{"id":13541779,"url":"https://github.com/andresriancho/enumerate-iam","last_synced_at":"2025-10-04T19:05:36.078Z","repository":{"id":40313575,"uuid":"186037170","full_name":"andresriancho/enumerate-iam","owner":"andresriancho","description":"Enumerate the permissions associated with AWS credential set","archived":false,"fork":false,"pushed_at":"2024-02-05T20:53:34.000Z","size":52,"stargazers_count":1151,"open_issues_count":17,"forks_count":179,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-05-15T09:38:24.291Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andresriancho.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-10T18:32:35.000Z","updated_at":"2025-05-11T14:22:21.000Z","dependencies_parsed_at":"2023-10-20T17:10:39.388Z","dependency_job_id":"3ce2de15-d129-4974-acfd-b5cc259695cc","html_url":"https://github.com/andresriancho/enumerate-iam","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fenumerate-iam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fenumerate-iam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fenumerate-iam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fenumerate-iam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andresriancho","download_url":"https://codeload.github.com/andresriancho/enumerate-iam/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254355335,"owners_count":22057354,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T10:00:57.003Z","updated_at":"2025-10-04T19:05:31.003Z","avatar_url":"https://github.com/andresriancho.png","language":"Python","funding_links":[],"categories":["AWS Security","Projects","Python","Other Awesome Lists","0x02 工具 :hammer_and_wrench:","Offensive (ATT\u0026CK tactics)","AWS"],"sub_categories":["IAM","Identity and Access Management","Offensive Security","1 云服务工具","⬆️ Privilege Escalation"],"readme":"## Enumerate IAM permissions\n\nFound a set of AWS credentials and have no idea which permissions it might have?\n\n```console\n$ ./enumerate-iam.py --access-key AKIA... --secret-key StF0q...\n2019-05-10 15:57:58,447 - 21345 - [INFO] Starting permission enumeration for access-key-id \"AKIA...\"\n2019-05-10 15:58:01,532 - 21345 - [INFO] Run for the hills, get_account_authorization_details worked!\n2019-05-10 15:58:01,537 - 21345 - [INFO] -- {\n    \"RoleDetailList\": [\n        {\n            \"Tags\": [], \n            \"AssumeRolePolicyDocument\": {\n                \"Version\": \"2008-10-17\", \n                \"Statement\": [\n                    {\n...\n2019-05-10 15:58:26,709 - 21345 - [INFO] -- gamelift.list_builds() worked!\n2019-05-10 15:58:26,850 - 21345 - [INFO] -- cloudformation.list_stack_sets() worked!\n2019-05-10 15:58:26,982 - 21345 - [INFO] -- directconnect.describe_locations() worked!\n2019-05-10 15:58:27,021 - 21345 - [INFO] -- gamelift.describe_matchmaking_rule_sets() worked!\n2019-05-10 15:58:27,311 - 21345 - [INFO] -- sqs.list_queues() worked!\n```\n\nNow you do!\n\n`enumerate-iam.py` tries to brute force all API calls allowed by the IAM policy.\nThe calls performed by this tool are all non-destructive (only get* and list*\ncalls are performed).\n\n## Installation\n\n```\ngit clone git@github.com:andresriancho/enumerate-iam.git\ncd enumerate-iam/\npip install -r requirements.txt\n```\n\n## Library\n\nThis software was written to be easy to integrate with other tools, just import\nthe main function and provide the required arguments:\n\n```python\nfrom enumerate_iam.main import enumerate_iam\n\nenumerate_iam(access_key,\n              secret_key,\n              session_token,\n              region)\n```\n\nThe output will contain all the enumerated permission information in a python\ndictionary.\n\n## Other tools\n\nBefore writing `enumerate-iam.py` I tried a few that performed the same task.\nDecided to write my own because the others:\n\n * Did not check for all API calls\n * Where painfully slow when adding more API calls to the list\n * Did not return the permissions in a programmatic way\n\n## Updating the API calls\n\nThe API calls to be performed during permission enumeration are stored in\n`enumerate_iam/bruteforce_tests.py`, a Python dict() which is generated by\n`enumerate_iam/generate_bruteforce_tests.py` using the API documentation\navailable in the `aws-sdk-js` library. \n\nAWS releases new services every quarter, to make sure that this tool is\nfinding all the existing permissions run:\n\n```console\ncd enumerate_iam/\ngit clone https://github.com/aws/aws-sdk-js.git\npython generate_bruteforce_tests.py\nrm -rf aws-sdk-js\n```\n\n## Related tools\n\nThis tool was released as part of the [Internet-Scale Analysis of AWS Cognito Security](https://www.blackhat.com/us-19/briefings/schedule/?hootPostID=4abc475398765919352042ac015752e6#internet-scale-analysis-of-aws-cognito-security-15829)\nresearch. During this research the [cc-lambda](https://github.com/andresriancho/cc-lambda) tool\nwas also used to extract information from the Common Crawl data.\n\n## Initial code\n\nThe initial code was released in [this gist](https://gist.github.com/darkarnium/1df59865f503355ef30672168063da4e)\nand improved in multiple ways:\n\n * Complete refactoring\n * Results returned in a programmatic way\n * Threads\n * Improved logging\n * Increased API call coverage\n * Export as a library\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandresriancho%2Fenumerate-iam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandresriancho%2Fenumerate-iam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandresriancho%2Fenumerate-iam/lists"}