o
PgJS @ s d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dl m
Z
d dl m Z d dl
mZ d dlmZ d dlmZ d d lmZ d d
lmZmZ d d lmZmZ d d lmZm Z d
Z ed e G dd deZ ej !dddZ"dd Z#dd Z$dd Z%dd Z&d d Z'e
eG d d d e(Z)G d d! d!e)Z*G d"d# d#e)Z+G d$d% d%e)Z,G d&d' d'e)Z-G d(d) d)e-Z.G d*d+ d+e-Z/d,d- Z0d.d/ Z1d0d Z2d1d2 Z3dS )3 )print_functionN)ABCMeta)
add_metaclass)Template)Enum)CRITICAL) getLogger)Policy)parse_arguments get_regions) query_awsget_parameter_file)AccountRegionCreate IAM reportpolicyuniversec @ s e Zd ZdZdZdS ) OutputFormatjsonhtmlN)__name__
__module__ __qualname__r r r r 5/var/www/html/post/cloudmapper/commands/iam_report.pyr s r web account-data
iam_reportc C s | S Nr )sr r r tolink s r c C s g } t tjdt}|d d}|d |D ]u}|d}i d|d d|d d |d
d |d d
|d d|d d|d d|d d|d d|d d|d d|d d |d d |d d!|d" d#|d$ d%|d& |d' |d( |d) |d* |d+ d,}| j| q| S )-Nziam-get-credential-reportContent
r ,userarn user_creation_time password_enabled password_last_used password_last_changed password_next_rotation
mfa_active access_key_1_active access_key_1_last_rotated access_key_1_last_used_date
access_key_1_last_used_region access_key_1_last_used_service access_key_2_active
access_key_2_last_rotated access_key_2_last_used_date access_key_2_last_used_region ) access_key_2_last_used_service
cert_1_activecert_1_last_rotated
cert_2_activecert_2_last_rotated)r regionaccountsplitpopappend)users json_blob csv_lineslinepartsr# r r r load_credential_report# sb
rX c C s g |d |d D ]a}i }||d< t | dd|d d }t | dd|}||d < d
|d < tj|d d
d d}|d D ]'} d| v rdtj| d d
d d}
||
j| d< | d |jk rdd|d < nq=|||d < q
d S )NUserDetailListRoleDetailListauthiamz&generate-service-last-accessed-detailsArnJobIdz!get-service-last-accessed-details last_accessT is_inactiveJobCompletionDater r7 %Y-%m-%dServicesLastAccessedLastAuthenticateddays_since_last_useF)r
datetimestrptimedaysmax_age) rN principal_statsjson_account_auth_detailsargsprincipal_authstatsjob_idjson_last_access_detailsjob_completion_dateservicelast_access_dater r r get_access_advisorQ sJ rt c C s8 d}d}| D ]}|d7 }|d dkr|d7 }q||dS )Nr r% TotalAuthenticatedEntities)
service_countservice_used_countr )service_last_accessedrv rw service_last_accessr r r get_service_count_and_usedx s
rz c C s d| }d ||||| S )N serviceChartz)format) principal
services_usedservices_grantedchartidr r r html_service_chart s r c @ s e Zd ZdZdZdZdZdd Zdd Zdd Z d d
Z
d d Z d
d Z dd Z
dd Zdd Zdd Zdd Zdd Zdd ZdS )
graph_node Nc C s d| | | di}|S )Ndata)idnametype)keyr get_type)selfresponser r r cytoscape_data s zgraph_node.cytoscape_datac C | j S r _graph_node__keyr r r r r zgraph_node.keyc C
|| _ d S r r )r r r r r set_key
zgraph_node.set_keyc C r r )_graph_node__name)r r r r r set_name r zgraph_node.set_namec C s | j dkr | S | j S )Nr )r r r r r r r s
zgraph_node.namec C d S r r r r r r is_principal zgraph_node.is_principalc C r r r r r r r r r zgraph_node.get_typec C | j | d S r )_graph_node__childrenrR r noder r r add_child zgraph_node.add_childc C r r )_graph_node__parentsrR r r r r
