|
1 | 1 | # CloudToolKit |
2 | 2 |
|
3 | | -CloudToolKit is an adversary simulation and validation toolkit for assessing the effectiveness of CSPM, CNAPP, and related cloud detection and investigation platforms in authorized environments. |
4 | | - |
5 | | -## Overview |
6 | | - |
7 | | -CloudToolKit helps defenders reproduce realistic cloud security scenarios in owned labs, approved internal subscriptions, and explicitly authorized customer environments. It is designed for defensive validation through cloud asset inventory, identity and privilege abuse checks, suspicious resource activity review, and authorized instance command checks that generate realistic telemetry for detection and investigation testing. |
8 | | - |
9 | | -## Features |
10 | | - |
11 | | -- **Multi-Cloud Coverage** - Alibaba, Tencent, Huawei, AWS, Azure, GCP, Volcengine, JDCloud, and UCloud |
12 | | -- **Cloud Asset Inventory** - Hosts, databases, storage buckets, domains, IAM users, billing/balance signals, logs, SMS assets, and related cloud resources where supported |
13 | | -- **Defender-Side Validation Payloads** - `iam-user-check`, `bucket-check`, `instance-cmd-check`, `event-check`, `rds-account-check`, `role-binding-check`, `bucket-acl-check`, and `iam-credential-check` |
14 | | -- **Interactive CLI** - Tab completion, session management, and credential caching |
15 | | -- **Lightweight Provider Clients** - AWS, Azure, Tencent, Huawei, and Alibaba integrations are being gradually decoupled from heavy official SDK paths |
16 | | - |
17 | | -## Supported Capabilities |
18 | | - |
19 | | -| Provider | Inventory Coverage | Validation Payloads | |
20 | | -|:--------:|:-------------------|:--------------------| |
21 | | -| Alibaba Cloud | ECS, DNS, RAM, RDS, OSS, SMS, SLS | `iam-user-check`, `bucket-check`, `event-check`, `instance-cmd-check`, `rds-account-check`, `role-binding-check`, `bucket-acl-check`, `iam-credential-check` | |
22 | | -| Tencent Cloud | CVM, Lighthouse, DNSPod, CAM, CDB, COS | `iam-user-check`, `bucket-check`, `instance-cmd-check`, `role-binding-check`, `bucket-acl-check`, `event-check`, `iam-credential-check`, `rds-account-check` | |
23 | | -| Huawei Cloud | ECS, IAM, RDS, OBS | `iam-user-check`, `bucket-check`, `role-binding-check`, `bucket-acl-check`, `event-check`, `iam-credential-check`, `rds-account-check` | |
24 | | -| AWS | EC2, IAM, S3 | `iam-user-check`, `bucket-check`, `role-binding-check`, `bucket-acl-check`, `instance-cmd-check`, `event-check`, `iam-credential-check`, `rds-account-check` | |
25 | | -| Azure | Virtual Machines, Microsoft Graph users, Blob Storage | `iam-user-check`, `instance-cmd-check`, `role-binding-check`, `bucket-acl-check`, `event-check`, `iam-credential-check`, `rds-account-check` | |
26 | | -| GCP | Compute Engine, Cloud DNS, Service Accounts, Cloud Storage | `iam-user-check`, `bucket-check`, `role-binding-check`, `bucket-acl-check`, `event-check`, `iam-credential-check`, `rds-account-check` | |
27 | | -| Volcengine | ECS, DNS, IAM, RDS, TOS | `iam-user-check`, `bucket-check`, `instance-cmd-check`, `role-binding-check`, `bucket-acl-check`, `iam-credential-check`, `event-check`, `rds-account-check` | |
28 | | -| JDCloud | VM, LAVM, IAM, OSS | `iam-user-check`, `bucket-check`, `instance-cmd-check`, `role-binding-check`, `bucket-acl-check` | |
29 | | -| UCloud | UHost, UDNS, IAM, UDB, US3 | `iam-user-check`, `bucket-check`, `role-binding-check`, `bucket-acl-check`, `event-check`, `rds-account-check` | |
30 | | - |
31 | | -Capability declarations are intentionally conservative. Provider capabilities that have not been verified against upstream SDK or OpenAPI behavior are not advertised until they have working drivers, replay coverage, and focused tests. |
32 | | - |
33 | | -## Example Validation Workflows |
34 | | - |
35 | | -- Use `cloudlist` in an authorized environment to verify whether a CSPM or CNAPP accurately discovers compute, storage, identity, database, and DNS resources. |
36 | | -- Use `iam-user-check` to create or remove a test IAM user and validate identity telemetry, alerting, and persistence detection coverage. |
37 | | -- Use `instance-cmd-check` to generate telemetry for command execution, process correlation, and investigation workflows on a test instance. |
38 | | -- Use `event-check` to review cloud security events and suspicious resource operations for investigation context, enrichment quality, and timeline reconstruction. |
39 | | -- Use `rds-account-check` to provision read-only RDS access in an authorized environment to validate database visibility, control coverage, and investigation readiness. |
40 | | -- Use `role-binding-check` to bind or unbind a test principal at an authorized scope to validate role-assignment telemetry, alerting, and audit trail coverage (Azure RBAC, GCP project IAM bindings). |
41 | | -- Use `bucket-acl-check` to toggle storage container public-access settings in an authorized environment to validate detection coverage for unintended data exposure across supported object-storage services. |
42 | | -- Use `iam-credential-check` to mint or revoke a long-lived IAM credential in an authorized environment to validate detection coverage for credential lifecycle abuse, such as service-account keys or application password credentials where supported. |
43 | | - |
44 | | -## Use Cases |
45 | | - |
46 | | -- storage exposure checks in authorized environments |
47 | | -- IAM lifecycle checks for identity telemetry and alert validation |
48 | | -- role assignment / IAM binding checks for privilege change detection coverage |
49 | | -- IAM credential lifecycle checks for long-lived credential abuse detection |
50 | | -- instance execution telemetry checks for detection and investigation workflows |
51 | | -- RDS account validation for database visibility and control verification |
52 | | -- cross-signal investigation testing across identity, compute, storage, and database activity |
| 3 | +<strong>English</strong> | <a href="./README.zh-CN.md">简体中文</a> |
| 4 | + |
| 5 | +> Multi-cloud defensive validation toolkit for CSPM / CNAPP detection, telemetry, and investigation workflows in authorized environments. |
| 6 | +
|
| 7 | +CloudToolKit gives security teams a practical way to verify whether cloud controls are discoverable, detectable, alertable, and investigable before those gaps matter in production. |
| 8 | + |
| 9 | +## Why CloudToolKit |
| 10 | + |
| 11 | +| Advantage | What it gives defenders | |
| 12 | +|---|---| |
| 13 | +| 9-cloud coverage | One workflow across major global and China cloud providers. | |
| 14 | +| Asset-first inventory | Hosts, databases, buckets, domains, accounts, logs, SMS assets, and billing-plane signals where supported. | |
| 15 | +| Validation payloads | Focused checks for identity lifecycle, credential lifecycle, role bindings, storage exposure, audit events, instance command telemetry, and database account changes. | |
| 16 | +| Replay mode | `demo` drives providers against in-memory replay fixtures, so detection logic can be tested without live cloud calls. | |
| 17 | +| Conservative claims | Capabilities are advertised only when drivers, replay paths, and focused tests are in place. | |
| 18 | + |
| 19 | +## Capability Matrix |
| 20 | + |
| 21 | +Every provider supports `cloudlist` asset enumeration. Asset categories include host / database / bucket / domain / account / log / sms / balance where the cloud has a native equivalent. |
| 22 | + |
| 23 | +Validation payload coverage: |
| 24 | + |
| 25 | +<table> |
| 26 | + <tr> |
| 27 | + <th align="left" width="170">Cloud</th> |
| 28 | + <th align="center">iam</th> |
| 29 | + <th align="center">bucket</th> |
| 30 | + <th align="center">event</th> |
| 31 | + <th align="center">cmd</th> |
| 32 | + <th align="center">rds</th> |
| 33 | + <th align="center">role</th> |
| 34 | + <th align="center">acl</th> |
| 35 | + <th align="center">cred</th> |
| 36 | + </tr> |
| 37 | + <tr> |
| 38 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="AWS"><rect width="24" height="24" rx="5" fill="#232F3E"/><text x="12" y="11" text-anchor="middle" font-family="Arial, sans-serif" font-size="7" font-weight="700" fill="#fff">aws</text><path d="M6 15c3 2.5 9 2.5 12 0" fill="none" stroke="#FF9900" stroke-width="1.8" stroke-linecap="round"/></svg> <strong>AWS</strong></td> |
| 39 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 40 | + </tr> |
| 41 | + <tr> |
| 42 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="Azure"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><path d="M7 18 11 5h4l-3 7-2 6H7z" fill="#0078D4"/><path d="M15 5 19 18h-7l-2-4 3-4-1 2z" fill="#50A7F8"/></svg> <strong>Azure</strong></td> |
| 43 | + <td align="center">✓</td><td align="center">—</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 44 | + </tr> |
| 45 | + <tr> |
| 46 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="GCP"><rect width="24" height="24" rx="5" fill="#fff" stroke="#DCE5F0"/><path d="M7 15h10" stroke="#4285F4" stroke-width="2.2" stroke-linecap="round"/><path d="M7 15a5 5 0 0 1 2-9" stroke="#34A853" stroke-width="2.2" stroke-linecap="round" fill="none"/><path d="M9 6a6 6 0 0 1 7 1" stroke="#FBBC04" stroke-width="2.2" stroke-linecap="round" fill="none"/><path d="M16 7a5 5 0 0 1 1 8" stroke="#EA4335" stroke-width="2.2" stroke-linecap="round" fill="none"/></svg> <strong>GCP</strong></td> |
| 47 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 48 | + </tr> |
| 49 | + <tr> |
| 50 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="Alibaba"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><g fill="none" stroke="#FF6A00" stroke-width="2" stroke-linecap="round"><path d="M8 7h3M8 7v10M8 17h3M16 7h-3M16 7v10M16 17h-3M10 12h4"/></g></svg> <strong>Alibaba</strong></td> |
| 51 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 52 | + </tr> |
| 53 | + <tr> |
| 54 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="Tencent"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><path d="M7 16h10a4 4 0 0 0 0-8h-1a6 6 0 0 0-11 3 4 4 0 0 0 2 5z" fill="none" stroke="#1E9BFF" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg> <strong>Tencent</strong></td> |
| 55 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 56 | + </tr> |
| 57 | + <tr> |
| 58 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="Huawei"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><g fill="#E53935" transform="translate(12 10)"><ellipse rx="1.4" ry="4.5" transform="rotate(-55) translate(0 -2.5)"/><ellipse rx="1.4" ry="4.5" transform="rotate(-30) translate(0 -2.5)"/><ellipse rx="1.4" ry="4.5" transform="rotate(0) translate(0 -2.5)"/><ellipse rx="1.4" ry="4.5" transform="rotate(30) translate(0 -2.5)"/><ellipse rx="1.4" ry="4.5" transform="rotate(55) translate(0 -2.5)"/></g><path d="M8 16c2 1.8 6 1.8 8 0" fill="none" stroke="#E53935" stroke-width="1.8" stroke-linecap="round"/></svg> <strong>Huawei</strong></td> |
| 59 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 60 | + </tr> |
| 61 | + <tr> |
| 62 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="Volcengine"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><path d="M5 17 10 6l3 7 3-4 4 8h-4l-3-4-2 4z" fill="#2B6CFF"/></svg> <strong>Volcengine</strong></td> |
| 63 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td> |
| 64 | + </tr> |
| 65 | + <tr> |
| 66 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="JDCloud"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><path d="M7 16h10a4 4 0 0 0 0-8h-1a6 6 0 0 0-11 3 4 4 0 0 0 2 5z" fill="none" stroke="#F44336" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><path d="M11 14c0 3-1.5 4.5-4 4.5" fill="none" stroke="#F44336" stroke-width="1.8" stroke-linecap="round"/></svg> <strong>JDCloud</strong></td> |
| 67 | + <td align="center">✓</td><td align="center">✓</td><td align="center">—</td><td align="center">✓</td><td align="center">—</td><td align="center">✓</td><td align="center">✓</td><td align="center">—</td> |
| 68 | + </tr> |
| 69 | + <tr> |
| 70 | + <td align="left" width="170"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" role="img" aria-label="UCloud"><rect width="24" height="24" rx="5" fill="#F8FAFC" stroke="#DCE5F0"/><path d="M7 6v8c0 3 2 5 5 5s5-2 5-5V6" fill="none" stroke="#2B6CFF" stroke-width="2.5" stroke-linecap="round"/><circle cx="17" cy="7" r="1.6" fill="#2B6CFF"/></svg> <strong>UCloud</strong></td> |
| 71 | + <td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">—</td><td align="center">✓</td><td align="center">✓</td><td align="center">✓</td><td align="center">—</td> |
| 72 | + </tr> |
| 73 | +</table> |
| 74 | + |
| 75 | +Legend: `iam` = user lifecycle · `bucket` = object visibility · `event` = audit log review · `cmd` = instance command telemetry · `rds` = database account lifecycle · `role` = privilege binding change · `acl` = storage exposure · `cred` = long-lived credential lifecycle. `—` = no native equivalent or pending validation. |
53 | 76 |
|
54 | 77 | ## Quick Start |
55 | 78 |
|
56 | 79 | ```bash |
57 | | -# Download from releases or build from source |
58 | 80 | go build --ldflags "-s -w" -trimpath -o ctk cmd/main.go |
59 | | - |
60 | | -# Run interactive console |
61 | | -./ctk |
| 81 | +./ctk # interactive REPL |
| 82 | +./ctk <provider> <action> [args] [flags] # headless one-shot |
62 | 83 | ``` |
63 | 84 |
|
64 | | -## Responsible Use |
65 | | - |
66 | | -CloudToolKit is intended only for owned environments, lab environments, approved internal subscriptions, and explicitly authorized customer environments. It is designed to help defenders verify detection coverage, telemetry quality, investigation workflows, and control effectiveness. It is not intended for unauthorized access, third-party abuse, or covert real-world intrusion activity. |
| 85 | +Try `demo` inside the REPL to drive any provider against an in-memory replay (no live cloud calls). |
67 | 86 |
|
68 | | -## Non-Goals |
69 | | - |
70 | | -CloudToolKit is not positioned as: |
| 87 | +## Responsible Use |
71 | 88 |
|
72 | | -- an unauthorized offensive toolkit |
73 | | -- a stealth or bypass framework |
74 | | -- a weaponized intrusion utility |
75 | | -- guidance for abuse against third-party environments |
| 89 | +Use only on owned, lab, internal, or explicitly authorized customer environments to verify detection coverage, telemetry quality, investigation workflow, and control effectiveness. CloudToolKit is not a stealth, bypass, or unauthorized intrusion utility and must not be used against third-party environments without permission. |
76 | 90 |
|
77 | 91 | ## Documentation |
78 | 92 |
|
79 | | -See [Wiki](https://github.com/404tk/cloudtoolkit/wiki) for detailed usage. |
| 93 | +- [Wiki](https://github.com/404tk/cloudtoolkit/wiki) — usage, payload references, replay walkthroughs |
80 | 94 |
|
81 | 95 | ## Acknowledgements |
82 | 96 |
|
|
0 commit comments