Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(iam): added user-report action to report on console access and api keys #18

Merged
merged 4 commits into from
Sep 16, 2020

Conversation

clok
Copy link
Contributor

@clok clok commented Sep 15, 2020

$ gw-aws-audit iam ur --help
NAME:
   gw-aws-audit iam user-report - generates report of IAM Users and Access Key Usage

USAGE:

This action will generate a report for all Users within an AWS account with the details
specific user authentication methods.

┌──────────────┬────────┬───────────┬─────────┬────────────┬─────────────────────────────────────────────────────────────────────────┐
│              │        │           │         │            │                           ACCESS KEY DETAILS                            │
│ USER         │ STATUS │       AGE │ CONSOLE │ LAST LOGIN │               KEY ID | STATUS | AGE | LAST USED | SERVICE               │
├──────────────┼────────┼───────────┼─────────┼────────────┼─────────────────────────────────────────────────────────────────────────┤
│ user12345    │   PASS │  123 days │      NO │       NONE │                               0 API Keys                                │
├──────────────┼────────┼───────────┼─────────┼────────────┼─────────────────────────────────────────────────────────────────────────┤
│ bot-user-123 │   WARN │  236 days │      NO │       NONE │                               2 API Keys                                │
│              │        │           │         │            │ AKIAIOSFODNN6EXAMPLE │ Active │ 229 days │   229 days 22 hours   │ s3   │
│              │        │           │         │            │ AKIAIOSFODNN5EXAMPLE │ Active │ 228 days │ 51 minutes 24 seconds │ sts  │
├──────────────┼────────┼───────────┼─────────┼────────────┼─────────────────────────────────────────────────────────────────────────┤
│ userAOK123   │   FAIL │   43 days │     YES │     5 days │                               1 API Key                                 │
│              │        │           │         │            │   AKIAIOSFODNN3EXAMPLE │ Active │ 43 days │ 22 hours 5 minutes │ ec2    │
└──────────────┴────────┴───────────┴─────────┴────────────┴─────────────────────────────────────────────────────────────────────────┘

USER [string]:
  - The user name

STATUS [enum]:
  - PASS: When a does NOT have Console Access and has NO Access Keys
  - FAIL: When a User has Console Access
  - WARN: When a User does NOT have Console Acces, but does have at least 1 Access Key
  - UNKNOWN: Catch all for cases not handled.

AGE [duration]:
  - Time since User was created

CONSOLE [bool]:
  - Does the User have Console Access? YES/NO

LAST LOGIN [duration]:
  - Time since User was created
  - NONE if the User does not have Console Access or if the User has NEVER logged in.

ACCESS KEY DETAILS [sub table]:
  - Primary header row is the number of Access Keys associated with the User

  KEY ID [string]:
    - The AWS_ACCESS_KEY_ID

  STATUS [enum]:
    - Active/Inactive

  LAST USED [duration]:
    - Time since the Access Key was last used.

  SERVICE [string]:
    - The last AWS Service that the Access Key was used to access at the "LAST USED" time.


OPTIONS:
   --help, -h  show help (default: false)

@clok clok self-assigned this Sep 15, 2020
@clok clok added the feature New feature or request label Sep 15, 2020
Copy link

@paulojblack paulojblack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I love that you're coupling the milestones of the security effort with utility features in this tool. Awesome stuff!

@clok clok merged commit ffccb73 into master Sep 16, 2020
@clok clok deleted the feat/iam branch September 16, 2020 02:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Development

Successfully merging this pull request may close these issues.

None yet

2 participants