add_parent r zgraph_node.add_parentc C r r )r r r r r children r zgraph_node.childrenc C r r )r r r r r parents r zgraph_node.parentsc C s| i }| D ]5}| D ],\}}||g }| r |}ng }|D ]
}|d| | q#|| |||< qq|S )Nz{}.{}) r get_services_alloweditemsgetr rR r| r extend)r serviceschildrr source source_list source_pathr r r r r s
z graph_node.get_services_allowedc C s g | _ g | _d S r )r r r r r r __init__ s
zgraph_node.__init__)r r r r r r r r r r r r r r r r r r r r r r r r r s$ r c s0 e Zd ZdZdd Zdd Z fddZ ZS ) user_nodeNc C dS NTr r r r r r r zuser_node.is_principalc C r )Nr# r r r r r r r zuser_node.get_typec s t | |d | |d || _|d D ]}||d }| | || q|dg D ]
}t| |}||| < q3|dg D ] }| dd d |d
| }|| }|| | | qGd S ) Nr] UserNameAttachedManagedPolicies PolicyArnUserPolicyList GroupListr groupPath)
superr r r _user_node__authr r r inline_policy_noder )r r[
auth_graphpolicy policy_node
group_name group_key
group_node __class__r r r s"
zuser_node.__init__)r r r r r r r
__classcell__r r r r r s
r c , e Zd Zdd Zdd Z fddZ ZS ) role_nodec C r r r r r r r r r zrole_node.is_principalc C r )Nroler r r r r r r zrole_node.get_typec t | |d | |d |d D ]}||d }| | || q|dg D ]
}t| |}||| < q0d S )Nr] RoleNamer r RolePolicyList r r r r r r r r r r r[ r r r r r r r
zrole_node.__init__r r r r r r r r r r r r r c r )r c C r NFr r r r r r r zgroup_node.is_principalc C r )Nr r r r r r r r zgroup_node.get_typec r )Nr] GroupNamer r GroupPolicyListr r r r r r r zgroup_node.__init__r r r r r r r r c @ s, e Zd Zi ZdZdd Zdd Zdd ZdS )r Nc C r r r r r r r r r zpolicy_node.is_principalc C s. i }| j }|D ] }| g||< q |S r ) _policy_node__policy_summaryaction_summarykeysr )r r r rr r r r r s
z policy_node.get_services_allowedc C s || _ t|| _d S r ) _policy_node__policy_documentr r )r docr r r set_policy_document% s z policy_node.set_policy_document)r r r r r r r r r r r r r s r c $ e Zd Zdd Z fddZ ZS )managed_policy_nodec C r )Nzmanaged policyr r r r r r + r z managed_policy_node.get_typec sN t | |d | |d |d D ]
}|d r$| |d qd S )Nr]
PolicyNamePolicyVersionListIsDefaultVersionDocument)r r r r r )r r[
policy_docr r r r . s
z managed_policy_node.__init__r r r r r r r r r r r * r c r )r c C r )Nz
inline policyr r r r r r 8 r zinline_policy_node.get_typec sX t | | d |d | |d || | | | |d d S )Nz/policy/r PolicyDocument)r r r r r r r )r parentr[ r r r r ; s
zinline_policy_node.__init__r r r r r r 7 r r c C s i }| d D ] }t |||d < |d D ]}|d r%||d |d qq| d D ] }t||||d < q+| d D ] }t||||d < q;| d D ] }t||||d < qK|S ) NPoliciesr] r r r GroupDetailListrY rZ )r r r r r )r[ iam_graphr policy_versionr r# r r r r
get_iam_graphD s r c C s g }| D ] }| | }t | dkst | dkr#|| | q| D ] }| | }| D ]}d| | ddi}|| q0q&|S )Nr r edge)r targetr )lenr r rR r r )r cytoscape_jsonkr r r r r r build_cytoscape_graphY s r c ( C sP i }d}t | dkrtd| }z ttjt W n ty& Y nw t tj
ddd}t | }W d n1 sBw Y i }t
d|}i }td|j |j|d< |j|d < tj d
|d < d |d
< |jrwd|d
< t|D ]} t|| }
|
