IAM Enumeration and Analysis Workflow

IAM Enumeration and Analysis Workflow

This is the recommended path if your goal is permission mapping and escalation-path analysis.

Step 1: Enumerate resources and policy bindings

modules run enum_all --iam
modules run enum_policy_bindings --ensure-tree

If you need to constrain deep Resource Manager checks to specific IDs while retaining broad discovery:

modules run enum_all --resource-manager --iam --get --project-allowlist-file projects.txt --folder-allowlist 123456789012 --org-allowlist-file org_ids.txt

With allowlists present:

• enum_all still performs broad Resource Manager discovery.
• If no allowlist flags are supplied, all discovered resources/projects are treated as in scope.
• non-Resource-Manager service modules only run for projects that resolve into the effective allowlist scope.
• If only one direct allowlist type is provided, other direct resource types are out of scope unless explicitly allowlisted.
• Parent allowlist flags constrain by descendant hierarchy depth and intersect with direct allowlists when both are present.
• Exception: enum_policy_bindings still runs once on the final enum_all loop.
• enum_policy_bindings reads cached workspace resources; if you previously enumerated resources outside the allowlist, those can still be included unless you reset/clean cache first.

enum_policy_bindings supports service scoping:

modules run enum_policy_bindings --resource-manager --storage --compute --secrets

Step 2: Process IAM bindings into principal-centric summaries

modules run process_iam_bindings

Optional outputs:

modules run process_iam_bindings --csv --txt
modules run process_iam_bindings --silent --csv --txt
modules run process_iam_bindings --force-refresh-bindings

What this gives you:

• flattened member-to-role/resource summaries
• inheritance-aware organization/folder/project context
• per-member rows stored for downstream reporting

Step 3: Review credential-effective permissions

creds info
creds info --csv

--csv is useful when terminal truncation hides long permission sets.

Step 4: Build OpenGraph

modules run enum_gcp_cloud_hound_data --expand-inherited --reset --out Bloodhound_Output.json

Then import JSON into BloodHound CE.

Notes on analyze_vulns

analyze_vulns is currently a scaffold and returns:

[*] analyze_vulns is coming soon.

Use process_iam_bindings + OpenGraph for current operational analysis.