IAM Enumeration and Analysis Workflow

IAM Enumeration and Analysis Workflow

This is the recommended path if your goal is permission mapping and escalation-path analysis.

Step 1: Enumerate resources and policy bindings

modules run enum_all --iam
modules run enum_policy_bindings --ensure-tree

enum_policy_bindings supports service scoping:

modules run enum_policy_bindings --resource-manager --storage --compute --secrets

Step 2: Process IAM bindings into principal-centric summaries

modules run process_iam_bindings

Optional outputs:

modules run process_iam_bindings --csv --txt
modules run process_iam_bindings --silent --csv --txt
modules run process_iam_bindings --force-refresh-bindings

What this gives you:

• flattened member-to-role/resource summaries
• inheritance-aware organization/folder/project context
• per-member rows stored for downstream reporting

Step 3: Review credential-effective permissions

creds info
creds info --csv

--csv is useful when terminal truncation hides long permission sets.

Step 4: Build OpenGraph

modules run enum_gcp_cloud_hound_data --expand-inherited --reset --out Bloodhound_Output.json

Then import JSON into BloodHound CE.

Notes on analyze_vulns

analyze_vulns is currently a scaffold and returns:

[*] analyze_vulns is coming soon.

Use process_iam_bindings + OpenGraph for current operational analysis.