{"id":18524559,"url":"https://github.com/stelligent/aws_group_policy","last_synced_at":"2026-03-05T08:30:58.458Z","repository":{"id":19604389,"uuid":"22855348","full_name":"stelligent/aws_group_policy","owner":"stelligent","description":"templates for creating a full privilege group and a read only group, as well as a script for moving non-mfa'd users from the privileged group to the read only group","archived":false,"fork":false,"pushed_at":"2020-01-07T21:23:40.000Z","size":16,"stargazers_count":6,"open_issues_count":1,"forks_count":3,"subscribers_count":81,"default_branch":"master","last_synced_at":"2026-02-02T08:14:02.547Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"ralphbean/bugwarrior","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stelligent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-08-11T21:23:00.000Z","updated_at":"2020-01-07T21:23:42.000Z","dependencies_parsed_at":"2022-07-12T15:17:22.088Z","dependency_job_id":null,"html_url":"https://github.com/stelligent/aws_group_policy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stelligent/aws_group_policy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws_group_policy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws_group_policy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws_group_policy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws_group_policy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stelligent","download_url":"https://codeload.github.com/stelligent/aws_group_policy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws_group_policy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30115910,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T08:19:04.902Z","status":"ssl_error","status_checked_at":"2026-03-05T08:17:37.148Z","response_time":93,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T17:42:27.199Z","updated_at":"2026-03-05T08:30:58.377Z","avatar_url":"https://github.com/stelligent.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws_group_policy\n\nThis repo contains CloudFormation templates and Ruby scripts to help manage your AWS IAM users.\n\n###description\n=============\nAn AWS IAM best practice is to require users to have multi-factor authentication devices attached to their accounts. Unfortunately, the default read-only policy doesn't allow users to attach an MFA to their account, and it's somewhat unclear what exact permissions are required to do so. \n\nSo what ends up happening is in your quest to have secure account access, you give your users overly-broad permissions, and then that account is only password protected. \n\nThis repo gives you the tools to avoid this anti-pattern. It contains two CloudFormation templates for creating IAM groups, and then a Ruby script that will check each user's MFA status and put them in the appopriate group.\n\n###contents\n========\n* **[conf/full_privilege_group.json](https://github.com/stelligent/aws_group_policy/blob/master/conf/full_privilege_group.json)** -- this CloudFormation template creates an IAM Group with full admin privileges. \n* **[conf/kickoff.json](https://github.com/stelligent/aws_group_policy/blob/master/conf/kickoff.json)** -- this CloudFormation template creates a read-only IAM group, a full admin IAM group, and an IAM user that is a member of the read-only group. This is used for new customers to get initial access to their AWS account in a secure manner.\n* **[conf/read_only_group.json](https://github.com/stelligent/aws_group_policy/blob/master/conf/read_only_group.json)** -- this CloudFormation template creates an IAM group with read-only access, but also the ability to create and attach an MFA to their IAM account.\n* **[conf/user.json](https://github.com/stelligent/aws_group_policy/blob/master/conf/user.json)** -- this isn't required, but is a simple CloudFormation template for creating a user. If you want to use the Cucumber feature, you can use this template to create a user to test with (though you'll still need to download the credentials from the console).\n* **[features/](https://github.com/stelligent/aws_group_policy/tree/master/features)** -- this directory contains a Cucumber test to ensure that the read-only policy is read-only enough, but still allows users to create and attach MFAs. \n* **[bin/check_accounts.rb](https://github.com/stelligent/aws_group_policy/blob/master/bin/check_accounts.rb)** -- this is the Ruby script that puts users into the appropriate group.\n* **[bin/sync_s3.sh](https://github.com/stelligent/aws_group_policy/blob/master/bin/sync_s3.sh)** -- this is a shell script to sync public Stelligent Kickoff Cloudformation templates to the proper location in S3\n\n###usage\n=====\nTo use this script, you'll need to create the two IAM Groups, and then look up their group names. Assign your desired users into either of the groups. Run the script with the names punched in and it'll figure out the rest.\n\nAssuming you have git, the AWS CLI, and Ruby installed...\n\n    git clone https://github.com/stelligent/aws_group_policy.git aws_group_policy\n    cd aws_group_policy\n    aws cloudformation create-stack --stack-name \"readonly-group\" --template-body file://./aws_group_policy/conf/read_only_group.json --capabilities=\"CAPABILITY_IAM\" --region \n    aws cloudformation create-stack --stack-name \"admin-group\" --template-body file://.//conf/full_privilege_group.json --capabilities=\"CAPABILITY_IAM\" \n\nThen go to [the AWS IAM console](https://console.aws.amazon.com/iam) and look up your group names. They'll have some CloudFormation randomness appended to the end. Then, assign your users to either of those accounts. The script will only manipulate users in the specified groups, so if you have users that you want to be left alone (service users, users with specific permissions, etc) just don't put them into either group. \n\nOnce your users are assigned, run this script, substituting the names for your group names:\n\n    ruby bin/check_accounts.rb -r ReadOnlyGroup -f AdminGroup\n\nYou should see output like this:\n\n    read-only user JeanLucPicard has an MFA attached, moving to full-privileged group AdminGroup\n    privileged user WesleyCrusher does not have an MFA attached, moving to read only group ReadOnlyGroup\n\n    \n###running the tests\n====\nIf you want to see the cucumber tests run, you'll need to manually create an IAM user and assign it to the read-only group. (there's a template in /conf that will set this all up for you).  You'll need to log into the console and grab its API keys, though.\n\n    aws cloudformation create-stack --stack-name \"test-read-only-user\" --template-body file://./conf/user.json --capabilities=\"CAPABILITY_IAM\" --parameters ParameterKey=\"group\",ParameterValue=\"ReadOnlyGroup\"\n    export AWS_ACCESS_KEY_ID=ABCDEFGHIJKLMNOPQRSTUVWXYZ\n    export AWS_SECRET_ACCESS_KEY=abcdefghijklmnop1234567890\n    cucumber \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Faws_group_policy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstelligent%2Faws_group_policy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Faws_group_policy/lists"}