duo-labs / duo-labs/cloudmapper

Ec2 cross account access

Open
#872 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
6.3k
Forks
836
PR merge metrics
No merged PRs in 30d

Description

Please mention the following:
- What command was run?
python3 cloudmapper.py collect --account MYACCOUNT

- Are you working out of a virtualenv environment, Docker, or something else?
No, straight pure bash shell with aws cli on ubuntu 20.04

The error
ERROR: Ensure your creds are valid.
An error occurred (AccessDenied) when calling the GetUser operation: User: arn:aws:sts::??????????????:assumed-role/role_myrole/i-xxxxxxxxxxxxxxx is not authorized to perform: iam:GetUser on resource: user test

And yes I have iam:Getuser on my Policy

PS: this is a access with a ec2 cross account role access and not a IAM user with Private key and Secret Key

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the reported command, cloudmapper.py collect --account MYACCOUNT, and trace how AWS CLI credentials and the iam:GetUser call are handled for an EC2 cross-account role. Compare that path with the stated role policy and determine whether cross-account role access is supported; done means the failure is fixed or the required credential and permission behavior is clearly established.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, bash, linux, ubuntu
Domain
authorization, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.