Create a Neo4J graph of users and roles trust policies within an AWS Organization.

Overview

AWS_ORG_MAPPER

This tool uses sso-oidc to authenticate to the AWS organization. Once authenticated the tool will attempt to enumerate all users and roles in the organization and map their trust relations.

The graph can be explored using Neo4j desktop or web client. Below you can find some sample queries that can help extract useful information from the graph.

Using this tool users can discover how role trusts are delegated in the organization and can help identify improve account isolation within the organization. For example, if there exists a role assumption path between two accounts the graph will be able to identify which roles and users are used to connect two accounts.

Requirements

  • Neo4j
  • boto3
  • AWS SSO Account
  • py2neo

How to Use

  1. Install the Python3 requirements with pip3 install -r requirements.txt

  2. Install Neo4j and add the connection details to config.py.

  3. Configure the SSO organization URL in config.py.

  4. Run the tool with python3 mapper.py

If there is no token file stored in the directory the SSO auth flow will start. The instructions and device link will be printed to the console. After auth, the SSO token will be saved to ./token. If you wish to run the tool on a new org make sure to delete the old ./token file.

The tool will attempt to use the first valid role associated with the SSO account. If there is access denied the tool will move the next available role within the account.

Once completed the graph is generated in Neo4j. Using the sample queries below or designed your own by referencing the structure in ## Graph Structure you can begin to extract information about the organization.

Notes

Does not currently support SAML Providers or SAML conditions.

I am currently not planning on implementing an interface for this tool as it serves more as an import tool for neo4j. I will be continuing to implement a better interface for the CLI to give the user more control over the execution.

Example Queries

  • List all Accounts

    MATCH (a:Account) RETURN A

  • List all Roles

    MATCH (r:Role) RETURN R

  • List all users

    MATCH (u:User) RETURN u

  • Count number of cross-account relations

    MATCH p=(A:Account)-[:OWNS]->(x)-[:ASSUMES]->(y)<-[:OWNS]-(B:Account) RETURN COUNT(p)

  • Find all paths between account A and account B

    MATCH p=(A:Account {accountId: "111111111"})-[:OWNS]->(x)-[:ASSUMES]->(y)<-[:OWNS]-(B:Account {accountId: "222222222"}) RETURN p

  • Find all routes from account A to any account

    MATCH p=(A:Account {accountId: "111111111"})-[:OWNS]->(x)-[:ASSUMES]->(y)<-[:OWNS]-(B:Account}) RETURN p

  • Find all roles that trust ":root" of an account.

    MATCH p=(a:Account)-[:ASSUMES]->(:Role) RETURN p

  • Find all roles assumed by a specific service.

    MATCH p=(:Service {Service: "lambda"})-[:ASSUMES]->(r:Role) WHERE r.accountID = "11111111111" RETURN p

Graph Structure

Nodes and Attributes

  • Role

    • Arn
    • RoleId
    • RoleName
    • accountId
  • Account

    • accountId
    • accountName
    • emailAddress
  • User

    • Arn
    • UserName
    • accountId
  • Service

    • Service (lambda.amazonaws.com)

Node Relations

  • Account -[OWNS]->(Role/User)
  • Account -[ASSUMES]-> (Role)
  • Role -[ASSUMES]-> (Role)
  • User -[ASSUMES]-> (Role)
  • Service -[ASSUMES]-> (Role)

Acknowledgment

Thanks to Christophe Tafani-Dereeper for the sso device auth code. Their code can be found here.

https://github.com/christophetd/aws-sso-device-code-authentication

Owner
Ruse
Ruse
Web3 Ethereum DeFi toolkit for smart contracts, Uniswap and PancakeSwap trades, Ethereum JSON-RPC utilities, wallets and automated test suites.

Web3 Ethereum Defi This project contains common Ethereum smart contracts and utilities, for trading, wallets,automated test suites and backend integra

Trading Strategy 222 Jan 04, 2023
A WhatsApp Crashing Tool for Termux

CrashW A WhatsApp Crashing Tool For Termux Users Installing : apt update && apt upgrade -y pkg install python3 pkg install git git clone git://gith

Gokul Mahato 20 Dec 27, 2022
Slack->DynamDB->Some applications

slack-event-subscriptions About The Project Do you want to get simple attendance checks? If you are using Slack, participants can just react on a spec

UpstageAI 26 May 28, 2022
Instagram boosting

instagram boosting bot This bot can boost your instagram account! Rules and Instruction Use git clone to download this repository Open cmd/terminal an

Eskimo 4 Oct 20, 2022
NFTs Upload to OpenSea CuseEdition

NFTs-Upload-to-OpenSea-CuseEdition YOUTUBE VIDEO - Soon... Download Python and

Lil Cuse 2 Jan 04, 2022
Python library for the eWarehousing Solutions API.

eWarehousing Solutions Python Library This library provides convenient access to the eWarehousing Solutions API from applications written in the Pytho

eWarehousing Solutions 2 Nov 09, 2022
I-Spy is a discord and twitter bot 🤖 that keeps a check on usage foul language, hate-speech and NSFW contents

I-Spy is a discord and twitter bot 🤖 that keeps a check on usage foul language, hate-speech and NSFW contents. It is the one stop solution to monitor your discord servers and twitter handles against

Tia Saxena 5 Nov 16, 2022
An API wrapper for Discord written in Python.

HCord A fork of discord.py project. HCord is a modern, easy to use, feature-rich, and async ready API wrapper for Discord written in Python. Key Featu

HCord 0 Jul 30, 2022
Matrix trivia bot with python

Matrix-trivia-bot Getting started See SETUP.md for how to setup and run the template project. Project structure A reference of each file included in t

1 Nov 16, 2021
Desktop Backup Client for Borg

Vorta Backup Client Vorta is a backup client for macOS and Linux desktops. It integrates the mighty BorgBackup with your desktop environment to protec

BorgBase.com 1.5k Jan 03, 2023
Stackoverflow Telegram Bot With Python

Template for Telegram Bot Template to create a telegram bot in python. How to Run Set your telegram bot token as environment variable TELEGRAM_BOT_TOK

PyTopia 10 Mar 07, 2022
Notion4ever - Python tool for export all your content of Notion page using official Notion API

NOTION4EVER Notion4ever is a small python tool that allows you to free your cont

50 Dec 30, 2022
Image-Bot-Discord - This Is a discord bot that shows the specific image you search from Google

Advanced Discord.py Image Bot CREDITS Made by RLX and Mathiscool README by Milrato Installation Guide in .env Adjust the TOKEN python main.py to start

RLX 3 Jan 16, 2022
An Open-Source Discord bot created to provide basic functionality which should be in every discord guild. We use this same bot with additional configurations for our guilds.

A Discord bot completely written to be taken from the source and built according to your own custom needs. This bot supports some core features and is

Tesseract Coding 14 Jan 11, 2022
Code done for/during the course

Serverless Course Autumn 2021 - Code This repository contains a set of examples developed during, but not limited to the live coding sessions. Lesson

Alexandru Burlacu 4 Dec 21, 2021
Quickly visualize docker networks with graphviz.

Docker Network Graph Visualize the relationship between Docker networks and containers as a neat graphviz graph. Example Usage usage: docker-net-graph

Leo Verto 43 Dec 12, 2022
A simple weather information tool.

pwy A simple weather information tool. Table of Contents Features Dependencies Installation Usage Update Changelog Credits License Features ASCII art

Clint 105 Dec 31, 2022
Finds Jobs on LinkedIn using web-scraping

Find Jobs on LinkedIn 📔 This program finds jobs by scraping on LinkedIn 👨‍💻 Relies on User Input. Accepts: Country, City, State 📑 Data about jobs

Matt 44 Dec 27, 2022
Adriano's Diets Consulting Bot - Parses and extracts informations about your diet (files in the Adriano's format).

Adriano's Diets Consulting Bot - Parses and extracts informations about your diet (files in the Adriano's format).

Marco A. 2 Feb 07, 2022
WaifuGen - A program made in waifuGen that generates SFW and NSFW waifus from the waifu.pics API

waifuGen A program made in waifuGen that generates SFW and NSFW waifus from the

1 Jan 05, 2022