{"id":24012873,"url":"https://github.com/glassechidna/step-everywhere","last_synced_at":"2026-02-26T05:55:49.740Z","repository":{"id":84300318,"uuid":"227720637","full_name":"glassechidna/step-everywhere","owner":"glassechidna","description":"Run a Lambda function in every account and region across your AWS organisation","archived":false,"fork":false,"pushed_at":"2023-02-14T15:38:10.000Z","size":13,"stargazers_count":3,"open_issues_count":2,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-28T18:11:36.589Z","etag":null,"topics":["aws","golang","lambda","serverless","step-functions"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/glassechidna.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-12-13T00:17:50.000Z","updated_at":"2020-03-29T21:18:06.000Z","dependencies_parsed_at":null,"dependency_job_id":"a4319f23-601a-4487-ad1c-2deaee3b03cc","html_url":"https://github.com/glassechidna/step-everywhere","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glassechidna%2Fstep-everywhere","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glassechidna%2Fstep-everywhere/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glassechidna%2Fstep-everywhere/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glassechidna%2Fstep-everywhere/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/glassechidna","download_url":"https://codeload.github.com/glassechidna/step-everywhere/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249038500,"owners_count":21202720,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","golang","lambda","serverless","step-functions"],"created_at":"2025-01-08T06:22:43.381Z","updated_at":"2026-02-26T05:55:44.718Z","avatar_url":"https://github.com/glassechidna.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `step-everywhere`\n\nDo you ever find yourself wanting to run some code in 10-100s of AWS accounts \nand regions? Maybe even stick in a Lambda function, but not have to deploy it\n300 times? `step-everywhere` aims to solve that pain point.\n\nYou provide:\n\n* A list of regions \n* The name of a role to assume in each account\n* The name of a Lambda function to execute in each account + region\n* (Optionally) A custom payload to send to the Lambda.\n\nIt uses a combination of Lambda, Step Functions, KMS, STS and S3 to:\n\n* Retrieve temporary credentials in every account\n* Generate presigned S3 URLs for storing results\n* Encrypt those credentials and S3 URLs\n* Pass those credentials and region to your Lambda\n* Your Lambda uploads its results to the presigned URL \n\nAll permutations of (account, region) are run as concurrently as\nStep Functions will permit.\n\n## Usage\n\nStart an execution of the Step Function with the following payload:\n\n```json5\n{\n  /* if not provided, defaults to every AWS region (even those disabled by default!) */\n  \"Regions\": [\"ap-southeast-2\", \"us-east-1\"],\n  \n  /* name of role available to be assumed in every account in your org (see security\n     section below) */\n  \"RoleName\": \"OrganizationAccountAccessRole\",\n\n  /* ARN of the \"worker\" lambda function that will get invoked for every permutation */\n  \"Function\": \"arn:aws:lambda:ap-southeast-2:607481581596:function:StepEverywhere_example\",\n \n  /* optionally you can provide a payload to be sent to every lambda invocation of your lambda */\n  \"Payload\": [\n    {\n      \"Key\": \"Name\", \n      \"Option\": \"Contains\", \n      \"Values\": [\"Zen\"]\n    }\n  ]\n}\n```\n\nBy default, output from each invocation will be stored in S3 at the path\n`s3://bucket/StepEverywhere/{{ .Function }}/{{ .FunctionQualifier }}/{{ .ExecutionId }}/{{ .AccountId }}/{{ .Region }}.json`\nwhere the placeholders are resolved to:\n\n* `Function`: the name of your Lambda worker function\n* `FunctionQualifier`: either `$LATEST` or the specific version/alias specified \n   in your input's Function ARN.\n* `ExecutionId`: the unique ID (typically a GUID) of the execution of the Step Function\n* `AccountId`: numeric AWS account ID\n* `Region`: region code, e.g. `us-east-1`\n\n## Security considerations\n\nYou're running arbitrary code in every AWS account you own! That's inherently a \nrisky proposition, but that doesn't mean we can't put *some* guard-rails around\nthis.\n\na) Encrypting temporary credentials using KMS. Standard workflow Step Functions\npersist input and output from each stage during execution and for 90 days afterwards.\nIf these credentials *weren't* encrypted, anyone with even read-only access to the\nStep Function could view and use the credentials for themselves.\n\nb) Fine-grained KMS key policy. If you use the KMS key resource in the CloudFormation\ntemplate (rather that providing your own key ID), the ability to decrypt the\ncredentials is restricted to only the role of Lambda that should rightfully have \naccess. This means that even if a human with `kms:Decrypt` on `*` privileges\ntries to decrypt the ciphertext, it will be denied.\n\nc) Only Lambda functions with a `StepEverywhere_` prefix in their name can be\nspecified as the \"worker\" function. This prevents you from being able to specify\n*completely* arbitrary Lambdas as worker functions, as things could implode if\na Lambda receives unexpected credentials.\n\nd) The role assumed in each account must have a `stepeverywhere:assumable: true`\ntag on it. This means that users cannot specify IAM roles that 1) trust the\nsource account in their trust policy but b) the administrators did not intend\nto be used by `step-everywhere`.\n\n## TODO\n\n* Only assume role once per account and share for each region (maybe)\n* Try-catch around worker so that a single failure doesn't cause others to abort\n* Lambda layers to hold helpers for nodejs and python\n* Golang package niceties\n* An example of how to parse using Athena (maybe)\n* CI/CD for publishing to the public Serverless App Repository\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglassechidna%2Fstep-everywhere","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fglassechidna%2Fstep-everywhere","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglassechidna%2Fstep-everywhere/lists"}