iann0036 / aws-leastprivilege Goto Github PK

Hi @iann0036

This tool looks really promising and just the kind of thing I've been looking for.

My use case is that I'm deploying infrastructure within CircleCI builds and I want to give the IAM User for the agents a lot less than full admin access 🤣

I've noticed the repo has been quiet for a fair few months - do you have an alternative to use now?

I would love to hear any experience you've got in least privileged exploration!

I currently get:

botocore.errorfactory.TypeNotFoundException: An error occurred (TypeNotFoundException) when calling the DescribeType operation: The type 'AWS::Serverless::Api' cannot be found.

See https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-resources-and-properties.html

https://github.com/iann0036/aws-leastprivilege/tree/master/cfnlp/mappings
https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arns-syntax

grep 'arn:aws:' cfnlp/mappings/*.py

Thought about just find-and-replacing all of them:

brew install gnu-sed
gsed -i 's/arn:aws:/arn:aws*:/' cfnlp/mappings/*.py

but a few shouldn't have that exact find-and-replace:

Dude, stop doing cool things like this. It makes me look bad. 😆