catrole 0.1.7

AWS IAM Role/Policy permission viewer — see what a role or policy can do

catrole

catrole is a python pip package which let's you:

AWS IAM Role/Policy permission viewer — see what a role or policy can do.

Requirements

• Python >= 3.11
• AWS credentials configured (via ~/.aws/credentials, environment variables, or SSO)
• A cross-account IAM role you can assume in target account(s)

Installation

From source (local)

git clone <repo-url>
cd cat-role
pip3 install .

For development (editable install):

pip3 install -e .

From PyPI (remote)

pip3 install catrole

Usage

catrole uses -R to specify an IAM role to assume in the target account.

If -R is not provided, catrole reads the role name from ~/.catrole.

Setting a default assume role

echo "my-readonly-role" > ~/.catrole

Once set, you can omit -R from all commands:

catrole -a 123456789012 -r MyAppRole

-R on the command line always takes precedence over ~/.catrole.

Scan a role

catrole -R my-readonly-role -a 123456789012 -r MyAppRole

Scan a policy

catrole -R my-readonly-role -a 123456789012 -p MyPolicy

Scan by ARN

catrole -R my-readonly-role -A arn:aws:iam::123456789012:role/MyAppRole

Search across all org accounts

catrole -R my-readonly-role -s '*lambda*'

Search within a single account

catrole -R my-readonly-role -s '*admin*' -a 123456789012

Results are printed as a table and automatically saved to a CSV file.

Run catrole -h for full help.