aws

Documentation

Index

• Variables
• func CheckPermissions(p *Preflight) error
• func CheckVPCQuota(p *Preflight) error
• func FetchCaller(p *Preflight) error
• func FetchDetails(p *Preflight) error
• func FetchPolicies(p *Preflight) error
• func ParseResourceName(arnStr string) (string, error)
• type Caller
  • func (c *Caller) IsAssumedRole() bool
• type Details
• type EKSCluster
• type IntegrationType
• type Params
• type Policy
• type Preflight
  • func New(params Params) (*Preflight, error)
  • func (p *Preflight) Run() (*Result, error)
  • func (p *Preflight) SetVerboseWriter(vw verbosewriter.WriteCloser)
• type Result
• type StatementEntry
• type Trail

Variables

var RequiredPermissions = map[IntegrationType][]string{
	Agentless: {
		"ec2:AssociateRouteTable",
		"ec2:AttachInternetGateway",
		"ec2:AuthorizeSecurityGroupEgress",
		"ec2:CreateInternetGateway",
		"ec2:CreateRoute",
		"ec2:CreateRouteTable",
		"ec2:CreateSecurityGroup",
		"ec2:CreateSubnet",
		"ec2:CreateTags",
		"ec2:CreateVpc",
		"ec2:DeleteInternetGateway",
		"ec2:DeleteRoute",
		"ec2:DeleteRouteTable",
		"ec2:DeleteSecurityGroup",
		"ec2:DeleteSubnet",
		"ec2:DeleteVpc",
		"ec2:DescribeInternetGateways",
		"ec2:DescribeNetworkAcls",
		"ec2:DescribeNetworkInterfaces",
		"ec2:DescribeRegions",
		"ec2:DescribeRouteTables",
		"ec2:DescribeSecurityGroupRules",
		"ec2:DescribeSecurityGroups",
		"ec2:DescribeSubnets",
		"ec2:DescribeVpcAttribute",
		"ec2:DescribeVpcClassicLink",
		"ec2:DescribeVpcClassicLinkDnsSupport",
		"ec2:DescribeVpcs",
		"ec2:DetachInternetGateway",
		"ec2:DeleteNetworkAclEntry",
		"ec2:DisassociateRouteTable",
		"ec2:ModifyVpcAttribute",
		"ec2:RevokeSecurityGroupEgress",
		"ec2:RevokeSecurityGroupIngress",
		"ecs:CreateCluster",
		"ecs:DeleteCluster",
		"ecs:DeregisterTaskDefinition",
		"ecs:DescribeClusters",
		"ecs:DescribeTaskDefinition",
		"ecs:PutClusterCapacityProviders",
		"ecs:RegisterTaskDefinition",
		"ecs:TagResource",
		"events:DeleteRule",
		"events:DescribeRule",
		"events:ListTagsForResource",
		"events:ListTargetsByRule",
		"events:PutRule",
		"events:PutTargets",
		"events:RemoveTargets",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"logs:CreateLogGroup",
		"logs:DeleteLogGroup",
		"logs:DescribeLogGroups",
		"logs:ListTagsLogGroup",
		"logs:PutRetentionPolicy",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutLifecycleConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"servicequotas:GetServiceQuota",
	},
	Config: {
		"cloudformation:CreateStack",
		"cloudformation:CreateStackInstances",
		"cloudformation:CreateStackSet",
		"cloudformation:DeleteStack",
		"cloudformation:DeleteStackInstances",
		"cloudformation:DeleteStackSet",
		"cloudformation:DescribeStackEvents",
		"cloudformation:DescribeStackInstance",
		"cloudformation:DescribeStacks",
		"cloudformation:DescribeStackSet",
		"cloudformation:DescribeStackSetOperation",
		"cloudformation:GetTemplate",
		"cloudformation:ListStackInstances",
		"ec2:DescribeRegions",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CancelKeyDeletion",
		"kms:CreateAlias",
		"kms:CreateCustomKeyStore",
		"kms:CreateGrant",
		"kms:CreateKey",
		"kms:DeleteAlias",
		"kms:DeleteCustomKeyStore",
		"kms:DeleteImportedKeyMaterial",
		"kms:DescribeCustomKeyStores",
		"kms:DescribeKey",
		"kms:DisableKey",
		"kms:DisableKeyRotation",
		"kms:EnableKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:GetParametersForImport",
		"kms:GetPublicKey",
		"kms:ListAliases",
		"kms:ListGrants",
		"kms:ListKeyPolicies",
		"kms:ListKeys",
		"kms:ListResourceTags",
		"kms:ListRetirableGrants",
		"kms:PutKeyPolicy",
		"kms:RevokeGrant",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"kms:UpdateAlias",
		"kms:UpdateCustomKeyStore",
		"kms:UpdateKeyDescription",
		"kms:UpdatePrimaryRegion",
		"lambda:AddPermission",
		"lambda:CreateFunction",
		"lambda:DeleteFunction",
		"lambda:GetFunction",
		"lambda:GetFunctionCodeSigningConfig",
		"lambda:GetPolicy",
		"lambda:InvokeFunction",
		"lambda:ListVersionsByFunction",
		"lambda:Removepermission",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteBucketWebsite",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetAccessPoint",
		"s3:GetAccessPointConfigurationForObjectLambda",
		"s3:GetAccessPointForObjectLambda",
		"s3:GetAccessPointPolicy",
		"s3:GetAccessPointPolicyStatus",
		"s3:GetAccessPointPolicyStatusForObjectLambda",
		"s3:GetAccountPublicAccessBlock",
		"s3:GetAnalyticsConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLocation",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetIntelligentTieringConfiguration",
		"s3:GetInventoryConfiguration",
		"s3:GetJobTagging",
		"s3:GetLifecycleConfiguration",
		"s3:GetMetricsConfiguration",
		"s3:GetObject",
		"s3:GetObjectAcl",
		"s3:GetObjectLegalHold",
		"s3:GetObjectRetention",
		"s3:GetObjectTagging",
		"s3:GetObjectTorrent",
		"s3:GetObjectVersion",
		"s3:GetObjectVersionAcl",
		"s3:GetObjectVersionForReplication",
		"s3:GetObjectVersionTagging",
		"s3:GetObjectVersionTorrent",
		"s3:GetReplicationConfiguration",
		"s3:GetStorageLensConfiguration",
		"s3:GetStorageLensConfigurationTagging",
		"s3:GetStorageLensDashboard",
		"s3:ListAccessPoints",
		"s3:ListAccessPointsForObjectLambda",
		"s3:ListAllMyBuckets",
		"s3:ListBucket",
		"s3:ListBucketMultipartUploads",
		"s3:ListBucketVersions",
		"s3:ListJobs",
		"s3:ListMultipartUploadParts",
		"s3:ListStorageLensConfigurations",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:Unsubscribe",
	},
	CloudTrail: {
		"cloudtrail:AddTags",
		"cloudtrail:CreateTrail",
		"cloudtrail:DeleteTrail",
		"cloudtrail:DescribeTrails",
		"cloudtrail:GetEventSelectors",
		"cloudtrail:GetTrail",
		"cloudtrail:GetTrailStatus",
		"cloudtrail:ListTags",
		"cloudtrail:ListTrails",
		"cloudtrail:StartLogging",
		"ec2:DescribeRegions",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CancelKeyDeletion",
		"kms:CreateKey",
		"kms:DeleteAlias",
		"kms:DeleteCustomKeyStore",
		"kms:DeleteImportedKeyMaterial",
		"kms:DescribeCustomKeyStores",
		"kms:DescribeKey",
		"kms:DisableKey",
		"kms:DisableKeyRotation",
		"kms:EnableKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:GetParametersForImport",
		"kms:GetPublicKey",
		"kms:ListAliases",
		"kms:ListGrants",
		"kms:ListKeyPolicies",
		"kms:ListKeys",
		"kms:ListResourceTags",
		"kms:ListRetirableGrants",
		"kms:PutKeyPolicy",
		"kms:RevokeGrant",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"kms:UpdateAlias",
		"kms:UpdateCustomKeyStore",
		"kms:UpdateKeyDescription",
		"kms:UpdatePrimaryRegion",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketNotification",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
		"sqs:CreateQueue",
		"sqs:DeleteQueue",
		"sqs:GetQueueAttributes",
		"sqs:ListQueueTags",
		"sqs:SetQueueAttributes",
		"sqs:TagQueue",
	},
}

