
+
+func CachedCodeArtifactListRepositories(client AWSCodeArtifactClientInterface, accountID string, region string) ([]codeArtifactTypes.RepositorySummary, error) {
+	var PaginationControl *string
+	var repositories []codeArtifactTypes.RepositorySummary
+	cacheKey := fmt.Sprintf("%s-codeartifact-ListRepositories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeArtifactTypes.RepositorySummary), nil
+	}
+	for {
+		ListRepositories, err := client.ListRepositories(
+			context.TODO(),
+			&codeartifact.ListRepositoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codeartifact.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return repositories, err
+		}
+
+		repositories = append(repositories, ListRepositories.Repositories...)
+
+		//pagination
+		if ListRepositories.NextToken == nil {
+			break
+		}
+		PaginationControl = ListRepositories.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, repositories, cache.DefaultExpiration)
+	return repositories, nil
+}

aws/sdk/codeartifact_mocks.go

@@ -0,0 +1,46 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codeartifact"
+	codeArtifactTypes "github.com/aws/aws-sdk-go-v2/service/codeartifact/types"
+)
+
+type MockedAWSCodeArtifactClient struct {
+}
+
+func (m *MockedAWSCodeArtifactClient) ListRepositories(ctx context.Context, input *codeartifact.ListRepositoriesInput, options ...func(*codeartifact.Options)) (*codeartifact.ListRepositoriesOutput, error) {
+	return &codeartifact.ListRepositoriesOutput{
+		NextToken: nil,
+		Repositories: []codeArtifactTypes.RepositorySummary{
+			{
+				Name:       aws.String("repo1"),
+				Arn:        aws.String("arn:aws:codeartifact:us-east-1:123456789012:repository/repo1"),
+				DomainName: aws.String("domain1"),
+			},
+			{
+				Name:       aws.String("repo2"),
+				Arn:        aws.String("arn:aws:codeartifact:us-east-1:123456789012:repository/repo2"),
+				DomainName: aws.String("domain1"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedAWSCodeArtifactClient) ListDomains(ctx context.Context, input *codeartifact.ListDomainsInput, options ...func(*codeartifact.Options)) (*codeartifact.ListDomainsOutput, error) {
+	return &codeartifact.ListDomainsOutput{
+		NextToken: nil,
+		Domains: []codeArtifactTypes.DomainSummary{
+			{
+				Name: aws.String("domain1"),
+				Arn:  aws.String("arn:aws:codeartifact:us-east-1:123456789012:domain/domain1"),
+			},
+			{
+				Name: aws.String("domain2"),
+				Arn:  aws.String("arn:aws:codeartifact:us-east-1:123456789012:domain/domain2"),
+			},
+		},
+	}, nil
+}

aws/sdk/codebuild.go

@@ -0,0 +1,118 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codebuild"
+	codeBuildTypes "github.com/aws/aws-sdk-go-v2/service/codebuild/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type CodeBuildClientInterface interface {
+	ListProjects(ctx context.Context, params *codebuild.ListProjectsInput, optFns ...func(*codebuild.Options)) (*codebuild.ListProjectsOutput, error)
+	BatchGetProjects(ctx context.Context, params *codebuild.BatchGetProjectsInput, optFns ...func(*codebuild.Options)) (*codebuild.BatchGetProjectsOutput, error)
+	GetResourcePolicy(ctx context.Context, params *codebuild.GetResourcePolicyInput, optFns ...func(*codebuild.Options)) (*codebuild.GetResourcePolicyOutput, error)
+}
+
+func init() {
+	gob.Register(codeBuildTypes.Project{})
+
+}
+
+// create a CachedCodeBuildListProjects function that accepts a codebuild client, account id, and region. Make sure it handles the region option and pagination
+func CachedCodeBuildListProjects(CodeBuildClient CodeBuildClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var projects []string
+	cacheKey := fmt.Sprintf("%s-codebuild-ListProjects", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+
+	for {
+		ListProjects, err := CodeBuildClient.ListProjects(
+			context.TODO(),
+			&codebuild.ListProjectsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codebuild.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		projects = append(projects, ListProjects.Projects...)
+
+		// Pagination control.
+		if ListProjects.NextToken != nil {
+			PaginationControl = ListProjects.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, projects, cache.DefaultExpiration)
+	return projects, nil
+
+}
+
+// create a CachedCodeBuildBatchGetProjects function that accepts a codebuild client, account id, region, and a single projectId. Make sure it handles the region option and pagination
+func CachedCodeBuildBatchGetProjects(CodeBuildClient CodeBuildClientInterface, accountID string, region string, projectID string) (codeBuildTypes.Project, error) {
+	project := codeBuildTypes.Project{}
+	cacheKey := fmt.Sprintf("%s-codebuild-BatchGetProjects-%s-%s", accountID, region, projectID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeBuildTypes.Project), nil
+	}
+
+	BatchGetProjects, err := CodeBuildClient.BatchGetProjects(
+		context.TODO(),
+		&codebuild.BatchGetProjectsInput{
+			Names: []string{projectID},
+		},
+		func(o *codebuild.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return project, err
+	}
+
+	internal.Cache.Set(cacheKey, BatchGetProjects.Projects[0], cache.DefaultExpiration)
+	return BatchGetProjects.Projects[0], nil
+}
+
+// create a CachedCodeBuildGetResourcePolicy function that accepts a codebuild client, account id, region, and a single projectId. Make sure it handles the region option and pagination
+func CachedCodeBuildGetResourcePolicy(CodeBuildClient CodeBuildClientInterface, accountID string, region string, projectID string) (string, error) {
+	cacheKey := fmt.Sprintf("%s-codebuild-GetResourcePolicy-%s-%s", accountID, region, projectID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(string), nil
+	}
+
+	GetResourcePolicy, err := CodeBuildClient.GetResourcePolicy(
+		context.TODO(),
+		&codebuild.GetResourcePolicyInput{
+			ResourceArn: aws.String("arn:aws:codebuild:" + region + ":" + accountID + ":project/" + projectID),
+		},
+		func(o *codebuild.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return "", err
+	}
+
+	internal.Cache.Set(cacheKey, GetResourcePolicy, cache.DefaultExpiration)
+	return aws.ToString(GetResourcePolicy.Policy), nil
+}

aws/sdk/codebuild_mocks.go

@@ -0,0 +1,19 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/codebuild"
+)
+
+type MockedCodeBuildClient struct {
+}
+
+func (m *MockedCodeBuildClient) ListProjects(ctx context.Context, input *codebuild.ListProjectsInput, options ...func(*codebuild.Options)) (*codebuild.ListProjectsOutput, error) {
+	return &codebuild.ListProjectsOutput{
+		Projects: []string{
+			"project1",
+			"project2",
+		},
+	}, nil
+}

aws/sdk/codecommit.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codecommit"
+	codeCommitTypes "github.com/aws/aws-sdk-go-v2/service/codecommit/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeCommitClientInterface interface {
+	ListRepositories(context.Context, *codecommit.ListRepositoriesInput, ...func(*codecommit.Options)) (*codecommit.ListRepositoriesOutput, error)
+}
+
+func init() {
+	gob.Register([]codeCommitTypes.RepositoryNameIdPair{})
+}
+
+func CachedCodeCommitListRepositories(client AWSCodeCommitClientInterface, accountID string, region string) ([]codeCommitTypes.RepositoryNameIdPair, error) {
+	var PaginationControl *string
+	var repositories []codeCommitTypes.RepositoryNameIdPair
+	cacheKey := fmt.Sprintf("%s-codecommit-ListRepositories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]codeCommitTypes.RepositoryNameIdPair), nil
+	}
+	for {
+		ListRepositories, err := client.ListRepositories(
+			context.TODO(),
+			&codecommit.ListRepositoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codecommit.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return repositories, err
+		}
+
+		repositories = append(repositories, ListRepositories.Repositories...)
+
+		//pagination
+		if ListRepositories.NextToken == nil {
+			break
+		}
+		PaginationControl = ListRepositories.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, repositories, cache.DefaultExpiration)
+	return repositories, nil
+}

aws/sdk/codecommit_mocks.go

@@ -0,0 +1,30 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecommit"
+	codeCommitTypes "github.com/aws/aws-sdk-go-v2/service/codecommit/types"
+)
+
+// create mocks for codecommit ListRepositories
+
+type MockedAWSCodeCommitClient struct {
+}
+
+func (m *MockedAWSCodeCommitClient) ListRepositories(ctx context.Context, input *codecommit.ListRepositoriesInput, options ...func(*codecommit.Options)) (*codecommit.ListRepositoriesOutput, error) {
+	return &codecommit.ListRepositoriesOutput{
+		NextToken: nil,
+		Repositories: []codeCommitTypes.RepositoryNameIdPair{
+			{
+				RepositoryId:   aws.String("repo1"),
+				RepositoryName: aws.String("repo1"),
+			},
+			{
+				RepositoryId:   aws.String("repo2"),
+				RepositoryName: aws.String("repo2"),
+			},
+		},
+	}, nil
+}

aws/sdk/codedeploy.go

@@ -0,0 +1,212 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/codedeploy"
+	codeDeployTypes "github.com/aws/aws-sdk-go-v2/service/codedeploy/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSCodeDeployClientInterface interface {
+	ListApplications(context.Context, *codedeploy.ListApplicationsInput, ...func(*codedeploy.Options)) (*codedeploy.ListApplicationsOutput, error)
+	GetApplication(context.Context, *codedeploy.GetApplicationInput, ...func(*codedeploy.Options)) (*codedeploy.GetApplicationOutput, error)
+	ListDeployments(context.Context, *codedeploy.ListDeploymentsInput, ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentsOutput, error)
+	GetDeployment(context.Context, *codedeploy.GetDeploymentInput, ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentOutput, error)
+	ListDeploymentConfigs(context.Context, *codedeploy.ListDeploymentConfigsInput, ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentConfigsOutput, error)
+	GetDeploymentConfig(context.Context, *codedeploy.GetDeploymentConfigInput, ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentConfigOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register([]codeDeployTypes.ApplicationInfo{})
+	gob.Register([]codeDeployTypes.DeploymentConfigInfo{})
+	gob.Register([]codeDeployTypes.DeploymentInfo{})
+
+}
+
+func CachedCodeDeployListApplications(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var applications []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListApplications-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListApplications, err := client.ListApplications(
+			context.TODO(),
+			&codedeploy.ListApplicationsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return applications, err
+		}
+
+		applications = append(applications, ListApplications.Applications...)
+
+		//pagination
+		if ListApplications.NextToken == nil {
+			break
+		}
+		PaginationControl = ListApplications.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, applications, cache.DefaultExpiration)
+	return applications, nil
+}
+
+func CachedCodeDeployListDeploymentConfigs(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var deploymentConfigs []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListDeploymentConfigs-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDeploymentConfigs, err := client.ListDeploymentConfigs(
+			context.TODO(),
+			&codedeploy.ListDeploymentConfigsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return deploymentConfigs, err
+		}
+
+		deploymentConfigs = append(deploymentConfigs, ListDeploymentConfigs.DeploymentConfigsList...)
+
+		//pagination
+		if ListDeploymentConfigs.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDeploymentConfigs.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, deploymentConfigs, cache.DefaultExpiration)
+	return deploymentConfigs, nil
+}
+
+func CachedCodeDeployListDeployments(client AWSCodeDeployClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var deployments []string
+	cacheKey := fmt.Sprintf("%s-codedeploy-ListDeployments-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListDeployments, err := client.ListDeployments(
+			context.TODO(),
+			&codedeploy.ListDeploymentsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *codedeploy.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return deployments, err
+		}
+
+		deployments = append(deployments, ListDeployments.Deployments...)
+
+		//pagination
+		if ListDeployments.NextToken == nil {
+			break
+		}
+		PaginationControl = ListDeployments.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, deployments, cache.DefaultExpiration)
+	return deployments, nil
+}
+
+func CachedCodeDeployGetApplication(client AWSCodeDeployClientInterface, accountID string, region string, applicationName string) (codeDeployTypes.ApplicationInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetApplication-%s-%s", accountID, region, applicationName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.ApplicationInfo), nil
+	}
+	GetApplication, err := client.GetApplication(
+		context.TODO(),
+		&codedeploy.GetApplicationInput{
+			ApplicationName: &applicationName,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetApplication.Application, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetApplication.Application, cache.DefaultExpiration)
+
+	return *GetApplication.Application, nil
+}
+
+func CachedCodeDeployGetDeploymentConfig(client AWSCodeDeployClientInterface, accountID string, region string, deploymentConfigName string) (codeDeployTypes.DeploymentConfigInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetDeploymentConfig-%s-%s", accountID, region, deploymentConfigName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.DeploymentConfigInfo), nil
+	}
+	GetDeploymentConfig, err := client.GetDeploymentConfig(
+		context.TODO(),
+		&codedeploy.GetDeploymentConfigInput{
+			DeploymentConfigName: &deploymentConfigName,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetDeploymentConfig.DeploymentConfigInfo, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetDeploymentConfig.DeploymentConfigInfo, cache.DefaultExpiration)
+
+	return *GetDeploymentConfig.DeploymentConfigInfo, nil
+}
+
+func CachedCodeDeployGetDeployment(client AWSCodeDeployClientInterface, accountID string, region string, deploymentID string) (codeDeployTypes.DeploymentInfo, error) {
+	cacheKey := fmt.Sprintf("%s-codedeploy-GetDeployment-%s-%s", accountID, region, deploymentID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(codeDeployTypes.DeploymentInfo), nil
+	}
+	GetDeployment, err := client.GetDeployment(
+		context.TODO(),
+		&codedeploy.GetDeploymentInput{
+			DeploymentId: &deploymentID,
+		},
+		func(o *codedeploy.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return *GetDeployment.DeploymentInfo, err
+	}
+
+	internal.Cache.Set(cacheKey, *GetDeployment.DeploymentInfo, cache.DefaultExpiration)
+
+	return *GetDeployment.DeploymentInfo, nil
+}

aws/sdk/codedeploy_mocks.go

@@ -0,0 +1,85 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codedeploy"
+	codedeployTypes "github.com/aws/aws-sdk-go-v2/service/codedeploy/types"
+)
+
+type MockedCodedeployClient struct {
+}
+
+func (m *MockedCodedeployClient) ListApplications(ctx context.Context, input *codedeploy.ListApplicationsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListApplicationsOutput, error) {
+	return &codedeploy.ListApplicationsOutput{
+		Applications: []string{
+			"app1",
+			"app2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) ListDeployments(ctx context.Context, input *codedeploy.ListDeploymentsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentsOutput, error) {
+	return &codedeploy.ListDeploymentsOutput{
+		Deployments: []string{
+			"deployment1",
+			"deployment2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) ListDeploymentConfigs(ctx context.Context, input *codedeploy.ListDeploymentConfigsInput, options ...func(*codedeploy.Options)) (*codedeploy.ListDeploymentConfigsOutput, error) {
+	return &codedeploy.ListDeploymentConfigsOutput{
+		DeploymentConfigsList: []string{
+			"deploymentConfig1",
+			"deploymentConfig2",
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetApplication(ctx context.Context, input *codedeploy.GetApplicationInput, options ...func(*codedeploy.Options)) (*codedeploy.GetApplicationOutput, error) {
+	return &codedeploy.GetApplicationOutput{
+		Application: &codedeployTypes.ApplicationInfo{
+			ApplicationName:   aws.String("application1"),
+			ApplicationId:     aws.String("application1"),
+			CreateTime:        aws.Time(time.Now()),
+			GitHubAccountName: aws.String("github"),
+			LinkedToGitHub:    true,
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetDeployment(ctx context.Context, input *codedeploy.GetDeploymentInput, options ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentOutput, error) {
+	return &codedeploy.GetDeploymentOutput{
+		DeploymentInfo: &codedeployTypes.DeploymentInfo{
+			ApplicationName: aws.String("application1"),
+			CreateTime:      aws.Time(time.Now()),
+			DeploymentId:    aws.String("deployment1"),
+			DeploymentOverview: &codedeployTypes.DeploymentOverview{
+				Failed:     0,
+				InProgress: 0,
+				Pending:    0,
+				Ready:      0,
+				Skipped:    0,
+				Succeeded:  0,
+			},
+			DeploymentConfigName: aws.String("deploymentConfig1"),
+			Status:               codedeployTypes.DeploymentStatusSucceeded,
+		},
+	}, nil
+}
+
+func (m *MockedCodedeployClient) GetDeploymentConfig(ctx context.Context, input *codedeploy.GetDeploymentConfigInput, options ...func(*codedeploy.Options)) (*codedeploy.GetDeploymentConfigOutput, error) {
+	return &codedeploy.GetDeploymentConfigOutput{
+		DeploymentConfigInfo: &codedeployTypes.DeploymentConfigInfo{
+			DeploymentConfigName: aws.String("deploymentConfig1"),
+			ComputePlatform:      codedeployTypes.ComputePlatformServer,
+			MinimumHealthyHosts: &codedeployTypes.MinimumHealthyHosts{
+				Type:  codedeployTypes.MinimumHealthyHostsTypeFleetPercent,
+				Value: 100,
+			},
+		},
+	}, nil
+}

aws/sdk/datapipeline.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/datapipeline"
+	dataPipelineTypes "github.com/aws/aws-sdk-go-v2/service/datapipeline/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSDataPipelineClientInterface interface {
+	ListPipelines(ctx context.Context, input *datapipeline.ListPipelinesInput, opts ...func(*datapipeline.Options)) (*datapipeline.ListPipelinesOutput, error)
+}
+
+func init() {
+	gob.Register([]dataPipelineTypes.PipelineIdName{})
+}
+
+func CachedDataPipelineListPipelines(client AWSDataPipelineClientInterface, accountID string, region string) ([]dataPipelineTypes.PipelineIdName, error) {
+	var PaginationControl *string
+	var pipelines []dataPipelineTypes.PipelineIdName
+	cacheKey := fmt.Sprintf("%s-datapipeline-ListPipelines-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]dataPipelineTypes.PipelineIdName), nil
+	}
+	for {
+		ListPipelines, err := client.ListPipelines(
+			context.TODO(),
+			&datapipeline.ListPipelinesInput{
+				Marker: PaginationControl,
+			},
+			func(o *datapipeline.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return pipelines, err
+		}
+
+		pipelines = append(pipelines, ListPipelines.PipelineIdList...)
+
+		//pagination
+		if ListPipelines.Marker == nil {
+			break
+		}
+		PaginationControl = ListPipelines.Marker
+	}
+
+	internal.Cache.Set(cacheKey, pipelines, cache.DefaultExpiration)
+	return pipelines, nil
+}

