{"id":18524549,"url":"https://github.com/stelligent/cfn-leaprog","last_synced_at":"2025-04-09T12:30:55.190Z","repository":{"id":43008815,"uuid":"254464326","full_name":"stelligent/cfn-leaprog","owner":"stelligent","description":"cfn-LEAst-Privilege-ROle-Generator: Experimental tool for generating least privileged IAM roles for CloudFormation and Service Catalog Launch Constraints.","archived":false,"fork":false,"pushed_at":"2022-03-23T15:38:05.000Z","size":52,"stargazers_count":40,"open_issues_count":4,"forks_count":6,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-24T05:27:13.285Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stelligent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-09T19:47:59.000Z","updated_at":"2023-10-31T16:57:36.000Z","dependencies_parsed_at":"2022-09-09T13:52:03.841Z","dependency_job_id":null,"html_url":"https://github.com/stelligent/cfn-leaprog","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fcfn-leaprog","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fcfn-leaprog/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fcfn-leaprog/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fcfn-leaprog/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stelligent","download_url":"https://codeload.github.com/stelligent/cfn-leaprog/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248040088,"owners_count":21037813,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T17:42:23.433Z","updated_at":"2025-04-09T12:30:52.952Z","avatar_url":"https://github.com/stelligent.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Background\nThis tool is an experimental approach to generating least privileged IAM roles \nfor CloudFormation and Service Catalog Launch Constraints.\n\nThe sourcebase contains two approaches.  \n\nThis doc describes how to execute the CloudTrail event filtering approach.\n\nThe other approach involves scraping CloudFormation stack events.  It is NOT recommended\nbut is kept here for historical reference.\n\n## Setup the Infrastructure\n\nMake sure your environment has default AWS credentials that can setup\nCloudTrail, CloudWatch and DynamoDB.\n\nMake sure you have a recent Ruby installed.  2.6 was used for development.\n\n```\nbundle install\nrake ct:infra\n```\n\n### Converge a CloudFormation Template\n\nFirst select a CloudFormation template that you want to generate the least privileged \npolicy/role for.  The `spec/test_templates/DynamoDB_Table.template` is a simple one \nto start with.  \n\nEdit the parameter values in `spec/test_templates/parameters/ddb.json` to your liking.\n\nThen execute the rake task to converge the template:\n```\nrake ct:create_stack[spec/test_templates/DynamoDB_Table.template,spec/test_templates/parameters/ddb.json]\n```\n\nThe rake task will emit an IAM role ARN to stdout.  Copy this text for the next step.\n\n### Generate the Policy\nWait a number of minutes for CloudTrail to catch up - usually 5-15 minutes.\n\n```\nrake ct:policy[arn:aws:iam::11111111111:role/cfn-leaprog-1586791962]\n```\n\n### Teardown\nOptionally tear down all the CloudTrail and CloudWatch Logs and Lambda infrastructure\nto save on costs when not in use.  It only takes a matter of a minute to spin up again....\n\n```\nrake ct:teardown_infra\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Fcfn-leaprog","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstelligent%2Fcfn-leaprog","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Fcfn-leaprog/lists"}