Attack Surface Analysis

# Cloud Attack Surface Discovery Script (AWS)
# Run during TRA scoping phase to enumerate exposure points

import json
from dataclasses import dataclass, field

@dataclass
class SurfaceFindings:
    public_ips: list = field(default_factory=list)
    public_s3: list = field(default_factory=list)
    open_security_groups: list = field(default_factory=list)
    public_apis: list = field(default_factory=list)
    iam_findings: list = field(default_factory=list)

def discover_public_ips(ec2_client) -> list:
    """Enumerate all public-facing IP addresses."""
    addresses = ec2_client.describe_addresses()
    instances = ec2_client.describe_instances(
        Filters=[{"Name": "ip-address", "Values": ["*"]}]
    )
    public_ips = []
    for addr in addresses.get("Addresses", []):
        public_ips.append({
            "ip": addr.get("PublicIp"),
            "association": addr.get("AssociationId", "Unassociated"),
            "instance": addr.get("InstanceId", "None"),
        })
    return public_ips

def discover_open_security_groups(ec2_client) -> list:
    """Find security groups with 0.0.0.0/0 ingress rules."""
    findings = []
    groups = ec2_client.describe_security_groups()
    for sg in groups.get("SecurityGroups", []):
        for perm in sg.get("IpPermissions", []):
            for ip_range in perm.get("IpRanges", []):
                if ip_range.get("CidrIp") == "0.0.0.0/0":
                    findings.append({
                        "group_id": sg["GroupId"],
                        "group_name": sg["GroupName"],
                        "port": perm.get("FromPort", "All"),
                        "protocol": perm.get("IpProtocol", "All"),
                    })
    return findings

def discover_public_s3(s3_client) -> list:
    """Check S3 buckets for public access."""
    findings = []
    buckets = s3_client.list_buckets()
    for bucket in buckets.get("Buckets", []):
        name = bucket["Name"]
        try:
            acl = s3_client.get_bucket_acl(Bucket=name)
            for grant in acl.get("Grants", []):
                grantee = grant.get("Grantee", {})
                if grantee.get("URI") ==                   "http://acs.amazonaws.com/groups/global/AllUsers":
                    findings.append({
                        "bucket": name,
                        "permission": grant["Permission"],
                    })
        except Exception:
            pass  # Access denied = not public
    return findings

def generate_surface_report(findings: SurfaceFindings) -> dict:
    """Generate attack surface summary for TRA."""
    total = (
        len(findings.public_ips)
        + len(findings.public_s3)
        + len(findings.open_security_groups)
        + len(findings.public_apis)
        + len(findings.iam_findings)
    )
    return {
        "total_findings": total,
        "critical": len(findings.public_s3)
            + len(findings.open_security_groups),
        "categories": {
            "public_ips": len(findings.public_ips),
            "public_storage": len(findings.public_s3),
            "open_network": len(findings.open_security_groups),
            "public_apis": len(findings.public_apis),
            "iam_issues": len(findings.iam_findings),
        },
    }

Attack Surface Analysis Checklist for TRA
═════════════════════════════════════════

NETWORK SURFACE
  □ Enumerate all public IPs and DNS records
  □ Map exposed ports and services (Nmap/Masscan)
  □ Review firewall rules and network ACLs
  □ Identify VPN/remote access endpoints
  □ Catalog TLS certificates and versions

CLOUD SURFACE
  □ Audit IAM policies for least privilege
  □ Check storage bucket/blob access policies
  □ Review security group and NSG rules
  □ Validate encryption at rest and in transit
  □ Audit logging and monitoring coverage

API SURFACE
  □ Inventory all API endpoints (REST/GraphQL/gRPC)
  □ Test authentication on every endpoint
  □ Verify authorization at object level (BOLA)
  □ Check rate limiting and throttling
  □ Review CORS and CSP policies

SUPPLY CHAIN SURFACE
  □ Generate and review SBOM
  □ Check dependencies for known CVEs
  □ Audit CI/CD pipeline permissions
  □ Verify artifact signing and provenance
  □ Review third-party integration permissions

IDENTITY SURFACE
  □ Audit IdP configuration (Entra/Okta/Auth0)
  □ Review OAuth/OIDC flow security
  □ Check MFA enforcement and bypass paths
  □ Audit service account permissions
  □ Review federation trust relationships