Merge pull request #20 from RiotGames/cf_dist_fix

Accounting for additional domain suffixes in CloudFront

cinq_auditor_domain_hijacking/__init__.py

@@ -1,4 +1,5 @@
 import logging
+import re
 from abc import ABCMeta, abstractmethod
 from datetime import datetime, timedelta
 
@@ -36,7 +37,8 @@ class DomainHijackAuditor(BaseAuditor):
         ConfigOption('enabled', False, 'bool', 'Enable the Domain Hijacking auditor'),
         ConfigOption('interval', 30, 'int', 'Run frequency in minutes'),
         ConfigOption('email_recipients', ['[email protected]'], 'array', 'List of emails to receive alerts'),
-        ConfigOption('hijack_subject', 'Potential domain hijack detected', 'string', 'Email subject for domain hijack notifications'),
+        ConfigOption('hijack_subject', 'Potential domain hijack detected', 'string',
+                     'Email subject for domain hijack notifications'),
         ConfigOption('alert_frequency', 24, 'int', 'How frequent in hours, to alert'),
     )
 
@@ -85,7 +87,7 @@ def run(self, *args, **kwargs):
             for dist in dists:
                 for org in dist.origins:
                     if org['type'] == 's3':
-                        bucket = org['source'].replace('.s3.amazonaws.com', '')
+                        bucket = self.return_resource_name(org['source'], 's3')
 
                         if bucket not in buckets:
                             key = '{} ({})'.format(bucket, dist.type)
@@ -192,6 +194,27 @@ def notify(self, new_issues, existing_issues, fixed_issues):
             except Exception as ex:
                 self.log.exception('Failed sending notification email: {}'.format(ex))
 
+    def return_resource_name(self, record, resource_type):
+        """ Removes the trailing AWS domain from a DNS record
+            to return the resource name
+
+            e.g bucketname.s3.amazonaws.com will return bucketname
+
+        Args:
+            record (str): DNS record
+            resource_type: AWS Resource type (i.e. S3 Bucket, Elastic Beanstalk, etc..)
+
+        """
+        try:
+            if resource_type == 's3':
+                regex = re.compile('.*(\.(?:s3-|s3){1}(?:.*)?\.amazonaws\.com)')
+                bucket_name = record.replace(regex.match(record).group(1), '')
+                return bucket_name
+
+        except Exception as e:
+            self.log.error('Unable to parse DNS record {} for resource type {}/{}'.format(record, resource_type, e))
+            return record
+
 
 # region Auditors
 class DomainAudit(object, metaclass=ABCMeta):
@@ -378,6 +401,8 @@ def audit(self, record, zone):
 
         # no issues were found, return empty list
         return []
+
+
 # endregion