duo-labs / duo-labs/cloudmapper
AWS GovCloud Regions Fail to Collect Data
- Dominant language
- JavaScript
- Stars
- 6.3k
- Forks
- 836
- PR merge metrics
- No merged PRs in 30d
Description
**Please mention the following:**
- What command was run?
python3 cloudmapper.py collect --config config.json --account \
- Are you working out of a pipenv environment, Docker, or something else?
I am working out of a pipenv
----------------------------------------------------------------------------------------
**Issue:**
I am unable to use Cloudmapper in AWS GovCloud regions. The aws-cli is attempting to make an API request to the "GenerateServiceLastAccessedDetail" service. Unfortunately, there are no GovCloud regions that currently track the data necessary to use this service ( [regions that do currently track this data](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html#access-advisor_tracking-period) ). As a result of the data not being availible, I believe this service (GenerateServiceLastAccessedDetail) may be turned off in the GovCloud regions. I verified the service was inactive in the IAM Console. After running "cloudmapper.py collect", the Permission tab of the "SecurityAudit" policy in the IAM console showed "GenerateServiceLastAccessedDetail" as an "Unrecognized action". Diving further into the IAM section of the "SecurityAudit" policy, the JSON shows that "GenerateServiceLastAccessedDetail" is allowed. I'm not sure why it's being flagged as an unrecognized action if the service is explicitly allowed in the "SecurityAudit" policy.
At the bottom of [this page](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-iam.html) in the GovCloud documentation from AWS, there is a bullet that states: "Information about when a role was last used is not available. For more information, see the [View Role Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#roles-delete_prerequisites). " It seems that without this data and the service that uses it, Cloudmapper is unusable in the GovCloud regions. Am I correct in assuming this?
**Example of error:**
"An error occurred (InvalidAction) when calling the GenerateServiceLastAccessedDetails operation: Operation GenerateServiceLastAccessedDetails is not enabled in region: us-gov-west-1"
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.