iamspectre

README

iamspectre

iamspectre — Cross-cloud IAM auditor for AWS, GCP, and Azure AD. Part of SpectreHub.

What it is

• Scans IAM resources across AWS, GCP, and Azure AD
• Detects stale users, unused roles, wildcard policies, missing MFA, and expired secrets
• Checks credential reports, key ages, service account bindings, and directory roles
• Each finding includes severity and actionable recommendation
• Outputs text, Markdown report, JSON, SARIF, and SpectreHub formats

What it is NOT

• Not a remediation tool — reports only, never modifies IAM resources
• Not a real-time monitor — point-in-time scanner
• Not a cost estimator — IAM findings are security risks, not dollar waste
• Not a CSPM replacement — focuses on identity and access only

Quick start

Homebrew

brew tap ppiankov/tap
brew install iamspectre

Docker

docker pull ghcr.io/ppiankov/iamspectre:latest
docker run --rm ghcr.io/ppiankov/iamspectre:latest aws --format json

Windows

Download the latest Windows .zip from GitHub Releases, extract iamspectre.exe, and add its folder to PATH or run it in place.

.\iamspectre.exe aws --format json

AWS credentials resolve through the SDK default chain from standard Windows locations such as %USERPROFILE%\.aws\. Azure also uses its default credential chain, but Microsoft Graph permissions, admin consent, directory roles, and some licensing requirements must be configured explicitly; follow the Azure authentication setup.

From source

git clone https://github.com/ppiankov/iamspectre.git
cd iamspectre
make build

Usage

iamspectre aws --format json

CLI commands

Command	Description
iamspectre aws	Audit AWS IAM resources
iamspectre gcp	Audit GCP IAM resources
iamspectre azure	Audit Microsoft Entra ID resources
iamspectre init	Generate config file and IAM permissions
iamspectre version	Print version

SpectreHub integration

iamspectre feeds IAM hygiene findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool iamspectre

GitHub Action

Run iamspectre in CI with iamspectre-action (AWS and GCP):

- uses: ppiankov/iamspectre-action@v1
  with:
    cloud: aws

Safety

iamspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your IAM resources.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs