Skip to content

Instantly share code, notes, and snippets.

@DevOps-Dad
Created February 25, 2019 19:09
Show Gist options
  • Save DevOps-Dad/bf59daab88ee9c1eb5df3be0976a8cb0 to your computer and use it in GitHub Desktop.
Save DevOps-Dad/bf59daab88ee9c1eb5df3be0976a8cb0 to your computer and use it in GitHub Desktop.
CloudMapper IAM #AWS
You must have the following privileges (these grant various read access of metadata):
arn:aws:iam::aws:policy/SecurityAudit
arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
And also:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"acm:DescribeCertificate",
"eks:DescribeCluster",
"eks:ListClusters",
"elasticfilesystem:DescribeMountTargetSecurityGroups",
"elasticfilesystem:DescribeMountTargets",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:DescribeSecurityConfiguration",
"events:DescribeRule",
"fms:ListComplianceStatus",
"fms:ListPolicies",
"guardduty:ListDetectors",
"guardduty:ListFindings",
"guardduty:ListIPSets",
"guardduty:ListInvitations",
"guardduty:ListMembers",
"guardduty:ListThreatIntelSets",
"iam:GenerateServiceLastAccessedDetails",
"inspector:DescribeAssessmentRuns",
"inspector:DescribeAssessmentTargets",
"inspector:DescribeAssessmentTemplates",
"inspector:DescribeCrossAccountAccessRole",
"inspector:DescribeFindings",
"inspector:DescribeResourceGroups",
"inspector:DescribeRulesPackages",
"iot:DescribeAuthorizer",
"iot:DescribeCACertificate",
"iot:DescribeCertificate",
"iot:DescribeDefaultAuthorizer",
"iot:GetPolicy",
"iot:GetPolicyVersion",
"lambda:GetFunctionConfiguration",
"lambda:GetLayerVersionPolicy",
"lambda:ListLayers",
"lightsail:GetInstances",
"opsworks:DescribeStacks",
"organizations:Describe*",
"organizations:List*",
"shield:DescribeAttack",
"shield:DescribeProtection",
"shield:DescribeSubscription",
"sso:DescribePermissionsPolicies",
"sso:ListApplicationInstanceCertificates",
"sso:ListApplicationInstances",
"sso:ListApplicationTemplates",
"sso:ListApplications",
"sso:ListDirectoryAssociations",
"sso:ListPermissionSets",
"sso:ListProfileAssociations",
"sso:ListProfiles"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment