Automating AWS with Python

01-webotron

Webotron contains scripts that will automate AWS using python. The firstone is sencrypt

sencrypt

Sencrypt project is based on the open source project from uptick : https://github.com/uptake/cloudbouncer

There are multiple commands that cloudbouncer implements, one of which checks if S3 buckets are encrypted, and the status of each object in S3 bucket. I have modified and using python libraries like click (to simplified and reduce the code) and twine (to make it in to an installable package) and also published in pypi so you can install and try quickly.

How to use

$ pip install sencrypt

make sure to use python3

$ pip3 install sencrypt

This would install the sencrypt on your machine.

Run sencrypt at the command prompt to see the help.

$ sencrypt

As you see there are three commands as a part of this package

You can see help on each command my simply running with --help option

This function would set encription on all the buckets, either using default serverside encription or if you specify --kms would use the kms key to encrypt the specified bucket(s)

As we know encripting the bucket would NOT encrypt the existingobjects in that bucket.

The --existingobjects with a TRUE would encrypt all the existing objects with teh specified encryption.
default value is FASLE as encripting existing b=objects takes long time based on number of objects in the bucket.

Sample commands

$ sencrypt audit-encryption displays current state of encryption of all the buckets

$ sencrypt audit-encryption <bucketName> displays current state of encryption of the specified bucket with all its objects.

$ sencrypt set-encryption <bucketName> sets the encryption of the specified bucket with Serverside encryption.

$ sencrypt set-encryption <bucketName> --existingobjects TRUE sets the encryption of all the objects in the specified bucket with serverside encryption.

$ sencrypt set-encryption <bucketName> --kms kmskey sets the encryption of the specified bucket with KMS encryption.

Code

Libraries used:

click https://click.palletsprojects.com/en/7.x/ python library to create the command line interface.

twine to build the sdist package and upload to pypi repository

Python Virtual environment is managed using 'pipenv' and above two packages were installed in dev environment ONLY.

Pre requisites

To run these commands the code currently uses the AWS default profile, and assumes the machine/user has privileges to access the s3 buckets.