Merge pull request #1288 from splunk/improvement_tag_handling

Add encrypted flag to all volumes

Author: P4T12ICK

modules/aws_controller.py

@@ -295,15 +295,24 @@ def show(self) -> None:
         for instance in instances:
             if instance["State"]["Name"] == "running":
                 instances_running = True
+                # Find the Name tag
+                instance_name = None
+                for tag in instance["Tags"]:
+                    if tag["Key"] == "Name":
+                        instance_name = tag["Value"]
+                        break
+                
+                if instance_name is None:
+                    instance_name = "Unknown"
+                
                 response.append(
                     [
-                        instance["Tags"][0]["Value"],
+                        instance_name,
                         instance["State"]["Name"],
                         instance["NetworkInterfaces"][0]["Association"]["PublicIp"],
                         instance["InstanceId"],
                     ]
                 )
-                instance_name = instance["Tags"][0]["Value"]
                 if instance_name.startswith("ar-splunk"):
                     splunk_ip = instance["NetworkInterfaces"][0]["Association"][
                         "PublicIp"
@@ -443,8 +452,18 @@ def show(self) -> None:
                         + self.config["general"]["attack_range_password"]
                     )
             else:
+                # Find the Name tag for non-running instances
+                instance_name = None
+                for tag in instance["Tags"]:
+                    if tag["Key"] == "Name":
+                        instance_name = tag["Value"]
+                        break
+                
+                if instance_name is None:
+                    instance_name = "Unknown"
+                
                 response.append(
-                    [instance["Tags"][0]["Value"], instance["State"]["Name"]]
+                    [instance_name, instance["State"]["Name"]]
                 )
 
         print()

modules/aws_service.py

@@ -27,8 +27,14 @@ def get_all_instances(key_name, ar_name, region):
         for instance in reservation['Instances']:
             if instance['State']['Name']!='terminated':
                 if len(instance['Tags']) > 0:
-                    tag_value = instance['Tags'][0]['Value']
-                    if tag_value.startswith('ar-'):
+                    # Find the Name tag
+                    tag_value = None
+                    for tag in instance['Tags']:
+                        if tag['Key'] == 'Name':
+                            tag_value = tag['Value']
+                            break
+                    
+                    if tag_value and tag_value.startswith('ar-'):
                         if (key_name in tag_value) and (ar_name in tag_value):
                             instances.append(instance)
 
@@ -38,8 +44,14 @@ def get_all_instances(key_name, ar_name, region):
 def get_instance_by_name(ec2_name, key_name, ar_name, region):
     instances = get_all_instances(key_name, ar_name, region)
     for instance in instances:
-        str = instance['Tags'][0]['Value']
-        if str == ec2_name:
+        # Find the Name tag
+        instance_name = None
+        for tag in instance['Tags']:
+            if tag['Key'] == 'Name':
+                instance_name = tag['Value']
+                break
+        
+        if instance_name == ec2_name:
             return instance
 
 def get_instances_by_ids(instance_ids, ec2_name, key_name, ar_name, region):

terraform/aws/modules/caldera-server/resources.tf

@@ -29,6 +29,7 @@ resource "aws_instance" "caldera_server" {
     volume_type = "gp2"
     volume_size = "60"
     delete_on_termination = "true"
+    encrypted  = "true"
   }
 
   tags = {

terraform/aws/modules/kali-server/resources.tf

@@ -29,6 +29,13 @@ resource "aws_instance" "kali_machine" {
     Name = "ar-kali-${var.general.key_name}-${var.general.attack_range_name}"
   }
 
+  root_block_device {
+    volume_type = "gp2"
+    volume_size = "20"
+    delete_on_termination = "true"
+    encrypted  = "true"
+  }
+
   provisioner "remote-exec" {
     inline = ["echo booted"]
 

terraform/aws/modules/linux-server/resources.tf

@@ -30,6 +30,7 @@ resource "aws_instance" "linux_server" {
     volume_type = "gp2"
     volume_size = "60"
     delete_on_termination = "true"
+    encrypted  = "true"
   }
 
   tags = {

terraform/aws/modules/nginx-server/resources.tf

@@ -30,6 +30,7 @@ resource "aws_instance" "nginx_server" {
     volume_type = "gp2"
     volume_size = "20"
     delete_on_termination = "true"
+    encrypted  = "true"
   }
 
   tags = {

terraform/aws/modules/phantom-server/resources.tf

@@ -35,6 +35,7 @@ resource "aws_instance" "phantom-server" {
     volume_type           = "gp2"
     volume_size           = "30"
     delete_on_termination = "true"
+    encrypted  = "true"
   }
   tags = {
     Name = "ar-phantom-${var.general.key_name}-${var.general.attack_range_name}"

terraform/aws/modules/snort-server/resources.tf

@@ -30,6 +30,13 @@ resource "aws_instance" "snort_sensor" {
     Name = "ar-snort-${var.general.key_name}-${var.general.attack_range_name}"
   }
 
+  root_block_device {
+    volume_type = "gp2"
+    volume_size = "20"
+    delete_on_termination = "true"
+    encrypted  = "true"
+  }
+
   provisioner "remote-exec" {
     inline = ["echo booted"]
 

terraform/aws/modules/splunk-server/resources.tf

@@ -88,6 +88,7 @@ resource "aws_instance" "splunk-server" {
     volume_type = "gp2"
     volume_size = "120"
     delete_on_termination = "true"
+    encrypted  = "true"
   }
 
   tags = {

terraform/aws/modules/windows/resources.tf

@@ -70,6 +70,7 @@ EOF
   root_block_device {
     delete_on_termination = true
     volume_size           = 50
+    encrypted  = "true"
   }
 
   provisioner "remote-exec" {