aws/sdk/datapipeline_mocks.go

@@ -0,0 +1,27 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/datapipeline"
+	dataPipelineTypes "github.com/aws/aws-sdk-go-v2/service/datapipeline/types"
+)
+
+type MockedDataPipelineClient struct {
+}
+
+func (m *MockedDataPipelineClient) ListPipelines(ctx context.Context, input *datapipeline.ListPipelinesInput, options ...func(*datapipeline.Options)) (*datapipeline.ListPipelinesOutput, error) {
+	return &datapipeline.ListPipelinesOutput{
+		PipelineIdList: []dataPipelineTypes.PipelineIdName{
+			{
+				Id:   aws.String("pipeline1"),
+				Name: aws.String("pipeline1"),
+			},
+			{
+				Id:   aws.String("pipeline2"),
+				Name: aws.String("pipeline2"),
+			},
+		},
+	}, nil
+}

aws/sdk/docdb.go

@@ -0,0 +1,141 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/docdb"
+	docdbTypes "github.com/aws/aws-sdk-go-v2/service/docdb/types"
+
+	"github.com/patrickmn/go-cache"
+)
+
+type DocDBClientInterface interface {
+	DescribeGlobalClusters(context.Context, *docdb.DescribeGlobalClustersInput, ...func(*docdb.Options)) (*docdb.DescribeGlobalClustersOutput, error)
+	DescribeDBClusters(context.Context, *docdb.DescribeDBClustersInput, ...func(*docdb.Options)) (*docdb.DescribeDBClustersOutput, error)
+	DescribeDBInstances(context.Context, *docdb.DescribeDBInstancesInput, ...func(*docdb.Options)) (*docdb.DescribeDBInstancesOutput, error)
+}
+
+func init() {
+	gob.Register([]docdbTypes.GlobalCluster{})
+	gob.Register([]docdbTypes.DBCluster{})
+	//gob.Register([]docdbTypes.DBInstance{})
+
+}
+
+func CachedDocDBDescribeGlobalClusters(client DocDBClientInterface, accountID string, region string) ([]docdbTypes.GlobalCluster, error) {
+	var PaginationControl *string
+	var globalClusters []docdbTypes.GlobalCluster
+	cacheKey := fmt.Sprintf("%s-docdb-DescribeGlobalClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]docdbTypes.GlobalCluster), nil
+	}
+	for {
+		DescribeGlobalClusters, err := client.DescribeGlobalClusters(
+			context.TODO(),
+			&docdb.DescribeGlobalClustersInput{
+				Marker: PaginationControl,
+			},
+			func(o *docdb.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return globalClusters, err
+		}
+
+		globalClusters = append(globalClusters, DescribeGlobalClusters.GlobalClusters...)
+
+		//pagination
+		if DescribeGlobalClusters.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeGlobalClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, globalClusters, cache.DefaultExpiration)
+	return globalClusters, nil
+}
+
+func CachedDocDBDescribeDBClusters(client DocDBClientInterface, accountID string, region string) ([]docdbTypes.DBCluster, error) {
+	var PaginationControl *string
+	var dbClusters []docdbTypes.DBCluster
+	cacheKey := fmt.Sprintf("%s-docdb-DescribeDBClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]docdbTypes.DBCluster), nil
+	}
+	for {
+		DescribeDBClusters, err := client.DescribeDBClusters(
+			context.TODO(),
+			&docdb.DescribeDBClustersInput{
+				Marker: PaginationControl,
+				Filters: []docdbTypes.Filter{
+					{
+						Name:   aws.String("engine"),
+						Values: []string{"docdb"},
+					},
+				},
+			},
+			func(o *docdb.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return dbClusters, err
+		}
+
+		dbClusters = append(dbClusters, DescribeDBClusters.DBClusters...)
+
+		//pagination
+		if DescribeDBClusters.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeDBClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, dbClusters, cache.DefaultExpiration)
+	return dbClusters, nil
+}
+
+func CachedDocDBDescribeDBInstances(client DocDBClientInterface, accountID string, region string) ([]docdbTypes.DBInstance, error) {
+	var PaginationControl *string
+	var dbInstances []docdbTypes.DBInstance
+	cacheKey := fmt.Sprintf("%s-docdb-DescribeDBInstances-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]docdbTypes.DBInstance), nil
+	}
+	for {
+		DescribeDBInstances, err := client.DescribeDBInstances(
+			context.TODO(),
+			&docdb.DescribeDBInstancesInput{
+				Marker: PaginationControl,
+			},
+			func(o *docdb.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return dbInstances, err
+		}
+
+		dbInstances = append(dbInstances, DescribeDBInstances.DBInstances...)
+
+		//pagination
+		if DescribeDBInstances.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeDBInstances.Marker
+	}
+
+	internal.Cache.Set(cacheKey, dbInstances, cache.DefaultExpiration)
+	return dbInstances, nil
+}

aws/sdk/docsdb_mocks.go

@@ -0,0 +1,25 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/docdb"
+	docdbTypes "github.com/aws/aws-sdk-go-v2/service/docdb/types"
+)
+
+type MockedAWSDocsDBClient struct {
+}
+
+func (m *MockedAWSDocsDBClient) DescribeDBClusters(ctx context.Context, input *docdb.DescribeDBClustersInput, options ...func(*docdb.Options)) (*docdb.DescribeDBClustersOutput, error) {
+	return &docdb.DescribeDBClustersOutput{
+		DBClusters: []docdbTypes.DBCluster{
+			{
+				DBClusterIdentifier: aws.String("cluster1"),
+			},
+			{
+				DBClusterIdentifier: aws.String("cluster2"),
+			},
+		},
+	}, nil
+}

aws/sdk/dynamodb.go

@@ -0,0 +1,85 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	dynamoDBTypes "github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type DynamoDBClientInterface interface {
+	ListTables(context.Context, *dynamodb.ListTablesInput, ...func(*dynamodb.Options)) (*dynamodb.ListTablesOutput, error)
+	DescribeTable(context.Context, *dynamodb.DescribeTableInput, ...func(*dynamodb.Options)) (*dynamodb.DescribeTableOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register(dynamoDBTypes.TableDescription{})
+}
+
+func CachedDynamoDBListTables(client DynamoDBClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var tables []string
+	cacheKey := fmt.Sprintf("%s-dynamodb-ListTables-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListTables, err := client.ListTables(
+			context.TODO(),
+			&dynamodb.ListTablesInput{
+				ExclusiveStartTableName: PaginationControl,
+			},
+			func(o *dynamodb.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return tables, err
+		}
+
+		tables = append(tables, ListTables.TableNames...)
+
+		//pagination
+		if ListTables.LastEvaluatedTableName == nil {
+			break
+		}
+		PaginationControl = ListTables.LastEvaluatedTableName
+	}
+
+	internal.Cache.Set(cacheKey, tables, cache.DefaultExpiration)
+	return tables, nil
+}
+
+func CachedDynamoDBDescribeTable(client DynamoDBClientInterface, accountID string, region string, tableName string) (dynamoDBTypes.TableDescription, error) {
+	var tableDescription dynamoDBTypes.TableDescription
+	cacheKey := fmt.Sprintf("%s-dynamodb-DescribeTable-%s-%s", accountID, region, tableName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(dynamoDBTypes.TableDescription), nil
+	}
+
+	DescribeTable, err := client.DescribeTable(
+		context.TODO(),
+		&dynamodb.DescribeTableInput{
+			TableName: &tableName,
+		},
+		func(o *dynamodb.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return tableDescription, err
+	}
+	tableDescription = *DescribeTable.Table
+
+	internal.Cache.Set(cacheKey, tableDescription, cache.DefaultExpiration)
+	return tableDescription, nil
+}

aws/sdk/dynamodb_mocks.go

@@ -0,0 +1,23 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
+	dynamodbTypes "github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
+)
+
+type MockedAWSDynamoDBClient struct {
+}
+
+func (m *MockedAWSDynamoDBClient) ListTables() ([]string, error) {
+	return []string{"table1", "table2"}, nil
+}
+
+func (m *MockedAWSDynamoDBClient) DescribeTable(ctx context.Context, input *dynamodb.DescribeTableInput, options ...func(*dynamodb.Options)) (*dynamodb.DescribeTableOutput, error) {
+	return &dynamodb.DescribeTableOutput{
+		Table: &dynamodbTypes.TableDescription{
+			TableName: input.TableName,
+		},
+	}, nil
+}

aws/sdk/ec2.go

@@ -0,0 +1,206 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2Types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSEC2ClientInterface interface {
+	DescribeInstances(context.Context, *ec2.DescribeInstancesInput, ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error)
+	DescribeNetworkInterfaces(context.Context, *ec2.DescribeNetworkInterfacesInput, ...func(*ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error)
+	DescribeSnapshots(context.Context, *ec2.DescribeSnapshotsInput, ...func(*ec2.Options)) (*ec2.DescribeSnapshotsOutput, error)
+	DescribeVolumes(context.Context, *ec2.DescribeVolumesInput, ...func(*ec2.Options)) (*ec2.DescribeVolumesOutput, error)
+	DescribeImages(context.Context, *ec2.DescribeImagesInput, ...func(*ec2.Options)) (*ec2.DescribeImagesOutput, error)
+}
+
+func init() {
+	gob.Register([]ec2Types.Instance{})
+	gob.Register([]ec2Types.NetworkInterface{})
+	gob.Register([]ec2Types.Snapshot{})
+	gob.Register([]ec2Types.Volume{})
+	gob.Register([]ec2Types.Image{})
+
+}
+
+func CachedEC2DescribeInstances(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Instance, error) {
+	var PaginationControl *string
+	var instances []ec2Types.Instance
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeInstances-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Instance), nil
+	}
+	for {
+		DescribeInstances, err := client.DescribeInstances(
+			context.TODO(),
+			&ec2.DescribeInstancesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return instances, err
+		}
+
+		for _, reservation := range DescribeInstances.Reservations {
+			instances = append(instances, reservation.Instances...)
+		}
+
+		//pagination
+		if DescribeInstances.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeInstances.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, instances, cache.DefaultExpiration)
+	return instances, nil
+}
+
+func CachedEC2DescribeNetworkInterfaces(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.NetworkInterface, error) {
+	var PaginationControl *string
+	var NetworkInterfaces []ec2Types.NetworkInterface
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeNetworkInterfaces-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.NetworkInterface), nil
+	}
+	for {
+		DescribeNetworkInterfaces, err := client.DescribeNetworkInterfaces(
+			context.TODO(),
+			&(ec2.DescribeNetworkInterfacesInput{
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return NetworkInterfaces, err
+		}
+		for _, networkInterface := range DescribeNetworkInterfaces.NetworkInterfaces {
+			NetworkInterfaces = append(NetworkInterfaces, networkInterface)
+		}
+		if DescribeNetworkInterfaces.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeNetworkInterfaces.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, NetworkInterfaces, cache.DefaultExpiration)
+	return NetworkInterfaces, nil
+}
+
+func CachedEC2DescribeSnapshots(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Snapshot, error) {
+	var PaginationControl *string
+	var Snapshots []ec2Types.Snapshot
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeSnapshots-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Snapshot), nil
+	}
+	for {
+		DescribeSnapshots, err := client.DescribeSnapshots(
+			context.TODO(),
+			&(ec2.DescribeSnapshotsInput{
+				NextToken: PaginationControl,
+				OwnerIds:  []string{accountID},
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Snapshots, err
+		}
+		for _, snapshot := range DescribeSnapshots.Snapshots {
+			Snapshots = append(Snapshots, snapshot)
+		}
+		if DescribeSnapshots.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeSnapshots.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Snapshots, cache.DefaultExpiration)
+	return Snapshots, nil
+}
+
+func CachedEC2DescribeVolumes(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Volume, error) {
+	var PaginationControl *string
+	var Volumes []ec2Types.Volume
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeVolumes-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Volume), nil
+	}
+	for {
+		DescribeVolumes, err := client.DescribeVolumes(
+			context.TODO(),
+			&(ec2.DescribeVolumesInput{
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Volumes, err
+		}
+		for _, volume := range DescribeVolumes.Volumes {
+			Volumes = append(Volumes, volume)
+		}
+		if DescribeVolumes.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeVolumes.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Volumes, cache.DefaultExpiration)
+	return Volumes, nil
+}
+
+func CachedEC2DescribeImages(client AWSEC2ClientInterface, accountID string, region string) ([]ec2Types.Image, error) {
+	var PaginationControl *string
+	var Images []ec2Types.Image
+	cacheKey := fmt.Sprintf("%s-ec2-DescribeImages-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]ec2Types.Image), nil
+	}
+	for {
+		DescribeImages, err := client.DescribeImages(
+			context.TODO(),
+			&(ec2.DescribeImagesInput{
+				Owners:    []string{accountID},
+				NextToken: PaginationControl,
+			}),
+			func(o *ec2.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return Images, err
+		}
+		for _, image := range DescribeImages.Images {
+			Images = append(Images, image)
+		}
+		if DescribeImages.NextToken == nil {
+			break
+		}
+		PaginationControl = DescribeImages.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, Images, cache.DefaultExpiration)
+	return Images, nil
+
+}

aws/sdk/ec2_mocks.go

@@ -0,0 +1,374 @@
+package sdk
+
+// create test for the Cached EC2 functions.  Create a mocked client and mocked functions for each of the methods used in the ec2.go file
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+)
+
+const DESCRIBE_NETWORK_INTEFACES_TEST_FILE = "./test-data/describe-network-interfaces.json"
+const DESCRIBE_INSTANCES_TEST_FILE = "./test-data/ec2-describeInstances.json"
+const DESCRIBE_SNAPSHOTS_TEST_FILE = "./test-data/ec2-describeSnapshots.json"
+const DESCRIBE_VOLUMES_TEST_FILE = "./test-data/ec2-describeVolumes.json"
+const DESCRIBE_IMAGES_TEST_FILE = "./test-data/ec2-describeImages.json"
+
+type MockedEC2Client2 struct {
+	describeNetworkInterfaces DescribeNetworkInterfaces
+	describeInstances         DescribeInstances
+	describeSnapshots         DescribeSnapshots
+	describeVolumes           DescribeVolumes
+	describeImages            DescribeImages
+}
+
+type DescribeNetworkInterfaces struct {
+	NetworkInterfaces []struct {
+		Status          string `json:"Status"`
+		MacAddress      string `json:"MacAddress"`
+		SourceDestCheck bool   `json:"SourceDestCheck"`
+		VpcID           string `json:"VpcId"`
+		Description     string `json:"Description"`
+		Association     struct {
+			PublicIP      string `json:"PublicIp"`
+			AssociationID string `json:"AssociationId"`
+			PublicDNSName string `json:"PublicDnsName"`
+			IPOwnerID     string `json:"IpOwnerId"`
+		} `json:"Association"`
+		NetworkInterfaceID string `json:"NetworkInterfaceId"`
+		PrivateIPAddresses []struct {
+			PrivateDNSName string `json:"PrivateDnsName"`
+			Association    struct {
+				PublicIP      string `json:"PublicIp"`
+				AssociationID string `json:"AssociationId"`
+				PublicDNSName string `json:"PublicDnsName"`
+				IPOwnerID     string `json:"IpOwnerId"`
+			} `json:"Association"`
+			Primary          bool   `json:"Primary"`
+			PrivateIPAddress string `json:"PrivateIpAddress"`
+		} `json:"PrivateIpAddresses"`
+		RequesterManaged bool          `json:"RequesterManaged"`
+		Ipv6Addresses    []interface{} `json:"Ipv6Addresses"`
+		PrivateDNSName   string        `json:"PrivateDnsName,omitempty"`
+		AvailabilityZone string        `json:"AvailabilityZone"`
+		Attachment       struct {
+			Status              string    `json:"Status"`
+			DeviceIndex         int       `json:"DeviceIndex"`
+			AttachTime          time.Time `json:"AttachTime"`
+			InstanceID          string    `json:"InstanceId"`
+			DeleteOnTermination bool      `json:"DeleteOnTermination"`
+			AttachmentID        string    `json:"AttachmentId"`
+			InstanceOwnerID     string    `json:"InstanceOwnerId"`
+		} `json:"Attachment"`
+		Groups []struct {
+			GroupName string `json:"GroupName"`
+			GroupID   string `json:"GroupId"`
+		} `json:"Groups"`
+		SubnetID         string        `json:"SubnetId"`
+		OwnerID          string        `json:"OwnerId"`
+		TagSet           []interface{} `json:"TagSet"`
+		PrivateIPAddress string        `json:"PrivateIpAddress"`
+	} `json:"NetworkInterfaces"`
+}
+
+type DescribeInstances struct {
+	Reservations []struct {
+		Instances []struct {
+			AmiLaunchIndex int    `json:"AmiLaunchIndex"`
+			ImageID        string `json:"ImageId"`
+			InstanceID     string `json:"InstanceId"`
+			InstanceType   string `json:"InstanceType"`
+			KernelID       string `json:"KernelId"`
+			KeyName        string `json:"KeyName"`
+			LaunchTime     string `json:"LaunchTime"`
+			Monitoring     struct {
+				State string `json:"State"`
+			} `json:"Monitoring"`
+			Placement struct {
+				AvailabilityZone string `json:"AvailabilityZone"`
+				GroupName        string `json:"GroupName"`
+				Tenancy          string `json:"Tenancy"`
+			} `json:"Placement"`
+			Platform            string `json:"Platform"`
+			PrivateDNS          string `json:"PrivateDnsName"`
+			PrivateIP           string `json:"PrivateIpAddress"`
+			PublicDNS           string `json:"PublicDnsName"`
+			PublicIP            string `json:"PublicIpAddress"`
+			State               string `json:"State"`
+			SubnetID            string `json:"SubnetId"`
+			VpcID               string `json:"VpcId"`
+			Architecture        string `json:"Architecture"`
+			BlockDeviceMappings []struct {
+				DeviceName string `json:"DeviceName"`
+				Ebs        struct {
+					AttachTime          time.Time `json:"AttachTime"`
+					DeleteOnTermination bool      `json:"DeleteOnTermination"`
+					Status              string    `json:"Status"`
+					VolumeID            string    `json:"VolumeId"`
+				} `json:"Ebs"`
+			} `json:"BlockDeviceMappings"`
+			ClientToken        string `json:"ClientToken"`
+			EbsOptimized       bool   `json:"EbsOptimized"`
+			Hypervisor         string `json:"Hypervisor"`
+			IamInstanceProfile struct {
+				Arn string `json:"Arn"`
+				ID  string `json:"Id"`
+			} `json:"IamInstanceProfile"`
+			NetworkInterfaces []struct {
+				Attachment struct {
+					AttachTime          time.Time `json:"AttachTime"`
+					AttachmentID        string    `json:"AttachmentId"`
+					DeleteOnTermination bool      `json:"DeleteOnTermination"`
+					DeviceIndex         int       `json:"DeviceIndex"`
+					Status              string    `json:"Status"`
+				} `json:"Attachment"`
+				Description string `json:"Description"`
+				Groups      []struct {
+					GroupName string `json:"GroupName"`
+					GroupID   string `json:"GroupId"`
+				} `json:"Groups"`
+				MacAddress         string `json:"MacAddress"`
+				NetworkInterfaceID string `json:"NetworkInterfaceId"`
+				OwnerID            string `json:"OwnerId"`
+				PrivateDNSName     string `json:"PrivateDnsName"`
+				PrivateIPAddress   string `json:"PrivateIpAddress"`
+				PrivateIPAddresses []struct {
+					Association struct {
+						IPOwnerID     string `json:"IpOwnerId"`
+						PublicDNSName string `json:"PublicDnsName"`
+						PublicIP      string `json:"PublicIp"`
+					} `json:"Association"`
+					Primary          bool   `json:"Primary"`
+					PrivateDNSName   string `json:"PrivateDnsName"`
+					PrivateIPAddress string `json:"PrivateIpAddress"`
+				} `json:"PrivateIpAddresses"`
+				SourceDestCheck bool   `json:"SourceDestCheck"`
+				Status          string `json:"Status"`
+				SubnetID        string `json:"SubnetId"`
+				VpcID           string `json:"VpcId"`
+			} `json:"NetworkInterfaces"`
+			RootDeviceName string `json:"RootDeviceName"`
+			RootDeviceType string `json:"RootDeviceType"`
+			SecurityGroups []struct {
+				GroupName string `json:"GroupName"`
+				GroupID   string `json:"GroupId"`
+			} `json:"SecurityGroups"`
+			SourceDestCheck bool `json:"SourceDestCheck"`
+			StateReason     struct {
+				Code    string `json:"Code"`
+				Message string `json:"Message"`
+			} `json:"StateReason"`
+			Tags []struct {
+				Key   string `json:"Key"`
+				Value string `json:"Value"`
+			} `json:"Tags"`
+			VirtualizationType string `json:"VirtualizationType"`
+		} `json:"Instances"`
+		OwnerID       string `json:"OwnerId"`
+		RequesterID   string `json:"RequesterId"`
+		ReservationID string `json:"ReservationId"`
+	} `json:"Reservations"`
+}
+
+type DescribeImages struct {
+	Images []struct {
+		Architecture        string `json:"Architecture"`
+		BlockDeviceMappings []struct {
+			DeviceName string `json:"DeviceName"`
+			Ebs        struct {
+				DeleteOnTermination bool   `json:"DeleteOnTermination"`
+				SnapshotID          string `json:"SnapshotId"`
+				VolumeSize          int    `json:"VolumeSize"`
+				VolumeType          string `json:"VolumeType"`
+			} `json:"Ebs"`
+		} `json:"BlockDeviceMappings"`
+		CreationDate  string `json:"CreationDate"`
+		Description   string `json:"Description"`
+		EnaSupport    bool   `json:"EnaSupport"`
+		Hypervisor    string `json:"Hypervisor"`
+		ImageID       string `json:"ImageId"`
+		ImageLocation string `json:"ImageLocation"`
+		ImageType     string `json:"ImageType"`
+		KernelID      string `json:"KernelId"`
+		Name          string `json:"Name"`
+		OwnerAlias    string `json:"OwnerAlias"`
+		OwnerID       string `json:"OwnerId"`
+		Platform      string `json:"Platform"`
+		ProductCodes  []struct {
+			ProductCodeID   string `json:"ProductCodeId"`
+			ProductCodeType string `json:"ProductCodeType"`
+		} `json:"ProductCodes"`
+		Public          bool   `json:"Public"`
+		RamdiskID       string `json:"RamdiskId"`
+		RootDeviceName  string `json:"RootDeviceName"`
+		RootDeviceType  string `json:"RootDeviceType"`
+		SriovNetSupport string `json:"SriovNetSupport"`
+		State           string `json:"State"`
+		StateReason     struct {
+			Code    string `json:"Code"`
+			Message string `json:"Message"`
+		} `json:"StateReason"`
+		Tags []struct {
+			Key   string `json:"Key"`
+			Value string `json:"Value"`
+		} `json:"Tags"`
+		VirtualizationType string `json:"VirtualizationType"`
+	} `json:"Images"`
+	NextToken string `json:"NextToken"`
+}
+
+type DescribeSnapshots struct {
+	Snapshots []struct {
+		DataEncryptionKeyID string    `json:"DataEncryptionKeyId"`
+		Description         string    `json:"Description"`
+		Encrypted           bool      `json:"Encrypted"`
+		KMSKeyID            string    `json:"KmsKeyId"`
+		OwnerAlias          string    `json:"OwnerAlias"`
+		OwnerID             string    `json:"OwnerId"`
+		Progress            string    `json:"Progress"`
+		SnapshotID          string    `json:"SnapshotId"`
+		StartTime           time.Time `json:"StartTime"`
+		State               string    `json:"State"`
+		StateMessage        string    `json:"StateMessage"`
+		TagSet              []struct {
+			Key   string `json:"Key"`
+			Value string `json:"Value"`
+		} `json:"Tags"`
+		VolumeID   string `json:"VolumeId"`
+		VolumeSize int    `json:"VolumeSize"`
+	} `json:"Snapshots"`
+}
+
+type DescribeVolumes struct {
+	Volumes []struct {
+		Attachments []struct {
+			AttachTime          time.Time `json:"AttachTime"`
+			DeleteOnTermination bool      `json:"DeleteOnTermination"`
+			Device              string    `json:"Device"`
+			InstanceID          string    `json:"InstanceId"`
+			State               string    `json:"State"`
+			VolumeID            string    `json:"VolumeId"`
+		} `json:"Attachments"`
+		AvailabilityZone string `json:"AvailabilityZone"`
+		CreateTime       string `json:"CreateTime"`
+		Encrypted        bool   `json:"Encrypted"`
+		KMSKeyID         string `json:"KmsKeyId"`
+		Size             int    `json:"Size"`
+		SnapshotID       string `json:"SnapshotId"`
+		State            string `json:"State"`
+		VolumeID         string `json:"VolumeId"`
+	} `json:"Volumes"`
+}
+
+func (c *MockedEC2Client2) DescribeNetworkInterfaces(ctx context.Context, input *ec2.DescribeNetworkInterfacesInput, f ...func(o *ec2.Options)) (*ec2.DescribeNetworkInterfacesOutput, error) {
+	var nics []ec2types.NetworkInterface
+	err := json.Unmarshal(readTestFile(DESCRIBE_NETWORK_INTEFACES_TEST_FILE), &c.describeNetworkInterfaces)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_NETWORK_INTEFACES_TEST_FILE)
+	}
+	for _, mockednic := range c.describeNetworkInterfaces.NetworkInterfaces {
+		nics = append(nics, ec2types.NetworkInterface{
+			Association: &ec2types.NetworkInterfaceAssociation{
+				PublicIp: aws.String(mockednic.Association.PublicIP),
+			},
+			NetworkInterfaceId: aws.String(mockednic.NetworkInterfaceID),
+			PrivateIpAddress:   aws.String(mockednic.PrivateIPAddress),
+			VpcId:              aws.String(mockednic.VpcID),
+			Attachment:         &ec2types.NetworkInterfaceAttachment{InstanceId: aws.String(mockednic.Attachment.InstanceID)},
+			Description:        aws.String(mockednic.Description),
+		})
+	}
+	return &ec2.DescribeNetworkInterfacesOutput{NetworkInterfaces: nics}, nil
+}
+
+func (c *MockedEC2Client2) DescribeInstances(ctx context.Context, input *ec2.DescribeInstancesInput, f ...func(o *ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
+	var instances []ec2types.Instance
+	err := json.Unmarshal(readTestFile(DESCRIBE_INSTANCES_TEST_FILE), &c.describeInstances)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_INSTANCES_TEST_FILE)
+	}
+	for _, mockedReservation := range c.describeInstances.Reservations {
+		for _, mockedInstance := range mockedReservation.Instances {
+			for _, inputInstanceID := range input.InstanceIds {
+				if mockedInstance.InstanceID == inputInstanceID {
+					instances = append(instances, ec2types.Instance{
+						InstanceId:   aws.String(mockedInstance.InstanceID),
+						InstanceType: ec2types.InstanceType(mockedInstance.InstanceType),
+						ImageId:      aws.String(mockedInstance.ImageID),
+					})
+				}
+			}
+		}
+	}
+	return &ec2.DescribeInstancesOutput{Reservations: []ec2types.Reservation{
+		{Instances: instances},
+	}}, nil
+}
+
+func (c *MockedEC2Client2) DescribeVolumes(ctx context.Context, input *ec2.DescribeVolumesInput, f ...func(o *ec2.Options)) (*ec2.DescribeVolumesOutput, error) {
+	var volumes []ec2types.Volume
+	err := json.Unmarshal(readTestFile(DESCRIBE_VOLUMES_TEST_FILE), &c.describeVolumes)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_VOLUMES_TEST_FILE)
+	}
+	for _, mockedVolume := range c.describeVolumes.Volumes {
+		for _, inputVolumeID := range input.VolumeIds {
+			if mockedVolume.VolumeID == inputVolumeID {
+				volumes = append(volumes, ec2types.Volume{
+					VolumeId: aws.String(mockedVolume.VolumeID),
+					Size:     aws.Int32(int32(mockedVolume.Size)),
+					Attachments: []ec2types.VolumeAttachment{
+						{
+							InstanceId: aws.String(mockedVolume.Attachments[0].InstanceID),
+						},
+					},
+				})
+			}
+		}
+	}
+	return &ec2.DescribeVolumesOutput{Volumes: volumes}, nil
+}
+
+func (c *MockedEC2Client2) DescribeSnapshots(ctx context.Context, input *ec2.DescribeSnapshotsInput, f ...func(o *ec2.Options)) (*ec2.DescribeSnapshotsOutput, error) {
+	var snapshots []ec2types.Snapshot
+	err := json.Unmarshal(readTestFile(DESCRIBE_SNAPSHOTS_TEST_FILE), &c.describeSnapshots)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_SNAPSHOTS_TEST_FILE)
+	}
+	for _, mockedSnapshot := range c.describeSnapshots.Snapshots {
+		for _, inputSnapshotID := range input.SnapshotIds {
+			if mockedSnapshot.SnapshotID == inputSnapshotID {
+				snapshots = append(snapshots, ec2types.Snapshot{
+					SnapshotId: aws.String(mockedSnapshot.SnapshotID),
+					VolumeId:   aws.String(mockedSnapshot.VolumeID),
+					State:      ec2types.SnapshotState(mockedSnapshot.State),
+				})
+			}
+		}
+	}
+	return &ec2.DescribeSnapshotsOutput{Snapshots: snapshots}, nil
+}
+
+func (c *MockedEC2Client2) DescribeImages(ctx context.Context, input *ec2.DescribeImagesInput, f ...func(o *ec2.Options)) (*ec2.DescribeImagesOutput, error) {
+	var images []ec2types.Image
+	err := json.Unmarshal(readTestFile(DESCRIBE_IMAGES_TEST_FILE), &c.describeImages)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_IMAGES_TEST_FILE)
+	}
+	for _, mockedImage := range c.describeImages.Images {
+		for _, inputImageID := range input.ImageIds {
+			if mockedImage.ImageID == inputImageID {
+				images = append(images, ec2types.Image{
+					ImageId: aws.String(mockedImage.ImageID),
+					Name:    aws.String(mockedImage.Name),
+				})
+			}
+		}
+	}
+	return &ec2.DescribeImagesOutput{Images: images}, nil
+}

aws/sdk/ecr.go

@@ -0,0 +1,137 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ecr"
+	ecrTypes "github.com/aws/aws-sdk-go-v2/service/ecr/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSECRClientInterface interface {
+	DescribeRepositories(ctx context.Context, params *ecr.DescribeRepositoriesInput, optFns ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error)
+	DescribeImages(ctx context.Context, params *ecr.DescribeImagesInput, optFns ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error)
+	GetRepositoryPolicy(ctx context.Context, params *ecr.GetRepositoryPolicyInput, optFns ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error)
+}
+
+func init() {
+	gob.Register([]ecrTypes.Repository{})
+	gob.Register([]ecrTypes.ImageDetail{})
+	gob.Register(ecrTypes.Repository{})
+
+}
+
+// create a CachedECRDescribeRepositories function that uses go-cache line the other Cached* functions. It should accept a ecr client, account id, and region. Make sure it handles the region option and pagination if needed
+func CachedECRDescribeRepositories(ECRClient AWSECRClientInterface, accountID string, region string) ([]ecrTypes.Repository, error) {
+	var PaginationControl *string
+	var repositories []ecrTypes.Repository
+	cacheKey := fmt.Sprintf("%s-ecr-DescribeRepositories-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECR repositories data")
+		return cached.([]ecrTypes.Repository), nil
+	}
+
+	for {
+		DescribeRepositories, err := ECRClient.DescribeRepositories(
+			context.TODO(),
+			&ecr.DescribeRepositoriesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *ecr.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		repositories = append(repositories, DescribeRepositories.Repositories...)
+
+		// Pagination control.
+		if DescribeRepositories.NextToken != nil {
+			PaginationControl = DescribeRepositories.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+	internal.Cache.Set(cacheKey, repositories, cache.DefaultExpiration)
+	return repositories, nil
+}
+
+// create a CachedECRDescribeImages function that uses go-cache line the other Cached* functions. It should accept a ecr client, account id, and region. Make sure it handles the region option and pagination if needed
+func CachedECRDescribeImages(ECRClient AWSECRClientInterface, accountID string, region string, repositoryName string) ([]ecrTypes.ImageDetail, error) {
+	var PaginationControl *string
+	var images []ecrTypes.ImageDetail
+	cacheKey := fmt.Sprintf("%s-efs-DescribImages-%s-%s", accountID, region, strings.ReplaceAll(repositoryName, "/", "-"))
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached Images data")
+		return cached.([]ecrTypes.ImageDetail), nil
+	}
+
+	for {
+		DescribeImages, err := ECRClient.DescribeImages(
+			context.TODO(),
+			&ecr.DescribeImagesInput{
+				NextToken:      PaginationControl,
+				RepositoryName: &repositoryName,
+			},
+			func(o *ecr.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		images = append(images, DescribeImages.ImageDetails...)
+
+		// Pagination control.
+		if DescribeImages.NextToken != nil {
+			PaginationControl = DescribeImages.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+	internal.Cache.Set(cacheKey, images, cache.DefaultExpiration)
+	return images, nil
+}
+
+// create a CachedECRGetRepositoryPolicy function that uses go-cache line the other Cached* functions. It should accept a ecr client, account id, and region. Make sure it handles the region option and pagination if needed
+func CachedECRGetRepositoryPolicy(ECRClient AWSECRClientInterface, accountID string, region string, repositoryName string) (string, error) {
+	// in repositoryName, replace "/" with "-"
+	cacheKey := fmt.Sprintf("%s-ecr-GetRepositoryPolicy-%s-%s", accountID, region, strings.ReplaceAll(repositoryName, "/", "-"))
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECR repository policy data")
+		return cached.(string), nil
+	}
+
+	GetRepositoryPolicy, err := ECRClient.GetRepositoryPolicy(
+		context.TODO(),
+		&ecr.GetRepositoryPolicyInput{
+			RepositoryName: &repositoryName,
+		},
+		func(o *ecr.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return "", err
+	}
+	PolicyText := aws.ToString(GetRepositoryPolicy.PolicyText)
+
+	internal.Cache.Set(cacheKey, PolicyText, cache.DefaultExpiration)
+	return PolicyText, nil
+}

aws/sdk/ecr_mocks.go

@@ -0,0 +1,73 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ecr"
+	ecrTypes "github.com/aws/aws-sdk-go-v2/service/ecr/types"
+)
+
+type MockedECRClient struct {
+}
+
+func (m *MockedECRClient) DescribeRepositories(ctx context.Context, input *ecr.DescribeRepositoriesInput, options ...func(*ecr.Options)) (*ecr.DescribeRepositoriesOutput, error) {
+	return &ecr.DescribeRepositoriesOutput{
+		Repositories: []ecrTypes.Repository{
+			{
+				RepositoryName: aws.String("repo1"),
+			},
+			{
+				RepositoryName: aws.String("repo2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedECRClient) DescribeImages(ctx context.Context, input *ecr.DescribeImagesInput, options ...func(*ecr.Options)) (*ecr.DescribeImagesOutput, error) {
+	return &ecr.DescribeImagesOutput{
+		ImageDetails: []ecrTypes.ImageDetail{
+			{
+				ImageTags: []string{
+					"tag1",
+					"tag2",
+				},
+			},
+			{
+				ImageTags: []string{
+					"tag3", "tag4", "tag5", "tag6"},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedECRClient) GetRepositoryPolicy(ctx context.Context, input *ecr.GetRepositoryPolicyInput, options ...func(*ecr.Options)) (*ecr.GetRepositoryPolicyOutput, error) {
+	return &ecr.GetRepositoryPolicyOutput{
+		PolicyText: aws.String(`{
+			"Version": "2008-10-17",
+			"Statement": [
+			  {
+				"Sid": "AllowPushPull",
+				"Effect": "Allow",
+				"Principal": {
+				  "AWS": [
+					"arn:aws:iam::123456789012:root",
+					"arn:aws:iam::123456789012:user/MyUser"
+					]
+				},
+				"Action": [
+										
+				  "ecr:GetDownloadUrlForLayer",
+				  "ecr:BatchGetImage",
+				  "ecr:BatchCheckLayerAvailability",
+				  "ecr:PutImage",
+				  "ecr:InitiateLayerUpload",
+				  "ecr:UploadLayerPart",
+				  "ecr:CompleteLayerUpload"
+				]
+										
+			}
+			]
+		}`),
+	}, nil
+}

aws/sdk/ecs.go

@@ -0,0 +1,215 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSECSClientInterface interface {
+	ListClusters(ctx context.Context, params *ecs.ListClustersInput, optFns ...func(*ecs.Options)) (*ecs.ListClustersOutput, error)
+	ListTasks(ctx context.Context, params *ecs.ListTasksInput, optFns ...func(*ecs.Options)) (*ecs.ListTasksOutput, error)
+	ListServices(ctx context.Context, params *ecs.ListServicesInput, optFns ...func(*ecs.Options)) (*ecs.ListServicesOutput, error)
+	DescribeTasks(ctx context.Context, params *ecs.DescribeTasksInput, optFns ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error)
+	DescribeTaskDefinition(ctx context.Context, params *ecs.DescribeTaskDefinitionInput, optFns ...func(*ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register(ecsTypes.Task{})
+	gob.Register(ecsTypes.TaskDefinition{})
+
+}
+
+func CachedECSListClusters(ECSClient AWSECSClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var clusters []string
+	cacheKey := fmt.Sprintf("%s-ecs-ListClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS clusters data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListClusters, err := ECSClient.ListClusters(
+			context.TODO(),
+			&ecs.ListClustersInput{
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		clusters = append(clusters, ListClusters.ClusterArns...)
+
+		// Pagination control.
+		if ListClusters.NextToken != nil {
+			PaginationControl = ListClusters.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}
+
+func CachedECSListTasks(ECSClient AWSECSClientInterface, accountID string, region string, cluster string) ([]string, error) {
+	var PaginationControl *string
+	var tasks []string
+	//grab cluster name from AWS ARN
+	clusterName := cluster[strings.LastIndex(cluster, "/")+1:]
+
+	cacheKey := fmt.Sprintf("%s-ecs-ListTasks-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS tasks data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListTasks, err := ECSClient.ListTasks(
+			context.TODO(),
+			&ecs.ListTasksInput{
+				Cluster:   &cluster,
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		tasks = append(tasks, ListTasks.TaskArns...)
+
+		// Pagination control.
+		if ListTasks.NextToken != nil {
+			PaginationControl = ListTasks.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, tasks, cache.DefaultExpiration)
+	return tasks, nil
+}
+
+func CachedECSDescribeTasks(ECSClient AWSECSClientInterface, accountID string, region string, cluster string, tasks []string) ([]ecsTypes.Task, error) {
+	var taskDetails []ecsTypes.Task
+	cacheKey := fmt.Sprintf("%s-ecs-DescribeTasks-%s-%s", accountID, region, cluster)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS task details data")
+		return cached.([]ecsTypes.Task), nil
+	}
+
+	DescribeTasks, err := ECSClient.DescribeTasks(
+		context.TODO(),
+		&ecs.DescribeTasksInput{
+			Cluster: &cluster,
+			Tasks:   tasks,
+		},
+		func(o *ecs.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return []ecsTypes.Task{}, err
+	}
+
+	taskDetails = append(taskDetails, DescribeTasks.Tasks...)
+
+	internal.Cache.Set(cacheKey, taskDetails, cache.DefaultExpiration)
+	return taskDetails, nil
+}
+
+func CachedECSDescribeTaskDefinition(ECSClient AWSECSClientInterface, accountID string, region string, taskDefinition string) (ecsTypes.TaskDefinition, error) {
+	var taskDefinitionDetails ecsTypes.TaskDefinition
+	cacheKey := fmt.Sprintf("%s-ecs-DescribeTaskDefinition-%s-%s", accountID, region, taskDefinition)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS task definition details data")
+		return cached.(ecsTypes.TaskDefinition), nil
+	}
+
+	DescribeTaskDefinition, err := ECSClient.DescribeTaskDefinition(
+		context.TODO(),
+		&ecs.DescribeTaskDefinitionInput{
+			TaskDefinition: &taskDefinition,
+		},
+		func(o *ecs.Options) {
+			o.Region = region
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return ecsTypes.TaskDefinition{}, err
+	}
+
+	taskDefinitionDetails = *DescribeTaskDefinition.TaskDefinition
+
+	internal.Cache.Set(cacheKey, taskDefinitionDetails, cache.DefaultExpiration)
+	return taskDefinitionDetails, nil
+}
+
+func CachedECSListServices(ECSClient AWSECSClientInterface, accountID string, region string, cluster string) ([]string, error) {
+	var PaginationControl *string
+	var services []string
+	//grab cluster name from AWS ARN
+	clusterName := cluster[strings.LastIndex(cluster, "/")+1:]
+
+	cacheKey := fmt.Sprintf("%s-ecs-ListServices-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached ECS services data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListServices, err := ECSClient.ListServices(
+			context.TODO(),
+			&ecs.ListServicesInput{
+				Cluster:   &cluster,
+				NextToken: PaginationControl,
+			},
+			func(o *ecs.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		services = append(services, ListServices.ServiceArns...)
+
+		// Pagination control.
+		if ListServices.NextToken != nil {
+			PaginationControl = ListServices.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, services, cache.DefaultExpiration)
+	return services, nil
+}

aws/sdk/ecs_mocks.go

@@ -0,0 +1,156 @@
+package sdk
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ecs"
+	ecsTypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
+)
+
+const DESCRIBE_TASKS_TEST_FILE = "./test-data/describe-tasks.json"
+
+type MockedECSClient struct {
+	describeTasks DescribeTasks
+}
+
+type ListTasks struct {
+	TaskArns []string `json:"taskArns"`
+}
+
+type DescribeTasks struct {
+	Tasks []struct {
+		Attachments []struct {
+			ID      string `json:"id"`
+			Type    string `json:"type"`
+			Status  string `json:"status"`
+			Details []struct {
+				Name  string `json:"name"`
+				Value string `json:"value"`
+			} `json:"details"`
+		} `json:"attachments"`
+		Attributes []struct {
+			Name  string `json:"name"`
+			Value string `json:"value"`
+		} `json:"attributes"`
+		AvailabilityZone string `json:"availabilityZone"`
+		ClusterArn       string `json:"clusterArn"`
+		Connectivity     string `json:"connectivity"`
+		ConnectivityAt   string `json:"connectivityAt"`
+		Containers       []struct {
+			ContainerArn      string        `json:"containerArn"`
+			TaskArn           string        `json:"taskArn"`
+			Name              string        `json:"name"`
+			Image             string        `json:"image"`
+			RuntimeID         string        `json:"runtimeId"`
+			LastStatus        string        `json:"lastStatus"`
+			NetworkBindings   []interface{} `json:"networkBindings"`
+			NetworkInterfaces []struct {
+				AttachmentID       string `json:"attachmentId"`
+				PrivateIpv4Address string `json:"privateIpv4Address"`
+			} `json:"networkInterfaces"`
+			HealthStatus string `json:"healthStatus"`
+			CPU          string `json:"cpu"`
+			Memory       string `json:"memory"`
+		} `json:"containers"`
+		CPU                  string `json:"cpu"`
+		CreatedAt            string `json:"createdAt"`
+		DesiredStatus        string `json:"desiredStatus"`
+		EnableExecuteCommand bool   `json:"enableExecuteCommand"`
+		Group                string `json:"group"`
+		HealthStatus         string `json:"healthStatus"`
+		LastStatus           string `json:"lastStatus"`
+		LaunchType           string `json:"launchType"`
+		Memory               string `json:"memory"`
+		Overrides            struct {
+			ContainerOverrides []struct {
+				Name string `json:"name"`
+			} `json:"containerOverrides"`
+			InferenceAcceleratorOverrides []interface{} `json:"inferenceAcceleratorOverrides"`
+		} `json:"overrides"`
+		PlatformVersion   string        `json:"platformVersion"`
+		PlatformFamily    string        `json:"platformFamily"`
+		PullStartedAt     string        `json:"pullStartedAt"`
+		PullStoppedAt     string        `json:"pullStoppedAt"`
+		StartedAt         string        `json:"startedAt"`
+		StartedBy         string        `json:"startedBy"`
+		Tags              []interface{} `json:"tags"`
+		TaskArn           string        `json:"taskArn"`
+		TaskDefinitionArn string        `json:"taskDefinitionArn"`
+		Version           int           `json:"version"`
+		EphemeralStorage  struct {
+			SizeInGiB int `json:"sizeInGiB"`
+		} `json:"ephemeralStorage"`
+	} `json:"tasks"`
+	Failures []interface{} `json:"failures"`
+}
+
+func (c *MockedECSClient) ListClusters(context.Context, *ecs.ListClustersInput, ...func(*ecs.Options)) (*ecs.ListClustersOutput, error) {
+	return &ecs.ListClustersOutput{ClusterArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster",
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster2",
+		"arn:aws:ecs:us-east-1:123456789012:cluster/MyCluster3",
+	}}, nil
+}
+
+func (c *MockedECSClient) ListTasks(ctx context.Context, input *ecs.ListTasksInput, f ...func(*ecs.Options)) (*ecs.ListTasksOutput, error) {
+	return &ecs.ListTasksOutput{TaskArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/74de0355a10a4f979ac495c14EXAMPLE",
+		"arn:aws:ecs:us-east-1:123456789012:task/MyCluster/d789e94343414c25b9f6bd59eEXAMPLE",
+	}}, nil
+}
+
+func (c *MockedECSClient) ListServices(ctx context.Context, input *ecs.ListServicesInput, f ...func(*ecs.Options)) (*ecs.ListServicesOutput, error) {
+	return &ecs.ListServicesOutput{ServiceArns: []string{
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService",
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService2",
+		"arn:aws:ecs:us-east-1:123456789012:service/MyService3",
+	}}, nil
+}
+
+func (c *MockedECSClient) DescribeTasks(ctx context.Context, input *ecs.DescribeTasksInput, f ...func(*ecs.Options)) (*ecs.DescribeTasksOutput, error) {
+	err := json.Unmarshal(readTestFile(DESCRIBE_TASKS_TEST_FILE), &c.describeTasks)
+	if err != nil {
+		log.Fatalf("can't unmarshall file %s", DESCRIBE_TASKS_TEST_FILE)
+	}
+	var tasks []ecsTypes.Task
+	for _, mockedTask := range c.describeTasks.Tasks {
+		if mockedTask.ClusterArn == aws.ToString(input.Cluster) {
+			for _, inputTask := range input.Tasks {
+				if mockedTask.TaskArn == inputTask {
+					var attachments []ecsTypes.Attachment
+					for _, a := range mockedTask.Attachments {
+						var deets []ecsTypes.KeyValuePair
+						for _, detail := range a.Details {
+							deets = append(deets, ecsTypes.KeyValuePair{
+								Name:  aws.String(detail.Name),
+								Value: aws.String(detail.Value)})
+						}
+						attachments = append(attachments, ecsTypes.Attachment{
+							Type:    aws.String(a.Type),
+							Details: deets,
+							Id:      aws.String(a.ID),
+							Status:  aws.String(a.Status),
+						})
+					}
+					tasks = append(tasks, ecsTypes.Task{
+						ClusterArn:        aws.String(mockedTask.ClusterArn),
+						TaskDefinitionArn: aws.String(mockedTask.TaskDefinitionArn),
+						LaunchType:        ecsTypes.LaunchType(*aws.String(mockedTask.LaunchType)),
+						TaskArn:           aws.String(mockedTask.TaskArn),
+						Attachments:       attachments,
+					})
+				}
+			}
+		}
+	}
+	return &ecs.DescribeTasksOutput{Tasks: tasks}, nil
+}
+
+func (c *MockedECSClient) DescribeTaskDefinition(ctx context.Context, input *ecs.DescribeTaskDefinitionInput, f ...func(o *ecs.Options)) (*ecs.DescribeTaskDefinitionOutput, error) {
+	testTaskDefinition := ecsTypes.TaskDefinition{}
+	testTaskDefinition.TaskRoleArn = aws.String("test123")
+	return &ecs.DescribeTaskDefinitionOutput{TaskDefinition: &testTaskDefinition}, nil
+}

aws/sdk/efs.go

@@ -0,0 +1,178 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/efs"
+	efsTypes "github.com/aws/aws-sdk-go-v2/service/efs/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSEFSClientInterface interface {
+	DescribeFileSystems(ctx context.Context, params *efs.DescribeFileSystemsInput, optFns ...func(*efs.Options)) (*efs.DescribeFileSystemsOutput, error)
+	DescribeMountTargets(ctx context.Context, params *efs.DescribeMountTargetsInput, optFns ...func(*efs.Options)) (*efs.DescribeMountTargetsOutput, error)
+	DescribeAccessPoints(ctx context.Context, params *efs.DescribeAccessPointsInput, optFns ...func(*efs.Options)) (*efs.DescribeAccessPointsOutput, error)
+	DescribeFileSystemPolicy(ctx context.Context, params *efs.DescribeFileSystemPolicyInput, optFns ...func(*efs.Options)) (*efs.DescribeFileSystemPolicyOutput, error)
+}
+
+func init() {
+	gob.Register([]efsTypes.FileSystemDescription{})
+	gob.Register([]efsTypes.MountTargetDescription{})
+	gob.Register([]efsTypes.AccessPointDescription{})
+	gob.Register(policy.Policy{})
+}
+
+func CachedDescribeFileSystems(EFSClient AWSEFSClientInterface, accountID string, r string) ([]efsTypes.FileSystemDescription, error) {
+	var PaginationMarker *string
+	var filesystems []efsTypes.FileSystemDescription
+	var err error
+	cacheKey := fmt.Sprintf("%s-efs-DescribeFileSystems-%s", accountID, r)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]efsTypes.FileSystemDescription), nil
+	}
+
+	for {
+		DescribeFileSystems, err := EFSClient.DescribeFileSystems(
+			context.TODO(),
+			&efs.DescribeFileSystemsInput{
+				Marker: PaginationMarker,
+			},
+			func(o *efs.Options) {
+				o.Region = r
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			return nil, err
+		}
+
+		filesystems = append(filesystems, DescribeFileSystems.FileSystems...)
+
+		// Pagination control. After the last page of output, the for loop exits.
+		if DescribeFileSystems.Marker != nil {
+			PaginationMarker = DescribeFileSystems.Marker
+		} else {
+			PaginationMarker = nil
+			break
+		}
+	}
+	internal.Cache.Set(cacheKey, filesystems, cache.DefaultExpiration)
+	return filesystems, err
+}
+
+func CachedDescribeMountTargets(EFSClient AWSEFSClientInterface, accountID string, r string, filesystemId string) ([]efsTypes.MountTargetDescription, error) {
+	var PaginationMarker *string
+	var mountTargets []efsTypes.MountTargetDescription
+	var err error
+	cacheKey := fmt.Sprintf("%s-efs-DescribeMountTargets-%s-%s", accountID, r, filesystemId)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]efsTypes.MountTargetDescription), nil
+	}
+
+	for {
+		DescribeMountTargets, err := EFSClient.DescribeMountTargets(
+			context.TODO(),
+			&efs.DescribeMountTargetsInput{
+				FileSystemId: aws.String(filesystemId),
+				Marker:       PaginationMarker,
+			},
+			func(o *efs.Options) {
+				o.Region = r
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			return nil, err
+		}
+
+		mountTargets = append(mountTargets, DescribeMountTargets.MountTargets...)
+
+		// Pagination control. After the last page of output, the for loop exits.
+		if DescribeMountTargets.Marker != nil {
+			PaginationMarker = DescribeMountTargets.Marker
+		} else {
+			PaginationMarker = nil
+			break
+		}
+	}
+	internal.Cache.Set(cacheKey, mountTargets, cache.DefaultExpiration)
+	return mountTargets, err
+}
+
+func CachedDescribeAccessPoints(EFSClient AWSEFSClientInterface, accountID string, r string, filesystemId string) ([]efsTypes.AccessPointDescription, error) {
+	var PaginationMarker *string
+	var accessPoints []efsTypes.AccessPointDescription
+	var err error
+	cacheKey := fmt.Sprintf("%s-efs-DescribeAccessPoints-%s-%s", accountID, r, filesystemId)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]efsTypes.AccessPointDescription), nil
+	}
+	for {
+		DescribeAccessPoints, err := EFSClient.DescribeAccessPoints(
+			context.TODO(),
+			&efs.DescribeAccessPointsInput{
+				FileSystemId: aws.String(filesystemId),
+				NextToken:    PaginationMarker,
+			},
+			func(o *efs.Options) {
+				o.Region = r
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			return nil, err
+		}
+
+		accessPoints = append(accessPoints, DescribeAccessPoints.AccessPoints...)
+
+		// Pagination control. After the last page of output, the for loop exits.
+		if DescribeAccessPoints.NextToken != nil {
+			PaginationMarker = DescribeAccessPoints.NextToken
+		} else {
+			PaginationMarker = nil
+			break
+		}
+	}
+	internal.Cache.Set(cacheKey, accessPoints, cache.DefaultExpiration)
+	return accessPoints, err
+}
+
+func CachedDescribeFileSystemPolicy(EFSClient AWSEFSClientInterface, filesystemId string, r string, accountID string) (policy.Policy, error) {
+	var efsPolicy policy.Policy
+	var policyJSON string
+	cacheKey := fmt.Sprintf("efs-%s-DescribeFileSystemPolicy-%s-%s", accountID, r, filesystemId)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(policy.Policy), nil
+	}
+
+	Policy, err := EFSClient.DescribeFileSystemPolicy(
+		context.TODO(),
+		&efs.DescribeFileSystemPolicyInput{
+			FileSystemId: aws.String(filesystemId),
+		},
+		func(o *efs.Options) {
+			o.Region = r
+		},
+	)
+	if err != nil {
+		sharedLogger.Error(err.Error())
+		return efsPolicy, err
+	}
+
+	policyJSON = aws.ToString(Policy.Policy)
+	efsPolicy, err = policy.ParseJSONPolicy([]byte(policyJSON))
+	if err != nil {
+		return efsPolicy, fmt.Errorf("parsing policy (%s) as JSON: %s", filesystemId, err)
+	}
+	internal.Cache.Set(cacheKey, efsPolicy, cache.DefaultExpiration)
+	return efsPolicy, nil
+}

aws/sdk/efs_mocks.go

@@ -0,0 +1,67 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/efs"
+	efsTypes "github.com/aws/aws-sdk-go-v2/service/efs/types"
+)
+
+type MockedEfsClient struct {
+}
+
+func (m *MockedEfsClient) DescribeFileSystems(ctx context.Context, input *efs.DescribeFileSystemsInput, options ...func(*efs.Options)) (*efs.DescribeFileSystemsOutput, error) {
+	return &efs.DescribeFileSystemsOutput{
+		FileSystems: []efsTypes.FileSystemDescription{
+			{
+				FileSystemId: aws.String("fs-12345678"),
+			},
+			{
+				FileSystemId: aws.String("fs-87654321"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedEfsClient) DescribeMountTargets(ctx context.Context, input *efs.DescribeMountTargetsInput, options ...func(*efs.Options)) (*efs.DescribeMountTargetsOutput, error) {
+	return &efs.DescribeMountTargetsOutput{
+		MountTargets: []efsTypes.MountTargetDescription{
+			{
+				MountTargetId: aws.String("fsmt-12345678"),
+				FileSystemId:  aws.String("fs-12345678"),
+				IpAddress:     aws.String("10.1.1.1"),
+			},
+			{
+				MountTargetId: aws.String("fsmt-87654321"),
+				FileSystemId:  aws.String("fs-87654321"),
+				IpAddress:     aws.String("10.2.2.2.2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedEfsClient) DescribeAccessPoints(ctx context.Context, input *efs.DescribeAccessPointsInput, options ...func(*efs.Options)) (*efs.DescribeAccessPointsOutput, error) {
+	return &efs.DescribeAccessPointsOutput{
+		AccessPoints: []efsTypes.AccessPointDescription{
+			{
+				AccessPointId: aws.String("fsap-12345678"),
+				FileSystemId:  aws.String("fs-12345678"),
+				Name:          aws.String("fsap-12345678"),
+				PosixUser: &efsTypes.PosixUser{
+					Gid: aws.Int64(1000),
+					Uid: aws.Int64(1000),
+				},
+			},
+			{
+				AccessPointId: aws.String("fsap-87654321"),
+				FileSystemId:  aws.String("fs-87654321"),
+				Name:          aws.String("fsap-12345679"),
+				PosixUser: &efsTypes.PosixUser{
+					Gid: aws.Int64(1000),
+					Uid: aws.Int64(1000),
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/eks.go