var RequiredPermissionsForOrg = map[IntegrationType][]string{
	Agentless: {
		"cloudformation:CreateStackInstances",
		"cloudformation:CreateStackSet",
		"cloudformation:DeleteStackInstances",
		"cloudformation:DeleteStackSet",
		"cloudformation:DescribeStackSet",
		"cloudformation:DescribeStackSetOperation",
		"cloudformation:ListStackInstances",
		"cloudformation:TagResource",
		"ec2:AssociateRouteTable",
		"ec2:AttachInternetGateway",
		"ec2:AuthorizeSecurityGroupEgress",
		"ec2:CreateFlowLogs",
		"ec2:CreateInternetGateway",
		"ec2:CreateNetworkAclEntry",
		"ec2:CreateRoute",
		"ec2:CreateRouteTable",
		"ec2:CreateSecurityGroup",
		"ec2:CreateSubnet",
		"ec2:CreateTags",
		"ec2:CreateVpc",
		"ec2:DeleteFlowLogs",
		"ec2:DeleteInternetGateway",
		"ec2:DeleteNetworkAclEntry",
		"ec2:DeleteRoute",
		"ec2:DeleteRouteTable",
		"ec2:DeleteSecurityGroup",
		"ec2:DeleteSubnet",
		"ec2:DeleteVpc",
		"ec2:DescribeFlowLogs",
		"ec2:DescribeInternetGateways",
		"ec2:DescribeNetworkAcls",
		"ec2:DescribeNetworkInterfaces",
		"ec2:DescribeRegions",
		"ec2:DescribeRouteTables",
		"ec2:DescribeSecurityGroupRules",
		"ec2:DescribeSecurityGroups",
		"ec2:DescribeSubnets",
		"ec2:DescribeVpcAttribute",
		"ec2:DescribeVpcClassicLink",
		"ec2:DescribeVpcClassicLinkDnsSupport",
		"ec2:DescribeVpcs",
		"ec2:DetachInternetGateway",
		"ec2:DisassociateRouteTable",
		"ec2:ModifyVpcAttribute",
		"ec2:ReplaceNetworkAclAssociation",
		"ec2:RevokeSecurityGroupEgress",
		"ec2:RevokeSecurityGroupIngress",
		"ecs:CreateCluster",
		"ecs:DeleteCluster",
		"ecs:DeregisterTaskDefinition",
		"ecs:DescribeClusters",
		"ecs:DescribeTaskDefinition",
		"ecs:ListTasks",
		"ecs:PutClusterCapacityProviders",
		"ecs:RegisterTaskDefinition",
		"ecs:StopTask",
		"ecs:TagResource",
		"events:DeleteRule",
		"events:DescribeRule",
		"events:ListTagsForResource",
		"events:ListTargetsByRule",
		"events:PutRule",
		"events:PutTargets",
		"events:RemoveTargets",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"logs:CreateDelivery",
		"logs:CreateLogDelivery",
		"logs:CreateLogGroup",
		"logs:CreateLogStream",
		"logs:DeleteLogGroup",
		"logs:DescribeLogGroups",
		"logs:DescribeLogStreams",
		"logs:ListTagsForResource",
		"logs:ListTagsLogGroup",
		"logs:PutLogEvents",
		"logs:PutRetentionPolicy",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetObject",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutLifecycleConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"secretsmanager:TagResource",
		"servicequotas:GetServiceQuota",
	},
	Config: {
		"cloudformation:CreateStack",
		"cloudformation:CreateStackInstances",
		"cloudformation:CreateStackSet",
		"cloudformation:DeleteStack",
		"cloudformation:DeleteStackInstances",
		"cloudformation:DeleteStackSet",
		"cloudformation:DescribeStackEvents",
		"cloudformation:DescribeStackInstance",
		"cloudformation:DescribeStacks",
		"cloudformation:DescribeStackSet",
		"cloudformation:DescribeStackSetOperation",
		"cloudformation:GetTemplate",
		"cloudformation:ListStackInstances",
		"cloudformation:TagResource",
		"ec2:DescribeRegions",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CancelKeyDeletion",
		"kms:CreateAlias",
		"kms:CreateCustomKeyStore",
		"kms:CreateGrant",
		"kms:CreateKey",
		"kms:DeleteAlias",
		"kms:DeleteCustomKeyStore",
		"kms:DeleteImportedKeyMaterial",
		"kms:DescribeCustomKeyStores",
		"kms:DescribeKey",
		"kms:DisableKey",
		"kms:DisableKeyRotation",
		"kms:EnableKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:GetParametersForImport",
		"kms:GetPublicKey",
		"kms:ListAliases",
		"kms:ListGrants",
		"kms:ListKeyPolicies",
		"kms:ListKeys",
		"kms:ListResourceTags",
		"kms:ListRetirableGrants",
		"kms:PutKeyPolicy",
		"kms:RevokeGrant",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"kms:UpdateAlias",
		"kms:UpdateCustomKeyStore",
		"kms:UpdateKeyDescription",
		"kms:UpdatePrimaryRegion",
		"lambda:AddPermission",
		"lambda:CreateFunction",
		"lambda:DeleteFunction",
		"lambda:GetFunction",
		"lambda:GetFunctionCodeSigningConfig",
		"lambda:GetPolicy",
		"lambda:InvokeFunction",
		"lambda:ListVersionsByFunction",
		"lambda:Removepermission",
		"lambda:TagResource",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteBucketWebsite",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetAccessPoint",
		"s3:GetAccessPointConfigurationForObjectLambda",
		"s3:GetAccessPointForObjectLambda",
		"s3:GetAccessPointForObjectLambda",
		"s3:GetAccessPointPolicy",
		"s3:GetAccessPointPolicyStatus",
		"s3:GetAccessPointPolicyStatusForObjectLambda",
		"s3:GetAccountPublicAccessBlock",
		"s3:GetAnalyticsConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLocation",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetIntelligentTieringConfiguration",
		"s3:GetInventoryConfiguration",
		"s3:GetJobTagging",
		"s3:GetLifecycleConfiguration",
		"s3:GetMetricsConfiguration",
		"s3:GetObject",
		"s3:GetObjectAcl",
		"s3:GetObjectLegalHold",
		"s3:GetObjectRetention",
		"s3:GetObjectTagging",
		"s3:GetObjectTorrent",
		"s3:GetObjectVersion",
		"s3:GetObjectVersionAcl",
		"s3:GetObjectVersionForReplication",
		"s3:GetObjectVersionTagging",
		"s3:GetObjectVersionTorrent",
		"s3:GetReplicationConfiguration",
		"s3:GetStorageLensConfiguration",
		"s3:GetStorageLensConfigurationTagging",
		"s3:GetStorageLensDashboard",
		"s3:ListAccessPoints",
		"s3:ListAccessPointsForObjectLambda",
		"s3:ListAllMyBuckets",
		"s3:ListBucket",
		"s3:ListBucketMultipartUploads",
		"s3:ListBucketVersions",
		"s3:ListJobs",
		"s3:ListMultipartUploadParts",
		"s3:ListStorageLensConfigurations",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"secretsmanager:TagResource",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
	},
	CloudTrail: {
		"cloudtrail:AddTags",
		"cloudtrail:CreateTrail",
		"cloudtrail:DeleteTrail",
		"cloudtrail:DescribeTrails",
		"cloudtrail:GetEventSelectors",
		"cloudtrail:GetTrailStatus",
		"cloudtrail:ListTags",
		"cloudtrail:StartLogging",
		"ec2:DescribeRegions",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:CreateServiceLinkedRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CancelKeyDeletion",
		"kms:CreateKey",
		"kms:DeleteAlias",
		"kms:DeleteCustomKeyStore",
		"kms:DeleteImportedKeyMaterial",
		"kms:DescribeCustomKeyStores",
		"kms:DescribeKey",
		"kms:DisableKey",
		"kms:DisableKeyRotation",
		"kms:EnableKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:GetParametersForImport",
		"kms:GetPublicKey",
		"kms:ListAliases",
		"kms:ListGrants",
		"kms:ListKeyPolicies",
		"kms:ListKeys",
		"kms:ListResourceTags",
		"kms:ListRetirableGrants",
		"kms:PutKeyPolicy",
		"kms:RevokeGrant",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"kms:UpdateAlias",
		"kms:UpdateCustomKeyStore",
		"kms:UpdateKeyDescription",
		"kms:UpdatePrimaryRegion",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
		"sqs:CreateQueue",
		"sqs:DeleteQueue",
		"sqs:GetQueueAttributes",
		"sqs:ListQueueTags",
		"sqs:SetQueueAttributes",
		"sqs:TagQueue",
	},
}

Functions

func CheckPermissions

func CheckPermissions(p *Preflight) error

func CheckVPCQuota

func CheckVPCQuota(p *Preflight) error

For AWS Agentless only

func FetchCaller

func FetchCaller(p *Preflight) error

func FetchDetails

func FetchDetails(p *Preflight) error

func FetchPolicies

func FetchPolicies(p *Preflight) error

func ParseResourceName

func ParseResourceName(arnStr string) (string, error)

ParseResourceName extracts the resource name from the caller identity Arn Examples:

• arn:aws:iam::123456789012:root -> root
• arn:aws:iam::123456789012:user/MyUser -> MyUser
• arn:aws:iam::123456789012:role/application_abc/component_xyz/RDSAccess -> RDSAccess
• arn:aws:iam::123456789012:assumed-role/preflight_ro/aws-go-sdk-00000000000 -> preflight_ro

Types

type Caller

type Caller struct {
	AccountID string
	ARN       string
	UserID    string
	Name      string // user name or role name
	IsRoot    bool
	IsAdmin   bool // true if the caller is root user or policies contain the action '*'
}

func (*Caller) IsAssumedRole

func (c *Caller) IsAssumedRole() bool

type Details

type Details struct {
	Regions       []string // Regions that are enabled for the caller account
	ExistingTrail Trail    // Existing eligible trail for CloudTrail integration
	EKSClusters   []EKSCluster

	// Fields for org-level
	OrgAccess           bool
	OrgID               string
	IsManagementAccount bool
	ManagementAccountID string
	OrgAccountIDs       []string
	OrgUnitIDs          []string
	RootOrgUnitID       string
	ControlTowerAccess  bool
}

type EKSCluster

type EKSCluster struct {
	Name   string
	Region string
}

type IntegrationType

type IntegrationType string

const (
	Agentless  IntegrationType = "aws_agentless"
	Config     IntegrationType = "aws_config"
	CloudTrail IntegrationType = "aws_cloudtrail"
)

type Params

type Params struct {
	Agentless       bool
	Config          bool
	CloudTrail      bool
	IsOrg           bool // If it's org-level integration
	Region          string
	Profile         string
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string // Optional for temporary credentials
}

type Policy

type Policy struct {
	Version   string
	Statement []StatementEntry
}

type Preflight

type Preflight struct {
	// contains filtered or unexported fields
}

func New

func New(params Params) (*Preflight, error)

func (*Preflight) Run

func (p *Preflight) Run() (*Result, error)

func (*Preflight) SetVerboseWriter

func (p *Preflight) SetVerboseWriter(vw verbosewriter.WriteCloser)

Overwrite the default verbose writer

type Result

type Result struct {
	Caller  Caller
	Details Details
	Errors  map[IntegrationType][]string
}

type StatementEntry

type StatementEntry struct {
	Effect   string
	Action   []string
	Resource []string
}

type Trail

type Trail struct {
	Name        string
	S3BucketARN string
	SNSTopicARN string
	KMSKeyARN   string
}