Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#1

Post by kmcquade » Tue, May 05, 2020, 12:33 PM UTC

Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool
github.com

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#2

Post by fred1991 » Tue, May 05, 2020, 2:23 PM UTC

Damn. The report guidance is really good. I'm going to use this in an assessment next week :) Have to review an account that has hundreds of IAM roles but this should help a lot,.

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#3

Post by kmcquade » Tue, May 05, 2020, 2:25 PM UTC

fred1991 wrote: post #2

Damn. The report guidance is really good. I'm going to use this in an assessment next week :) Have to review an account that has hundreds of IAM roles but this should help a lot,.

Thanks! I’m glad you like it. Let me know if you have any feedback - here, in the Gitter channel (link in the Readme), or on Twitter (kmcquade3)

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#4

Post by chmod-noobs » Tue, May 05, 2020, 2:35 PM UTC

Cool project. How is this different from PMapper though? I use that it some of my assessments (underrated tool IMHO).

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#5

Post by kmcquade » Tue, May 05, 2020, 2:41 PM UTC

chmod-noobs wrote: post #4

Cool project. How is this different from PMapper though? I use that it some of my assessments (underrated tool IMHO).

PMapper is definitely a great tool. It’s best used in Pentests for validating some privilege escalation paths. It has the benefit of analyzing IAM trust policies, resource based policies, viewing escalation paths in a graph based approach. Very underrated indeed.

Cloudsplaining is faster at creating a more comprehensive report. We realize that there is lots of damage that can be done just by being able to modify Infrastructure, even when your privileges fall short of legit privilege escalation.

I think the example report will illustrate this best for you. Check it out here: https://opensource.salesforce.com/cloudsplaining/

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#6

Post by chmod-noobs » Tue, May 05, 2020, 2:50 PM UTC

kmcquade wrote: post #3

fred1991 wrote: post #2

Damn. The report guidance is really good. I'm going to use this in an assessment next week :) Have to review an account that has hundreds of IAM roles but this should help a lot,.

Thanks! I’m glad you like it. Let me know if you have any feedback - here, in the Gitter channel (link in the Readme), or on Twitter (kmcquade3)

What kind of privileges do I need to run it? I don’t see any details in the documentation. You should probably add this there.

Re: Show HN: Cloudsplaining, an AWS IAM Security Assessment Tool

#7

Post by kmcquade » Tue, May 05, 2020, 3:52 PM UTC

chmod-noobs wrote: post #6

kmcquade wrote: post #3

Earlier quoted context omitted.

Thanks! I’m glad you like it. Let me know if you have any feedback - here, in the Gitter channel (link in the Readme), or on Twitter (kmcquade3)

What kind of privileges do I need to run it? I don’t see any details in the documentation. You should probably add this there.

You just need a single IAM action - iam:GetAccountAuthorizationDetails (https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetA...).

I’ll definitely add that to the README. Thanks