@@ -0,0 +1,152 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/eks"
+	eksTypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type EKSClientInterface interface {
+	DescribeCluster(context.Context, *eks.DescribeClusterInput, ...func(*eks.Options)) (*eks.DescribeClusterOutput, error)
+	ListClusters(context.Context, *eks.ListClustersInput, ...func(*eks.Options)) (*eks.ListClustersOutput, error)
+	DescribeNodegroup(context.Context, *eks.DescribeNodegroupInput, ...func(*eks.Options)) (*eks.DescribeNodegroupOutput, error)
+	ListNodegroups(context.Context, *eks.ListNodegroupsInput, ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register(eksTypes.Cluster{})
+	gob.Register(eksTypes.Nodegroup{})
+
+}
+
+func CachedEKSDescribeCluster(client EKSClientInterface, accountID string, clusterName string, region string) (eksTypes.Cluster, error) {
+	var cluster eksTypes.Cluster
+	cacheKey := fmt.Sprintf("%s-eks-DescribeCluster-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(eksTypes.Cluster), nil
+	}
+	clusterOutput, err := client.DescribeCluster(
+		context.TODO(),
+		&eks.DescribeClusterInput{
+			Name: &clusterName,
+		},
+		func(o *eks.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return cluster, err
+	}
+	cluster = *clusterOutput.Cluster
+
+	internal.Cache.Set(cacheKey, cluster, cache.DefaultExpiration)
+	return cluster, nil
+}
+
+func CachedEKSListClusters(client EKSClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var clusters []string
+	cacheKey := fmt.Sprintf("%s-eks-ListClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListClusters, err := client.ListClusters(
+			context.TODO(),
+			&eks.ListClustersInput{
+				NextToken: PaginationControl,
+			},
+			func(o *eks.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return clusters, err
+		}
+
+		clusters = append(clusters, ListClusters.Clusters...)
+
+		//pagination
+		if ListClusters.NextToken == nil {
+			break
+		}
+		PaginationControl = ListClusters.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}
+
+func CachedEKSListNodeGroups(client EKSClientInterface, accountID string, region string, clusterName string) ([]string, error) {
+	var PaginationControl *string
+	var nodeGroups []string
+	cacheKey := fmt.Sprintf("%s-eks-ListNodeGroups-%s-%s", accountID, region, clusterName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListNodeGroups, err := client.ListNodegroups(
+			context.TODO(),
+			&eks.ListNodegroupsInput{
+				ClusterName: &clusterName,
+				NextToken:   PaginationControl,
+			},
+			func(o *eks.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return nodeGroups, err
+		}
+
+		nodeGroups = append(nodeGroups, ListNodeGroups.Nodegroups...)
+		if ListNodeGroups.NextToken != nil {
+			PaginationControl = ListNodeGroups.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+
+	}
+	internal.Cache.Set(cacheKey, nodeGroups, cache.DefaultExpiration)
+
+	return nodeGroups, nil
+}
+
+func CachedEKSDescribeNodeGroup(client EKSClientInterface, accountID string, region string, clusterName string, nodeGroupName string) (eksTypes.Nodegroup, error) {
+	var nodeGroup eksTypes.Nodegroup
+	cacheKey := fmt.Sprintf("%s-eks-DescribeNodeGroup-%s-%s-%s", accountID, region, nodeGroupName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(eksTypes.Nodegroup), nil
+	}
+	nodeGroupOutput, err := client.DescribeNodegroup(
+		context.TODO(),
+		&eks.DescribeNodegroupInput{
+			ClusterName:   &clusterName,
+			NodegroupName: &nodeGroupName,
+		},
+		func(o *eks.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return nodeGroup, err
+	}
+	nodeGroup = *nodeGroupOutput.Nodegroup
+
+	internal.Cache.Set(cacheKey, nodeGroup, cache.DefaultExpiration)
+	return nodeGroup, nil
+}

aws/sdk/eks_mocks.go

@@ -0,0 +1,54 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/eks"
+	eksTypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
+)
+
+type MockedAWSEksClient struct {
+}
+
+func (m *MockedAWSEksClient) ListClusters(ctx context.Context, input *eks.ListClustersInput, options ...func(*eks.Options)) (*eks.ListClustersOutput, error) {
+	return &eks.ListClustersOutput{
+		Clusters: []string{
+			"cluster1",
+			"cluster2",
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) DescribeCluster(ctx context.Context, input *eks.DescribeClusterInput, options ...func(*eks.Options)) (*eks.DescribeClusterOutput, error) {
+	return &eks.DescribeClusterOutput{
+		Cluster: &eksTypes.Cluster{
+			Arn:             aws.String("arn:aws:eks:us-east-1:123456789012:cluster/cluster1"),
+			Endpoint:        aws.String("https://cluster1.us-east-1.eks.amazonaws.com"),
+			Name:            aws.String("cluster1"),
+			PlatformVersion: aws.String("eks.1"),
+			Version:         aws.String("1.18"),
+			RoleArn:         aws.String("arn:aws:iam::123456789012:role/eks-role"),
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) ListNodegroups(ctx context.Context, input *eks.ListNodegroupsInput, options ...func(*eks.Options)) (*eks.ListNodegroupsOutput, error) {
+	return &eks.ListNodegroupsOutput{
+		Nodegroups: []string{
+			"nodegroup1",
+			"nodegroup2",
+		},
+	}, nil
+}
+
+func (m *MockedAWSEksClient) DescribeNodegroup(ctx context.Context, input *eks.DescribeNodegroupInput, options ...func(*eks.Options)) (*eks.DescribeNodegroupOutput, error) {
+	return &eks.DescribeNodegroupOutput{
+		Nodegroup: &eksTypes.Nodegroup{
+			ClusterName:   aws.String("cluster1"),
+			NodeRole:      aws.String("arn:aws:iam::123456789012:role/eks-role"),
+			NodegroupName: aws.String("nodegroup1"),
+			NodegroupArn:  aws.String("arn:aws:eks:us-east-1:123456789012:nodegroup/cluster1/nodegroup1"),
+		},
+	}, nil
+}

aws/sdk/elasticache.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/elasticache"
+	elasticacheTypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSElastiCacheClientInterface interface {
+	DescribeCacheClusters(context.Context, *elasticache.DescribeCacheClustersInput, ...func(*elasticache.Options)) (*elasticache.DescribeCacheClustersOutput, error)
+}
+
+func init() {
+	gob.Register([]elasticacheTypes.CacheCluster{})
+
+}
+
+func CachedElastiCacheDescribeCacheClusters(client AWSElastiCacheClientInterface, accountID string, region string) ([]elasticacheTypes.CacheCluster, error) {
+	var PaginationControl *string
+	var clusters []elasticacheTypes.CacheCluster
+	cacheKey := fmt.Sprintf("%s-elasticache-DescribeCacheClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]elasticacheTypes.CacheCluster), nil
+	}
+	for {
+		DescribeCacheClusters, err := client.DescribeCacheClusters(
+			context.TODO(),
+			&elasticache.DescribeCacheClustersInput{
+				Marker: PaginationControl,
+			},
+			func(o *elasticache.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return clusters, err
+		}
+
+		clusters = append(clusters, DescribeCacheClusters.CacheClusters...)
+
+		//pagination
+		if DescribeCacheClusters.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeCacheClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}

aws/sdk/elasticache_mocks.go

@@ -0,0 +1,40 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticache"
+	elasticacheTypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
+)
+
+type MockedElasticacheClient struct {
+}
+
+func (m *MockedElasticacheClient) DescribeCacheClusters(ctx context.Context, input *elasticache.DescribeCacheClustersInput, options ...func(*elasticache.Options)) (*elasticache.DescribeCacheClustersOutput, error) {
+	return &elasticache.DescribeCacheClustersOutput{
+		CacheClusters: []elasticacheTypes.CacheCluster{
+			{
+				CacheClusterId:            aws.String("test"),
+				ARN:                       aws.String("arn:aws:elasticache:us-east-1:123456789012:cluster:myCluster"),
+				Engine:                    aws.String("redis"),
+				EngineVersion:             aws.String("6.x"),
+				CacheNodeType:             aws.String("cache.t3.micro"),
+				NumCacheNodes:             aws.Int32(1),
+				CacheClusterStatus:        aws.String("available"),
+				PreferredAvailabilityZone: aws.String("us-east-1a"),
+				CacheSubnetGroupName:      aws.String("default"),
+				ReplicationGroupId:        aws.String("test"),
+				SecurityGroups: []elasticacheTypes.SecurityGroupMembership{
+					{
+						SecurityGroupId: aws.String("test"),
+						Status:          aws.String("active"),
+					},
+				},
+
+				AutoMinorVersionUpgrade:    true,
+				PreferredMaintenanceWindow: aws.String("sun:05:00-sun:06:00"),
+			},
+		},
+	}, nil
+}

aws/sdk/elasticbeanstalk.go

@@ -0,0 +1,35 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk"
+	elasticbeanstalkTypes "github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk/types"
+)
+
+type AWSElasticBeanstalkClientInterface interface {
+	DescribeApplications(context.Context, *elasticbeanstalk.DescribeApplicationsInput, ...func(*elasticbeanstalk.Options)) (*elasticbeanstalk.DescribeApplicationsOutput, error)
+}
+
+func init() {
+	gob.Register([]elasticbeanstalkTypes.ApplicationDescription{})
+}
+
+func CachedElasticBeanstalkDescribeApplications(client AWSElasticBeanstalkClientInterface, accountID string, region string) ([]elasticbeanstalkTypes.ApplicationDescription, error) {
+	var applications []elasticbeanstalkTypes.ApplicationDescription
+	DescribeApplications, err := client.DescribeApplications(
+		context.TODO(),
+		&elasticbeanstalk.DescribeApplicationsInput{},
+		func(o *elasticbeanstalk.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return applications, err
+	}
+
+	applications = append(applications, DescribeApplications.Applications...)
+	return applications, nil
+}

aws/sdk/elasticbeanstalk_mocks.go

@@ -0,0 +1,33 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk"
+	elasticbeanstalkTypes "github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk/types"
+)
+
+type MockedElasticBeanstalkClient struct {
+}
+
+func (m *MockedElasticBeanstalkClient) DescribeApplications(ctx context.Context, input *elasticbeanstalk.DescribeApplicationsInput, options ...func(*elasticbeanstalk.Options)) (*elasticbeanstalk.DescribeApplicationsOutput, error) {
+	return &elasticbeanstalk.DescribeApplicationsOutput{
+		Applications: []elasticbeanstalkTypes.ApplicationDescription{
+			{
+				ApplicationName: aws.String("app1"),
+				ApplicationArn:  aws.String("arn:aws:elasticbeanstalk:us-east-1:123456789012:application/app1"),
+				ConfigurationTemplates: []string{
+					"template1",
+				},
+			},
+			{
+				ApplicationName: aws.String("app2"),
+				ApplicationArn:  aws.String("arn:aws:elasticbeanstalk:us-east-1:123456789012:application/app2"),
+				ConfigurationTemplates: []string{
+					"template2",
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/elb.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing"
+	elbTypes "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type ELBClientInterface interface {
+	DescribeLoadBalancers(context.Context, *elasticloadbalancing.DescribeLoadBalancersInput, ...func(*elasticloadbalancing.Options)) (*elasticloadbalancing.DescribeLoadBalancersOutput, error)
+}
+
+func init() {
+	gob.Register([]elbTypes.LoadBalancerDescription{})
+}
+
+func CachedELBDescribeLoadBalancers(client ELBClientInterface, accountID string, region string) ([]elbTypes.LoadBalancerDescription, error) {
+	var PaginationControl *string
+	var loadbalancers []elbTypes.LoadBalancerDescription
+	cacheKey := fmt.Sprintf("%s-elb-DescribeLoadBalancers-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]elbTypes.LoadBalancerDescription), nil
+	}
+	for {
+		DescribeLoadBalancers, err := client.DescribeLoadBalancers(
+			context.TODO(),
+			&elasticloadbalancing.DescribeLoadBalancersInput{
+				Marker: PaginationControl,
+			},
+			func(o *elasticloadbalancing.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return loadbalancers, err
+		}
+
+		loadbalancers = append(loadbalancers, DescribeLoadBalancers.LoadBalancerDescriptions...)
+
+		//pagination
+		if DescribeLoadBalancers.NextMarker == nil {
+			break
+		}
+		PaginationControl = DescribeLoadBalancers.NextMarker
+	}
+
+	internal.Cache.Set(cacheKey, loadbalancers, cache.DefaultExpiration)
+	return loadbalancers, nil
+}

aws/sdk/elb_mocks.go

@@ -0,0 +1,37 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing"
+	elbTypes "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing/types"
+)
+
+type MockedElbClient struct {
+}
+
+func (m *MockedElbClient) DescribeLoadBalancers(ctx context.Context, input *elasticloadbalancing.DescribeLoadBalancersInput, options ...func(*elasticloadbalancing.Options)) (*elasticloadbalancing.DescribeLoadBalancersOutput, error) {
+	return &elasticloadbalancing.DescribeLoadBalancersOutput{
+		LoadBalancerDescriptions: []elbTypes.LoadBalancerDescription{
+			{
+				LoadBalancerName: aws.String("elb1"),
+				DNSName:          aws.String("elb1"),
+				Instances: []elbTypes.Instance{
+					{
+						InstanceId: aws.String("i-1234567890abcdef0"),
+					},
+				},
+			},
+			{
+				LoadBalancerName: aws.String("elb2"),
+				DNSName:          aws.String("elb2"),
+				Instances: []elbTypes.Instance{
+					{
+						InstanceId: aws.String("i-1234567890abcdef1"),
+					},
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/elbv2.go

@@ -0,0 +1,56 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2"
+	elbV2Types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type ELBv2ClientInterface interface {
+	DescribeLoadBalancers(context.Context, *elasticloadbalancingv2.DescribeLoadBalancersInput, ...func(*elasticloadbalancingv2.Options)) (*elasticloadbalancingv2.DescribeLoadBalancersOutput, error)
+}
+
+func init() {
+	gob.Register([]elbV2Types.LoadBalancer{})
+}
+
+func CachedELBv2DescribeLoadBalancers(client ELBv2ClientInterface, accountID string, region string) ([]elbV2Types.LoadBalancer, error) {
+	var PaginationControl *string
+	var loadbalancers []elbV2Types.LoadBalancer
+	cacheKey := fmt.Sprintf("%s-elbv2-DescribeLoadBalancers-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]elbV2Types.LoadBalancer), nil
+	}
+	for {
+		DescribeLoadBalancers, err := client.DescribeLoadBalancers(
+			context.TODO(),
+			&elasticloadbalancingv2.DescribeLoadBalancersInput{
+				Marker: PaginationControl,
+			},
+			func(o *elasticloadbalancingv2.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return loadbalancers, err
+		}
+
+		loadbalancers = append(loadbalancers, DescribeLoadBalancers.LoadBalancers...)
+
+		//pagination
+		if DescribeLoadBalancers.NextMarker == nil {
+			break
+		}
+		PaginationControl = DescribeLoadBalancers.NextMarker
+	}
+
+	internal.Cache.Set(cacheKey, loadbalancers, cache.DefaultExpiration)
+	return loadbalancers, nil
+}

aws/sdk/elbv2_mocks.go

@@ -0,0 +1,58 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2"
+	elbv2Types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
+)
+
+type MockedElbv2Client struct {
+}
+
+func (m *MockedElbv2Client) DescribeLoadBalancers(ctx context.Context, input *elasticloadbalancingv2.DescribeLoadBalancersInput, options ...func(*elasticloadbalancingv2.Options)) (*elasticloadbalancingv2.DescribeLoadBalancersOutput, error) {
+	return &elasticloadbalancingv2.DescribeLoadBalancersOutput{
+		LoadBalancers: []elbv2Types.LoadBalancer{
+			{
+				LoadBalancerArn:       aws.String("arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188"),
+				DNSName:               aws.String("my-load-balancer-424835706.us-east-1.elb.amazonaws.com"),
+				CanonicalHostedZoneId: aws.String("Z2P70J7EXAMPLE"),
+				CreatedTime:           aws.Time(time.Now()),
+				LoadBalancerName:      aws.String("my-load-balancer"),
+				Scheme:                elbv2Types.LoadBalancerSchemeEnumInternetFacing,
+				VpcId:                 aws.String("vpc-3ac0fb5f"),
+				State: &elbv2Types.LoadBalancerState{
+					Code:   elbv2Types.LoadBalancerStateEnumActive,
+					Reason: aws.String(""),
+				},
+				Type: elbv2Types.LoadBalancerTypeEnumApplication,
+				AvailabilityZones: []elbv2Types.AvailabilityZone{
+					{
+						ZoneName: aws.String("us-east-1a"),
+						SubnetId: aws.String("subnet-8360a9e7"),
+						LoadBalancerAddresses: []elbv2Types.LoadBalancerAddress{
+							{
+								IpAddress: aws.String("1.2.3.4"),
+							},
+						},
+					},
+					{
+						ZoneName: aws.String("us-east-1b"),
+						SubnetId: aws.String("subnet-b7d581c0"),
+						LoadBalancerAddresses: []elbv2Types.LoadBalancerAddress{
+							{
+								IpAddress: aws.String("2.3.4.5"),
+							},
+						},
+					},
+				},
+				SecurityGroups: []string{
+					"sg-5943793c",
+				},
+				IpAddressType: elbv2Types.IpAddressTypeDualstack,
+			},
+		},
+	}, nil
+}

