probator-auditor-iam

Please open issues in the Probator repository

Description

This auditor validates and applies IAM policies for AWS Accounts.

Configuration Options

roles configuration

The roles setting allows you to configure roles to create and manage on all accounts enabled in Probator. The JSON document is structured as a dictionary, with the top-level key being the name of the role, and the dictionary value has two keys; trust and policies

trust

The trust setting must be a valid IAM Assume Role Policy Document. If the trust key is an empty object ({}), null or not set, the default trust document is provided.

policies

The policies key contains a list of IAM policy names to attach to the role. These policies must exist within the account before running the auditor, ideally being created by the auditor as well.

Example document

The example below shows how one can manage the role probator assumes for monitoring and auditing in your accounts

{
    "probator_role": {
        "trust": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::123456789012:role/probator-instance-role",
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "policies": [
            "ProbatorAccess"
        ]
    }
}

This project is based on the work for Cloud Inquisitor by Riot Games