import boto3 from awsume.awsumepy import awsume import csv from theorchard_accounts import ACCOUNTS as THEORCHARD_ACCOUNTS from gdb_accounts import ACCOUNTS as GDB_ACCOUNTS def get_session(account_alias, use_awsume=False): if use_awsume: session = awsume(account_alias) else: session = boto3.Session(profile_name=account_alias) return session def get_cloud_trails(account_id, account_alias, use_awsume=False): # Create boto3 session session = get_session(account_alias, use_awsume) # Create an Cloudtrail client client = session.client('cloudtrail') # Retrieve instances with the specified tag and value paginator = client.get_paginator('list_trails') page_iterator = paginator.paginate() # List to hold the instance detrails trails_details = [] for page in page_iterator: for trail in page['Trails']: trail_info = client.get_trail(Name=trail['TrailARN'])['Trail'] trails_details.append( ( account_id, trail_info.get('Name'), trail_info.get('S3BucketName'), trail_info.get('S3KeyPrefix'), trail_info.get('SnsTopicName'), trail_info.get('SnsTopicARN'), trail_info.get('IncludeGlobalServiceEvents'), trail_info.get('IsMultiRegionTrail'), trail_info.get('HomeRegion'), trail_info.get('LogFileValidationEnabled'), trail_info.get('CloudWatchLogsLogGroupArn'), trail_info.get('CloudWatchLogsRoleArn'), trail_info.get('KmsKeyId'), trail_info.get('HasCustomEventSelectors'), trail_info.get('HasInsightSelectors'), trail_info.get('IsOrganizationTrail'), ) ) return trails_details def main(): with open('cloud-trails.csv', 'w') as f: writer = csv.writer(f , lineterminator='\n') writer.writerow( ( 'Account ID', 'Name', 'S3BucketName', 'S3KeyPrefix', 'SnsTopicName', 'SnsTopicARN', 'IncludeGlobalServiceEvents', 'IsMultiRegionTrail', 'HomeRegion', 'LogFileValidationEnabled', 'CloudWatchLogsLogGroupArn', 'CloudWatchLogsRoleArn', 'KmsKeyId', 'HasCustomEventSelectors', 'HasInsightSelectors', 'IsOrganizationTrail', ) ) trails_details = [] for account_id, account_alias in THEORCHARD_ACCOUNTS.items(): print(f'getting items for {account_alias}') trails_details.extend(get_cloud_trails(account_id, account_alias, True)) for account_id, account_alias in GDB_ACCOUNTS.items(): print(f'getting items for {account_alias}') trails_details.extend(get_cloud_trails(account_id, account_alias)) for tup in trails_details: writer.writerow(tup) if __name__ == '__main__': main()