class CloudTrail

Collect CloudTrail resources

Public Instance Methods

collect() click to toggle source

Returns an array of resources.

# File lib/aws_recon/collectors/cloudtrail.rb, line 10
def collect
  resources = []
  #
  # describe_trails
  #
  @client.describe_trails.each_with_index do |response, page|
    log(response.context.operation_name, page)

    response.trail_list.each do |trail|
      # list_tags needs to call into home_region
      client = if @region != trail.home_region
                 Aws::CloudTrail::Client.new({ region: trail.home_region })
               else
                 @client
               end

      struct = OpenStruct.new(trail.to_h)
      struct.tags = client.list_tags({ resource_id_list: [trail.trail_arn] }).resource_tag_list.first.tags_list.map(&:to_h)
      struct.type = 'cloud_trail'
      struct.event_selectors = client.get_event_selectors({ trail_name: trail.name }).to_h
      struct.status = client.get_trail_status({ name: trail.name }).to_h
      struct.arn = trail.trail_arn

      resources.push(struct.to_h)
    end
  end

  resources
end