aws/sdk/emr.go

@@ -0,0 +1,98 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/emr"
+	emrTypes "github.com/aws/aws-sdk-go-v2/service/emr/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSEMRClientInterface interface {
+	ListClusters(context.Context, *emr.ListClustersInput, ...func(*emr.Options)) (*emr.ListClustersOutput, error)
+	ListInstances(context.Context, *emr.ListInstancesInput, ...func(*emr.Options)) (*emr.ListInstancesOutput, error)
+}
+
+func init() {
+	gob.Register([]emrTypes.ClusterSummary{})
+
+	//need to do this to avoid conflicts with the Instance type in the ec2 package
+	type EMRInstance emrTypes.Instance
+	gob.Register([]EMRInstance{})
+}
+
+func CachedEMRListClusters(client AWSEMRClientInterface, accountID string, region string) ([]emrTypes.ClusterSummary, error) {
+	var PaginationControl *string
+	var clusters []emrTypes.ClusterSummary
+	cacheKey := fmt.Sprintf("%s-emr-ListClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]emrTypes.ClusterSummary), nil
+	}
+	for {
+		ListClusters, err := client.ListClusters(
+			context.TODO(),
+			&emr.ListClustersInput{
+				Marker: PaginationControl,
+			},
+			func(o *emr.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return clusters, err
+		}
+
+		clusters = append(clusters, ListClusters.Clusters...)
+
+		//pagination
+		if ListClusters.Marker == nil {
+			break
+		}
+		PaginationControl = ListClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}
+
+func CachedEMRListInstances(client AWSEMRClientInterface, accountID string, region string, clusterID string) ([]emrTypes.Instance, error) {
+	var PaginationControl *string
+	var instances []emrTypes.Instance
+	cacheKey := fmt.Sprintf("%s-emr-ListInstances-%s-%s", accountID, region, clusterID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]emrTypes.Instance), nil
+	}
+	for {
+		ListInstances, err := client.ListInstances(
+			context.TODO(),
+			&emr.ListInstancesInput{
+				ClusterId: &clusterID,
+				Marker:    PaginationControl,
+			},
+			func(o *emr.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return instances, err
+		}
+
+		instances = append(instances, ListInstances.Instances...)
+
+		//pagination
+		if ListInstances.Marker == nil {
+			break
+		}
+		PaginationControl = ListInstances.Marker
+	}
+
+	internal.Cache.Set(cacheKey, instances, cache.DefaultExpiration)
+	return instances, nil
+}

aws/sdk/emr_mocks.go

@@ -0,0 +1,44 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/emr"
+	emrTypes "github.com/aws/aws-sdk-go-v2/service/emr/types"
+)
+
+type MockedEMRClient struct {
+}
+
+func (m *MockedEMRClient) ListClusters(ctx context.Context, input *emr.ListClustersInput, options ...func(*emr.Options)) (*emr.ListClustersOutput, error) {
+	return &emr.ListClustersOutput{
+		Clusters: []emrTypes.ClusterSummary{
+			{
+				Id: aws.String("cluster1"),
+			},
+			{
+				Id: aws.String("cluster2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedEMRClient) ListInstances(ctx context.Context, input *emr.ListInstancesInput, options ...func(*emr.Options)) (*emr.ListInstancesOutput, error) {
+	return &emr.ListInstancesOutput{
+		Instances: []emrTypes.Instance{
+			{
+				Id:               aws.String("instance1"),
+				InstanceType:     aws.String("m5.xlarge"),
+				Ec2InstanceId:    aws.String("i-1234567890"),
+				PrivateDnsName:   aws.String("ip-10-0-0-1.ec2.internal"),
+				PublicDnsName:    aws.String("ec2-1-2-3-4.compute-1.amazonaws.com"),
+				PrivateIpAddress: aws.String("10.0.0.1"),
+				PublicIpAddress:  aws.String("1.2.3.4"),
+			},
+			{
+				Id: aws.String("instance2"),
+			},
+		},
+	}, nil
+}

aws/sdk/glue.go

@@ -0,0 +1,192 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
+	glueTypes "github.com/aws/aws-sdk-go-v2/service/glue/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSGlueClientInterface interface {
+	ListDevEndpoints(ctx context.Context, params *glue.ListDevEndpointsInput, optFns ...func(*glue.Options)) (*glue.ListDevEndpointsOutput, error)
+	ListJobs(ctx context.Context, params *glue.ListJobsInput, optFns ...func(*glue.Options)) (*glue.ListJobsOutput, error)
+	GetTables(ctx context.Context, params *glue.GetTablesInput, optFns ...func(*glue.Options)) (*glue.GetTablesOutput, error)
+	GetDatabases(ctx context.Context, params *glue.GetDatabasesInput, optFns ...func(*glue.Options)) (*glue.GetDatabasesOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+	gob.Register(glueTypes.DevEndpoint{})
+	gob.Register(glueTypes.Job{})
+	gob.Register([]glueTypes.Table{})
+	gob.Register([]glueTypes.Database{})
+}
+
+func CachedGlueListDevEndpoints(GlueClient AWSGlueClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var devEndpoints []string
+	cacheKey := "glue-ListDevEndpoints-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached Glue dev endpoints data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListDevEndpoints, err := GlueClient.ListDevEndpoints(
+			context.TODO(),
+			&glue.ListDevEndpointsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *glue.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		devEndpoints = append(devEndpoints, ListDevEndpoints.DevEndpointNames...)
+
+		// Pagination control.
+		if aws.ToString(ListDevEndpoints.NextToken) != "" {
+			PaginationControl = ListDevEndpoints.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, devEndpoints, cache.DefaultExpiration)
+
+	return devEndpoints, nil
+}
+
+func CachedGlueListJobs(GlueClient AWSGlueClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var jobs []string
+	cacheKey := "glue-ListJobs-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached Glue jobs data")
+		return cached.([]string), nil
+	}
+
+	for {
+		ListJobs, err := GlueClient.ListJobs(
+			context.TODO(),
+			&glue.ListJobsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *glue.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		jobs = append(jobs, ListJobs.JobNames...)
+
+		// Pagination control.
+		if ListJobs.NextToken != nil {
+			PaginationControl = ListJobs.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, jobs, cache.DefaultExpiration)
+
+	return jobs, nil
+}
+
+func CachedGlueGetTables(GlueClient AWSGlueClientInterface, accountID string, region string, dbName string) ([]glueTypes.Table, error) {
+	var PaginationControl *string
+	var tables []glueTypes.Table
+	cacheKey := "glue-GetTables-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached Glue tables data")
+		return cached.([]glueTypes.Table), nil
+	}
+
+	for {
+		GetTables, err := GlueClient.GetTables(
+			context.TODO(),
+			&glue.GetTablesInput{
+				DatabaseName: &dbName,
+				NextToken:    PaginationControl,
+			},
+			func(o *glue.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		tables = append(tables, GetTables.TableList...)
+
+		// Pagination control.
+		if GetTables.NextToken != nil {
+			PaginationControl = GetTables.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, tables, cache.DefaultExpiration)
+
+	return tables, nil
+}
+
+func CachedGlueGetDatabases(GlueClient AWSGlueClientInterface, accountID string, region string) ([]glueTypes.Database, error) {
+	var PaginationControl *string
+	var databases []glueTypes.Database
+	cacheKey := "glue-GetDatabases-" + accountID + "-" + region
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		sharedLogger.Debug("Using cached Glue databases data")
+		return cached.([]glueTypes.Database), nil
+	}
+
+	for {
+		GetDatabases, err := GlueClient.GetDatabases(
+			context.TODO(),
+			&glue.GetDatabasesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *glue.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		databases = append(databases, GetDatabases.DatabaseList...)
+
+		// Pagination control.
+		if GetDatabases.NextToken != nil {
+			PaginationControl = GetDatabases.NextToken
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, databases, cache.DefaultExpiration)
+
+	return databases, nil
+}

aws/sdk/glue_mocks.go

@@ -0,0 +1,80 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/glue"
+	glueTypes "github.com/aws/aws-sdk-go-v2/service/glue/types"
+)
+
+type MockedGlueClient struct {
+}
+
+func (m *MockedGlueClient) ListDevEndpoints(ctx context.Context, input *glue.ListDevEndpointsInput, options ...func(*glue.Options)) (*glue.ListDevEndpointsOutput, error) {
+	return &glue.ListDevEndpointsOutput{
+		DevEndpointNames: []string{
+			"devendpoint1",
+			"devendpoint2",
+		},
+	}, nil
+}
+
+func (m *MockedGlueClient) ListJobs(ctx context.Context, input *glue.ListJobsInput, options ...func(*glue.Options)) (*glue.ListJobsOutput, error) {
+	return &glue.ListJobsOutput{
+		JobNames: []string{
+			"job1",
+			"job2",
+		},
+	}, nil
+}
+
+func (m *MockedGlueClient) GetTables(ctx context.Context, input *glue.GetTablesInput, options ...func(*glue.Options)) (*glue.GetTablesOutput, error) {
+	return &glue.GetTablesOutput{
+		TableList: []glueTypes.Table{
+			{
+				Name:         aws.String("table1"),
+				DatabaseName: aws.String("database1"),
+				Description:  aws.String("description1"),
+				Parameters: map[string]string{
+					"param1": "value1",
+					"param2": "value2",
+				},
+			},
+			{
+				Name:         aws.String("table2"),
+				DatabaseName: aws.String("database2"),
+				Description:  aws.String("description2"),
+				Parameters: map[string]string{
+					"param1": "value1",
+					"param2": "value2",
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedGlueClient) GetDatabases(ctx context.Context, input *glue.GetDatabasesInput, options ...func(*glue.Options)) (*glue.GetDatabasesOutput, error) {
+	return &glue.GetDatabasesOutput{
+		DatabaseList: []glueTypes.Database{
+			{
+				Name:        aws.String("database1"),
+				Description: aws.String("description1"),
+				LocationUri: aws.String("s3://bucket1"),
+				Parameters: map[string]string{
+					"param1": "value1",
+					"param2": "value2",
+				},
+			},
+			{
+				Name:        aws.String("database2"),
+				Description: aws.String("description2"),
+				LocationUri: aws.String("s3://bucket2"),
+				Parameters: map[string]string{
+					"param1": "value1",
+					"param2": "value2",
+				},
+			},
+		},
+	}, nil
+}

aws/sdk/grafana.go

@@ -0,0 +1,58 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/grafana"
+	grafanaTypes "github.com/aws/aws-sdk-go-v2/service/grafana/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type GrafanaClientInterface interface {
+	ListWorkspaces(context.Context, *grafana.ListWorkspacesInput, ...func(*grafana.Options)) (*grafana.ListWorkspacesOutput, error)
+}
+
+func init() {
+	gob.Register([]grafanaTypes.WorkspaceSummary{})
+}
+
+func CachedGrafanaListWorkspaces(client GrafanaClientInterface, accountID string, region string) ([]grafanaTypes.WorkspaceSummary, error) {
+	var PaginationControl *string
+	var workspaces []grafanaTypes.WorkspaceSummary
+	cacheKey := fmt.Sprintf("%s-grafana-ListWorkspaces-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]grafanaTypes.WorkspaceSummary), nil
+	}
+
+	for {
+
+		ListWorkspaces, err := client.ListWorkspaces(
+			context.TODO(),
+			&grafana.ListWorkspacesInput{
+				NextToken: PaginationControl,
+			},
+			func(o *grafana.Options) {
+				o.Region = region
+			},
+		)
+		if err != nil {
+			return workspaces, err
+
+		}
+
+		workspaces = append(workspaces, ListWorkspaces.Workspaces...)
+
+		//pagination
+		if ListWorkspaces.NextToken == nil {
+			break
+		}
+		PaginationControl = ListWorkspaces.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, workspaces, cache.DefaultExpiration)
+	return workspaces, nil
+}

aws/sdk/grafana_mocks.go

@@ -0,0 +1,42 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/grafana"
+	grafanaTypes "github.com/aws/aws-sdk-go-v2/service/grafana/types"
+)
+
+type MockedGrafanaClient struct {
+}
+
+func (m *MockedGrafanaClient) ListWorkspaces(ctx context.Context, input *grafana.ListWorkspacesInput, options ...func(*grafana.Options)) (*grafana.ListWorkspacesOutput, error) {
+	return &grafana.ListWorkspacesOutput{
+		Workspaces: []grafanaTypes.WorkspaceSummary{
+			{
+				Authentication: &grafanaTypes.AuthenticationSummary{
+					Providers: []grafanaTypes.AuthenticationProviderTypes{
+						grafanaTypes.AuthenticationProviderTypesAwsSso,
+					},
+				},
+				Created: aws.Time(time.Now()),
+				Id:      aws.String("workspace1"),
+				Name:    aws.String("workspace1"),
+				Status:  grafanaTypes.WorkspaceStatusActive,
+			},
+			{
+				Authentication: &grafanaTypes.AuthenticationSummary{
+					Providers: []grafanaTypes.AuthenticationProviderTypes{
+						grafanaTypes.AuthenticationProviderTypesAwsSso,
+					},
+				},
+				Created: aws.Time(time.Now()),
+				Id:      aws.String("workspace2"),
+				Name:    aws.String("workspace2"),
+				Status:  grafanaTypes.WorkspaceStatusActive,
+			},
+		},
+	}, nil
+}

aws/sdk/iam.go

@@ -0,0 +1,290 @@
+package sdk
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/gob"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSIAMClientInterface interface {
+	ListUsers(ctx context.Context, params *iam.ListUsersInput, optFns ...func(*iam.Options)) (*iam.ListUsersOutput, error)
+	ListAccessKeys(ctx context.Context, params *iam.ListAccessKeysInput, optFns ...func(*iam.Options)) (*iam.ListAccessKeysOutput, error)
+	ListRoles(ctx context.Context, params *iam.ListRolesInput, optFns ...func(*iam.Options)) (*iam.ListRolesOutput, error)
+	GetAccountAuthorizationDetails(ctx context.Context, params *iam.GetAccountAuthorizationDetailsInput, optFns ...func(*iam.Options)) (*iam.GetAccountAuthorizationDetailsOutput, error)
+	SimulatePrincipalPolicy(ctx context.Context, params *iam.SimulatePrincipalPolicyInput, optFns ...func(*iam.Options)) (*iam.SimulatePrincipalPolicyOutput, error)
+	ListInstanceProfiles(ctx context.Context, params *iam.ListInstanceProfilesInput, optFns ...func(*iam.Options)) (*iam.ListInstanceProfilesOutput, error)
+	ListGroups(ctx context.Context, params *iam.ListGroupsInput, optFns ...func(*iam.Options)) (*iam.ListGroupsOutput, error)
+}
+
+func init() {
+	gob.Register([]iamTypes.User{})
+	gob.Register([]iamTypes.AccessKeyMetadata{})
+	gob.Register([]iamTypes.Role{})
+	gob.Register([]iamTypes.Group{})
+	gob.Register([]iamTypes.PolicyDetail{})
+	gob.Register([]iamTypes.InstanceProfile{})
+	gob.Register([]iamTypes.EvaluationResult{})
+	gob.Register(customGAADOutput{})
+}
+
+func CachedIamListUsers(IAMClient AWSIAMClientInterface, accountID string) ([]iamTypes.User, error) {
+	var PaginationControl *string
+	var users []iamTypes.User
+	cacheKey := fmt.Sprintf("%s-iam-ListUsers", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]iamTypes.User), nil
+	}
+
+	for {
+		ListUsers, err := IAMClient.ListUsers(
+			context.TODO(),
+			&iam.ListUsersInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		users = append(users, ListUsers.Users...)
+
+		// Pagination control.
+		if ListUsers.Marker != nil {
+			PaginationControl = ListUsers.Marker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, users, cache.DefaultExpiration)
+	return users, nil
+
+}
+
+func CachedIamListRoles(IAMClient AWSIAMClientInterface, accountID string) ([]iamTypes.Role, error) {
+	var PaginationControl *string
+	var roles []iamTypes.Role
+	cacheKey := fmt.Sprintf("%s-iam-ListRoles", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]iamTypes.Role), nil
+	}
+
+	for {
+		ListRoles, err := IAMClient.ListRoles(
+			context.TODO(),
+			&iam.ListRolesInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			sharedLogger.Error(err.Error())
+			break
+		}
+
+		roles = append(roles, ListRoles.Roles...)
+
+		// Pagination control.
+		if ListRoles.Marker != nil {
+			PaginationControl = ListRoles.Marker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, roles, cache.DefaultExpiration)
+	return roles, nil
+
+}
+
+func CachedIamListAccessKeys(IAMClient AWSIAMClientInterface, accountID string, userName string) ([]iamTypes.AccessKeyMetadata, error) {
+	var PaginationControl *string
+	var accessKeys []iamTypes.AccessKeyMetadata
+	cacheKey := fmt.Sprintf("%s-iam-ListAccessKeys-%s", accountID, userName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]iamTypes.AccessKeyMetadata), nil
+	}
+
+	for {
+		ListAccessKeys, err := IAMClient.ListAccessKeys(
+			context.TODO(),
+			&iam.ListAccessKeysInput{
+				UserName: &userName,
+				Marker:   PaginationControl,
+			},
+		)
+		if err != nil {
+			return accessKeys, err
+		}
+
+		accessKeys = append(accessKeys, ListAccessKeys.AccessKeyMetadata...)
+
+		// Pagination control.
+		if ListAccessKeys.Marker != nil {
+			PaginationControl = ListAccessKeys.Marker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, accessKeys, cache.DefaultExpiration)
+	return accessKeys, nil
+
+}
+
+type customGAADOutput struct {
+	GroupDetailList []iamTypes.GroupDetail
+	UserDetailList  []iamTypes.UserDetail
+	RoleDetailList  []iamTypes.RoleDetail
+	Policies        []iamTypes.ManagedPolicyDetail
+}
+
+func CachedIAMGetAccountAuthorizationDetails(IAMClient AWSIAMClientInterface, accountID string) (customGAADOutput, error) {
+	var PaginationControl *string
+	var GroupDetailList []iamTypes.GroupDetail
+	var UserDetailList []iamTypes.UserDetail
+	var RoleDetailList []iamTypes.RoleDetail
+	var Policies []iamTypes.ManagedPolicyDetail
+	var AllAccountAuthorizationDetails = customGAADOutput{
+		GroupDetailList: GroupDetailList,
+		UserDetailList:  UserDetailList,
+		RoleDetailList:  RoleDetailList,
+		Policies:        Policies,
+	}
+
+	cacheKey := fmt.Sprintf("%s-iam-GetAccountAuthorizationDetails", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(customGAADOutput), nil
+	}
+
+	for {
+		GetAccountAuthorizationDetails, err := IAMClient.GetAccountAuthorizationDetails(
+			context.TODO(),
+			&iam.GetAccountAuthorizationDetailsInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			return AllAccountAuthorizationDetails, err
+		}
+
+		AllAccountAuthorizationDetails.GroupDetailList = append(AllAccountAuthorizationDetails.GroupDetailList, GetAccountAuthorizationDetails.GroupDetailList...)
+		AllAccountAuthorizationDetails.UserDetailList = append(AllAccountAuthorizationDetails.UserDetailList, GetAccountAuthorizationDetails.UserDetailList...)
+		AllAccountAuthorizationDetails.RoleDetailList = append(AllAccountAuthorizationDetails.RoleDetailList, GetAccountAuthorizationDetails.RoleDetailList...)
+		AllAccountAuthorizationDetails.Policies = append(AllAccountAuthorizationDetails.Policies, GetAccountAuthorizationDetails.Policies...)
+
+		if GetAccountAuthorizationDetails.Marker != nil {
+			PaginationControl = GetAccountAuthorizationDetails.Marker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, AllAccountAuthorizationDetails, cache.DefaultExpiration)
+	return AllAccountAuthorizationDetails, nil
+
+}
+
+func CachedIamSimulatePrincipalPolicy(IAMClient AWSIAMClientInterface, accountID string, principal *string, actionNames []string, resourceArns []string) ([]iamTypes.EvaluationResult, error) {
+	var PaginationControl2 *string
+	var EvaluationResults []iamTypes.EvaluationResult
+	md5hashedActionNames := md5.Sum([]byte(strings.Join(actionNames, "")))
+	md5hashedResourceArns := md5.Sum([]byte(strings.Join(resourceArns, "")))
+	// proccess arn and get the name of the resource
+	arn, err := arn.Parse(*principal)
+	if err != nil {
+		return EvaluationResults, err
+	}
+	name := arn.Resource
+	// if name has muliplte / then get the last one
+	if strings.Contains(arn.Resource, "/") {
+		name = arn.Resource[strings.LastIndex(arn.Resource, "/")+1:]
+	}
+
+	truncatedHashLength := 8
+	cacheKey := fmt.Sprintf("%s-iamSimulator-%s-%s-%s", accountID, name, hex.EncodeToString(md5hashedActionNames[:truncatedHashLength]), hex.EncodeToString(md5hashedResourceArns[:truncatedHashLength]))
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]iamTypes.EvaluationResult), nil
+	}
+
+	for {
+		SimulatePrincipalPolicy, err := IAMClient.SimulatePrincipalPolicy(
+			context.TODO(),
+			&iam.SimulatePrincipalPolicyInput{
+				Marker:          PaginationControl2,
+				ActionNames:     actionNames,
+				PolicySourceArn: principal,
+				ResourceArns:    resourceArns,
+			},
+		)
+		if err != nil {
+			return EvaluationResults, err
+		}
+
+		EvaluationResults = append(EvaluationResults, SimulatePrincipalPolicy.EvaluationResults...)
+
+		if SimulatePrincipalPolicy.Marker != nil {
+			PaginationControl2 = SimulatePrincipalPolicy.Marker
+		} else {
+			PaginationControl2 = nil
+			break
+		}
+
+	}
+	internal.Cache.Set(cacheKey, EvaluationResults, cache.DefaultExpiration)
+	return EvaluationResults, nil
+}
+
+func CachedIamListGroups(IAMClient AWSIAMClientInterface, accountID string) ([]iamTypes.Group, error) {
+	var PaginationControl *string
+	var Groups []iamTypes.Group
+	cacheKey := fmt.Sprintf("%s-iam-ListGroups", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]iamTypes.Group), nil
+	}
+
+	for {
+		ListGroups, err := IAMClient.ListGroups(
+			context.TODO(),
+			&iam.ListGroupsInput{
+				Marker: PaginationControl,
+			},
+		)
+		if err != nil {
+			return Groups, err
+		}
+
+		Groups = append(Groups, ListGroups.Groups...)
+
+		// Pagination control.
+		if ListGroups.Marker != nil {
+			PaginationControl = ListGroups.Marker
+		} else {
+			PaginationControl = nil
+			break
+		}
+	}
+
+	internal.Cache.Set(cacheKey, Groups, cache.DefaultExpiration)
+	return Groups, nil
+
+}

