Repokid utilizes Access Advisor, which is provided by Aardvark, to eliminate permissions that grant access to services that are not being used. This process is applied to the inline policies of IAM roles within an AWS account.
Getting Started:
- First, install mkvirtualenv repokid
- Next, clone the repository using: git clone
[email protected]:Netflix/repokid.git
- Change into the repokid directory: cd repokid
- Install the package in editable mode: pip install -e .
- Finally, configure Repokid with: repokid config config.json
DynamoDB:
- You will need to set up a DynamoDB table named repokid_roles (make sure to specify the account and endpoint in the dynamo_db section of the config file).
- This table should have RoleId (string) as the primary partition key, and there should be no primary sort key.
- Create a global secondary index called Account, which should have a primary partition key of Account, with RoleId and Account as projected attributes.
- Additionally, create another global secondary index named RoleName, which will have a primary partition key of RoleName, with RoleId and RoleName as projected attributes.
- For development purposes, you can run DynamoDB locally. To do this, use the command: docker-compose up