{"id":18792857,"url":"https://github.com/deekayen/ansible-role-iam_access_simulation","last_synced_at":"2025-12-28T14:30:16.705Z","repository":{"id":138909113,"uuid":"305798155","full_name":"deekayen/ansible-role-iam_access_simulation","owner":"deekayen","description":"Simulate the access of IAM users and roles performing various IAM actions against any ARN. Get a list of which users and roles have access.","archived":false,"fork":false,"pushed_at":"2024-01-29T15:48:37.000Z","size":58,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-12-29T15:30:31.023Z","etag":null,"topics":["ansible-role","aws-cli","iam-actions","simulation"],"latest_commit_sha":null,"homepage":"https://galaxy.ansible.com/ui/standalone/roles/deekayen/iam_access_simulation/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/deekayen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"deekayen","ko_fi":"deekayen","liberapay":"deekayen","custom":["paypal.me/deekayen","venmo.com/drdnorman","buymeacoff.ee/deekayen"]}},"created_at":"2020-10-20T18:24:57.000Z","updated_at":"2024-01-29T15:38:12.000Z","dependencies_parsed_at":"2024-01-29T17:45:04.849Z","dependency_job_id":null,"html_url":"https://github.com/deekayen/ansible-role-iam_access_simulation","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deekayen%2Fansible-role-iam_access_simulation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deekayen%2Fansible-role-iam_access_simulation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deekayen%2Fansible-role-iam_access_simulation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deekayen%2Fansible-role-iam_access_simulation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/deekayen","download_url":"https://codeload.github.com/deekayen/ansible-role-iam_access_simulation/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239718375,"owners_count":19685725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible-role","aws-cli","iam-actions","simulation"],"created_at":"2024-11-07T21:22:07.078Z","updated_at":"2025-12-28T14:30:16.649Z","avatar_url":"https://github.com/deekayen.png","language":null,"funding_links":["https://github.com/sponsors/deekayen","https://ko-fi.com/deekayen","https://liberapay.com/deekayen","paypal.me/deekayen","venmo.com/drdnorman","buymeacoff.ee/deekayen"],"categories":[],"sub_categories":[],"readme":"AWS IAM Access Simulation\n=========================\n\n[![CI](https://github.com/deekayen/ansible-role-iam_access_simulation/actions/workflows/ci.yml/badge.svg)](https://github.com/deekayen/ansible-role-iam_access_simulation/actions/workflows/ci.yml)\n\nSimulate the access of IAM users and roles performing various IAM actions against any ARN. This tells you which users and roles have access to your S3 buckets or KMS keys when the auditors ask.\n\nThis will gather all the users and roles in your AWS account, then test the provided actions against ARNs that you will define in the `resources_to_test` variable. If you'd like to test only users OR roles, then you can omit the one you don't need using the `user` or `role` tag assigned to the tasks for filtering.\n\nTest access of IAM users and roles using the [AWS CLI simulate principal policy](https://docs.aws.amazon.com/cli/latest/reference/iam/simulate-principal-policy.html) feature.\n\n```shell\naws iam simulate-principal-policy \\\n  --policy-source-arn \u003cuser/role arn\u003e \\\n  --resource-arns \u003cresource arn\u003e \\\n  --action-names \u003caction\u003e\n```\n\nRole Variables\n--------------\n\n```yaml\nresources_to_test: []\n```\n\nExample Playbook\n----------------\n\n```yaml\n---\n\n- hosts: localhost\n  connection: local\n  gather_facts: no\n\n  vars:\n    resources_to_test:\n      - action: s3:GetObject\n        resource: arn:aws:s3:::deekayen-123456789000-secret-bucket\n      - action: kms:Decrypt\n        resource: arn:aws:kms:us-east-1:123456789000:key/1234abab-1e2c-3a4b-9ba8-1234567890ab\n\n  roles:\n    - deekayen.iam_access_simulation\n```\n\nThe results of the simulation are printed to the console at the end of the playbook run.\n\n```shell\nTASK [iam_access_simulation : Print similation results.] **********************\nok: [localhost] =\u003e {\n    \"msg\": [\n        \"User deekayen allowed to s3:GetObject on arn:aws:s3:::deekayen-123456789000-secret-bucket\",\n        \"Role ec2-instances allowed to s3:GetObject on arn:aws:s3:::deekayen-123456789000-secret-bucket\",\n        \"User deekayen allowed to kms:Decrypt on arn:aws:kms:us-east-1:123456789000:key/1234abab-1e2c-3a4b-9ba8-1234567890ab\",\n        \"Role ec2-instances allowed to kms:Decrypt on arn:aws:kms:us-east-1:123456789000:key/1234abab-1e2c-3a4b-9ba8-1234567890ab\"\n    ]\n}\n[\n\nPLAY RECAP *********************************************************************\nlocalhost                  : ok=327  changed=0    unreachable=0    failed=0    skipped=324  rescued=0    ignored=0\n\nPlaybook run took 0 days, 0 hours, 3 minutes, 14 seconds\n```\n\nRequirements\n------------\n\nThe control machine needs boto and AWS CLI.\n\nDependencies\n------------\n\n```yaml\ncollections:\n  - amazon.aws\n  - community.general\n```\n\nLicense\n-------\n\nBSD-3-Clause\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeekayen%2Fansible-role-iam_access_simulation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeekayen%2Fansible-role-iam_access_simulation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeekayen%2Fansible-role-iam_access_simulation/lists"}