$profile vs $AWS_PROFILE

[wdahlenburg]

Hi BishopFox Team,

I was wondering about the decision to use $profile in the loot output versus $AWS_PROFILE. AWS lists this as the default environment variable to specify the profile to use: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

It's super minor, but would likely save users some time when copying and pasting commands.

It'd also be nice if a user passes in a custom --profile=xyz flag to cloudfox for that value to be propagated into any resultant files.

[sethsec-bf]

Hey @wdahlenburg! Thanks for your questions/insight.

The decision point for both items you talk about is the same. The profile we run cloudfox under (and our other white box actions) is almost always different than the profile we use to actually pull off the attack paths. We decided to keep it a different environment variable in the event that you were already using the AWS_PROFILE variable for another use case.

I'm not saying this is the best answer, but that's the reason behind the decision.

Basically we reserve profile as attacker_profile, and sometimes that changes based on how many credentials we have stolen so far.

Given this background, do you think it's still the right move to use AWS_PROFILE? I think it might be. Or should we maybe consider changing profile to the more explicit attacker_profile to make it more clear?

Thanks again

[wdahlenburg]

That makes sense to me. On a "well configured" account an audit role shouldn't have privileges to read sensitive data or modify existing resources. The majority of the time the audit profile will not have permissions to abuse those resources unless resource misconfigurations exist for the account.

There are three cases where the profile can be defined:

1. default profile is loaded from ~/.aws/credentials
2. $AWS_PROFILE defines the correct profile
3. The --profile flag is added to explicitly define the profile to use

With 1 & 2, the --profile flag can be left out and the command will run with either $AWS_PROFILE or the default profile. Since cloudfox adds the --profile flag by default, if a user fails to set the $profile variable the command will fail as the argument will be empty.

The loot commands do mention that users should export their desired profile to the $profile variable.

I tend to favor the command working even if it's not the "attacking" account. Users will still need to update an environment variable if they wish to use a different account, but it feels more natural to set $AWS_PROFILE after running the scan. With this, I could see the --profile flag being dropped or just changing $profile to $AWS_PROFILE.