aws

Documentation

Index

• func ScannerCount() int
• type AWSScanner
  • func NewAWSScanner(client *Client, scanCfg iam.ScanConfig) *AWSScanner
  • func NewAWSScannerWithIAM(client *Client, iamClient IAMAPI, scanCfg iam.ScanConfig) *AWSScanner
  • func (s *AWSScanner) ScanAll(ctx context.Context) (*iam.ScanResult, error)
• type Client
  • func NewClient(ctx context.Context, profile string) (*Client, error)
  • func NewClientWithSTS(cfg aws.Config, stsAPI STSAPI) *Client
  • func (c *Client) Config() aws.Config
  • func (c *Client) GetAccountID(ctx context.Context) (string, error)
• type CredentialEntry
  • func FetchCredentialReport(ctx context.Context, client IAMAPI) ([]CredentialEntry, error)
• type IAMAPI
• type PolicyDocument
  • func ParsePolicyDocument(encoded string) (*PolicyDocument, error)
  • func (d *PolicyDocument) HasWildcardAction() bool
  • func (d *PolicyDocument) HasWildcardResource() bool
• type PolicyScanner
  • func NewPolicyScanner(client IAMAPI) *PolicyScanner
  • func (s *PolicyScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)
  • func (s *PolicyScanner) Type() iam.ResourceType
• type PolicyStatement
• type Principal
  • func (p *Principal) UnmarshalJSON(data []byte) error
• type RoleScanner
  • func NewRoleScanner(client IAMAPI, accountID string) *RoleScanner
  • func (s *RoleScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)
  • func (s *RoleScanner) Type() iam.ResourceType
• type STSAPI
• type StringOrSlice
  • func (s StringOrSlice) Contains(val string) bool
  • func (s *StringOrSlice) UnmarshalJSON(data []byte) error
• type UserScanner
  • func NewUserScanner(entries []CredentialEntry) *UserScanner
  • func (s *UserScanner) Scan(_ context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)
  • func (s *UserScanner) Type() iam.ResourceType

Functions

func ScannerCount

func ScannerCount() int

ScannerCount returns the number of scanners used.

Types

type AWSScanner

type AWSScanner struct {
	// contains filtered or unexported fields
}

AWSScanner orchestrates all AWS IAM scanners.

func NewAWSScanner

func NewAWSScanner(client *Client, scanCfg iam.ScanConfig) *AWSScanner

NewAWSScanner creates an orchestrator for AWS IAM scanning.

func NewAWSScannerWithIAM

func NewAWSScannerWithIAM(client *Client, iamClient IAMAPI, scanCfg iam.ScanConfig) *AWSScanner

NewAWSScannerWithIAM creates an orchestrator with a custom IAM client (for testing).

func (*AWSScanner) ScanAll

func (s *AWSScanner) ScanAll(ctx context.Context) (*iam.ScanResult, error)

ScanAll runs all AWS IAM scanners and returns combined results.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client wraps the AWS SDK configuration for creating service clients.

func NewClient

func NewClient(ctx context.Context, profile string) (*Client, error)

NewClient creates a new AWS client using the specified profile.

func NewClientWithSTS

func NewClientWithSTS(cfg aws.Config, stsAPI STSAPI) *Client

NewClientWithSTS creates a client with a custom STS implementation (for testing).

func (*Client) Config

func (c *Client) Config() aws.Config

Config returns the underlying AWS config.

func (*Client) GetAccountID

func (c *Client) GetAccountID(ctx context.Context) (string, error)

GetAccountID returns the AWS account ID for the current credentials.

type CredentialEntry

type CredentialEntry struct {
	User                   string
	ARN                    string
	PasswordEnabled        bool
	PasswordLastUsed       *time.Time
	MFAActive              bool
	AccessKey1Active       bool
	AccessKey1LastUsedDate *time.Time
	AccessKey2Active       bool
	AccessKey2LastUsedDate *time.Time
}

CredentialEntry represents a single row from the IAM credential report CSV.

func FetchCredentialReport

func FetchCredentialReport(ctx context.Context, client IAMAPI) ([]CredentialEntry, error)

FetchCredentialReport generates and retrieves the IAM credential report.

type IAMAPI

type IAMAPI interface {
	GenerateCredentialReport(ctx context.Context, params *iam.GenerateCredentialReportInput, optFns ...func(*iam.Options)) (*iam.GenerateCredentialReportOutput, error)
	GetCredentialReport(ctx context.Context, params *iam.GetCredentialReportInput, optFns ...func(*iam.Options)) (*iam.GetCredentialReportOutput, error)
	ListRoles(ctx context.Context, params *iam.ListRolesInput, optFns ...func(*iam.Options)) (*iam.ListRolesOutput, error)
	ListPolicies(ctx context.Context, params *iam.ListPoliciesInput, optFns ...func(*iam.Options)) (*iam.ListPoliciesOutput, error)
	GetPolicyVersion(ctx context.Context, params *iam.GetPolicyVersionInput, optFns ...func(*iam.Options)) (*iam.GetPolicyVersionOutput, error)
}

IAMAPI defines the IAM operations used by the scanners.

type PolicyDocument

type PolicyDocument struct {
	Version   string            `json:"Version"`
	Statement []PolicyStatement `json:"Statement"`
}

PolicyDocument represents an AWS IAM policy document.

func ParsePolicyDocument

func ParsePolicyDocument(encoded string) (*PolicyDocument, error)

ParsePolicyDocument decodes a URL-encoded policy document JSON string.

func (*PolicyDocument) HasWildcardAction

func (d *PolicyDocument) HasWildcardAction() bool

HasWildcardAction checks if any Allow statement has Action "*".

func (*PolicyDocument) HasWildcardResource

func (d *PolicyDocument) HasWildcardResource() bool

HasWildcardResource checks if any Allow statement has Resource "*".

type PolicyScanner

type PolicyScanner struct {
	// contains filtered or unexported fields
}

PolicyScanner detects unattached and wildcard IAM policies.

func NewPolicyScanner

func NewPolicyScanner(client IAMAPI) *PolicyScanner

NewPolicyScanner creates a scanner for IAM policies.

func (*PolicyScanner) Scan

func (s *PolicyScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)

Scan examines customer-managed IAM policies for issues.

func (*PolicyScanner) Type

func (s *PolicyScanner) Type() iam.ResourceType

Type returns the resource type this scanner handles.

type PolicyStatement

type PolicyStatement struct {
	Sid       string        `json:"Sid,omitempty"`
	Effect    string        `json:"Effect"`
	Action    StringOrSlice `json:"Action"`
	Resource  StringOrSlice `json:"Resource"`
	Principal *Principal    `json:"Principal,omitempty"`
	Condition any           `json:"Condition,omitempty"`
}

PolicyStatement represents a single statement in a policy document.

type Principal

type Principal struct {
	Wildcard  bool
	AWS       StringOrSlice
	Service   StringOrSlice
	Federated StringOrSlice
}

Principal represents the Principal field in a policy statement. It can be "*" (wildcard), or a map of principal types to values.

func (*Principal) UnmarshalJSON

func (p *Principal) UnmarshalJSON(data []byte) error

UnmarshalJSON implements custom unmarshaling for Principal.

type RoleScanner

type RoleScanner struct {
	// contains filtered or unexported fields
}

RoleScanner detects unused roles and cross-account trust issues.

func NewRoleScanner

func NewRoleScanner(client IAMAPI, accountID string) *RoleScanner

NewRoleScanner creates a scanner for IAM roles.

func (*RoleScanner) Scan

func (s *RoleScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)

Scan examines all IAM roles for unused and cross-account trust issues.

func (*RoleScanner) Type

func (s *RoleScanner) Type() iam.ResourceType

Type returns the resource type this scanner handles.

type STSAPI

type STSAPI interface {
	GetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.Options)) (*sts.GetCallerIdentityOutput, error)
}

STSAPI defines the STS operations used by the client.

type StringOrSlice

type StringOrSlice []string

StringOrSlice handles AWS policy fields that can be a single string or an array.

func (StringOrSlice) Contains

func (s StringOrSlice) Contains(val string) bool

Contains checks if the slice contains a specific string.

func (*StringOrSlice) UnmarshalJSON

func (s *StringOrSlice) UnmarshalJSON(data []byte) error

UnmarshalJSON implements custom unmarshaling for StringOrSlice.

type UserScanner

type UserScanner struct {
	// contains filtered or unexported fields
}

UserScanner detects stale users, stale access keys, and users without MFA.

func NewUserScanner

func NewUserScanner(entries []CredentialEntry) *UserScanner

NewUserScanner creates a scanner that operates on pre-fetched credential report entries.

func (*UserScanner) Scan

func (s *UserScanner) Scan(_ context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)

Scan examines credential report entries for user-level findings.

func (*UserScanner) Type

func (s *UserScanner) Type() iam.ResourceType

Type returns the resource type this scanner handles.