steampipe-mod-aws-compliance
cargo-auditable
Our great sponsors
steampipe-mod-aws-compliance | cargo-auditable | |
---|---|---|
18 | 23 | |
349 | 543 | |
3.2% | 3.7% | |
8.4 | 7.9 | |
10 days ago | 25 days ago | |
HCL | Rust | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
steampipe-mod-aws-compliance
-
How to run an AWS CIS v3.0 assessment in CloudShell
In a prior post I showed how to install Steampipe in AWS CloudShell to instantly query over 460+ resource types from your AWS APIs using SQL, and another post on how to use the Steampipe AWS Compliance mod to assess over 25+ security benchmarks across your AWS accounts.
-
What's new in the CIS v2.0 benchmark for AWS
The Steampipe AWS Compliance mod, is packed with hundreds of controls that check your AWS accounts for compliance with 25 benchmarks including NIST, PCI, HIPAA, SOC2, FedRAMP and more, now includes new controls for AWS CIS v2.0. If you're new to Steampipe, download Steampipe, install and configure the AWS plugin, and run these commands.
-
Open source automated AWS CIS v2.0 benchmark assessment just released by Steampipe.io
The Steampipe AWS Compliance mod, is packed with hundreds of open source controls that evaluate your AWS accounts for compliance with 25 benchmarks (NIST, PCI, HIPAA, etc). The mod now also includes new controls for AWS CIS v2.0.
- Is there an open source version of Dome9?
-
Steampipe vs aws security hub
The Steampipe AWS Compliance mod has more coverage with 21 security benchmarks (e.g. CIS v1.5, PCI, Foundations, NIST 800-53 rev5, etc).
- CLoud Custodian - Pretty Output? Alternatives?
- Scanning for AWS Security Issues with Trivy
-
Open source AWS Dashboards: Visualize your AWS assets & security reports; 100+ dashboards out of the box; Build your own with HCL & SQL.
AWS Compliance mod: includes instant compliance reports for CIS, PCI, NIST, HIPAA, SOC2 & more: https://hub.steampipe.io/mods/turbot/aws_compliance
-
How to perform a security audit of your AWS account in AWS CloudShell
For example, the AWS Compliance Mod layers benchmarks and controls covering 13 compliance standards including CIS, HIPAA, NIST, PCI, FedRAMP, SOC 2 and more. Each benchmark includes a set of pass/fail controls. Each control tests for a compliance recommendation such as "EC2 instances" should be managed by AWS Systems Manager" and reports OK or Alarm.
-
Compliance as code for AWS
Steampipe (https://steampipe.io) is an open source CLI to query AWS and more with SQL. The AWS Compliance mod (https://hub.steampipe.io/mods/turbot/aws_compliance) has over 500 controls out of the box covering CIS, PCI, NIST, HIPAA, SOC2 & more you can run in your terminal across all your AWS accounts.
cargo-auditable
-
Rust Offline?
Further we use cargo-auditable and cargo-audit as part of both our pipeline and regular scanning of all deployed services. This makes our InfoSec and Legal super happy since it means they can also monitor compliance with licenses and patch/update timings.
-
Hey Rustaceans! Got a question? Ask here (15/2023)!
This exists, see cargo auditable.
-
The Rust Implementation Of GNU Coreutils Is Becoming Remarkably Robust
The Rust community seems to have settled on a perfectly reasonable way to address bit-rot in statically linked binaries. https://github.com/rust-secure-code/cargo-auditable
-
Release Engineering Is Exhausting So Here's cargo-dist
Would you be open to integrating cargo auditable into this pipeline in some form? It seems like a great match.
-
Swift Achieved Dynamic Linking Where Rust Couldn't
> and static compilation probably just hides the problem unless security scanners these days can identify statically compiled vulnerable versions of libraries
Some scanners like trivy [1] can scan statically compiled binaries, provided they include dependency version information (I think go does this on its own, for rust there's [2], not sure about other languages).
It also looks into your containers.
The problem is what to do when it finds a vulnerability. In a fat app with dynamic linking you could exchange the offending library, check that this doesn't break anything for your use case, and be on your way. But with static linking you need to compile a new version, or get whoever can build it to compile a new version. Which seems to be a major drawback of discouraging fat apps.
-
'cargo auditable' can now be used as a drop-in replacement for Cargo
I have investigated a bunch of standardized formats - SPDX, CycloneDX, etc. All of them are unsuitable for a variety of reasons, chief of which are being way too verbose and including timestamps, which would break reproducible builds.
-
sccache now supports GHA as backend
The fix for interoperability with cargo auditable has also shipped in the latest release of sccache. You can use the released sccache now instead of building it from git!
-
`cargo audit` can now scan compiled binaries
I've been working to bring vulnerability scanning to Rust binaries by creating cargo auditable, which embeds the list of dependencies and their versions into the compiled binary. This lets you audit the binary you actually run, instead of the Cargo.lock file in some repo somewhere.
-
Here's how to patch the upcoming OpenSSL vulnerability in Rust
cargo auditable solves this problem by embedding the list of dependencies and their versions into the binaries. But until it becomes part of Cargo and gets enabled by default, static linking will remain problematic.
- Introducing cargo-auditable: audit Rust binaries for known bugs or vulnerabilities in production
What are some alternatives?
cloudquery - The open source high performance ELT framework powered by Apache Arrow
trivy - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
prowler - Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
auto-fuzz-test - Effortlessly fuzz libraries with large API surfaces
terraform-aws-secure-baseline - Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.
cargo-supply-chain - Gather author, contributor and publisher data on crates in your dependency graph.
pci_fetch - A library for querying connected PCI devices and a pci.ids parser.
eve-rs - A simple, intuitive, express-like HTTP library
steampipe-mod-aws-thrifty - Are you a Thrifty AWS dev? This mod checks your AWS accounts for unused and under-utilized resources using Powerpipe and Steampipe.
SummerOfCode2021 - GSoC 2021 Idea List for Casbin
steampipe-plugin-aws - Use SQL to instantly query AWS resources across regions and accounts. Open source CLI. No DB required.
svntogit-community - Automatic import of svn 'community' repo (read-only mirror)