aws/sdk/iam_mocks.go

@@ -0,0 +1,222 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+)
+
+type MockedIAMClient struct {
+}
+
+func (m *MockedIAMClient) ListUsers(ctx context.Context, input *iam.ListUsersInput, options ...func(*iam.Options)) (*iam.ListUsersOutput, error) {
+	return &iam.ListUsersOutput{
+		Users: []iamTypes.User{
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:user/user1"),
+				CreateDate: aws.Time(time.Now()),
+				Path:       aws.String("/"),
+				UserId:     aws.String("123456789012"),
+				UserName:   aws.String("user1"),
+			},
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:user/user2"),
+				CreateDate: aws.Time(time.Now()),
+				Path:       aws.String("/"),
+				UserId:     aws.String("123456789012"),
+				UserName:   aws.String("user2"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedIAMClient) ListAccessKeys(ctx context.Context, input *iam.ListAccessKeysInput, options ...func(*iam.Options)) (*iam.ListAccessKeysOutput, error) {
+	return &iam.ListAccessKeysOutput{
+		AccessKeyMetadata: []iamTypes.AccessKeyMetadata{
+			{
+				AccessKeyId: aws.String("accesskey1"),
+				CreateDate:  aws.Time(time.Now()),
+				Status:      iamTypes.StatusTypeActive,
+				UserName:    aws.String("user1"),
+			},
+			{
+				AccessKeyId: aws.String("accesskey2"),
+				CreateDate:  aws.Time(time.Now()),
+				Status:      iamTypes.StatusTypeActive,
+				UserName:    aws.String("user2"),
+			},
+		},
+	}, nil
+
+}
+
+func (m *MockedIAMClient) ListGroups(ctx context.Context, input *iam.ListGroupsInput, options ...func(*iam.Options)) (*iam.ListGroupsOutput, error) {
+	return &iam.ListGroupsOutput{
+		Groups: []iamTypes.Group{
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:group/group1"),
+				CreateDate: aws.Time(time.Now()),
+				GroupId:    aws.String("123456789012"),
+				GroupName:  aws.String("group1"),
+				Path:       aws.String("/"),
+			},
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:group/group2"),
+				CreateDate: aws.Time(time.Now()),
+				GroupId:    aws.String("123456789012"),
+				GroupName:  aws.String("group2"),
+				Path:       aws.String("/"),
+			},
+		},
+	}, nil
+
+}
+
+func (m *MockedIAMClient) ListRoles(ctx context.Context, input *iam.ListRolesInput, options ...func(*iam.Options)) (*iam.ListRolesOutput, error) {
+	return &iam.ListRolesOutput{
+		Roles: []iamTypes.Role{
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role1"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+				RoleName:                 aws.String("role1"),
+				Path:                     aws.String("/"),
+			},
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role2"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+				RoleName:                 aws.String("role2"),
+				Path:                     aws.String("/"),
+			},
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role3"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+				RoleName:                 aws.String("role3"),
+				Path:                     aws.String("/"),
+			},
+		},
+	}, nil
+
+}
+
+func (m *MockedIAMClient) GetAccountAuthorizationDetails(ctx context.Context, params *iam.GetAccountAuthorizationDetailsInput, optFns ...func(*iam.Options)) (*iam.GetAccountAuthorizationDetailsOutput, error) {
+	return &iam.GetAccountAuthorizationDetailsOutput{
+		GroupDetailList: []iamTypes.GroupDetail{
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:group/group1"),
+				CreateDate: aws.Time(time.Now()),
+				GroupId:    aws.String("123456789012"),
+				GroupName:  aws.String("group1"),
+				Path:       aws.String("/"),
+			},
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:group/group2"),
+				CreateDate: aws.Time(time.Now()),
+				GroupId:    aws.String("123456789012"),
+				GroupName:  aws.String("group2"),
+				Path:       aws.String("/"),
+			},
+		},
+		RoleDetailList: []iamTypes.RoleDetail{
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role1"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+				RoleName:                 aws.String("role1"),
+				Path:                     aws.String("/"),
+			},
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role2"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+				RoleName:                 aws.String("role2"),
+				Path:                     aws.String("/"),
+			},
+			{
+				Arn:                      aws.String("arn:aws:iam::123456789012:role/role3"),
+				AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Action\":\"sts:AssumeRole\"}]}"),
+				CreateDate:               aws.Time(time.Now()),
+				RoleId:                   aws.String("123456789012"),
+
+				RoleName: aws.String("role3"),
+				Path:     aws.String("/"),
+			},
+		},
+		UserDetailList: []iamTypes.UserDetail{
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:user/user1"),
+				CreateDate: aws.Time(time.Now()),
+
+				UserId:   aws.String("123456789012"),
+				UserName: aws.String("user1"),
+				Path:     aws.String("/"),
+			},
+			{
+				Arn:        aws.String("arn:aws:iam::123456789012:user/user2"),
+				CreateDate: aws.Time(time.Now()),
+
+				UserId:   aws.String("123456789012"),
+				UserName: aws.String("user2"),
+				Path:     aws.String("/"),
+			},
+		},
+	}, nil
+}
+
+func (m *MockedIAMClient) SimulatePrincipalPolicy(ctx context.Context, params *iam.SimulatePrincipalPolicyInput, optFns ...func(*iam.Options)) (*iam.SimulatePrincipalPolicyOutput, error) {
+	return &iam.SimulatePrincipalPolicyOutput{
+		EvaluationResults: []iamTypes.EvaluationResult{
+			{
+				EvalActionName:   aws.String("sts:AssumeRole"),
+				EvalDecision:     iamTypes.PolicyEvaluationDecisionTypeAllowed,
+				EvalResourceName: aws.String("arn:aws:iam::123456789012:role/role1"),
+				MatchedStatements: []iamTypes.Statement{
+					{
+						SourcePolicyId:   aws.String("PolicyForRole1"),
+						SourcePolicyType: iamTypes.PolicySourceTypeUser,
+						StartPosition: &iamTypes.Position{
+							Column: 0,
+							Line:   0,
+						},
+					},
+				},
+			},
+		},
+	}, nil
+
+}
+
+func (m *MockedIAMClient) ListInstanceProfiles(ctx context.Context, params *iam.ListInstanceProfilesInput, optFns ...func(*iam.Options)) (*iam.ListInstanceProfilesOutput, error) {
+	return &iam.ListInstanceProfilesOutput{
+		InstanceProfiles: []iamTypes.InstanceProfile{
+			{
+				Arn:                 aws.String("arn:aws:iam::123456789012:instance-profile/instance-profile1"),
+				CreateDate:          aws.Time(time.Now()),
+				InstanceProfileId:   aws.String("123456789012"),
+				InstanceProfileName: aws.String("instance-profile1"),
+				Path:                aws.String("/"),
+				Roles: []iamTypes.Role{
+					{
+						Arn:                      aws.String("arn:aws:iam::123456789012:role/role1"),
+						AssumeRolePolicyDocument: aws.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"),
+						CreateDate:               aws.Time(time.Now()),
+						RoleId:                   aws.String("123456789012"),
+						RoleName:                 aws.String("role1"),
+						Path:                     aws.String("/"),
+					},
+				},
+			},
+		},
+	}, nil
+
+}

aws/sdk/kinesis.go

@@ -0,0 +1,55 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/kinesis"
+	"github.com/patrickmn/go-cache"
+)
+
+type AWSKinesisClientInterface interface {
+	ListStreams(context.Context, *kinesis.ListStreamsInput, ...func(*kinesis.Options)) (*kinesis.ListStreamsOutput, error)
+}
+
+func init() {
+	gob.Register([]string{})
+}
+
+func CachedKinesisListStreams(client AWSKinesisClientInterface, accountID string, region string) ([]string, error) {
+	var PaginationControl *string
+	var streams []string
+	cacheKey := fmt.Sprintf("%s-kinesis-ListStreams-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]string), nil
+	}
+	for {
+		ListStreams, err := client.ListStreams(
+			context.TODO(),
+			&kinesis.ListStreamsInput{
+				NextToken: PaginationControl,
+			},
+			func(o *kinesis.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return streams, err
+		}
+
+		streams = append(streams, ListStreams.StreamNames...)
+
+		//pagination
+		if ListStreams.NextToken == nil {
+			break
+		}
+		PaginationControl = ListStreams.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, streams, cache.DefaultExpiration)
+	return streams, nil
+}

aws/sdk/kinesis_mocks.go

@@ -0,0 +1,21 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kinesis"
+)
+
+type MockedKinesisClient struct {
+}
+
+func (m *MockedKinesisClient) ListStreams(ctx context.Context, input *kinesis.ListStreamsInput, options ...func(*kinesis.Options)) (*kinesis.ListStreamsOutput, error) {
+	return &kinesis.ListStreamsOutput{
+		HasMoreStreams: aws.Bool(false),
+		StreamNames: []string{
+			"stream1",
+			"stream2",
+		},
+	}, nil
+}

aws/sdk/lambda.go

@@ -0,0 +1,147 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/lambda"
+	lambdaTypes "github.com/aws/aws-sdk-go-v2/service/lambda/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type LambdaClientInterface interface {
+	ListFunctions(context.Context, *lambda.ListFunctionsInput, ...func(*lambda.Options)) (*lambda.ListFunctionsOutput, error)
+	GetFunction(context.Context, *lambda.GetFunctionInput, ...func(*lambda.Options)) (*lambda.GetFunctionOutput, error)
+	GetFunctionUrlConfig(context.Context, *lambda.GetFunctionUrlConfigInput, ...func(*lambda.Options)) (*lambda.GetFunctionUrlConfigOutput, error)
+}
+
+func init() {
+	gob.Register([]lambdaTypes.FunctionConfiguration{})
+	gob.Register(customGetFuntionURLOutput{})
+}
+
+// create a  CachedLambdaListFunctions function that accepts a lambda client, account id, region. Make sure it uses go-cache and handles the region option and pagination
+func CachedLambdaListFunctions(client LambdaClientInterface, accountID string, region string) ([]lambdaTypes.FunctionConfiguration, error) {
+	var PaginationControl *string
+	var functions []lambdaTypes.FunctionConfiguration
+	cacheKey := fmt.Sprintf("%s-lambda-ListFunctions-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]lambdaTypes.FunctionConfiguration), nil
+	}
+
+	for {
+		ListFunctions, err := client.ListFunctions(
+			context.TODO(),
+			&lambda.ListFunctionsInput{
+				Marker: PaginationControl,
+			},
+			func(o *lambda.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return functions, err
+		}
+
+		functions = append(functions, ListFunctions.Functions...)
+
+		//pagination
+		if ListFunctions.NextMarker == nil {
+			break
+		}
+		PaginationControl = ListFunctions.NextMarker
+	}
+	internal.Cache.Set(cacheKey, functions, cache.DefaultExpiration)
+
+	return functions, nil
+}
+
+type customGetFuntionURLOutput struct {
+	// The type of authentication that your function URL uses. Set to AWS_IAM if you
+	// want to restrict access to authenticated users only. Set to NONE if you want to
+	// bypass IAM authentication to create a public endpoint. For more information, see
+	// Security and auth model for Lambda function URLs (https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html)
+	// .
+	//
+	// This member is required.
+	AuthType lambdaTypes.FunctionUrlAuthType
+
+	// When the function URL was created, in ISO-8601 format (https://www.w3.org/TR/NOTE-datetime)
+	// (YYYY-MM-DDThh:mm:ss.sTZD).
+	//
+	// This member is required.
+	CreationTime *string
+
+	// The Amazon Resource Name (ARN) of your function.
+	//
+	// This member is required.
+	FunctionArn *string
+
+	// The HTTP URL endpoint for your function.
+	//
+	// This member is required.
+	FunctionUrl *string
+
+	// When the function URL configuration was last updated, in ISO-8601 format (https://www.w3.org/TR/NOTE-datetime)
+	// (YYYY-MM-DDThh:mm:ss.sTZD).
+	//
+	// This member is required.
+	LastModifiedTime *string
+
+	// The cross-origin resource sharing (CORS) (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+	// settings for your function URL.
+	Cors *lambdaTypes.Cors
+
+	// Use one of the following options:
+	//   - BUFFERED – This is the default option. Lambda invokes your function using
+	//   the Invoke API operation. Invocation results are available when the payload is
+	//   complete. The maximum payload size is 6 MB.
+	//   - RESPONSE_STREAM – Your function streams payload results as they become
+	//   available. Lambda invokes your function using the InvokeWithResponseStream API
+	//   operation. The maximum response payload size is 20 MB, however, you can
+	//   request a quota increase (https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html)
+	//   .
+	InvokeMode lambdaTypes.InvokeMode
+}
+
+// create a  CachedLambdaGetFunctionUrlConfig function that accepts a lambda client, account id, region, and function name. Make sure it uses go-cache and handles the region option
+func CachedLambdaGetFunctionUrlConfig(client LambdaClientInterface, accountID string, region string, functionName string) (customGetFuntionURLOutput, error) {
+	var functionUrlConfigOutput customGetFuntionURLOutput
+	cacheKey := fmt.Sprintf("%s-lambda-GetFunctionUrlConfig-%s-%s", accountID, region, functionName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(customGetFuntionURLOutput), nil
+	}
+
+	GetFunctionUrlConfig, err := client.GetFunctionUrlConfig(
+		context.TODO(),
+		&lambda.GetFunctionUrlConfigInput{
+			FunctionName: &functionName,
+		},
+		func(o *lambda.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return functionUrlConfigOutput, err
+	}
+
+	functionUrlConfigOutput = customGetFuntionURLOutput{
+		AuthType:         GetFunctionUrlConfig.AuthType,
+		CreationTime:     GetFunctionUrlConfig.CreationTime,
+		FunctionArn:      GetFunctionUrlConfig.FunctionArn,
+		FunctionUrl:      GetFunctionUrlConfig.FunctionUrl,
+		LastModifiedTime: GetFunctionUrlConfig.LastModifiedTime,
+		Cors:             GetFunctionUrlConfig.Cors,
+		InvokeMode:       GetFunctionUrlConfig.InvokeMode,
+	}
+
+	internal.Cache.Set(cacheKey, functionUrlConfigOutput, cache.DefaultExpiration)
+
+	return functionUrlConfigOutput, nil
+}

aws/sdk/lambda_mocks.go

@@ -0,0 +1,62 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/lambda"
+	lambdaTypes "github.com/aws/aws-sdk-go-v2/service/lambda/types"
+)
+
+type MockedLambdaClient struct {
+}
+
+func (m *MockedLambdaClient) ListFunctions(ctx context.Context, input *lambda.ListFunctionsInput, options ...func(*lambda.Options)) (*lambda.ListFunctionsOutput, error) {
+	return &lambda.ListFunctionsOutput{
+		Functions: []lambdaTypes.FunctionConfiguration{
+			{
+				FunctionArn:  aws.String("arn:aws:lambda:us-east-1:123456789012:function:my-function"),
+				FunctionName: aws.String("my-function"),
+				Handler:      aws.String("index.handler"),
+				Runtime:      lambdaTypes.RuntimeNodejs18x,
+				Environment: &lambdaTypes.EnvironmentResponse{
+					Variables: map[string]string{
+						"key1": "value1",
+						"key2": "value2",
+					},
+				},
+			},
+			{
+				FunctionArn:  aws.String("arn:aws:lambda:us-east-1:123456789012:function:my-function2"),
+				FunctionName: aws.String("my-function2"),
+				Handler:      aws.String("index.handler"),
+				Runtime:      lambdaTypes.RuntimeNodejs18x,
+			},
+		},
+	}, nil
+}
+
+func (m *MockedLambdaClient) GetFunction(ctx context.Context, input *lambda.GetFunctionInput, options ...func(*lambda.Options)) (*lambda.GetFunctionOutput, error) {
+	return &lambda.GetFunctionOutput{
+		Configuration: &lambdaTypes.FunctionConfiguration{
+			FunctionArn:  aws.String("arn:aws:lambda:us-east-1:123456789012:function:my-function"),
+			FunctionName: aws.String("my-function"),
+			Handler:      aws.String("index.handler"),
+			Runtime:      lambdaTypes.RuntimeNodejs18x,
+			Environment: &lambdaTypes.EnvironmentResponse{
+				Variables: map[string]string{
+					"key1": "value1",
+					"key2": "value2",
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedLambdaClient) GetFunctionUrlConfig(ctx context.Context, input *lambda.GetFunctionInput, options ...func(*lambda.Options)) (*lambda.GetFunctionUrlConfigOutput, error) {
+	return &lambda.GetFunctionUrlConfigOutput{
+		FunctionUrl: aws.String("https://my-function.us-east-1.amazonaws.com/Prod/"),
+		FunctionArn: aws.String("arn:aws:lambda:us-east-1:123456789012:function:my-function"),
+		AuthType:    lambdaTypes.FunctionUrlAuthTypeNone,
+	}, nil
+}

