Check IAM Role/User/Group Permissions

This script performs a simular function as AWS Web Console's Access Advisor but instead generates CSV formatted report containing the identifying Name, Creation Date, Last Used Date, and Unused Permissions

These reports are useful for establish a more secure environment utilizing least privilege principle.

( For a much more powerful tool check out policy_sentry )

Requirements

Requires the boto3 library installed

    $ pip install boto3

The following AWS IAM permissions are needed

  iam:GenerateServiceLastAccessedDetails
  iam:GetServiceLastAccessedDetails
  iam:GetServiceLastAccessedDetailsWithEntities
  iam:ListPoliciesGrantingServiceAccess

Usage

usage: check_iam_permissions.py [-h] [--user] [--role] [--group]

the options --user --role --group can be used to generate the respective reports individually.

Without arguments, all three reports will be generated with the file names role_permissions.csv user_permissions.csv group_permissions.csv.

The script also takes the standard AWS authentication options --profile, --region, --key & --secret

Output Example