iamspectre

README

iamspectre

iamspectre — Cross-cloud IAM auditor for AWS, GCP, and Azure AD. Part of SpectreHub.

What it is

• Scans IAM resources across AWS, GCP, and Azure AD
• Detects stale users, unused roles, wildcard policies, missing MFA, and expired secrets
• Checks credential reports, key ages, service account bindings, and directory roles
• Each finding includes severity and actionable recommendation
• Outputs text, JSON, SARIF, and SpectreHub formats

What it is NOT

• Not a remediation tool — reports only, never modifies IAM resources
• Not a real-time monitor — point-in-time scanner
• Not a cost estimator — IAM findings are security risks, not dollar waste
• Not a CSPM replacement — focuses on identity and access only

Quick start

Homebrew

brew tap ppiankov/tap
brew install iamspectre

Windows

Download the latest Windows .zip from GitHub Releases, extract iamspectre.exe, and add its folder to PATH or run it in place.

.\iamspectre.exe scan --provider aws --format json

AWS and Azure credentials resolve through the official SDK default credential chains from standard Windows locations (%USERPROFILE%\.aws\ and az login), so no extra configuration is needed.

From source

git clone https://github.com/ppiankov/iamspectre.git
cd iamspectre
make build

Usage

iamspectre scan --provider aws --format json

CLI commands

Command	Description
iamspectre scan	Scan IAM resources across cloud providers
iamspectre init	Generate config file and IAM permissions
iamspectre version	Print version

SpectreHub integration

iamspectre feeds IAM hygiene findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool iamspectre

Safety

iamspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your IAM resources.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs