orcasecurity / orca-toolbox Goto Github PK

Running python version 3.11.2
windows 10
iam-ape version (latest from install)

running into issue when launching terminal as admin and running:

iam-ape --update

I keep getting:
PermissionError: [Errno 13] Permission denied: 'C:\Users\XXX\AppData\Local\Temp\tmp8u32qw9q'

IAM-APE returns an empty answer when trying to feed it a policy that is structured as an Allowlist with a Deny and NotAction combination. Example can be found here in AWS documentation.

When I run it with an ARN of my role that has Admin permissions and with -s switch it produces empty output:
`
Effective permissions policy for arn:aws:iam::12312312312:role/path/rolename

{
"Statement": []
}
`

Expectations is that it would evaluate the SCP correctly and provide the effective permissions

AWS creates roles with forward-slashes in the resource name part (eg. role/aws-reserved/sso.amazonaws.com/xxx, role/service-role/xxx),
and the current regexp will mark them as invalid.

Currently its only possible to pass 1 SCP file with the -s option. In many organizations an AWS account will have multiple SCPs attached. I would like to have the possibliity to pass multiple policy files to evaluate against.

I have an error when I run the command: iam-ape --arn arn:aws:iam::069560771595:role/account-creation-foundation

ERROR: Failed to load AWS IAM Actions due to file could not be opened successfully
File "c:\users\jhonnatan.costa\anaconda3\lib\site-packages\iam_ape\expand_policy.py", line 153, in expand_action
for action in self.all_iam_actions[service].keys():
KeyError: 'servicecatalog'

hi,
I'm trying to run this against the policy file downloaded using get get-account-authorisation-details, but it seems it doesn't consider SCP policies. Do we have to download the SCPp policies separately? Not sure if it is reflected in the document.

Thanks,
A.

Hi.
it would be great if this tool could be delivered as a Docker image to save dependency issues:

ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
awscli 1.32.59 requires botocore==1.34.59, but you have botocore 1.34.95 which is incompatible.