trek10inc / config-excess-access-exorcism Goto Github PK
View Code? Open in Web Editor NEWAn AWS config rule that uses IAM Access Advisor to find over-permissioned IAM users, groups, and roles.
License: MIT License
An AWS config rule that uses IAM Access Advisor to find over-permissioned IAM users, groups, and roles.
License: MIT License
Hello,
First of all Strong Work on this. It really fits my needs.
When attempting to deploy with
rdk -r us-east-1 deploy IAM_ALLOWS_UNUSED_SERVICES
I got this:
Running deploy!
Found Custom Rule.
Zipping IAM_ALLOWS_UNUSED_SERVICES
Uploading IAM_ALLOWS_UNUSED_SERVICES
Traceback (most recent call last):
File "/usr/local/bin/rdk", line 20, in
return_val = my_rdk.process_command()
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 227, in process_command
exit_code = method_to_call()
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 904, in deploy
s3_dst = self.__upload_function_code(rule_name, rule_params, account_id, my_session, code_bucket_name)
File "/usr/local/lib/python2.7/dist-packages/rdk/rdk.py", line 2029, in __upload_function_code
my_s3.meta.client.upload_file(s3_src, code_bucket_name, s3_dst)
File "/usr/local/lib/python2.7/dist-packages/boto3/s3/inject.py", line 131, in upload_file
extra_args=ExtraArgs, callback=Callback)
File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 287, in upload_file
filename, '/'.join([bucket, key]), e))
boto3.exceptions.S3UploadFailedError: Failed to upload /home/me/Gits/config-excess-access-exorcism/IAM_ALLOWS_UNUSED_SERVICES/IAM_ALLOWS_UNUSED_SERVICES.zip to config-rule-code-bucket-xxxxxxxxxxxx-us-east-2/IAM_ALLOWS_UNUSED_SERVICES/IAM_ALLOWS_UNUSED_SERVICES.zip: An error occurred (NoSuchBucket) when calling the CreateMultipartUpload operation: The specified bucket does not exist
After manually creating the bucket the deploy works. The role I assumed to run the command has permissions to create a bucket in the account
After deploying, the Lambda generated errors. I'm sorry I did not save any of the errors but they all refereed to the module 'redo' not being present.
I reran the following command appending it with redo:
pip install -t IAM_ALLOWS_UNUSED_SERVICES/ boto3 pytz redo
When I redeployed it worked.
This is really strong work. I have a suggestion to make the results cleaner. I'd like to have the ability to tag an IAM resource so that it is not evaluated for compliance. There are resources that we KNOW will be non-compliant and that we don't want to see in the list.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.