PMapper VS MAMIP

In addition to ScoutSuite, I recommend PMapper. https://github.com/nccgroup/PMapper

There are tons of other escape hatches, so it's a pretty big moving target. If you'd like to get a hint about your setup, I'd suggest trying: https://github.com/nccgroup/PMapper

I maintain an open-source project [1] that uses graphs to model data. I wanted to make my project as accessible as possible, so Graphviz was perfect since it's dead-simple to install and use on all major OS platforms.

[1] https://github.com/nccgroup/PMapper

Hi HN!

Principal Mapper is a tool + library for analyzing and securing your AWS IAM configuration. It generates a model of your account and/or organization and uses it to give you a better idea of the effective permissions of your IAM Users and Roles. It has privilege escalation detection built-in and is hopefully written in a way that will let you extend it for your use-cases.

This v1.1.0 update covers more types of policies (resource policies, permission boundaries, session policies, SCPs), supports AWS Organizations, enables cross-account checks, and more!

https://github.com/nccgroup/PMapper

Happy to answer any questions you have here!

For anyone else who wants to see the role permissions themselves, look here: https://github.com/z0ph/MAMIP/blob/master/policies/AWSSupportServiceRolePolicy

Reverted 22 hours ago: https://github.com/z0ph/MAMIP/commit/b6f696cebc7b9a4f71dd34c...

- https://github.com/z0ph/MAMIP/blob/master/DEPRECATED.json

Saw it referenced at https://github.com/z0ph/MAMIP/commit/acb0ede and Google is failing me.

That page includes an explanation as to why the finding did not result in a deprecation of a managed policy. All other findings from the report not already surfaced and discussed on our documentation page are associated with deleted or deprecated policies (presumably still available in the MAMIP repo, leading to why your work referenced some managed policies that are no longer applicable).