jdkrt|
jd|
}t|
||| q{g } g } g }
| D ]A\}}d|d v r|d d |d< d|d< |d r|
| q| | q|d d |d< d|d< |d r|
| q| | qtd t |}t |}t tj
ddd d }t j ||d d W d n 1 s
w Y td g |d!< t!| D ]#}t"|| d" d# }|d! ||| d d |d$ |d% d& q g |d'< t!| D ]#}t"|| d" d# }|d' ||| d d |d$ |d% d& qJg |d(< t!|
D ] }d)}|| d dkrd*}|d( |||| d d+ qvg |d,< | D ]M\}}|d rqi }||d-< d|d v rd)|d.< |d d/ |d-< |d d |d0< d|d v rd*|d.< |d d/ |d-< |d d |d0< ||d d/ }|# }tj$|d" d1 d2d3 d
}g |d4< |d" d# D ]H}d5}|%d6d5d5kr(|tj$|d6 d2d3 d
j&}d }|d5ks4|d7kr6d8}|%|d9 d:g} d;
| } |d4 ||d< || d= q |d %d>g } g |d?< |d d/ d2d@ } | D ]} |d? t'| dA | | dB ql|d dC } g |dD< | D ]}!|dD t'|!dE |!dF dB q|d %dGg } | (|d %dHg g |dI< | D ]}!|dI |!dF t j)|!dJ d d dK qd|d v rt j)|d dL d d |dM< |d, | qg |d?< |dN D ]r} t'| d/ | dO dB}"|| d/ }#g |"dP< |#* D ]}$|"dP t'|$+ |$ dB qg |"dD< | dC D ]}!|"dD t'|!dE |!dF dB q,g |"dI< | dQ D ]}!|"dI |!dF t j)|!dJ d d dK qH|d? |" qg |dR< |dS D ][}!t'|!d/ |!dF d dT}dU|!d/ v rdV|dW< ||!d/ }%g |dX< |%* D ]}$|dX t'|$+ |$ dB q|!dY D ]}&|&dZ rt j)|&d[ d d |d\< q|dR | qp|j,t-j.krt d]td }'|'/|j0|d^ W d n 1 sw Y n&|j,t-j kr t d_td }'t ||' W d n 1 sw Y td`t|j,j1 dS )ar Nr% z2This command only works with one account at a time templatesziam_report.htmlrzCreating IAM report for: {} account_name
account_idrb report_generated_timer graphz;
z us-east-1z%iam-get-account-authorization-detailsr r[
short_namer r r` r r# z* Generating IAM graphr r z data.jsonwr+ )indentz#* Generating the rest of the reportrS r_ rc rw rv )r$ r r~ r rolesinactive_principalsz%z)r$ iconr
principalsr$ r r] r ra r r7 r -rd Z badServiceNamespaceunknown; ServiceName)styler last_user r groupsr zgroup/)link_idr r managed_policiesr r r r inline_policiesr )r documentAssumeRolePolicyDocument assume_roler r membersr policiesr )r r managedzarn:aws:iam::aws:policyz3AWS managed policy
r attachmentsr r r r z{}.html)tz{}.jsonzReport written to {}.{})2r ExceptionrQ osmkdirpathdirnameREPORT_OUTPUT_FILEOSErroropenjoinr readr printr| r local_idrf nowstrftime
show_graphr r r rO rt r rR r r r dumpsortedrz r rg r rh r r dumpsr r requested_outputr r writerendervalue)(accountsconfigrl rj rk rO report_templatetemplater region_jsonrN rS r r r} rn r r outfileservice_countsr pprincipal_nodeprivilege_sources report_daterr r r r r
arn_prefixr r
r gr r r versionfr r r r k s
c C sn t }|jdddtd |jddddd |jd
d tjtd d
|jdd t| |\}}}t||| d S )Nz --max-agezSNumber of days a user or role hasn't been used before it's marked dead. Default: 90r )helpdefaultr z--graphz Display a graph. Default: Falser
store_true)r6 destactionz--outputz@Set the output type for the report. [json | html]. Default: htmlr# )r6 r7 r r9 F)r ) argparseArgumentParser add_argumentintr r set_defaultsr
r ) argumentsparserrl r' r( r r r run s. rB )4
__future__r r; r rf os.pathr abcr sixr jinja2r enumr loggingr r policyuniverse.policyr
shared.commonr
r shared.queryr r
shared.nodesr r __description__setLevelr r r r r rX rt rz r objectr r r r r r r r r r rB r r r r sL .'
A