Crypto Inventory Scanner

python azure/keyvault_inventory.py \
  --subscription-id YOUR_SUBSCRIPTION_ID \
  --output inventory/azure-keyvault-inventory.json \
  --include-properties \
  --check-expiration

#!/usr/bin/env python3
"""Azure Key Vault Cryptographic Inventory Scanner"""

import azure.identity
import azure.keyvault.keys
import azure.keyvault.secrets
import azure.keyvault.certificates
from azure.mgmt.keyvault import KeyVaultManagementClient
import json
from datetime import datetime

def scan_azure_keyvaults(subscription_id):
    """Scan all Key Vaults in subscription"""

    credential = azure.identity.DefaultAzureCredential()
    kv_mgmt_client = KeyVaultManagementClient(credential, subscription_id)

    inventory = {
        "scan_date": datetime.now().isoformat(),
        "subscription_id": subscription_id,
        "vaults": []
    }

    # List all key vaults
    vaults = kv_mgmt_client.vaults.list()

    for vault in vaults:
        vault_url = f"https://{vault.name}.vault.azure.net"
        print(f"Scanning vault: {vault.name}")

        vault_data = {
            "name": vault.name,
            "resource_group": vault.id.split('/')[4],
            "location": vault.location,
            "keys": [],
            "certificates": [],
            "vulnerable_count": 0
        }

        try:
            # Scan keys
            key_client = azure.keyvault.keys.KeyClient(vault_url, credential)
            for key_props in key_client.list_properties_of_keys():
                key = key_client.get_key(key_props.name)

                key_info = {
                    "name": key.name,
                    "type": key.key.kty,
                    "enabled": key.properties.enabled,
                    "created": key.properties.created_on.isoformat() if key.properties.created_on else None,
                    "expires": key.properties.expires_on.isoformat() if key.properties.expires_on else None,
                    "quantum_vulnerable": False
                }

                # Check if quantum-vulnerable
                if key.key.kty in ["RSA", "EC", "RSA-HSM", "EC-HSM"]:
                    key_info["quantum_vulnerable"] = True
                    vault_data["vulnerable_count"] += 1

                    if key.key.kty.startswith("RSA"):
                        key_info["key_size"] = key.key.n.bit_length() if key.key.n else None
                    elif key.key.kty.startswith("EC"):
                        key_info["curve"] = key.key.crv.value if key.key.crv else None

                vault_data["keys"].append(key_info)

            # Scan certificates
            cert_client = azure.keyvault.certificates.CertificateClient(vault_url, credential)
            for cert_props in cert_client.list_properties_of_certificates():
                cert = cert_client.get_certificate(cert_props.name)

                cert_info = {
                    "name": cert.name,
                    "subject": str(cert.properties.subject) if cert.properties.subject else None,
                    "thumbprint": cert.properties.thumbprint.hex() if cert.properties.thumbprint else None,
                    "enabled": cert.properties.enabled,
                    "expires": cert.properties.expires_on.isoformat() if cert.properties.expires_on else None,
                    "quantum_vulnerable": True  # Most X.509 certs use RSA/ECDSA
                }

                vault_data["certificates"].append(cert_info)
                vault_data["vulnerable_count"] += 1

        except Exception as e:
            vault_data["error"] = str(e)
            print(f"  Error scanning {vault.name}: {e}")

        inventory["vaults"].append(vault_data)

    # Summary
    total_vulnerable = sum(v["vulnerable_count"] for v in inventory["vaults"])
    inventory["summary"] = {
        "total_vaults": len(inventory["vaults"]),
        "total_vulnerable_assets": total_vulnerable
    }

    return inventory

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python keyvault_inventory.py SUBSCRIPTION_ID")
        sys.exit(1)

    subscription_id = sys.argv[1]
    results = scan_azure_keyvaults(subscription_id)

    # Save to file
    with open("azure-keyvault-inventory.json", "w") as f:
        json.dump(results, f, indent=2)

    print(f"\\nInventory complete!")
    print(f"Total vaults scanned: {results['summary']['total_vaults']}")
    print(f"Quantum-vulnerable assets: {results['summary']['total_vulnerable_assets']}")

python aws/kms_inventory.py \
  --profile default \
  --all-regions \
  --output inventory/aws-kms-inventory.json

#!/usr/bin/env python3
"""AWS KMS Cryptographic Inventory Scanner"""

import boto3
import json
from datetime import datetime
from concurrent.futures import ThreadPoolExecutor, as_completed

def scan_kms_region(region_name):
    """Scan KMS keys in a single region"""
    print(f"Scanning region: {region_name}")

    kms = boto3.client('kms', region_name=region_name)
    vulnerable_keys = []

    try:
        # List all KMS keys
        paginator = kms.get_paginator('list_keys')
        for page in paginator.paginate():
            for key in page['Keys']:
                key_id = key['KeyId']

                try:
                    # Get key metadata
                    metadata = kms.describe_key(KeyId=key_id)['KeyMetadata']

                    key_spec = metadata.get('KeySpec', 'SYMMETRIC_DEFAULT')
                    key_usage = metadata.get('KeyUsage', 'ENCRYPT_DECRYPT')

                    # Check if quantum-vulnerable
                    vulnerable_specs = [
                        'RSA_2048', 'RSA_3072', 'RSA_4096',
                        'ECC_NIST_P256', 'ECC_NIST_P384', 'ECC_NIST_P521',
                        'ECC_SECG_P256K1'
                    ]

                    if key_spec in vulnerable_specs:
                        key_info = {
                            "KeyId": key_id,
                            "KeyArn": metadata['Arn'],
                            "KeySpec": key_spec,
                            "KeyUsage": key_usage,
                            "KeyState": metadata['KeyState'],
                            "CreationDate": metadata['CreationDate'].isoformat(),
                            "Enabled": metadata['Enabled'],
                            "Description": metadata.get('Description', ''),
                            "Region": region_name
                        }

                        # Get key tags
                        try:
                            tags_response = kms.list_resource_tags(KeyId=key_id)
                            key_info["Tags"] = {tag['TagKey']: tag['TagValue']
                                                for tag in tags_response.get('Tags', [])}
                        except:
                            key_info["Tags"] = {}

                        vulnerable_keys.append(key_info)

                except Exception as e:
                    print(f"  Error describing key {key_id}: {e}")

    except Exception as e:
        print(f"  Error scanning region {region_name}: {e}")
        return {"region": region_name, "error": str(e), "keys": []}

    return {"region": region_name, "keys": vulnerable_keys, "count": len(vulnerable_keys)}


def scan_all_aws_kms():
    """Scan all AWS regions for KMS keys"""

    ec2 = boto3.client('ec2', region_name='us-east-1')
    regions = [r['RegionName'] for r in ec2.describe_regions()['Regions']]

    inventory = {
        "scan_date": datetime.now().isoformat(),
        "regions": [],
        "total_vulnerable_keys": 0
    }

    # Scan regions in parallel
    with ThreadPoolExecutor(max_workers=5) as executor:
        future_to_region = {executor.submit(scan_kms_region, region): region
                            for region in regions}

        for future in as_completed(future_to_region):
            region_data = future.result()
            inventory["regions"].append(region_data)
            inventory["total_vulnerable_keys"] += region_data.get("count", 0)

    return inventory


if __name__ == "__main__":
    results = scan_all_aws_kms()

    # Save to file
    with open("aws-kms-inventory.json", "w") as f:
        json.dump(results, f, indent=2, default=str)

    print(f"\\n=== AWS KMS Inventory Complete ===")
    print(f"Regions scanned: {len(results['regions'])}")
    print(f"Quantum-vulnerable keys found: {results['total_vulnerable_keys']}")

    # Summary by region
    print("\\nBy Region:")
    for region_data in sorted(results['regions'], key=lambda x: x.get('count', 0), reverse=True):
        if region_data.get('count', 0) > 0:
            print(f"  {region_data['region']}: {region_data['count']} vulnerable keys")

# Azure App Service Certificates
python azure/certificate_inventory.py \
  --subscription-id YOUR_SUBSCRIPTION_ID \
  --output inventory/azure-certificates.json

# AWS Certificate Manager (ACM)
python aws/acm_inventory.py \
  --all-regions \
  --output inventory/aws-acm-certificates.json

# AWS IAM Server Certificates
python aws/iam_certificate_inventory.py \
  --output inventory/aws-iam-certificates.json

# Scan from endpoint list
python shared/tls_endpoint_scanner.py \
  --endpoints-file endpoints.txt \
  --output inventory/tls-endpoints.json

# Auto-discover from Azure Load Balancers
python azure/lb_endpoint_discovery.py \
  --subscription-id YOUR_SUBSCRIPTION_ID \
  --scan-tls \
  --output inventory/azure-lb-tls.json

# Auto-discover from AWS ELB/ALB
python aws/elb_endpoint_discovery.py \
  --all-regions \
  --scan-tls \
  --output inventory/aws-elb-tls.json

# Azure SQL Database TDE
python azure/sql_encryption_inventory.py \
  --subscription-id YOUR_SUBSCRIPTION_ID \
  --output inventory/azure-sql-encryption.json

# AWS RDS Encryption
python aws/rds_encryption_inventory.py \
  --all-regions \
  --output inventory/aws-rds-encryption.json

# AWS DynamoDB Encryption
python aws/dynamodb_encryption_inventory.py \
  --all-regions \
  --output inventory/aws-dynamodb-encryption.json

# Azure Storage Accounts
python azure/storage_encryption_inventory.py \
  --subscription-id YOUR_SUBSCRIPTION_ID \
  --output inventory/azure-storage-encryption.json

# AWS S3 Bucket Encryption
python aws/s3_encryption_inventory.py \
  --output inventory/aws-s3-encryption.json

python shared/consolidate_inventory.py \
  --input-dir inventory/ \
  --output reports/crypto-inventory-master.json \
  --format json,csv,html

# This generates:
# - crypto-inventory-master.json (machine-readable)
# - crypto-inventory-master.csv (spreadsheet)
# - crypto-inventory-master.html (interactive report)