aws/sdk/lightsail.go

@@ -0,0 +1,91 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/lightsail"
+	lightsailTypes "github.com/aws/aws-sdk-go-v2/service/lightsail/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type lightsailClientInterface interface {
+	GetInstances(context.Context, *lightsail.GetInstancesInput, ...func(*lightsail.Options)) (*lightsail.GetInstancesOutput, error)
+	GetContainerServices(context.Context, *lightsail.GetContainerServicesInput, ...func(*lightsail.Options)) (*lightsail.GetContainerServicesOutput, error)
+}
+
+func init() {
+
+	//need to do this to avoid conflicts with the Instance type in the ec2 package
+	type lightsailInstance lightsailTypes.Instance
+	gob.Register([]lightsailInstance{})
+
+	gob.Register([]lightsailTypes.ContainerService{})
+
+}
+
+func CachedLightsailGetInstances(client lightsailClientInterface, accountID string, region string) ([]lightsailTypes.Instance, error) {
+	var PaginationControl *string
+	var services []lightsailTypes.Instance
+
+	// TODO: When caching is enabled, this []lightsailTypes.Instance type clashes with the EC instance type when it comes to gob.Register. need to figure out how to register both types
+	// cacheKey := fmt.Sprintf("%s-lightsail-GetInstances-%s", accountID, region)
+	// cached, found := internal.Cache.Get(cacheKey)
+	// if found {
+	// 	return cached.([]lightsailTypes.Instance), nil
+	// }
+	for {
+		GetInstances, err := client.GetInstances(
+			context.TODO(),
+			&lightsail.GetInstancesInput{
+				PageToken: PaginationControl,
+			},
+			func(o *lightsail.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return services, err
+		}
+
+		services = append(services, GetInstances.Instances...)
+
+		//pagination
+		if GetInstances.NextPageToken == nil {
+			break
+		}
+		PaginationControl = GetInstances.NextPageToken
+	}
+
+	// TODO: When caching is enabled, this []lightsailTypes.Instance type clashes with the EC instance type when it comes to gob.Register. need to figure out how to register both types
+	//internal.Cache.Set(cacheKey, services, cache.DefaultExpiration)
+	return services, nil
+}
+
+func CachedLightsailGetContainerServices(client lightsailClientInterface, accountID string, region string) ([]lightsailTypes.ContainerService, error) {
+	var services []lightsailTypes.ContainerService
+	cacheKey := fmt.Sprintf("%s-lightsail-GetContainerService-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]lightsailTypes.ContainerService), nil
+	}
+	GetInstances, err := client.GetContainerServices(
+		context.TODO(),
+		&lightsail.GetContainerServicesInput{},
+		func(o *lightsail.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return services, err
+	}
+
+	services = append(services, GetInstances.ContainerServices...)
+
+	internal.Cache.Set(cacheKey, services, cache.DefaultExpiration)
+	return services, nil
+}

aws/sdk/lightsail_mocks.go

@@ -0,0 +1,80 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/lightsail"
+	lightsailTypes "github.com/aws/aws-sdk-go-v2/service/lightsail/types"
+)
+
+type MockedLightsailClient struct {
+}
+
+func (m *MockedLightsailClient) GetInstances(ctx context.Context, input *lightsail.GetInstancesInput, options ...func(*lightsail.Options)) (*lightsail.GetInstancesOutput, error) {
+	return &lightsail.GetInstancesOutput{
+		Instances: []lightsailTypes.Instance{
+			{
+				BlueprintId: aws.String("blueprint1"),
+				BundleId:    aws.String("bundle1"),
+				CreatedAt:   aws.Time(time.Now()),
+				Location: &lightsailTypes.ResourceLocation{
+					AvailabilityZone: aws.String("us-east-1a"),
+					RegionName:       lightsailTypes.RegionNameUsEast1,
+				},
+				Name: aws.String("instance1"),
+				Networking: &lightsailTypes.InstanceNetworking{
+					MonthlyTransfer: &lightsailTypes.MonthlyTransfer{
+						GbPerMonthAllocated: aws.Int32(1),
+					},
+				},
+				PrivateIpAddress: aws.String("10.1.1.1"),
+				PublicIpAddress:  aws.String("1.2.3.4"),
+			},
+			{
+				BlueprintId: aws.String("blueprint2"),
+				BundleId:    aws.String("bundle2"),
+				CreatedAt:   aws.Time(time.Now()),
+				Location: &lightsailTypes.ResourceLocation{
+					AvailabilityZone: aws.String("us-east-1b"),
+					RegionName:       lightsailTypes.RegionNameUsEast1,
+				},
+				Name: aws.String("instance2"),
+				Networking: &lightsailTypes.InstanceNetworking{
+					MonthlyTransfer: &lightsailTypes.MonthlyTransfer{
+						GbPerMonthAllocated: aws.Int32(2),
+					},
+				},
+				PrivateIpAddress: aws.String("10.2.2.2"),
+				PublicIpAddress:  aws.String("2.3.4.4"),
+			},
+		},
+	}, nil
+
+}
+
+func (m *MockedLightsailClient) GetContainerServices(ctx context.Context, input *lightsail.GetContainerServicesInput, options ...func(*lightsail.Options)) (*lightsail.GetContainerServicesOutput, error) {
+	return &lightsail.GetContainerServicesOutput{
+		ContainerServices: []lightsailTypes.ContainerService{
+			{
+				Arn: aws.String("arn1"),
+				Location: &lightsailTypes.ResourceLocation{
+					AvailabilityZone: aws.String("us-east-1a"),
+					RegionName:       lightsailTypes.RegionNameUsEast1,
+				},
+				Url:               aws.String("https://container1"),
+				PrivateDomainName: aws.String("container1"),
+			},
+			{
+				Arn: aws.String("arn2"),
+				Location: &lightsailTypes.ResourceLocation{
+					AvailabilityZone: aws.String("us-east-1a"),
+					RegionName:       lightsailTypes.RegionNameUsEast1,
+				},
+				Url:               aws.String("https://container2"),
+				PrivateDomainName: aws.String("container2"),
+			},
+		},
+	}, nil
+}

aws/sdk/mq.go

@@ -0,0 +1,58 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/mq"
+	mqTypes "github.com/aws/aws-sdk-go-v2/service/mq/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type MQClientInterface interface {
+	ListBrokers(context.Context, *mq.ListBrokersInput, ...func(*mq.Options)) (*mq.ListBrokersOutput, error)
+}
+
+func init() {
+	gob.Register([]mqTypes.BrokerSummary{})
+}
+
+// create CachedMQListBrokers function that uses go-cache and pagination
+func CachedMQListBrokers(client MQClientInterface, accountID string, region string) ([]mqTypes.BrokerSummary, error) {
+	var PaginationControl *string
+	var brokers []mqTypes.BrokerSummary
+	cacheKey := fmt.Sprintf("%s-mq-ListBrokers-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]mqTypes.BrokerSummary), nil
+	}
+
+	for {
+		ListBrokers, err := client.ListBrokers(
+			context.TODO(),
+			&mq.ListBrokersInput{
+				NextToken: PaginationControl,
+			},
+			func(o *mq.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return brokers, err
+		}
+
+		brokers = append(brokers, ListBrokers.BrokerSummaries...)
+
+		//pagination
+		if ListBrokers.NextToken == nil {
+			break
+		}
+		PaginationControl = ListBrokers.NextToken
+	}
+
+	internal.Cache.Set(cacheKey, brokers, cache.DefaultExpiration)
+	return brokers, nil
+}

aws/sdk/mq_mocks.go

@@ -0,0 +1,40 @@
+package sdk
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mq"
+	mqTypes "github.com/aws/aws-sdk-go-v2/service/mq/types"
+)
+
+type MockedMQClient struct {
+}
+
+func (m *MockedMQClient) ListBrokers(ctx context.Context, input *mq.ListBrokersInput, options ...func(*mq.Options)) (*mq.ListBrokersOutput, error) {
+	return &mq.ListBrokersOutput{
+		BrokerSummaries: []mqTypes.BrokerSummary{
+			{
+				BrokerArn:        aws.String("broker1"),
+				BrokerId:         aws.String("broker1"),
+				BrokerName:       aws.String("broker1"),
+				BrokerState:      mqTypes.BrokerStateRunning,
+				Created:          aws.Time(time.Now()),
+				DeploymentMode:   mqTypes.DeploymentModeSingleInstance,
+				EngineType:       mqTypes.EngineTypeRabbitmq,
+				HostInstanceType: aws.String("host1"),
+			},
+			{
+				BrokerArn:        aws.String("broker2"),
+				BrokerId:         aws.String("broker2"),
+				BrokerName:       aws.String("broker2"),
+				BrokerState:      mqTypes.BrokerStateRunning,
+				Created:          aws.Time(time.Now()),
+				DeploymentMode:   mqTypes.DeploymentModeSingleInstance,
+				EngineType:       mqTypes.EngineTypeActivemq,
+				HostInstanceType: aws.String("host2"),
+			},
+		},
+	}, nil
+}

aws/sdk/opensearch.go

@@ -0,0 +1,107 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/opensearch"
+	openSearchTypes "github.com/aws/aws-sdk-go-v2/service/opensearch/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type OpenSearchClientInterface interface {
+	ListDomainNames(context.Context, *opensearch.ListDomainNamesInput, ...func(*opensearch.Options)) (*opensearch.ListDomainNamesOutput, error)
+	DescribeDomainConfig(context.Context, *opensearch.DescribeDomainConfigInput, ...func(*opensearch.Options)) (*opensearch.DescribeDomainConfigOutput, error)
+	DescribeDomain(context.Context, *opensearch.DescribeDomainInput, ...func(*opensearch.Options)) (*opensearch.DescribeDomainOutput, error)
+}
+
+func init() {
+	gob.Register([]openSearchTypes.DomainInfo{})
+	gob.Register(openSearchTypes.DomainConfig{})
+	gob.Register(openSearchTypes.DomainStatus{})
+}
+
+// create CachedOpenSearchListDomainNames function that uses go-cache and pagination
+func CachedOpenSearchListDomainNames(client OpenSearchClientInterface, accountID string, region string) ([]openSearchTypes.DomainInfo, error) {
+	var domains []openSearchTypes.DomainInfo
+	cacheKey := fmt.Sprintf("%s-opensearch-ListDomainNames-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]openSearchTypes.DomainInfo), nil
+	}
+
+	ListDomainNames, err := client.ListDomainNames(
+		context.TODO(),
+		&opensearch.ListDomainNamesInput{},
+		func(o *opensearch.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return domains, err
+	}
+
+	domains = append(domains, ListDomainNames.DomainNames...)
+
+	internal.Cache.Set(cacheKey, domains, cache.DefaultExpiration)
+	return domains, nil
+}
+
+// create CachedOpenSearchDescribeDomainConfig function that uses go-cache and pagination and supports region option
+func CachedOpenSearchDescribeDomainConfig(client OpenSearchClientInterface, accountID string, region string, domainName string) (openSearchTypes.DomainConfig, error) {
+	var DomainConfig openSearchTypes.DomainConfig
+	cacheKey := fmt.Sprintf("%s-opensearch-DescribeDomainConfig-%s-%s", accountID, region, domainName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(openSearchTypes.DomainConfig), nil
+	}
+	DescribeDomainConfig, err := client.DescribeDomainConfig(
+		context.TODO(),
+		&opensearch.DescribeDomainConfigInput{
+			DomainName: &domainName,
+		},
+		func(o *opensearch.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return DomainConfig, err
+	}
+
+	DomainConfig = *DescribeDomainConfig.DomainConfig
+
+	internal.Cache.Set(cacheKey, DomainConfig, cache.DefaultExpiration)
+	return DomainConfig, nil
+}
+
+// create CachedOpenSearchDescribeDomain function that uses go-cache and pagination and supports region option
+func CachedOpenSearchDescribeDomain(client OpenSearchClientInterface, accountID string, region string, domainName string) (openSearchTypes.DomainStatus, error) {
+	var DomainStatus openSearchTypes.DomainStatus
+	cacheKey := fmt.Sprintf("%s-opensearch-DescribeDomain-%s-%s", accountID, region, domainName)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(openSearchTypes.DomainStatus), nil
+	}
+	DescribeDomain, err := client.DescribeDomain(
+		context.TODO(),
+		&opensearch.DescribeDomainInput{
+			DomainName: &domainName,
+		},
+		func(o *opensearch.Options) {
+			o.Region = region
+		},
+	)
+
+	if err != nil {
+		return DomainStatus, err
+	}
+
+	DomainStatus = *DescribeDomain.DomainStatus
+
+	internal.Cache.Set(cacheKey, DomainStatus, cache.DefaultExpiration)
+	return DomainStatus, nil
+}

aws/sdk/opensearch_mocks.go

@@ -0,0 +1,63 @@
+package sdk
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/opensearch"
+	openSearchTypes "github.com/aws/aws-sdk-go-v2/service/opensearch/types"
+)
+
+type MockedOpenSearchClient struct {
+}
+
+func (m *MockedOpenSearchClient) ListDomainNames(ctx context.Context, input *opensearch.ListDomainNamesInput, options ...func(*opensearch.Options)) (*opensearch.ListDomainNamesOutput, error) {
+	return &opensearch.ListDomainNamesOutput{
+		DomainNames: []openSearchTypes.DomainInfo{
+			{
+				DomainName: aws.String("domain1"),
+				EngineType: openSearchTypes.EngineTypeOpenSearch,
+			},
+			{
+				DomainName: aws.String("domain2"),
+				EngineType: openSearchTypes.EngineTypeElasticsearch,
+			},
+		},
+	}, nil
+}
+
+func (m *MockedOpenSearchClient) DescribeDomainConfig(ctx context.Context, input *opensearch.DescribeDomainConfigInput, options ...func(*opensearch.Options)) (*opensearch.DescribeDomainConfigOutput, error) {
+	return &opensearch.DescribeDomainConfigOutput{
+		DomainConfig: &openSearchTypes.DomainConfig{
+			EngineVersion: &openSearchTypes.VersionStatus{
+				Options: aws.String("OpenSearch-1.1"),
+				Status: &openSearchTypes.OptionStatus{
+					PendingDeletion: aws.Bool(false),
+				},
+			},
+			ClusterConfig: &openSearchTypes.ClusterConfigStatus{
+				Options: &openSearchTypes.ClusterConfig{
+					DedicatedMasterCount:   aws.Int32(3),
+					DedicatedMasterEnabled: aws.Bool(true),
+					InstanceCount:          aws.Int32(3),
+					WarmCount:              aws.Int32(3),
+					WarmEnabled:            aws.Bool(true),
+				},
+			},
+			DomainEndpointOptions: &openSearchTypes.DomainEndpointOptionsStatus{
+				Options: &openSearchTypes.DomainEndpointOptions{
+					EnforceHTTPS: aws.Bool(true),
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *MockedOpenSearchClient) DescribeDomain(ctx context.Context, input *opensearch.DescribeDomainInput, options ...func(*opensearch.Options)) (*opensearch.DescribeDomainOutput, error) {
+	return &opensearch.DescribeDomainOutput{
+		DomainStatus: &openSearchTypes.DomainStatus{
+			DomainName: aws.String("domain1"),
+			Endpoint:   aws.String("https://domain1.us-east-1.es.amazonaws.com"),
+		},
+	}, nil
+}

aws/sdk/org.go

@@ -0,0 +1,81 @@
+package sdk
+
+import (
+	"context"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/service/organizations"
+	orgTypes "github.com/aws/aws-sdk-go-v2/service/organizations/types"
+	"github.com/patrickmn/go-cache"
+)
+
+type OrganizationsClientInterface interface {
+	ListAccounts(ctx context.Context, params *organizations.ListAccountsInput, optFns ...func(*organizations.Options)) (*organizations.ListAccountsOutput, error)
+	DescribeOrganization(ctx context.Context, params *organizations.DescribeOrganizationInput, optFns ...func(*organizations.Options)) (*organizations.DescribeOrganizationOutput, error)
+}
+
+func init() {
+	gob.Register([]orgTypes.Account{})
+	//gob.Register(orgTypes.Organization{})
+}
+
+// create a CachedOrganizationsListAccounts function that uses go-cache and pagination and returns a list of accounts
+func CachedOrganizationsListAccounts(client OrganizationsClientInterface, accountID string) ([]orgTypes.Account, error) {
+	var PaginationControl *string
+	var accounts []orgTypes.Account
+	cacheKey := fmt.Sprintf("%s-organizations-ListAccounts", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]orgTypes.Account), nil
+	}
+
+	for {
+		ListAccounts, err := client.ListAccounts(
+			context.TODO(),
+			&organizations.ListAccountsInput{
+				NextToken: PaginationControl,
+			},
+		)
+
+		if err != nil {
+			return accounts, err
+		}
+
+		accounts = append(accounts, ListAccounts.Accounts...)
+
+		//pagination
+		if ListAccounts.NextToken == nil {
+			break
+		}
+		PaginationControl = ListAccounts.NextToken
+	}
+	internal.Cache.Set(cacheKey, accounts, cache.DefaultExpiration)
+
+	return accounts, nil
+}
+
+// create a CachedOrganizationsDescribeOrganization function that uses go-cache and returns an organization
+func CachedOrganizationsDescribeOrganization(client OrganizationsClientInterface, accountID string) (*orgTypes.Organization, error) {
+	var organization *orgTypes.Organization
+	cacheKey := fmt.Sprintf("%s-organizations-DescribeOrganization", accountID)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.(*orgTypes.Organization), nil
+	}
+
+	DescribeOrganization, err := client.DescribeOrganization(
+		context.TODO(),
+		&organizations.DescribeOrganizationInput{},
+	)
+
+	if err != nil {
+		return organization, err
+	}
+
+	organization = DescribeOrganization.Organization
+	internal.Cache.Set(cacheKey, organization, cache.DefaultExpiration)
+
+	return organization, nil
+}