Skip to content

Add CloudTrail event logging across all exploit modules and identity add --from-profile alias #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sethsec merged 3 commits into from
Oct 5, 2026
Merged

Add CloudTrail event logging across all exploit modules and identity add --from-profile alias #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b653ecb
Add purple team CloudTrail event logging across all exploit modules a…
sethsec Oct 3, 2026
6a16e1e
Add --from-profile alias to identity add CLI command.
sethsec Oct 3, 2026
85946ac
Upgrade Go dependencies and fix BlobAttributeValue rename in EC2 SDK …
sethsec Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .claude/skills/create-module/checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,9 @@ Use this checklist after generating a new module to verify everything is complet
- `CleanupMethod` set to the API action
- `ModuleID` set to the path ID
- `Metadata` includes info needed for cleanup
- [ ] Cleanup handler exists in `pkg/core/repl/session.go` for each resource type created
- [ ] Cleanup handler exists in `pkg/core/repl/session.go` `sessionCleanup()` for each resource type created
- [ ] `CleanupCommand()` in `pkg/report/cleanup.go` has a `case` for each resource type — this drives the AWS CLI command shown in `workspace cleanup`, the terminal report, and every exported report (HTML/Markdown). Falling through to `default` produces "manual cleanup required" instead of a real command.
- [ ] `cleanupOperationFromType()` in `pkg/core/repl/session.go` has a `case` for each resource type — this maps the type to an AWS operation name (e.g., `DeleteFunction`) for CloudTrail audit log entries emitted after cleanup.

## Side Effect Tracking (payload modifications)
- [ ] After execution, module checks if payload implements `SideEffectReporter`
Expand Down
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@
*.out
coverage.html

# Generated HTML reports
*.html

# Go workspace file
go.work

Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ REPL surface:

**Resource Tracking**: Modules must call `tracker.TrackResource()` for created resources and check for `SideEffectReporter` on payloads to track modifications. Cleanup is region-aware, interactive via `survey/v2`, with permission error guidance.

**Cleanup Report**: `workspace report` generates handoff report with manual AWS CLI cleanup commands. Supports `--module <id>` filtering.
**Cleanup Report**: `workspace report` generates handoff report with manual AWS CLI cleanup commands. Supports `--output <file.html|file.md>` for export and `--module <id>` filtering. **When adding a new resource type**, you must add a `case` to both `CleanupCommand()` in `pkg/report/cleanup.go` (drives the CLI command shown in the terminal, HTML, and Markdown reports) and `cleanupOperationFromType()` in `pkg/core/repl/session.go` (maps the type to an AWS operation name for CloudTrail audit log entries). Omitting either causes the resource to fall through to `default` and print "manual cleanup required" instead of a real command. The `/create-module` checklist enforces this.

**Timeouts**: 30-second timeouts for AWS operations (SSO credential resolution).

Expand Down
100 changes: 50 additions & 50 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,38 +1,38 @@
module github.com/DataDog/pathrunner

go 1.25.0
go 1.26.0

require (
github.com/aws/aws-sdk-go-v2 v1.45.1
github.com/aws/aws-sdk-go-v2/config v1.33.1
github.com/aws/aws-sdk-go-v2/credentials v1.20.1
github.com/aws/aws-sdk-go-v2/service/apprunner v1.44.1
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.75.1
github.com/aws/aws-sdk-go-v2/service/batch v1.72.1
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore v1.43.0
github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol v1.61.1
github.com/aws/aws-sdk-go-v2/service/braket v1.45.1
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.78.1
github.com/aws/aws-sdk-go-v2/service/codebuild v1.75.1
github.com/aws/aws-sdk-go-v2/service/codedeploy v1.40.1
github.com/aws/aws-sdk-go-v2/service/cognitoidentity v1.39.0
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.65.1
github.com/aws/aws-sdk-go-v2/service/ec2 v1.325.1
github.com/aws/aws-sdk-go-v2/service/ecr v1.62.1
github.com/aws/aws-sdk-go-v2/service/ecs v1.93.0
github.com/aws/aws-sdk-go-v2/service/emr v1.66.1
github.com/aws/aws-sdk-go-v2/service/emrserverless v1.46.1
github.com/aws/aws-sdk-go-v2/service/gamelift v1.63.1
github.com/aws/aws-sdk-go-v2/service/glue v1.155.1
github.com/aws/aws-sdk-go-v2/service/iam v1.61.1
github.com/aws/aws-sdk-go-v2/service/imagebuilder v1.60.1
github.com/aws/aws-sdk-go-v2/service/kinesisanalyticsv2 v1.44.1
github.com/aws/aws-sdk-go-v2/service/lambda v1.104.1
github.com/aws/aws-sdk-go-v2/service/omics v1.51.1
github.com/aws/aws-sdk-go-v2/service/s3 v1.109.1
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.46.1
github.com/aws/aws-sdk-go-v2/service/ssm v1.75.1
github.com/aws/aws-sdk-go-v2/service/sts v1.47.1
github.com/aws/aws-sdk-go-v2 v1.47.1
github.com/aws/aws-sdk-go-v2/config v1.33.6
github.com/aws/aws-sdk-go-v2/credentials v1.20.6
github.com/aws/aws-sdk-go-v2/service/apprunner v1.48.1
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.78.1
github.com/aws/aws-sdk-go-v2/service/batch v1.78.0
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore v1.50.1
github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol v1.72.0
github.com/aws/aws-sdk-go-v2/service/braket v1.48.1
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.81.1
github.com/aws/aws-sdk-go-v2/service/codebuild v1.78.1
github.com/aws/aws-sdk-go-v2/service/codedeploy v1.45.1
github.com/aws/aws-sdk-go-v2/service/cognitoidentity v1.42.1
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.70.0
github.com/aws/aws-sdk-go-v2/service/ec2 v1.338.1
github.com/aws/aws-sdk-go-v2/service/ecr v1.66.1
github.com/aws/aws-sdk-go-v2/service/ecs v1.100.0
github.com/aws/aws-sdk-go-v2/service/emr v1.70.1
github.com/aws/aws-sdk-go-v2/service/emrserverless v1.49.1
github.com/aws/aws-sdk-go-v2/service/gamelift v1.66.2
github.com/aws/aws-sdk-go-v2/service/glue v1.167.0
github.com/aws/aws-sdk-go-v2/service/iam v1.64.1
github.com/aws/aws-sdk-go-v2/service/imagebuilder v1.66.1
github.com/aws/aws-sdk-go-v2/service/kinesisanalyticsv2 v1.47.1
github.com/aws/aws-sdk-go-v2/service/lambda v1.110.0
github.com/aws/aws-sdk-go-v2/service/omics v1.55.1
github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.50.1
github.com/aws/aws-sdk-go-v2/service/ssm v1.79.0
github.com/aws/aws-sdk-go-v2/service/sts v1.51.1
github.com/charmbracelet/bubbletea v1.3.10
github.com/charmbracelet/huh v1.0.0
github.com/charmbracelet/lipgloss v1.1.0
Expand All @@ -43,25 +43,25 @@ require (
github.com/spf13/cobra v1.10.2
)

require github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.84.1
require github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.89.0

require (
github.com/atotto/clipboard v0.1.4 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 // indirect
// bedrockagentcore and bedrockagentcorecontrol moved to direct dependencies above (used by bedrock_startbrowsersession_cdp module)
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.13.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.1 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.7.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.35.1 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.40.1 // indirect
github.com/aws/smithy-go v1.28.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.13.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 // indirect
github.com/aws/smithy-go v1.28.2 // indirect
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
github.com/catppuccin/go v0.3.0 // indirect
github.com/charmbracelet/bubbles v1.0.0 // indirect
Expand All @@ -71,20 +71,20 @@ require (
github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
github.com/clipperhouse/displaywidth v0.11.0 // indirect
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/dustin/go-humanize v1.1.0 // indirect
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/mattn/go-isatty v0.0.24 // indirect
github.com/mattn/go-localereader v0.0.1 // indirect
github.com/mattn/go-runewidth v0.0.28 // indirect
github.com/mattn/go-runewidth v0.0.30 // indirect
github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
github.com/muesli/cancelreader v0.2.2 // indirect
github.com/muesli/termenv v0.16.0 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/xo/terminfo v1.0.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/term v0.45.0
golang.org/x/text v0.41.0 // indirect
github.com/xo/terminfo v1.2.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/term v0.46.0
golang.org/x/text v0.42.0 // indirect
)
Loading
Loading