duo-labs / duo-labs/cloudmapper

AWS GovCloud Regions Fail to Collect Data

Open
#691 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
6.3k
Forks
836
PR merge metrics
No merged PRs in 30d

Description

**Please mention the following:**
- What command was run?
python3 cloudmapper.py collect --config config.json --account \

- Are you working out of a pipenv environment, Docker, or something else?
I am working out of a pipenv
----------------------------------------------------------------------------------------

**Issue:**
I am unable to use Cloudmapper in AWS GovCloud regions. The aws-cli is attempting to make an API request to the "GenerateServiceLastAccessedDetail" service. Unfortunately, there are no GovCloud regions that currently track the data necessary to use this service ( [regions that do currently track this data](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html#access-advisor_tracking-period) ). As a result of the data not being availible, I believe this service (GenerateServiceLastAccessedDetail) may be turned off in the GovCloud regions. I verified the service was inactive in the IAM Console. After running "cloudmapper.py collect", the Permission tab of the "SecurityAudit" policy in the IAM console showed "GenerateServiceLastAccessedDetail" as an "Unrecognized action". Diving further into the IAM section of the "SecurityAudit" policy, the JSON shows that "GenerateServiceLastAccessedDetail" is allowed. I'm not sure why it's being flagged as an unrecognized action if the service is explicitly allowed in the "SecurityAudit" policy.

At the bottom of [this page](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-iam.html) in the GovCloud documentation from AWS, there is a bullet that states: "Information about when a role was last used is not available. For more information, see the [View Role Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#roles-delete_prerequisites). " It seems that without this data and the service that uses it, Cloudmapper is unusable in the GovCloud regions. Am I correct in assuming this?

**Example of error:**
"An error occurred (InvalidAction) when calling the GenerateServiceLastAccessedDetails operation: Operation GenerateServiceLastAccessedDetails is not enabled in region: us-gov-west-1"

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.