aws-lint-iam-policies

A tool for privilege escalation within Linux environments by targeting vulnerabilities in SUDO usage.

Conducts IAM policy linting checks for either a single AWS account or for all accounts within an AWS Organization. It extracts all supported identity-based and resource-based policies, then reports on those that breach security best practices or contain errors.

The actual linting process is carried out by the AWS IAM Access Analyzer's policy validation feature. This feature is primarily recognized for providing recommendations when users manually edit IAM policies in the AWS Console UI. The linting checks are developed and maintained by AWS, and further details can be found here. Usage: Ensure that you have AWS credentials set up for your targeted environment.

You can achieve this by using environment variables or by specifying a named profile with the optional --profile argument. If you are checking against a single AWS account (--scope ACCOUNT), you need at least these permissions. If you are checking against all accounts within an AWS Organization (--scope ORGANIZATION), you must use credentials that belong to the management account of the Organization and have at least these permissions.

The Organization's member accounts need to have an IAM role set up that is capable of assuming the IAM role of the management account.